FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

Gravatar

EssentialOfficial website

Gravatar is Automattic's globally recognized avatar service: a user's profile picture is linked to their email address and shown on WordPress comments and many other sites. The image is loaded from Gravatar's servers using a hash of the email address, which shares the visitor's IP address and that hash with Automattic. Many sites therefore mention it in their privacy notice or proxy the images.

Block Gravatar until consentScan my site
Overview

What does Gravatar do?

Gravatar, the Globally Recognised Avatar service, is operated by Automattic Inc. in San Francisco. Built into WordPress core and used by thousands of comment systems, forums and SaaS applications, it lets users associate a profile picture with their email address. Every avatar request to gravatar.com transfers the visitor IP, user agent and a hash of the email to the United States.

What Gravatar does

When a page needs to display an avatar (for a comment author, a forum member, a profile widget) the website hashes the email address (MD5 historically, SHA 256 in modern versions) and builds a URL of the form secure.gravatar.com/avatar/{hash}. The browser fetches this image directly from Automattic, which can therefore log the visitor IP, user agent and the page that triggered the request via the Referer header.

Data and cookies collected

Gravatar normally does not set tracking cookies on the embedding website, but it may set Automattic session cookies (wpcom_*, tk_*) when the visitor is logged in to WordPress.com. The visitor IP, the email hash and the Referer URL are transmitted on every avatar request and stored in Automattic logs. The CNIL has confirmed that a hashed email is still personal data under Recital 26 GDPR.

GDPR and ePrivacy implications

German courts (LG Munich, 2022) ruled that loading external resources that leak the IP address without consent breaches the GDPR. Gravatar requests follow exactly the same pattern. Although the avatar itself is not a cookie, the IP transfer to a US third party falls under Art. 6 GDPR and the email hash falls under Art. 4(1). Consent is the safest legal basis for an EU facing website.

Data transfers to the United States

Automattic is self certified under the EU US Data Privacy Framework, which serves as an Art. 45 adequacy decision for transfers to certified US importers. If the DPF is invalidated again (the previous Privacy Shield and Safe Harbor both fell), transfers must rely on Standard Contractual Clauses with supplementary measures and a documented Transfer Impact Assessment. Always re check Automattic certification status at dataprivacyframework.gov.

Practical compliance steps

Disable Gravatar in WordPress until consent is granted (Settings > Discussion > Show Avatars), or use a privacy proxy such as the Avatar Privacy plugin that hosts avatars locally. Block Gravatar through your CMP under the functional or marketing category. Document Automattic as a US sub processor in your records of processing, your privacy notice and your cookie banner. If you accept comments, allow visitors to use a generic identicon or local fallback.

Compliance

Gravatar and the GDPR

Gravatar is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Gravatar reveals the visitor IP to a US third party and discloses an email hash, which is considered personal data by the EDPB. Consent or a strong contractual basis under Art. 6(1)(f) is required.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, TDDDG, LSSI CE, CCPA/CPRA, EU US Data Privacy Framework, CNIL guidance on email hashing (May 2022)
Cookies and trackers

What Gravatar sets and contacts

Tracking method
Image based avatar service. Pages query the Gravatar HTTP API with an MD5 (or SHA-256) hash of the visitor email address. Gravatar then returns the matching avatar and logs the request, including the visitor IP address and user agent.
Server location
Operated by Automattic Inc. in San Francisco, United States. Requests are served by a global CDN with edge nodes worldwide, while user data and Gravatar profiles are stored in the United States.
Data transferred outside the EU
Every request to secure.gravatar.com or gravatar.com transfers the visitor IP address, user agent and the hashed email to Automattic servers in the United States. Automattic is self certified under the EU US Data Privacy Framework. Without consent or proper safeguards the transfer is unlawful.

Cookies set (3)

NameTypeDurationPurpose
wpcom_loggedinthird_party2 weeksSet by Automattic for visitors signed in to WordPress.com when avatars are fetched.
tk_aithird_party1 yearAnonymous identifier used by Automattic Tracks for product analytics across Automattic properties.
tk_lrthird_party1 yearStores the landing page referrer for Automattic Tracks analytics.

Third-party domains contacted (5)

  • gravatar.com
  • secure.gravatar.com
  • 0.gravatar.com
  • en.gravatar.com
  • automattic.com
Questions

Frequently asked questions about Gravatar

Can't find your question? Write to us, we answer fast.

Which cookies does Gravatar set?

Gravatar itself rarely sets cookies on the embedding website. When the visitor is authenticated on WordPress.com, Automattic session cookies such as wpcom_loggedin, wp_api_sec, tk_ai or tk_lr may be present on the gravatar.com response. These are third party cookies that require consent.

Is consent required to use Gravatar?

Yes, in the EEA. Although the avatar request does not set first party cookies, it transfers the visitor IP and an email hash to Automattic in the United States. Under Art. 6 GDPR the safest legal basis is consent, especially considering the LG Munich ruling on similar Google Fonts requests.

What is the legal basis for Gravatar processing?

Consent (Art. 6(1)(a) GDPR) is recommended for an EU facing website. Legitimate interest under Art. 6(1)(f) can be argued only if local avatar fallbacks are offered and the Transfer Impact Assessment is documented. In WordPress, the simplest path is to disable remote avatars by default.

Is data transferred to the United States?

Yes. Every Gravatar request reaches Automattic infrastructure in the United States. Automattic relies on the EU US Data Privacy Framework for the transfer. You must verify the current certification status of Automattic on dataprivacyframework.gov and document the transfer in your records of processing.

Do I need a DPIA for Gravatar?

A standalone DPIA is generally not required, but if Gravatar is combined with comment systems, analytics or marketing tags the overall website DPIA should mention the email hash, the IP exposure and the US transfer. A Transfer Impact Assessment is mandatory.

How do I implement Gravatar correctly?

Either disable remote avatars in WordPress (Settings > Discussion > uncheck Show Avatars), or install a privacy proxy (Avatar Privacy plugin) that caches Gravatar locally, or block Gravatar through your CMP behind a marketing category. Provide a generic identicon as fallback. Document the choice in your privacy notice.

Which alternatives to Gravatar should I consider?

Self hosted alternatives include Libravatar (federated, EU friendly), Avatar Privacy (WordPress plugin), Boring Avatars (procedural SVG identicons) or simply hosting uploaded avatars on your own server or object storage. Each removes the US transfer issue entirely.

How do I update the cookie policy when Gravatar changes?

When Automattic updates its privacy policy, terms or transfer mechanism, reflect the change in your cookie table and privacy notice. If the DPF status changes (suspension or invalidation), bump the consent banner version to invalidate consents that were collected under the previous regime.

Same category

More services: Other

See the whole category

Clinked

Clinked is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Clinked integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Clinked helps organizations maintain robust websites that meet user expectations and technical requirements.

Other

SOPlanning

SOPlanning is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SOPlanning supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SOPlanning ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Vera

Vera is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Vera integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Vera makes advanced AI accessible to all teams.

Other

Ziber

Ziber is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Ziber supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Ziber ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Other

LogRocket

LogRocket is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. LogRocket offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, LogRocket empowers organizations to optimize strategy and maximize return on investment.

Analytics

Droxit

Droxit is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Droxit integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Droxit helps organizations maintain robust websites that meet user expectations and technical requirements.

Other

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site