Mailchimp for WordPress

The signup form itself works without any cookies. Cookies are only set when Mailchimp site tracking is enabled in the connected Mailchimp account. In that case Mailchimp may set mailchimp_landing_site (stores the landing page for attribution, lasting 1 month), _mcid (a persistent Mailchimp visitor identifier) and a form session cookie. Disabling Mailchimp site tracking results in a fully cookieless signup flow.

Yes, in two ways. First, explicit marketing consent is required before adding a subscriber to a Mailchimp list. Use an unticked opt in checkbox on the form. Second, if Mailchimp site tracking is enabled, prior consent for tracking cookies is also required before those cookies can be set. Double opt in is strongly recommended for marketing consent.

The legal basis for newsletter signup and for sending marketing emails is consent under Article 6(1)(a) GDPR. This must be specific, informed and unambiguous marketing consent obtained via an unticked checkbox. If site tracking cookies are used, Article 5(3) ePrivacy also applies. Legitimate interest is not an appropriate basis for email marketing.

Yes. Every form submission sends the subscriber email, name and IP address to Intuit Mailchimp servers in the United States. Mailchimp relies on the EU US Data Privacy Framework and standard contractual clauses as transfer mechanisms. Ensure you have signed the Mailchimp data processing agreement and document this transfer in your records of processing activities.

A DPIA is recommended if Mailchimp site tracking is enabled, because this involves systematic monitoring of visitor behaviour through persistent tracking cookies and building visitor profiles. Key risks include processing subscriber data in the United States and cookie tracking without prior consent. Mitigations include disabling site tracking, implementing double opt in and using granular consent.

Enable double opt in in your Mailchimp audience settings. Add an explicit, unticked marketing consent checkbox to every signup form. Disable Mailchimp site tracking unless you have a separate cookie consent gate. Sign the Mailchimp data processing agreement. Document the US data transfer in your records. Include Mailchimp in your privacy policy and cookie policy. Never bundle marketing consent with terms acceptance.

For a more privacy friendly option, consider a self hosted email marketing platform such as Mautic or Sendy, which keeps subscriber data on your own server in the EU. These avoid the US data transfer entirely. If you stay with Mailchimp, disabling site tracking and using double opt in are the two most effective privacy improvements.

If Mailchimp site tracking is disabled, note in your cookie policy that the signup form works without cookies and no Mailchimp cookies are set. If site tracking is enabled, list mailchimp_landing_site (1 month, landing page attribution), _mcid (persistent visitor identifier) and the form session cookie. State that subscriber data is transferred to Mailchimp in the United States under the EU US Data Privacy Framework.