Privacy Policy for WordPress Sites

A WordPress privacy policy must cover far more than the default template WordPress provides. Every WordPress site collects personal data through core features like comments (which store names, email addresses, and IP addresses), user registration accounts, and login cookies. Beyond that, the plugins you install dramatically expand your data footprint. Contact form plugins like WPForms and Gravity Forms store submitted personal information in your database. Analytics plugins track page views, session duration, and visitor demographics. WooCommerce stores full customer profiles including payment and shipping data. Under laws like the GDPR, CCPA, and CalOPPA, you are legally required to disclose every category of data your site collects, how it is used, and which third parties receive it. A generic privacy policy will not protect you — your policy must reflect the specific plugins, integrations, and data flows on your WordPress installation.

Data WordPress Core Collects

Before you even install a single plugin, WordPress itself collects personal data through several built-in features. The comment system stores a commenter's name, email address, website URL, IP address, and browser user agent string. WordPress uses this data to display comments and to help with spam detection. If you enable user registration, WordPress stores usernames, email addresses, and hashed passwords. WordPress also sets several cookies: a session cookie for logged-in users, and comment author cookies that remember a visitor's name and email for future comments. These cookies persist for 347 days by default.

WordPress also includes an embedded content system (oEmbed) that loads external content from YouTube, Twitter, and other platforms. When visitors view a page with embedded content, those third-party services can set their own cookies and track visitors. Your privacy policy should disclose these embeds as third-party data collection.

Plugin Data Collection You Must Disclose

Plugins are the biggest source of undisclosed data collection on WordPress sites. Here are the most common categories you need to address:

Contact form plugins (WPForms, Contact Form 7, Gravity Forms) store every form submission in your WordPress database, including names, email addresses, phone numbers, and any free-text fields. Some plugins also log IP addresses and browser data with each submission.

Analytics plugins (Google Analytics via MonsterInsights or Site Kit, Matomo, Plausible) track visitor behavior including pages viewed, time on site, referral sources, device type, and geographic location. Google Analytics in particular sends all of this data to Google's servers outside your control.

SEO plugins (Yoast, Rank Math, All in One SEO) themselves collect minimal visitor data, but they integrate with Google Search Console and may enable schema markup that affects how your data appears to third parties. Some premium SEO plugins send site data to their own servers for analysis features.

Security plugins (Wordfence, Sucuri, iThemes Security) log IP addresses, login attempts, and blocked requests. Wordfence sends threat data to its central servers, which means visitor IP addresses are shared with a third party.

WooCommerce and Ecommerce Data

If you run WooCommerce, your privacy obligations expand significantly. WooCommerce collects and stores customer names, email addresses, billing addresses, shipping addresses, phone numbers, IP addresses, and complete order histories. Payment data flows through your chosen payment gateway (Stripe, PayPal, Square), which means you must also disclose the gateway's data practices in your policy.

WooCommerce also sets cookies to maintain shopping cart contents, track recently viewed products, and store customer session data. These cookies are considered necessary for ecommerce functionality and generally do not require prior consent, but they must still be disclosed in your privacy policy. If you use WooCommerce extensions for email marketing, abandoned cart recovery, or customer reviews, each of those adds additional data collection you must document.

Jetpack and Automattic Services

Jetpack is one of the most data-intensive WordPress plugins. When activated, it connects your site to Automattic's cloud infrastructure and transmits visitor data for features including site statistics, downtime monitoring, brute force attack protection, image CDN (Photon), and related posts. The Jetpack Stats feature tracks every page view, including the visitor's IP address, referrer, browser, and operating system.

If you use Jetpack's social sharing buttons, they load third-party scripts from Facebook, Twitter, and other social networks, enabling those platforms to track your visitors. Your privacy policy must disclose both the data Jetpack sends to Automattic and the third-party tracking enabled by Jetpack's social features. Consider whether each Jetpack module you have enabled is necessary, and disable any you do not actively use to reduce your disclosure burden.

How to Build Your WordPress Privacy Policy

Start by auditing every plugin on your site. Go to your WordPress dashboard, review your installed plugins, and document what data each one collects. Check each plugin's own privacy documentation — reputable plugins include a section about GDPR compliance and data handling in their documentation or readme files.

Your privacy policy should include sections covering: what personal data you collect and why, how long you retain it, which third parties receive it (with links to their privacy policies), what cookies your site sets, and how users can request access to or deletion of their data. Under GDPR, you must also identify your legal basis for each type of data processing — typically consent for marketing, legitimate interest for analytics, and contractual necessity for ecommerce transactions.

WordPress includes a built-in privacy data export and erasure tool (under Tools > Export Personal Data and Tools > Erase Personal Data). Your policy should explain how users can submit these requests. This is not optional — GDPR Article 17 gives users the right to erasure, and CCPA Section 1798.105 gives California residents the right to deletion.