Gravity Forms
Gravity Forms is a premium WordPress form plugin from Rocketgenius, used for contact forms, quizzes, payment forms and complex multi-page workflows. Entries are saved in the WordPress database and can be sent to CRM, email or payment services through add-ons. The plugin does not track visitors, but the personal data collected and any integrations must be covered under the GDPR.
What does Gravity Forms do?
Gravity Forms is a flagship premium form plugin for WordPress, developed since 2008 by Rocketgenius Inc. in Tampa, Florida. With over a million active installations it powers contact forms, registration forms, surveys, quizzes and payment forms on WordPress sites worldwide. Because it is fully self hosted, Gravity Forms gives website operators direct control over where the submission data is stored and how long it is kept.
What Gravity Forms does
Gravity Forms renders forms on the server using the WordPress template engine, validates input client side and server side, and stores submissions as entries in the WordPress database. Add ons connect the form to email, CRM, payment, signature, e commerce and marketing services. The plugin also offers conditional logic, multi page forms, file uploads, partial entries and a REST API.
Data and cookies
Gravity Forms stores everything the form collects in the entries table of WordPress, including the values submitted, the visitor IP (if not anonymised), the user agent, the source page URL and the user ID if the visitor is logged in. By default it sets only short lived cookies for partial entries (gform_browser_id) when the partial entries add on is active. None of these cookies is shared with Rocketgenius.
GDPR and ePrivacy implications
Because the data controller is the website operator (not Rocketgenius), Gravity Forms is treated as a tool rather than a third party service. The website operator chooses the lawful basis, the retention period and the security measures. Gravity Forms provides the IP anonymisation toggle, the consent field, the Entry Anonymizer for erasure requests and the Personal Data tools added in version 2.4 to comply with Art. 15, 17 and 20 GDPR.
Data transfers and add ons
Rocketgenius servers only receive the licence key and basic site fingerprint. However, every add on you activate may transfer the entry data to a third party (Stripe, PayPal, Mailchimp, ActiveCampaign, HubSpot, Salesforce, Zoho, Twilio, etc.), often located in the United States. Each add on must be assessed individually in your records of processing and may require an additional sub processor agreement.
Practical compliance steps
Enable IP anonymisation in Forms > Settings > General. Add a Consent field and a privacy notice on every form. Configure the retention period per form (Form Settings > Personal Data). Use the Personal Data Exporter and Eraser hooks for Art. 15 and Art. 17 requests. List every active add on and its sub processor in your records of processing and privacy notice. Audit forms quarterly to remove unused fields.
Gravity Forms and the GDPR
- Legal basis
- Performance of a contract or pre contractual measure (Art. 6(1)(b) GDPR) for the form submission itself. Consent (Art. 6(1)(a)) when a newsletter checkbox, marketing add on or tracking cookie is added. Legal obligation (Art. 6(1)(c)) if the form is used to honour a statutory obligation.
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive, TDDDG, LSSI CE, CCPA/CPRA, PCI DSS (when payment add ons are used)
What Gravity Forms sets and contacts
- Tracking method
- Self hosted WordPress plugin. Forms are rendered server side, submissions are stored in the site's own WordPress database, and the plugin communicates with Rocketgenius servers only for licence validation, automatic updates and optional add ons (Stripe, PayPal, Mailchimp, ActiveCampaign, etc.).
- Server location
- Plugin developed by Rocketgenius Inc., Tampa, Florida, United States. Form submissions remain on the customer WordPress server. License servers and the official documentation are operated from the United States.
- Cookieless mode available
- Yes
- Data transferred outside the EU
- No personal data of form respondents is automatically transferred outside the EU. Only the license key and server fingerprint are sent to Rocketgenius in the United States for activation and updates. If you enable add ons such as Stripe, Mailchimp or ActiveCampaign, the submission data flows to those third parties.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| gform_browser_id | first_party | 30 days | Identifies the browser for the Partial Entries add on to resume an incomplete form submission. |
| gf_session_* | first_party | Session | Stores intermediate form state between pages on multi page forms. |
| gform_uniqueid_* | first_party | Session | Generates a unique identifier for file uploads tied to the current submission. |
Third-party domains contacted (3)
gravityforms.comgravityhelp.comrocketgenius.com
Frequently asked questions about Gravity Forms
Can't find your question? Write to us, we answer fast.
Which cookies does Gravity Forms set?
By default, Gravity Forms sets only short lived first party cookies that are strictly necessary: gform_browser_id when the Partial Entries add on is active and a session cookie for multi page forms. None is shared with Rocketgenius. The plugin does not set any tracking or marketing cookie.
Is consent required to use Gravity Forms?
Consent is generally not required for the form itself, because submitting personal data through a contact form is processed on the legal basis of pre contractual measures (Art. 6(1)(b) GDPR). However, any marketing checkbox (newsletter, profiling) and add ons that drop tracking cookies must be wrapped in a separate opt in consent.
What is the legal basis for processing form data?
Most contact forms rely on Art. 6(1)(b) GDPR (pre contractual measures), recruitment forms on Art. 6(1)(b) for the application and Art. 6(1)(c) for legal record keeping. Marketing checkboxes always require consent under Art. 6(1)(a) and Art. 7. Sensitive data (Art. 9 GDPR) needs explicit consent and a documented assessment.
Is form data transferred to the United States?
Form submissions stay in your WordPress database, so by default no data leaves the EU. Only the Gravity Forms licence key and site fingerprint reach Rocketgenius in the US. Active add ons (Stripe, Mailchimp, HubSpot, etc.) however do transfer the entry data and trigger separate transfer rules.
Do I need a DPIA for Gravity Forms?
Not in itself. A DPIA may be needed when the form collects special categories of data (health, biometrics, religion), is used in a recruitment context with profiling, or feeds into automated decision making. The DPIA covers the form purpose, not the plugin code base.
How do I implement Gravity Forms in a GDPR compliant way?
Activate IP anonymisation, add a consent field and a privacy notice, set a retention period per form, list the third party add ons in your privacy policy, sign Data Processing Agreements with each add on vendor, and rely on the WordPress Personal Data Exporter and Eraser to honour Art. 15 and 17 requests within one month.
Which alternatives to Gravity Forms should I consider?
WordPress alternatives include WPForms, Ninja Forms, Fluent Forms (all US/Bangladesh), Formidable Forms (US) and self hosted Forminator. EU first SaaS options: Tally (Belgium), Typeform (Spain), JotForm (US with EU hosting). For pure privacy, the built in Contact Form 7 with Flamingo plugin is fully local.
How do I update the cookie policy when Gravity Forms changes?
When you add an add on that drops new cookies or transfers data, update the cookie table and the data transfer section in your privacy notice, bump the consent banner version to invalidate older consents, and document the new sub processor in your records of processing.
Bing Webmaster
Bing Webmaster is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Bing Webmaster is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Bing Webmaster offers reliable solutions that scale with organizational needs and evolving web standards.
Jilt App
Jilt App is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Jilt App supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Jilt App remains a leading web development choice.
Review Wave
Review Wave is a customer review and reputation management platform that helps businesses collect, manage, and showcase authentic customer feedback. It automates review request workflows, aggregates ratings from multiple sources, and displays social proof. Review Wave supports rich snippet integration for enhanced search engine visibility, helping build trust, improve local SEO, and increase conversion rates through verified customer testimonials.
Linguise
Linguise is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Linguise offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Linguise empowers organizations to optimize strategy and maximize return on investment.
ContactUs
ContactUs is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ContactUs enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ContactUs empowers marketing teams to achieve measurable growth.
Text Marketer
Text Marketer is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Text Marketer enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Text Marketer empowers marketing teams to achieve measurable growth.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.