> Akismet sends comment, IP, email and name to Automattic servers in the US. Learn the GDPR legal basis, transfer mechanisms and how to inform commenters. > > Canonical: https://www.flowconsent.com/en/services/security/akismet Security # Akismet Essential · [Official website](https://akismet.com) Akismet is the leading anti spam WordPress plugin, operated by Automattic Inc. It intercepts comments, contact form submissions and registrations, sends them to the Akismet REST API for spam classification and stores a verdict back in the WordPress database. Akismet does not set visitor cookies by default but does transfer personal data to the United States. [Block Akismet until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Required - Documented cookies 1 - Third-party domains 4 - Servers United States (Automattic Inc., operates Akismet from its US infrastructure on multiple cloud providers and its own data centres). No EU regional option is offered. The Akismet API is served globally via a CDN that may terminate the TLS in the EU, but the spam learning corpus and processing live in the US. Overview ## What does Akismet do? ## **What is Akismet?** Akismet (Automatic Kismet) is the de facto anti spam plugin for WordPress, operated by Automattic Inc. since 2005. The plugin ships pre installed on every WordPress install. When a comment, contact form submission or new user registration arrives, Akismet calls the rest.akismet.com REST API with the message body and contextual metadata, receives a spam score and stores the verdict alongside the comment. ## **Data transmitted to Akismet** Akismet does not set cookies on visitor browsers by default. It transfers personal data server side: the comment text, commenter name, email, URL, IP address, user agent, referrer, and the URL of the page hosting the form. Akismet retains this data for up to 15 days for the most likely spam, longer if it improves the corpus. The site operator therefore acts as controller of a transfer to Automattic in the US. ## **GDPR and ePrivacy implications** Since no cookies are set, Article 5(3) of the ePrivacy Directive does not apply to Akismet itself. The processing of comment, IP and email is however personal data under Article 4(1) GDPR. Transfer to the United States triggers Chapter V of GDPR: Automattic relies on the EU US Data Privacy Framework and Standard Contractual Clauses. ## **Consent or legitimate interest?** Most site operators rely on Art. 6(1)(f) legitimate interest in keeping the comment section free of spam, supported by a documented balancing test. Stricter interpretations (CNIL, Garante guidance for sensitive contexts) recommend an explicit consent checkbox at form submission, especially when the form collects extra personal data. Either way, the site must clearly inform commenters that their input is sent to Akismet in the United States. ## **Data transfers** Akismet is operated entirely from US infrastructure. The CDN may terminate the connection inside the EU but the spam corpus and the machine learning service run in the United States. Automattic publishes a DPA addendum, lists Akismet sub processors, signs SCCs and is certified under the EU US Data Privacy Framework. ## **Practical compliance steps** Add a privacy notice under the comment and contact forms naming Akismet and Automattic, link to your privacy policy and to Automattic's privacy notice, choose between consent or legitimate interest, sign the Automattic DPA addendum where applicable, document the transfer in your record of processing and consider EU spam filtering alternatives if you process sensitive data. Compliance ## Akismet and the GDPR Akismet is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) is the safest basis because Akismet transfers visitor identifiable data (IP, email, name, URL, comment text) to a US service. Site operators may also rely on Art. 6(1)(f) legitimate interest in spam prevention, provided they document a balancing test and inform commenters. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA ### Impact assessment (DPIA) Akismet is unlikely to require a DPIA on its own for a low traffic blog. A DPIA may be warranted when Akismet is deployed on a site that collects highly sensitive comments (health, political, minors), when it is used to filter authenticated user content at scale, or when combined with other Automattic services (Jetpack, WooCommerce) that share identifiers across services. ### Sample text for your banner > This site uses Akismet to reduce spam. When you submit a comment or contact form, your message, IP, email and the URL of this page are sent to Akismet, operated by Automattic Inc. in the United States. By submitting this form you consent to this processing. Cookies and trackers ## What Akismet sets and contacts - Tracking method WordPress server side plugin that intercepts comment, contact form and registration submissions, sends the content plus visitor IP, email, name, URL, user agent and referrer to the Akismet REST API at rest.akismet.com for spam classification; does not set cookies on visitor browsers by default but the API call still constitutes a transfer of personal data. - Server location United States (Automattic Inc., operates Akismet from its US infrastructure on multiple cloud providers and its own data centres). No EU regional option is offered. The Akismet API is served globally via a CDN that may terminate the TLS in the EU, but the spam learning corpus and processing live in the US. - Cookieless mode available Yes - Data transferred outside the EU Automattic Inc. is US headquartered and processes Akismet data exclusively on US infrastructure. Even where the CDN terminates the connection in the EU, the spam classification model and the corpus reside in the United States. Automattic relies on Standard Contractual Clauses and the EU US Data Privacy Framework as transfer mechanisms. ### Cookies set (1) | Name | Type | Duration | Purpose | | ---- | ------------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------- | | none | Server side processing (no browser cookies) | N/A | Akismet does not set cookies in the visitor browser by default; it transmits form data server side to the Akismet API | ### Third-party domains contacted (4) - `rest.akismet.com` - `akismet.com` - `wordpress.com` - `automattic.com` Questions ## Frequently asked questions about Akismet Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Akismet set? By default none. Akismet performs the spam check server side and does not set any cookie in the visitor browser. The data transfer happens through the WordPress server which calls the Akismet REST API. ### Is consent required? Akismet itself does not need ePrivacy consent because it sets no cookies. Whether GDPR consent is required for the data transfer depends on your legal basis. Most operators rely on legitimate interest; a stricter interpretation suggests adding a consent checkbox at form submission. ### What is the legal basis? The two common bases are Art. 6(1)(f) legitimate interest in protecting the comment section from spam (with balancing test) and Art. 6(1)(a) explicit consent at form submission. Authenticated user filtering can also rely on Art. 6(1)(b) contract. ### Does Akismet transfer data to the US? Yes. Automattic Inc. operates Akismet from US infrastructure. The transfer is covered by Automattic's SCCs and the EU US Data Privacy Framework certification. The CDN can terminate the TLS in the EU but the spam corpus stays in the US. ### Do I need a DPIA? For a typical low traffic blog, no. A DPIA is appropriate when Akismet filters sensitive content (health, political, minors) or when it processes a high volume of personal data alongside other Automattic services. ### How do I implement Akismet compliantly? Display a privacy notice near the comment and contact forms, link to the Automattic privacy notice, choose between consent and legitimate interest, sign the Automattic DPA addendum where applicable, and document the transfer in your record of processing. ### Are there alternatives? Yes: Antispam Bee (Germany), Cleantalk (Cyprus), Spam Protection by CleanTalk, WPBruiser, Friendly Captcha (Germany) for upstream blocking, plus native WordPress comment moderation and honeypot fields. EU origin tools reduce US data transfer. ### How do I update my cookie policy? You do not need to list Akismet in your cookie policy since no cookies are set. Instead disclose Akismet in your privacy policy as a sub processor handling spam classification, name Automattic, indicate retention up to 15 days for likely spam and the US transfer. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [GeeTest](https://www.flowconsent.com/en/services/security/geetest) [GeeTest is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GeeTest supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GeeTest ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/geetest) [Essential](https://www.flowconsent.com/en/services/security/geetest) · ### [ClickReport](https://www.flowconsent.com/en/services/security/clickreport) [ClickReport is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ClickReport supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ClickReport ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/clickreport) [Essential](https://www.flowconsent.com/en/services/security/clickreport) · ### [IP2Location.io](https://www.flowconsent.com/en/services/security/ip2location-io) [IP2Location.io is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. IP2Location.io integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, IP2Location.io helps organizations maintain robust websites that meet user expectations and technical.](https://www.flowconsent.com/en/services/security/ip2location-io) [Essential](https://www.flowconsent.com/en/services/security/ip2location-io) · ### [Userbase](https://www.flowconsent.com/en/services/security/userbase) [Userbase is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Userbase offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Userbase empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/security/userbase) [Essential](https://www.flowconsent.com/en/services/security/userbase) · ### [Alibaba Cloud Verification Code](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code) [Alibaba Cloud Verification Code is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Alibaba Cloud Verification Code provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Alibaba Cloud Verification Code ensures optimal performance at scale.](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code) [Essential](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code) · ### [Palo Alto GlobalProtect](https://www.flowconsent.com/en/services/security/palo-alto-networks-globalprotect) [Palo Alto Networks - GlobalProtect is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Palo Alto Networks - GlobalProtect supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Palo Alto Networks - GlobalProtect ensures your website delivers a smooth, uninterrupted.](https://www.flowconsent.com/en/services/security/palo-alto-networks-globalprotect) [Security](https://www.flowconsent.com/en/services/security/palo-alto-networks-globalprotect) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)