GDPR (and similar privacy regulations elsewhere — CCPA in California, and others) applies to any site collecting personal data from people in the covered jurisdictions, regardless of where the site itself is hosted. WordPress includes some built-in tooling to help, but genuine compliance depends on how your specific site actually collects and handles data — no plugin makes that determination for you.
What WordPress core already gives you
Since WordPress 4.9.6, core includes baseline privacy tools: a Privacy Policy page template/guide, a personal data export tool (compiles a user's data into a downloadable file on request), and a personal data erasure tool (handles account and comment data deletion requests). These cover core WordPress data — they do not automatically extend to every plugin's data unless that plugin has specifically registered its data with these tools, which not all plugins do correctly.
Know what data your specific site actually collects
This is the step that's genuinely site-specific and can't be templated:
- Comments — collect name, email, IP address by default (IP address is personal data under GDPR).
- Contact forms — whatever fields you've configured, often more than strictly necessary.
- Analytics — many analytics tools collect IP addresses and behavioral data by default; some require explicit consent, some can be configured for a more privacy-preserving mode (IP anonymization, cookieless tracking).
- E-commerce — names, addresses, payment-related data (though full card details should never touch your server directly — that's what a PCI-compliant payment processor is for).
- Membership/account systems — whatever profile data you collect at registration.
- Third-party embeds — social media embeds, YouTube videos, and similar can set third-party cookies or make requests to external services before any consent is given, which is itself a compliance issue for some regulations.
A real Privacy Policy, not boilerplate
Your privacy policy needs to reflect what your site actually does — which third-party services receive data (payment processors, email providers, analytics, ad networks), how long you retain it, and how someone can exercise their rights (access, correction, deletion). A generic template pasted in without adjustment is a common and genuine compliance gap, not just a formality.
Cookie consent: match the mechanism to what you actually load
If your site sets non-essential cookies (most analytics and marketing tools do), you generally need consent before those scripts run, not just a banner that appears while tracking has already started. This is a common implementation mistake — a cookie banner that's purely cosmetic while the analytics script already fired on page load doesn't satisfy the "prior consent" requirement most of these regulations set. A proper consent-management setup blocks non-essential scripts until consent is actually given.
Data subject rights need a real process, not just theoretical support
Beyond the technical export/erasure tools, someone needs to actually own the process: receiving a request, verifying the requester's identity, fulfilling it within the required timeframe, and covering data held outside WordPress itself (a separate email marketing platform, a CRM, backup archives) — core's tools only handle what's in the WordPress database.
Third-party plugins and services are part of your compliance surface
Every plugin or embedded service that receives visitor data (form plugins sending submissions to an external service, analytics, chat widgets, ad networks) is a data processor in GDPR terms, and your privacy policy and data processing agreements need to account for them. Audit what's actually installed and sending data externally — it's often more than site owners initially assume.
This is guidance, not legal advice
Compliance requirements vary by jurisdiction, by what data you handle, and by your specific business context — this post covers the common technical considerations on the WordPress side, not a substitute for actual legal counsel on your obligations.
The takeaway
WordPress's built-in privacy tools are a genuinely useful foundation, but real compliance requires understanding what your specific site collects, ensuring third-party plugins and services are properly accounted for, and having an actual process — not just a policy page — for handling data subject requests.
