WordPress GDPR Compliance Checklist (2026)

Most WordPress GDPR content falls into one of two failure modes. It either promises that installing a cookie banner plugin makes you compliant, or it dumps the full regulation on you without saying which parts apply to a website at all. Neither is useful when you're trying to work out what to actually do on Tuesday afternoon.

WordPress core has shipped genuine privacy tooling since 2018, and it covers real GDPR obligations. It also has specific, documented limitations that nobody mentions when they tell you WordPress "has GDPR features." This walks through what's built in, what the regulation actually requires of a typical site, where WordPress sites commonly leak personal data, and what changed in 2026, including one thing that's genuinely unstable right now.

This article is general information, not legal advice. GDPR obligations depend on what your organisation does, where it operates, and what data it processes. If your site handles personal data at any meaningful scale, get advice from a qualified data protection lawyer in your jurisdiction.

TL;DR

WordPress 4.9.6 added four core privacy tools: a Privacy Policy page generator, Export Personal Data, Erase Personal Data, and the opt-in comment cookie checkbox. They work, but they only cover WordPress core plus plugins that specifically register privacy handlers.

The Erase Personal Data tool does not delete the user account itself, and it does not touch backups. Both are common and consequential misunderstandings.

Cookie banners come from the ePrivacy Directive, not GDPR. Crucially, the EDPB has stated that legitimate interest is not a valid basis for storing or accessing information on a user's device, so "we use analytics under legitimate interest" doesn't work for the cookie itself.

GDPR fines are two-tier: up to €10 million or 2% of worldwide annual turnover for one set of breaches, and up to €20 million or 4% for the more serious set, whichever is higher in each case. EU authorities issued roughly €1.15 billion in fines during 2025 per the EDPB's annual report.

The EU-US Data Privacy Framework is still valid as of mid-2026 but is under active legal threat following a June 2026 US Supreme Court ruling affecting FTC independence. Don't assume it will hold indefinitely; know what your US-based vendors rely on.

What WordPress Core Actually Gives You

All four privacy tools arrived together in WordPress 4.9.6, released May 17, 2018, a week before GDPR became enforceable. They're still the baseline in 2026.

The Privacy Policy Page Tool

Under Settings → Privacy, you can create or designate a Privacy Policy page. A Privacy Policy Guide assembles suggested policy language contributed by WordPress core and by any plugins that register content through the wp_add_privacy_policy_content hook.

Its limitation is significant: it only surfaces text from core and from plugins that took the trouble to register privacy content. It does not detect or describe third-party services. Your analytics provider, ad network, embedded video player, CDN, and payment processor will not appear unless you write them in yourself. The tool gives you a starting draft, not a complete policy, and the accuracy of the final document is entirely your responsibility.

Export Personal Data

Under Tools → Export Personal Data, an admin enters a username or email address. WordPress emails that address a confirmation request, and once the person confirms, the admin can generate a ZIP export. Core's developer documentation describes the output as a mini website with an index HTML page, grouping the person's data by source.

It works for registered users and for non-registered people such as logged-out commenters, since it's keyed on email address. Plugins can register their own exporters through the wp_privacy_personal_data_exporters filter, and the process runs in paginated AJAX batches to avoid timeouts.

Exports are cached on the server for three days and then automatically deleted.

Erase Personal Data

Same request-and-confirm workflow, under Tools → Erase Personal Data. On confirmation, WordPress runs registered eraser callbacks (wp_privacy_personal_data_erasers filter) in paginated batches.

Three documented limitations that matter a great deal:

It does not delete the registered user account. That's a separate manual step. An admin who runs the eraser and assumes the account is gone is wrong.
It does not touch backups or archives. Only the live database is affected. If someone exercises their right to erasure and your backups retain their data, that's a gap you need a documented policy for.
It only covers core plus participating plugins. A plugin that stores personal data without registering an eraser will retain it silently.

It's also irreversible once confirmed, and it doesn't override legitimate retention obligations such as tax or accounting record requirements.

WordPress 4.9.6 changed the comment form's convenience cookie from opt-out to explicit, unchecked-by-default opt-in: "Save my name, email, and website in this browser for the next time I comment." If the visitor leaves it unchecked, no cookie is set. This was a direct response to GDPR and remains the default.

The regulation is long. The parts most relevant to running a site are narrower.

A lawful basis for processing (Article 6). There are six: consent, necessity for a contract, a legal obligation, vital interests, a public task, and legitimate interests. Consent is one option among six, not the default. For an e-commerce order, contract necessity usually covers the transaction itself; for a marketing newsletter, consent typically applies.

Valid consent (Article 4(11)). GDPR defines it as "any freely given, specific, informed and unambiguous indication of the data subject's wishes" given "by a statement or by a clear affirmative action." Recital 32 makes explicit what this rules out: pre-ticked boxes and silence do not constitute consent. Article 7 adds that you must be able to demonstrate consent was given, that a consent request bundled with other terms must be clearly distinguishable, and that withdrawing consent must be as easy as giving it.

That last point is where most cookie banners fail in practice. A banner with a prominent "Accept all" and a buried, multi-click path to reject is difficult to reconcile with "as easily as it was given."

Data subject rights. People can request access to their data, rectification of inaccurate data, erasure, and portability. These map fairly directly onto WordPress's export and erase tools, though as noted, the tools only cover what's registered with them. Erasure is not absolute; the European Commission's own guidance confirms exceptions exist, including legal retention obligations and freedom of expression. There is a statutory deadline for responding, set out in Article 12(3); check the current regulation text for the exact period rather than relying on secondhand figures.

Breach notification (Article 33). Notify the competent supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it," unless the breach is unlikely to result in a risk to individuals. EDPB guidance clarifies that the clock starts when you have a reasonable degree of certainty that a security incident has occurred and personal data has been compromised. Separately, under Article 34, you must notify affected individuals directly when the breach is likely to result in a high risk to their rights and freedoms.

For a WordPress site, this makes intrusion detection an actual compliance requirement, not just good hygiene. You cannot report within 72 hours of becoming aware if you never become aware. Given 2026's pattern of critical WordPress vulnerabilities being exploited within days of disclosure, managed security monitoring with malware scanning is doing compliance work as much as security work.

Records of processing (Article 30). You need documentation of what you process and why. There's a limited exemption for smaller organisations, but it falls away where processing is regular, or risky, or involves special category data, which covers a lot of real sites. Check Article 30(5) for the precise threshold.

Data Protection Officer (Article 37). Mandatory where core activities involve regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special category or criminal conviction data. Public authorities must always appoint one. In practice, a typical small business WordPress site does not trigger this unless it's doing large-scale tracking or profiling.

Fines (Article 83). Two tiers, and the "whichever is higher" wording matters:

Tier	Maximum	Applies to
Lower (Art. 83(4))	€10 million or 2% of total worldwide annual turnover, whichever is higher	Records failures, breach notification failures, privacy-by-design failures, processor obligations
Upper (Art. 83(5))	€20 million or 4% of total worldwide annual turnover, whichever is higher	Breaches of core principles, lawful basis, consent conditions, data subject rights, international transfer rules

For scale: the EDPB's 2025 annual report, published April 2026, records EU national authorities issuing roughly €1.15 billion in GDPR fines during 2025, with Ireland and France accounting for the largest shares.

This is the most consistently misunderstood area, so it's worth being precise.

Cookie consent comes from the ePrivacy Directive, not GDPR. Article 5(3) of the ePrivacy Directive governs storing or accessing information on a user's terminal device, which covers cookies, local storage, and similar mechanisms. It's a separate legal instrument, implemented through national law in each member state, which is why cookie rules vary somewhat across the EU while GDPR is uniform.

Three consequences worth internalising:

Consent is required for anything not strictly necessary. The exemption is narrow: cookies genuinely required to deliver a service the user explicitly asked for, such as a shopping cart session, load balancing, or security. The EDPB has recommended the term "strictly necessary" over the looser "essential" precisely because sites routinely over-classify.

Analytics cookies require consent. They are not strictly necessary under the EDPB's reading. This has been the consistent position of the EDPB and national regulators.

Legitimate interest does not work for cookies. This is the one that trips up otherwise well-informed people. The EDPB has stated directly that legitimate interest, a valid GDPR Article 6 lawful basis, is not a valid basis for the initial storage or access under ePrivacy Article 5(3). You may be able to rely on legitimate interest for processing that happens after storage, but not to justify setting the cookie in the first place.

GDPR still applies afterward. Once cookie consent is given under ePrivacy, the resulting personal data processing falls under GDPR, where the EDPB considers consent generally the most appropriate lawful basis for that follow-on processing.

One note on the legal landscape: the long-planned ePrivacy Regulation intended to replace the 2002/2009 Directive has still not been adopted as of 2026. The Directive remains the operative instrument. Be wary of content claiming a new EU cookie regulation has landed.

Where WordPress Sites Actually Leak Personal Data

The gap between "installed a privacy plugin" and "actually compliant" usually lives here.

Comments. WordPress stores commenter name, email, website, and IP address by default. IP addresses are widely treated as personal data.

Contact forms. Most form plugins store submissions in the database indefinitely by default, and often forward them to third-party email or CRM services. Ask two questions of every form on your site: where does this data go, and when does it get deleted?

Analytics. Requires cookie consent under ePrivacy plus a GDPR lawful basis for the processing, and often raises an international transfer question depending on the provider.

Third-party embeds. This is the sleeper issue. YouTube embeds, Google Maps, and externally hosted fonts load resources from third-party servers at page render, transmitting the visitor's IP address before they've interacted with any consent banner.

The Google Fonts case is the concrete precedent people cite. In a ruling dated 20 January 2022 (case 3 O 17493/20), the Regional Court of Munich I awarded a plaintiff €100 in damages against a website operator for loading fonts dynamically from Google's servers without consent, transmitting the visitor's IP address, when self-hosting was a viable alternative. It's a single national trial-court decision rather than EU-wide binding precedent, but it's the reason self-hosting fonts became standard WordPress privacy advice, and the reasoning generalises to any externally loaded asset.

CDNs and server logs. Access logs typically capture IP addresses. Retention periods and anonymisation are frequently overlooked.

Plugins phoning home. Telemetry, licence checks, and third-party API calls can transmit data externally. Worth auditing on a site with a large plugin count.

What Changed in 2026

Enforcement intensity is up. The €1.15 billion in 2025 fines documented in the EDPB's April 2026 annual report represents a notable increase over prior years.

A GDPR Procedural Regulation harmonising how data protection authorities handle cross-border complaints entered into force at the start of 2026, with a grace period before full application. It's aimed at regulators rather than website operators, so the direct impact on a typical WordPress site is limited, but verify the current dates against the official EU sources if it's relevant to your organisation.

The EU-US Data Privacy Framework is the one to watch. This is the mechanism most WordPress sites implicitly rely on whenever they use a US-based host, CDN, analytics provider, or plugin vendor that self-certifies under it.

Current status, stated carefully: the framework, adopted as a Commission adequacy decision in July 2023, remains formally in force. It survived its first judicial challenge when the EU General Court upheld its validity in September 2025.

The new pressure came in June 2026, when the US Supreme Court held that the President may remove FTC Commissioners without the previously required statutory cause. Because the FTC's independent enforcement role underpins the framework's adequacy finding, legal commentators have flagged this as a genuine threat to its foundation, and privacy groups have signalled further CJEU litigation. Two prior transfer frameworks, Safe Harbour and Privacy Shield, were struck down by the CJEU under comparable arguments.

What to do about it: don't panic and don't ignore it. The framework is valid today, so transfers relying on it are lawful today. But treat it as unstable: know which of your vendors rely on it, check that they're actually certified rather than assuming, and understand what your fallback would be, typically Standard Contractual Clauses, if it were invalidated. Anyone telling you the framework has already been struck down is wrong; anyone telling you it's settled is being optimistic.

The Practical Checklist

Working through these covers most of what a typical WordPress site needs to address:

Inventory what personal data your site collects and where it goes. Comments, forms, accounts, orders, analytics, embeds, logs. This is the foundation for everything else and the step most often skipped.
Set your Privacy Policy page in Settings → Privacy, then actually write it, adding every third-party service the generator can't see.
Audit every third-party embed and external asset. Self-host fonts. Consider consent-gating or facade-loading YouTube and Maps embeds so nothing loads before the visitor agrees.
Implement cookie consent that meets the standard, meaning no pre-ticked boxes, no cookies set before consent, rejection as easy as acceptance, and a way to withdraw consent later.
Define retention periods for form submissions, comments, orders, and logs, then actually enforce them rather than keeping everything forever.
Test the export and erase tools on a dummy account before you get a real request. Confirm which of your plugins register handlers, and remember that erasure doesn't remove the account or clean backups.
Document a backup policy that addresses erasure requests, since core's tool doesn't touch backups and you'll need a defensible position on how long deleted data persists in them.
Put breach detection in place so the 72-hour clock is one you can actually meet. Malware scanning, file integrity monitoring, and admin-account alerting all serve here.
List your data processors and check their transfer mechanism, particularly US-based ones relying on the Data Privacy Framework.
Keep records of processing per Article 30 if the exemption doesn't apply to you.

Important: Before making structural privacy changes, particularly anything that deletes data, take a backup and test on staging. MagicWP's on-demand backups and one-click staging let you validate an erasure workflow without risking production data.

Frequently Asked Questions

Does WordPress have built-in GDPR compliance tools? Yes, four of them, added in WordPress 4.9.6: a Privacy Policy page generator, Export Personal Data, Erase Personal Data, and an opt-in comment cookie checkbox. They cover real obligations but only handle WordPress core plus plugins that specifically register privacy handlers, and they don't make a site compliant on their own.

Does the WordPress Erase Personal Data tool delete the user's account? No. It runs registered eraser callbacks against personal data but leaves the registered user account in place. Deleting the account is a separate manual step. It also does not touch backups or archives, only the live database.

Do I need a cookie banner for a WordPress site? If you set any non-essential cookies and serve EU visitors, yes, but the requirement comes from the ePrivacy Directive rather than GDPR itself. Strictly necessary cookies such as a shopping cart session are exempt. Analytics cookies are not.

Can I use legitimate interest instead of consent for analytics cookies? Not for setting the cookie. The EDPB has stated that legitimate interest is not a valid basis for storing or accessing information on a user's device under ePrivacy Article 5(3). It may apply to processing that happens after consent is obtained, but not to the storage itself.

Are Google Fonts a GDPR problem in WordPress? Loading them from Google's servers transmits visitor IP addresses to a third party. A German regional court awarded €100 in damages over exactly this in January 2022, reasoning that self-hosting was a viable alternative. It's one national ruling rather than EU-wide precedent, but self-hosting fonts is now standard practice and costs you nothing.

How quickly do I have to report a data breach? Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it's unlikely to pose a risk to individuals. If the breach is likely to result in a high risk to individuals, Article 34 also requires notifying them directly.

What are the maximum GDPR fines? Two tiers. The lower tier is up to €10 million or 2% of total worldwide annual turnover, whichever is higher. The upper tier, covering breaches of core principles, consent conditions, data subject rights, and transfer rules, is up to €20 million or 4%, whichever is higher.

Is it still legal to use US-based hosting or plugins under GDPR? As of mid-2026, yes, where the vendor is certified under the EU-US Data Privacy Framework or another valid mechanism such as Standard Contractual Clauses. The framework remains in force but is facing renewed legal challenge following a June 2026 US Supreme Court ruling on FTC independence. Check your vendors' certifications and know your fallback.

Does a small blog need a DPO? Almost certainly not. Article 37 requires one only where core activities involve large-scale systematic monitoring or large-scale processing of special category or criminal conviction data, or where you're a public authority.

Conclusion

WordPress GDPR compliance in 2026 comes down to knowing where core's tools stop. They handle policy scaffolding, data export, and data erasure competently within their scope, and that scope excludes your third-party services, your backups, and the user account itself. Everything outside that boundary is work you have to do deliberately.

The two areas worth immediate attention are third-party embeds leaking IP addresses before consent, and breach detection that makes the 72-hour notification window achievable rather than theoretical. The transfer-mechanism question sitting under your US-based vendors is worth understanding now rather than during whatever comes next for the Data Privacy Framework.

And to repeat the thing that matters most: this is general information about how WordPress and GDPR intersect, not legal advice. Use it to prepare good questions for a lawyer who knows your jurisdiction and your business, not as a substitute for one.

WordPress GDPR Compliance in 2026: A Practical Checklist for Site Owners