By platform

Cookie Policy Generator for WordPress

Written for the plugin stack - because on WordPress, the plugins are the data flows.

Generate your cookie policy Read the cookie policy guide

WordPress core sets only a handful of cookies - session, login and comment-author. The interesting ones come from plugins and themes, which is why a WordPress cookie table has to be built from an actual scan rather than from documentation.

WordPress core collects very little: comment author details, a login cookie, and whatever the theme adds. Everything else comes from plugins, and a typical business site runs between fifteen and forty of them. Contact forms, analytics, SEO tools, caching, backups, security, membership, e-commerce and email marketing each collect, store or transmit personal data.

That makes the plugin list the single most important input to a WordPress privacy policy. WordPress core has built-in privacy tooling - a suggested policy text assembled from plugins that implement the privacy API, plus personal data export and erase tools - but only some plugins participate, so the suggested text is always incomplete.

Self-hosting adds a layer most site owners forget: your host processes personal data too, server logs record IP addresses, and backups replicate everything including data a user has asked you to delete.

What a cookie policy for a WordPress site has to cover

Core cookies: wordpress_logged_in, wp-settings, comment_author fields
Plugin cookies from analytics, caching, security, chat and marketing tools
Theme and page-builder cookies, which are frequently overlooked
Which consent plugin gates them and what it actually blocks
How a visitor withdraws consent, and which plugin surfaces that control

How a WordPress site actually moves personal data

Contact form submissions

Contact Form 7, WPForms and Gravity Forms may email submissions, store them in the database, or both - and each has its own retention setting that defaults to keeping everything.

Comment metadata

WordPress stores the commenter’s IP address and user agent alongside the comment, which many site owners do not realise and few disclose.

Analytics and SEO plugins

Analytics plugins inject tracking, and some SEO plugins phone home with usage telemetry. Both belong in the disclosure.

Security plugins and firewall logs

Wordfence, Sucuri and similar log IP addresses and login attempts, retain them, and often send data to a vendor cloud.

Backups and staging copies

Full-database backups replicate personal data to another location, and a deletion request has to reach them or your erasure is incomplete.

Gravatar and remote avatars

Enabled by default, sending a hash of the commenter’s email address to Automattic on every page view that shows an avatar.

Third parties the draft will ask you about

Automattic (Jetpack, Gravatar) · WooCommerce · Stripe · PayPal · Mailchimp · Wordfence · Cloudflare · UpdraftPlus · Google Analytics 4 · your hosting provider

The rules that apply

WordPress privacy tools

Settings → Privacy assembles suggested policy text from participating plugins, and Tools → Export/Erase Personal Data handles subject requests for core and participating plugins.

Plugin-by-plugin obligations

Each plugin that transmits data off-site introduces a new recipient and usually a new processor agreement to obtain.

Hosting and server logs

Your host is a processor. Access logs containing IP addresses are personal data with their own retention question.

WooCommerce and payment gateways

Order, customer and payment data, with gateway plugins handing card details to the provider.

Comment and user data

Core stores comment author name, email, IP address and user agent, and sets a cookie if the consent checkbox is ticked.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Publishing the document on WordPress

Create the page and set it as the privacy policy page
Settings → Privacy lets you designate it, which makes core link it from the login and registration screens.
Export your plugin list first
It is the raw material for the recipients and cookies sections. Note which ones transmit data off-site.
Configure form and comment retention
Set a real period in each form plugin and decide how long comment metadata is kept.
Decide on Gravatar
Disable it, or disclose it. Discussion settings control whether avatars render at all.
Test the export and erase tools
Tools → Export Personal Data and Erase Personal Data. Confirm what they actually return, and document what they miss.
Add the policy links to the footer widget or menu
So they appear site-wide rather than only where the theme happens to place them.

Where this usually goes wrong

Publishing the suggested privacy text unedited

Settings → Privacy generates suggested content with instructional placeholders. Sites publish it verbatim, brackets included.

Undisclosed plugin data flows

Only plugins that implement the WordPress privacy API contribute to the suggested text. The others - often the ones sending the most data - are silent.

Gravatar left on without disclosure

It transmits an email hash to a third party for every avatar rendered.

Erasure requests that miss backups and caches

A deletion that leaves the record in nightly backups and a CDN cache is not a deletion.

No processor agreement with the host

Hosting is processing. The contract needs Article 28 terms if you serve UK or EU visitors.

Comment IP logging with no retention rule

Stored indefinitely by default, with no purpose after the spam check is done.

Frequently asked questions

Does WordPress generate a privacy policy for me?

It generates suggested text assembled from core and from plugins that implement the privacy API. It is a scaffold with placeholders and it is silent about every plugin that does not participate.

Do I need to list every plugin in my privacy policy?

Not every plugin, but every plugin that collects personal data or sends it somewhere. A caching plugin that stays local is different from an analytics plugin that transmits to a vendor.

Does WordPress store IP addresses?

Yes - comment author IP addresses and user agents are stored by default, and most security plugins log far more. Both are personal data.

What about my hosting provider?

They are a processor. You need appropriate contractual terms with them, and your policy should disclose hosting as a category of recipient including where the servers are.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.