# WordPress privacy policy setup and requirements

> Set up the WordPress privacy policy page, link it site-wide, account for plugins and embeds, and meet WordPress.org plugin data rules.

WordPress lets you designate a privacy policy page under Settings, Privacy, and core displays that page on the login and registration screens. It does not write an accurate policy for you or link it from every page; you need to describe what your theme, plugins, forms, comments, analytics, and embeds actually collect and add the link to your footer or menu. Plugin developers on WordPress.org have their own rules about external services and data collection.

Canonical URL: https://legalpolicygenerator.com/resources/wordpress-privacy-policy

## What WordPress core provides

WordPress 4.9.6 introduced a privacy settings tool. Under Settings, Privacy, an administrator can create a new privacy policy page or choose an existing one, and WordPress then shows a link to it on the login and registration pages. The screen links to a policy guide that collects suggested text from core and from plugins that register it. Core also added tools to export and erase a person's personal data on request. These features help you organize a policy and handle requests, but the text must still reflect your site.

## Linking the policy across the site

The WordPress documentation notes that the site owner is responsible for linking the privacy policy from every page. Add the page to a footer menu or widget, or use a theme that calls the template function the_privacy_policy_link(), which outputs a link to the designated page. Make sure the link is visible on mobile layouts and on landing pages built with page builders that bypass the theme footer.

## What a WordPress site typically collects

Comments store a name, email, website, IP address, and browser user agent, and may send an email hash to Gravatar to display avatars. Contact and form plugins store submissions and may email them to administrators. Membership, e-commerce, and learning plugins create accounts, orders, and payment records. Security plugins log IP addresses and login attempts. Caching and CDN services process request data. Each of these should appear in the policy if active on your site.

## Plugins, embeds, and third-party services

Analytics plugins, advertising scripts, social sharing buttons, newsletter forms, spam protection services, and embedded YouTube videos, maps, or social posts load third-party code that can set cookies or receive visitor data. List the services you actually use, the purposes, and whether they run before or after consent. Review the plugin list periodically, because deactivated plugins can leave scripts behind and new plugins can add collection silently.

## Rules for WordPress.org plugin developers

The WordPress.org detailed plugin guidelines state in guideline 7 that plugins may not contact external servers without explicit and authorized consent, and that data collection should be documented in the readme, preferably with a clearly stated privacy policy. Guideline 6 allows plugins that act as interfaces to external software-as-a-service, but the service must be documented, preferably with a link to the service's terms of use. A plugin developer that operates a SaaS backend therefore needs a privacy policy of its own that site owners can reference.

## Consent and cookies on WordPress

WordPress core sets cookies for logged-in users and for commenters who opt in to remembering their details. Plugins add analytics and marketing cookies. In the EU and UK, non-essential cookies generally require prior consent; use a consent tool that actually blocks scripts until consent, and describe its behavior in the policy. Test the site in a private window to see which requests fire before any choice is made.

## Handling export and erasure requests

The Tools menu includes Export Personal Data and Erase Personal Data screens that send a confirmation email to the requester and then compile or remove data held by core and by plugins that register exporters and erasers. Plugins that do not register them need manual handling. Describe in the policy how people can make a request, how you verify it, and which records, such as orders kept for tax purposes, are retained.

## Generating a WordPress policy

Choose the website platform in the questionnaire and select the providers your plugins use, such as Google Analytics, Mailchimp, reCAPTCHA or hCaptcha, Stripe or PayPal, and Cloudflare. The generated policy includes only those services. Paste the hosted link into a custom link menu item, or copy the standalone HTML into the page designated under Settings, Privacy, so core's login and registration links point to the same document.

## Common questions

### Is the WordPress policy guide text enough?

The guide collects suggested text from core and participating plugins, but not every plugin contributes, and it does not know your hosting, analytics settings, or regional audience. Treat it as input, not a finished policy.

### Do WordPress.com sites need their own policy?

Yes, if you collect information through forms, comments, newsletters, analytics, or stores. The platform's own privacy policy covers the platform operator's processing, not yours.

Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability.