> WPForms is a drag-and-drop WordPress form builder: what it does on your site, how it handles entries and integrations and what that means for GDPR. > > Canonical: https://www.flowconsent.com/en/services/marketing/wpforms Marketing # WPForms Unclassified · [Official website](https://wpforms.com) WPForms is a drag-and-drop form builder plugin for WordPress from Awesome Motive, used for contact, survey, payment and registration forms. Entries can be stored in the WordPress database and sent to email marketing, CRM or payment services through add-ons. The plugin does not track visitors itself, but the data collected and any third-party integrations must be covered under the GDPR. [Block WPForms until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 3 - Servers Plugin developed by WPForms LLC (Awesome Motive group), West Palm Beach, Florida, United States. Form submissions remain on the customer WordPress server. Licence and template servers are operated from the United States and AWS regions. Overview ## What does WPForms do? WPForms is the most installed premium form builder for WordPress with more than six million active sites. Developed by WPForms LLC, part of the Awesome Motive group in Florida, it offers a drag and drop builder, pre built templates and a strong ecosystem of integrations. Like Gravity Forms, it is fully self hosted: submissions stay in the WordPress database controlled by the website operator. ## **What WPForms does** WPForms renders forms on the WordPress server, validates inputs, sends notifications, and stores entries in the wp\_wpforms\_entries table. It supports conditional logic, multi page forms, file uploads, calculations, signatures, anti spam (hCaptcha, Cloudflare Turnstile, Akismet) and integrations with Stripe, PayPal, Square, Mailchimp, ActiveCampaign, Constant Contact, HubSpot, Salesforce, Zapier, Slack and many more. ## **Data and cookies** By default, WPForms stores in the WordPress database the values submitted, the visitor IP (unless disabled in Settings > General > Disable User Details), the user agent and the referrer URL. The plugin sets first party cookies wpforms\_referer\_url, wpforms\_ip and wpforms\_uuid to power the form analytics and conversion tracking. The free version sends anonymous usage telemetry to Awesome Motive unless opted out. ## **GDPR and ePrivacy implications** The website operator remains the data controller. WPForms ships with built in GDPR enhancements: a global toggle to disable User Details storage (Settings > General), a Consent field for explicit opt in, and hooks compatible with the WordPress Personal Data Exporter and Eraser. The IP address is considered personal data under Recital 30 GDPR, so storage must be justified by purpose and limited in time. Disable telemetry on production sites. ## **Data transfers and integrations** Awesome Motive servers (US) only receive licence validation and the optional telemetry ping. Each active integration is a separate sub processor: Stripe and PayPal (US, with EU entities), Mailchimp (US, EU US DPF), Constant Contact (US), ActiveCampaign (US), HubSpot (US, EU US DPF), Salesforce (US, EU US DPF), Zapier (US). Each must be listed and contractually covered. ## **Practical compliance steps** Disable User Details (or set a short retention) in WPForms Settings. Add a Consent field and a link to the privacy notice on each form. Disable usage telemetry. Add Akismet, hCaptcha or Cloudflare Turnstile to deter spam without third country transfers. Document active integrations as sub processors and sign their DPAs. Use the Personal Data Exporter and Eraser to handle Art. 15 and 17 requests within one month. Compliance ## WPForms and the GDPR - Legal basis Performance of a contract or pre contractual measure (Art. 6(1)(b) GDPR) for the form submission itself. Consent (Art. 6(1)(a)) for a newsletter checkbox, marketing integration or tracking cookie. Legal obligation (Art. 6(1)(c)) if the form is used to honour a statutory obligation such as tax invoicing. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, TDDDG, LSSI CE, CCPA/CPRA, PCI DSS (when Stripe or PayPal payment forms are used) Cookies and trackers ## What WPForms sets and contacts - Tracking method Self hosted WordPress plugin. Forms are rendered server side, submissions are stored in the site's own WordPress database. The plugin communicates with WPForms LLC servers only for licence validation, automatic updates, template downloads and optional integrations (Stripe, PayPal, Mailchimp, Constant Contact, etc.). - Server location Plugin developed by WPForms LLC (Awesome Motive group), West Palm Beach, Florida, United States. Form submissions remain on the customer WordPress server. Licence and template servers are operated from the United States and AWS regions. - Cookieless mode available Yes - Data transferred outside the EU No personal data of form respondents is automatically transferred outside the EU. Only the licence key, the plugin telemetry (if enabled) and the WPForms tracking ping are sent to Awesome Motive in the United States. Activated integrations (Stripe, Mailchimp, Constant Contact, ActiveCampaign) will transfer the entry data to those processors. ### Cookies set (3) | Name | Type | Duration | Purpose | | --------------------- | ------------ | --------- | ------------------------------------------------------------------------------------------------ | | wpforms\_referer\_url | first\_party | 24 hours | Stores the URL of the page where the visitor first encountered the form, for form analytics. | | wpforms\_ip | first\_party | 24 hours | Stores a hashed copy of the visitor IP for form analytics and conversion tracking. | | wpforms\_uuid | first\_party | 12 months | Unique visitor identifier used by the User Journey add on to reconstruct the path to conversion. | ### Third-party domains contacted (3) - `wpforms.com` - `api.wpforms.com` - `awesomemotive.com` Questions ## Frequently asked questions about WPForms Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does WPForms set? WPForms sets first party cookies wpforms\_referer\_url (24 hours), wpforms\_ip (24 hours) and wpforms\_uuid (12 months) when form analytics or User Journey tracking are enabled. These cookies are used to attribute submissions to a referring page. They require consent if used for non strictly necessary purposes. ### Is consent required to use WPForms? Consent is not required for a simple contact form processed under Art. 6(1)(b) GDPR. Consent is required for marketing checkboxes, the User Journey tracking cookie, and for any active integration that drops a tracking cookie (e.g. HubSpot, ActiveCampaign). ### What is the legal basis for processing form data? Pre contractual measures (Art. 6(1)(b) GDPR) for contact and quote forms. Legal obligation (Art. 6(1)(c)) for tax and invoicing forms. Consent (Art. 6(1)(a)) for marketing checkboxes. Vital interests (Art. 6(1)(d)) is unusual but possible for emergency forms. ### Is form data transferred to the United States? Submissions stay in your WordPress database. Awesome Motive (US) receives the licence key and optional telemetry only. Each active integration (Stripe, Mailchimp, HubSpot, etc.) may transfer the entry data to the US under the EU US Data Privacy Framework or Standard Contractual Clauses. ### Do I need a DPIA for WPForms? Not for the plugin itself. A DPIA is appropriate when forms collect special categories of data, are part of automated decision making, or are integrated with high risk profiling. The DPIA assesses the form purpose and integrations, not the plugin code. ### How do I implement WPForms in a GDPR compliant way? Disable User Details storage or set a short retention. Add a Consent field and a privacy notice link on every form. Disable usage telemetry. Use Akismet, hCaptcha or Cloudflare Turnstile for anti spam. Sign DPAs with each integration vendor. Document active integrations in the records of processing. ### Which alternatives to WPForms should I consider? WordPress alternatives include Gravity Forms (US), Ninja Forms (US), Fluent Forms (Bangladesh), Forminator (US), and the free Contact Form 7 with Flamingo. EU first SaaS options: Tally (Belgium), Typeform (Spain). For maximum privacy, Contact Form 7 + Flamingo keeps everything local. ### How do I update the cookie policy when WPForms changes? When you enable a new integration, update the cookie table and the data transfer section of your privacy policy, list the new sub processor in your records of processing, bump the consent banner version to invalidate older consents and re run any documented assessment. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Dito](https://www.flowconsent.com/en/services/marketing/dito) [Dito is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Dito enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Dito empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/dito) [Marketing](https://www.flowconsent.com/en/services/marketing/dito) · ### [Kyvio](https://www.flowconsent.com/en/services/marketing/kyvio) [Kyvio is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Kyvio offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Kyvio empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/marketing/kyvio) [Marketing](https://www.flowconsent.com/en/services/marketing/kyvio) · ### [Moosend](https://www.flowconsent.com/en/services/marketing/moosend) [Moosend is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Moosend provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Moosend helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/moosend) [Marketing](https://www.flowconsent.com/en/services/marketing/moosend) · ### [ManyContacts](https://www.flowconsent.com/en/services/marketing/manycontacts) [ManyContacts is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. ManyContacts provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, ManyContacts helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/manycontacts) [Marketing](https://www.flowconsent.com/en/services/marketing/manycontacts) · ### [Ops Calendar](https://www.flowconsent.com/en/services/marketing/ops-calendar) [Ops Calendar is an online scheduling and booking platform that enables businesses to automate appointment management and reduce no-shows. It provides a customizable booking interface, calendar synchronization, and automated reminders via email and SMS. Ops Calendar supports multiple service types, staff scheduling, and payment collection. With timezone detection and availability management, Ops Calendar simplifies scheduling across any industry and business size.](https://www.flowconsent.com/en/services/marketing/ops-calendar) [Marketing](https://www.flowconsent.com/en/services/marketing/ops-calendar) · ### [ActiveCampaign](https://www.flowconsent.com/en/services/marketing/activecampaign) [ActiveCampaign is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ActiveCampaign enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ActiveCampaign empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/activecampaign) [Marketing](https://www.flowconsent.com/en/services/marketing/activecampaign) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)