Quick answer: WordPress itself is not “GDPR compliant” or “non-compliant”. Compliance depends on how your site collects and uses personal data. For most sites, the work is: publish an accurate privacy policy, collect only the data you need in forms, get consent before non-essential cookies and tracking load, sign data processing agreements with your host and tools, handle access and deletion requests using WordPress’s built-in tools, and keep the site secure. UK sites follow UK GDPR, the Data Protection Act 2018 and PECR, which were updated by the Data (Use and Access) Act 2025, with new cookie exemptions in force since February 2026.
This guide is practical information, not legal advice. For a business with complex data use, speak to a privacy professional.
Does GDPR apply to my WordPress site?
GDPR applies if you are based in the EU or UK, or if you offer goods or services to people there or monitor their behaviour, for example with analytics. That means a US or Australian site can be covered if it actively targets UK or EU customers. The EU GDPR and the UK GDPR are now separate laws, but they are still very similar. If your audience includes both, build for the stricter interpretation.
Personal data on a typical WordPress site includes:
- Names and email addresses from contact forms, comments and newsletter sign-ups
- IP addresses stored with comments and in security logs
- Customer details and order history in WooCommerce
- Cookie identifiers and device data used by analytics and advertising tools
- User accounts for members, students or customers
The WordPress GDPR checklist
| Area | What to do | Where in WordPress |
|---|---|---|
| Privacy policy | Write an accurate policy and link it in the footer and forms | Settings → Privacy |
| Forms | Collect only necessary fields; add a privacy notice; set retention | Your form plugin’s settings |
| Cookies | Block non-essential cookies until consent | Consent management plugin |
| Analytics | Configure for consent, or use a privacy-friendly option | Analytics plugin or tag manager |
| Data requests | Export or erase a person’s data on request | Tools → Export / Erase Personal Data |
| Processors | Sign DPAs with host, email, analytics and form providers | Provider dashboards |
| Security | Updates, strong passwords, 2FA, backups | See our security checklist |
| Breaches | Know how to assess and report incidents | Your internal process |
1. Use WordPress’s built-in privacy tools
WordPress has included privacy tools in core for years, and many site owners never use them:
- Settings → Privacy lets you choose or create a privacy policy page, with a guide that suggests text based on your plugins.
- Tools → Export Personal Data creates a downloadable file of everything WordPress and compatible plugins hold about an email address.
- Tools → Erase Personal Data removes or anonymises that data after you confirm the request.
Both tools send a confirmation email to the person, which helps verify identity. Under UK GDPR you normally have one month to respond to a request.
2. Write a privacy policy that matches reality
Generic templates are a common failure. Your policy should list what you collect, why, the lawful basis, who you share it with (host, email provider, analytics, payment provider), how long you keep it, international transfers, and how people can exercise their rights. Update it when you add a plugin that collects data. Our own privacy policy and cookie policy show the kind of detail to include.
3. Fix your forms
Forms are where most personal data enters a WordPress site:
- Remove fields you do not need. A contact form rarely needs a phone number and address.
- Add a short notice linking to your privacy policy near the submit button.
- Use a separate, unticked checkbox for marketing emails. Do not bundle it with the contact form consent.
- Decide how long entries stay in the database. Many form plugins can delete entries automatically after a set number of days.
- Make sure form emails are sent securely through a proper email service, not the server’s default mail function.
4. Cookies and tracking
Under PECR in the UK and the ePrivacy rules in the EU, you need consent before storing or reading non-essential cookies, such as advertising pixels and most third-party analytics. Strictly necessary cookies, such as a shopping cart or login session, do not need consent.
UK change in 2026: the Data (Use and Access) Act 2025 added new consent exemptions to PECR, in force from February 5, 2026. They cover, for example, cookies used only to collect statistics to improve your own website, and cookies that remember how a visitor wants the site to look, as long as users get clear information and a simple way to object. The ICO finalised its guidance on these exemptions in April 2026. Analytics that share data with a third party for its own purposes, or feed advertising, still need consent. EU sites have no equivalent exemption, so EU visitors still need opt-in consent for analytics.
Higher fines: maximum PECR fines now match UK GDPR levels: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
5. Analytics and fonts
- Google Analytics 4: use Consent Mode with a consent banner, and turn off data-sharing settings you do not need.
- Privacy-focused alternatives: cookieless analytics tools reduce consent requirements, but still check what they collect.
- Fonts: load web fonts from your own server rather than a third-party CDN, so visitors’ IP addresses are not sent elsewhere on every page load. It also tends to be faster.
- Embeds: YouTube, maps and social embeds set third-party cookies. Use privacy-enhanced modes or click-to-load placeholders.
6. Sign data processing agreements
Every company that processes personal data for you is a processor and needs a contract that meets GDPR requirements. For a typical site that includes your web host, email marketing service, form or CRM tool, analytics provider and backup storage. Most providers offer a standard DPA in their dashboard or legal pages. If you are choosing a host, see best WordPress hosting in the UK, which includes a UK GDPR checklist.
7. Register with the ICO (UK)
Most UK organisations that process personal data must pay an annual data protection fee to the Information Commissioner’s Office, unless an exemption applies. The ICO’s website has a short self-assessment tool to check whether you need to pay and which tier applies.
8. Keep it secure and plan for breaches
GDPR requires “appropriate technical and organisational measures”. For WordPress, that means updates, strong passwords, two-factor authentication, limited admin accounts, backups and a patched server. Work through our WordPress security checklist and follow WordPress security news.
If a breach is likely to put people’s rights at risk, UK GDPR requires you to report it to the ICO within 72 hours of becoming aware of it, and to tell affected people without undue delay when the risk is high.
WooCommerce stores: extra steps
- Do not force account creation; allow guest checkout where possible.
- Set how long order data is kept for tax purposes and anonymise old orders after that. WooCommerce has personal data retention settings under its privacy settings.
- Keep marketing consent separate from the purchase.
- Make sure payment details are handled by your payment provider, not stored on your server.
Common GDPR mistakes on WordPress sites
- A cookie banner that loads tracking scripts before the visitor clicks anything.
- “Accept” and “Reject” buttons that are not equally easy to use.
- Pre-ticked marketing boxes.
- A privacy policy copied from another site that mentions tools you do not use.
- Old plugins still collecting data after you stopped using them.
FAQ
Is WordPress GDPR compliant out of the box?
WordPress core includes privacy tools and asks for consent before saving comment cookies, but your plugins, theme, analytics and embeds decide most of your compliance. You need to configure them.
Do I need a cookie banner if I only use Google Analytics?
For EU visitors, yes. For UK visitors, the new statistical exemption may cover some first-party analytics, but standard Google Analytics setups that share data with Google usually still need consent. Check the ICO’s current guidance.
Do US websites need to follow GDPR?
Only if they target people in the UK or EU, for example by selling to them, pricing in pounds or euros, or tracking their behaviour. Many US sites choose to follow GDPR anyway, because US state privacy laws have similar ideas.
What fines apply?
Under UK GDPR, the maximum is £17.5 million or 4% of global annual turnover, whichever is higher. Regulators usually start with guidance and warnings for small organisations, but you should not rely on that.
WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.
