If you run a WordPress site and someone just told you it needs to be "GDPR compliant," first: breathe. Second: most of what's written about this topic is generic legal filler with the words "WordPress GDPR" sprinkled in, so let's actually talk about your specific software, starting from zero.
Quick refresher: what even is GDPR?
GDPR is a European privacy law. The short version: if people in the EU visit your site and you collect any information about them, even just an email address or their IP address, you have to handle that data responsibly and be upfront about it. And yes, this applies to you even if your business isn't in Europe at all. Location of your company doesn't matter, location of your visitors does. A blog, an online store, a newsletter signup, any of these can put you under GDPR's umbrella the moment an EU visitor shows up.
Good news: WordPress already does some of this for you
Here's something almost nobody mentions clearly: WordPress has had real, working privacy tools built into it since 2018, added specifically because of GDPR. You don't need a plugin for these, they're just sitting in your dashboard already:
- Tools → Export Personal Data. Someone sends you a request asking what data you have on them. You type in their email, WordPress emails them to confirm it's really them, then generates a file with their data. Done.
- Tools → Erase Personal Data. Same idea, but for "please delete my data" instead of "show me my data." Same confirmation-email safety check.
- Settings → Privacy. Helps you build a privacy policy page. If you've got plugins installed (a store, a forms tool), it can even pull in suggested wording about what those plugins collect, so you're not starting from a blank page.
One asterisk worth knowing: using "Erase Personal Data" doesn't delete the person's actual WordPress account, it just clears out their personal data. If you want the account gone too, that's a separate step.
And a quick note if you're on WordPress.com (the hosted version) rather than running your own WordPress.org install: these tools might be switched off by default there. This whole guide assumes you're on self-hosted WordPress, where you or your host control the server directly.
The part WordPress does NOT help you with at all
Cookie banners. Zero help. Nothing. WordPress's built-in tools are all about "after someone asks," they do nothing to stop a tracking cookie from firing the moment someone lands on your site, and there's no built-in banner or popup of any kind, not even a basic one. That popup itself is really just asking permission before tracking someone, and WordPress leaves that whole job to you. You've got two real paths: a consent plugin, or a full consent management platform (a CMP, basically "the serious version of a cookie banner tool").
Okay, so what does GDPR actually want from a cookie banner?
Same rules no matter what software you're running:
- Ask before tracking, not after. The cookie shouldn't load until someone clicks "accept." Loading it quietly and hoping nobody complains doesn't count.
- Make "no" exactly as easy as "yes." A big shiny "Accept" button next to a tiny gray "Reject" link is a trick, not a real choice, and regulators specifically watch for this. It's got a name, actually: a cookie banner dark pattern.
- Let people pick categories. "Yes to basic stuff, no to ad tracking" needs to be an option, not just one big switch.
- No boxes pre-checked in your favor. If it's already ticked "yes" before the visitor touches anything, that's not consent.
Get these wrong and the fines are real: up to €20 million, or 4% of a company's entire global revenue, whichever's bigger, for the worst violations. Most actual fines land way below that, but the ceiling is genuinely that high.
Consent plugin, or full CMP? Here's the actual difference
Most WordPress guides just list five plugin names and call it a day. That skips the real question.
A basic consent plugin installs like any WordPress plugin, shows a banner, and often that's it. Quick to set up, lives right in your dashboard. The catch: quality is all over the place. Some genuinely scan your site and block tracking properly. Others are just a banner sitting on top of trackers that fire anyway, and a bunch of free ones get abandoned by their developers and nobody notices for years.
A full CMP actually scans your entire site for every script and cookie running on it, sorts them into categories, and blocks the non-essential ones until someone says yes. The setup itself looks about the same as it does on other website builders, one plugin or script, configured once, so if you manage more than one site on different platforms, you're not learning a new process each time. And here's a detail worth knowing, since assumptions get made a lot here: not every CMP on WordPress works by dropping in an outside script the way it might on other website builders. Some, Secure Privacy's own WordPress plugin included, are built as an actual native WordPress plugin, meaning no external script call at all, your consent records get stored right in your own WordPress database instead of some third-party's cloud, and it's built to play nicely with something called WP Consent API, basically a handshake standard so multiple privacy plugins on the same site don't step on each other and double-prompt your visitors.
Why does the "no plugin fully guarantees compliance" warning actually matter on WordPress specifically? Because tracking on a WordPress site comes from everywhere at once, your theme, random plugins, embedded widgets, ad snippets, not just the one banner plugin you consciously installed. A tool that only watches its own little corner misses everything else, and that's exactly the kind of gap someone can spot just by poking around in their browser's dev tools.
Wait, what about visitors from the US or Brazil?
This whole guide has been about GDPR specifically, but "is my WordPress site cookie compliant" isn't only a European question, and the other big ones don't work the same way, so it's worth a quick detour.
California's CCPA/CPRA doesn't actually make you ask permission before setting cookies the way GDPR does. Instead, it makes you be upfront about what you're collecting, and if you sell or share personal info (a broader idea than literally selling it for cash) or deal with sensitive personal info, you need two specific links on your site: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information." If your WordPress site has the usual analytics and ad cookies running and you clear CCPA's thresholds, skipping those two links is a real gap, not a nitpick.
Brazil's LGPD works a lot more like GDPR: clear notice that cookies are happening, plus actual opt-in consent before the non-essential ones load, held to the same five standards GDPR uses (freely given, informed, specific, unambiguous, easy to take back). If your banner's already built for GDPR, most of the heavy lifting is done, you just need to make sure it's actually collecting real consent from Brazilian visitors too, not just assuming a GDPR-flavored banner running elsewhere covers them.
Bottom line if your WordPress site gets visitors from more than one place: a banner tuned only for GDPR will quietly under-comply in the US (missing those two CCPA links) and might under-comply for Brazilian visitors too if it's not actually blocking cookies before consent. This is exactly the kind of thing a real CMP handles automatically based on where the visitor's coming from, a plugin that only knows how to show one generic banner to everybody usually doesn't. Secure Privacy's WordPress plugin is built to solve exactly this, one setup that automatically shows the right banner and the right links (GDPR, CCPA, LGPD, whatever applies) depending on where the visitor actually is, so you're not stitching together separate rules for separate regions by hand.
What about all the plugins I'm already running?
Every plugin, embed, or widget that touches visitor data counts as either a "controller" or a "processor" under GDPR-speak, and if it's processing data on your behalf (your analytics plugin, your contact form, your payment processor), you're supposed to have an agreement with whoever built it, most legit plugin makers publish one, it's worth actually checking instead of assuming it exists. Same goes for anything embedded, a YouTube video, a share button, a font pulled from an outside server, all of these can quietly set cookies or ping third parties you never explicitly told to do that.
Mistakes people actually make on WordPress
- Treating a contact form as a free pass. Someone filling out your form agreed to have their inquiry answered, not to get added to your email marketing list. That's a separate yes.
- Not double-checking WooCommerce's extra bits. The core order-processing stuff is fine, necessary to fulfill a purchase. Where it goes sideways is the add-on marketing tools, abandoned-cart emails, upsell plugins, reusing that same order data for something the customer never agreed to.
- Assuming your caching plugin doesn't count. Some caching/performance plugins log visitor IP addresses behind the scenes. Still personal data. Still needs to be in your policy.
- Forgetting old plugins you deactivated. Turning a plugin off doesn't erase what it already collected. If you've swapped tools over the years, there's a decent chance old data is still sitting in your database somewhere.
- Trusting the free version of a plugin to do the real work. A lot of popular consent plugins hold back the actual scanning-and-blocking behind a paywall, so the free tier is just a banner for show. Worth checking what your specific plugin's free tier actually does before assuming "installed" means "working."
The quick version, if you just want a checklist
- Make sure Tools → Export/Erase Personal Data and Settings → Privacy are all there and working (self-hosted WordPress.org only).
- Fill out your privacy policy through Settings → Privacy.
- Pick a consent plugin or a full CMP based on how much stuff is actually running on your site, 3+ plugins/embeds usually means you want the real CMP.
- Confirm your tool actually blocks cookies before consent, not just shows a popup.
- Check accept/reject are equally easy to click, nothing pre-checked.
- Get data processing agreements from your analytics/forms/payment plugins.
- Actually test the export and erase tools once before you need them for real.
- Keep records of what people consented to and when.
Common questions
Is WordPress GDPR compliant right out of the box?
Partly. It's got real tools for data requests and privacy policy stuff built in since 2018. Cookie consent, though, zero help, you need a plugin or CMP for that part.
I already use WordPress's privacy tools, do I still need a cookie plugin?
Yes. Those tools handle "give me my data" or "delete my data" requests. They don't touch cookies or show a banner at all, that's a totally separate job.
Does erasing someone's data delete their whole account?
No. It clears their personal data, but the account itself sticks around unless you delete it separately.
What's actually different between a consent plugin and a full CMP?
A basic plugin usually just shows a banner. A full CMP scans everything running on your site, sorts it, blocks the non-essential stuff until someone says yes, and keeps a real record, catching things like theme trackers and embeds a simple banner plugin would miss entirely.
Do these free WordPress tools work if I'm on WordPress.com instead of WordPress.org?
Maybe not. WordPress.com might have them switched off by default depending on your plan. This guide's for self-hosted WordPress.org, where you control the server.
How expensive can getting this wrong actually get?
Up to €20 million or 4% of a company's total global revenue, whichever number's bigger, for the worst cases. Most real fines are nowhere near that, but the max is genuinely that high.
