Module 9 · 9.3

English

Nederlands English Deutsch

GDPR: cookies, forms and Privacy Policy

Module 9: Email, search visibility, GDPR, maintenance and migrating · Reading time: 10 minutes

Learning objective: After this lesson you can get the GDPR basics of a WordPress website in order: know which personal data you process, handle cookies and external content properly, set up forms correctly and draw up a Privacy Policy.

Key concepts: personal data, processing, legal basis, duty to inform, Privacy Policy, cookie rule (Telecommunications Act), consent, functional and analytical cookies, tracking cookies, cookie banner, external content, forms, retention period, processor, data processing agreement, data breach

This lesson is general explanation, not legal advice. For your own situation, read the information from the supervisory authority for privacy in your country, or consult an expert.

What the GDPR has to do with your website

The GDPR (General Data Protection Regulation) is about personal data: anything that lets you directly or indirectly identify someone. On a website that's more than you think: a name and email address from a form, an order, an account, but also an IP address and a cookie with a unique number.

Almost every WordPress website therefore processes personal data: in forms, comments, accounts, orders, server logs, backups, mail logs (lesson 9.1) and in what your website sends to other parties. Among others, these rules apply:

You need a legal basis for every processing activity (Article 6 GDPR), for example: necessary to perform a contract (an order), consent (a newsletter), or a legitimate interest.
You don't process more than necessary and don't keep it longer than necessary.
You inform people about what you do (Article 13 GDPR): you do this in your Privacy Policy.
You secure the data appropriately (https, updates, backups: the rest of this course).
If you have another party process data on your behalf (your host, a mail service, a plugin with a cloud service), that party is a processor and you sign a data processing agreement (Article 28 GDPR). Hosts and large services usually have one ready as standard.
If something goes wrong (a hack, a leaked backup), that's a data breach which you sometimes have to report (lesson 7.5).

Cookies: the Telecommunications Act

For cookies (and comparable techniques such as local storage and tracking pixels), the cookie rule from the Telecommunications Act also applies in the Netherlands (Article 11.7a). In short, as the Dutch supervisory authority explains it:

Functional cookies needed to make the website work (a login cookie, a shopping basket, remembering the cookie choice itself): allowed without consent. You do still need to inform people about them.
Analytical cookies with no or only minor effects on privacy: allowed without consent, if they meet certain conditions. Think of statistics you keep yourself, or that are configured in a privacy-friendly way (no sharing of data, shortened IP addresses, no tracking across other websites).
Tracking cookies and anything that tracks visitors or builds profiles (adverts, social media, most embedded services from large platforms): only after consent, and so only loaded after the visitor has said "yes".

A cookie banner asks for that consent. The Dutch supervisory authority states, among other things: explain which cookies you use and what for, refusing must be just as easy as accepting, and no pre-ticked boxes. A banner that only has "OK", or that already loads the tracking code before a choice has been made, doesn't comply. There are many cookie plugins for WordPress; choose one that genuinely blocks scripts until consent is given, and check that it does (this lesson's exercise will help).

External content: what your website sends to others

Even without cookies, your website sends data to other parties as soon as a page loads something from them. Your visitor's browser then fetches it from that party, and that party sees at least the IP address. Examples:

Element	What happens	Alternative
Fonts from an external service	Every visitor connects to that service	Fonts on your own server (lesson 6.3)
Embedded videos	The video platform can set cookies and track visitors	The platform's privacy-friendly embed mode, or an image that only loads the video after a click
Maps	Same as above	An image with a link to the map
Avatars from Gravatar	An encoded email address goes to Gravatar	Avatars off (lesson 2.4)
Spam protection from an external service (a captcha)	Visitor data goes to that service	A privacy-friendly captcha or a spam filter without an external service
Statistics	Depends on the service and settings	Privacy-friendly statistics, or statistics on your own server

In Germany, a court (LG München I, January 2022) ruled that loading fonts from an external service without consent was contrary to the GDPR, because this passed on the visitor's IP address. That's not a Dutch ruling, but it shows what the issue is about: you need to be able to explain every external source.

Forms

A form is a processing activity. Keep in mind:

Only ask for what you need. For a call-back request you need a name and phone number, not an address and date of birth.
Use https (lesson 3.1), otherwise the data travels across the internet unencrypted.
Where does the data end up? Many form plugins also store every submission in the database, alongside the email. After a few years that can mean thousands of submissions sitting there. Set a retention period, or turn off storage if the email is enough. The mail log of your SMTP plugin (lesson 9.1) contains them too.
Consent for a newsletter is a separate checkbox that isn't pre-ticked. A contact form is not a newsletter sign-up.
Spam protection: see the table above.

The Privacy Policy

During installation, WordPress creates a draft Privacy Policy page and has a helper with sample text under Settings > Privacy; plugins that process data can add text there. That's a starting point, not a finished result. According to Article 13 GDPR, a Privacy Policy describes, among other things:

who you are and how people can reach you;
which personal data you process, what for and on what legal basis;
who you share it with (processors, other parties) and whether it goes outside the EU;
how long you keep it;
what rights people have (access, correction, deletion, objection) and that they can lodge a complaint with the supervisory authority for privacy;
which cookies and external services your website uses.

Put a link to the Privacy Policy in the footer (lesson 4.3), so it can be found on every page, and next to every form.

Under Tools, WordPress also has functions to export personal data and erase personal data at a user's request. Useful for an access or deletion request, but they only find data from WordPress and from plugins that hook into this.

A simple step-by-step plan

Make a list of all the processing activities on your website: forms, accounts, orders, comments, statistics, newsletter, logs, backups.
Check what your website sends to other parties when it loads (this lesson's exercise).
Remove what isn't needed; replace what can be done in a more privacy-friendly way.
Arrange consent for what remains and genuinely needs consent, with a banner that blocks scripts.
Sign data processing agreements and write (or rewrite) your Privacy Policy.
Review it again every year (lesson 9.4), and after every new plugin that processes data.

Summary

Almost every WordPress website processes personal data: forms, accounts, IP addresses, logs, backups.
Functional and limited analytical cookies are allowed without consent; tracking only after consent, and only loaded then.
External content (fonts, videos, maps, captchas) sends data to others; host it locally or only load it after a click.
In forms, only ask for what's needed, don't keep submissions indefinitely, keep the newsletter checkbox separate and not pre-ticked.
A Privacy Policy in line with Article 13 GDPR, findable on every page; data processing agreements with your host and services.

Quiz

Exercise

Exercise A9.3: What does your website send to others? Enter your website's address. The tool loads the homepage as a new visitor would, without cookies and without consent, and gives you an overview: which cookies the server sets immediately (names only), and which other domains the page loads scripts, fonts, iframes or images from. Known services for statistics, adverts, social media, fonts and video are reported by name (orange: "check whether this only loads after consent, or replace it"). It also checks whether there is a link to a Privacy Policy on the homepage.

Exercise D9.3: Your processing list and Privacy Policy. Make a list of all the processing activities on your website (forms, accounts, orders, comments, statistics, newsletter, logs, backups) with, for each one: which data, what for, legal basis, where it's stored, for how long, and which processor is involved. Compare this list with your Privacy Policy and tick off what's covered. Note what you're adding or removing, and which external services from exercise A9.3 you're replacing or putting behind consent.

Exercise D9.3: Your processing list and Privacy Policy

You do this exercise yourself; no one checks it. Tick off what you've done and mark the exercise as done.

Gone through all types of processing
Per processing activity: data, purpose, legal basis, storage, retention period, processor
Compared with the Privacy Policy

Your processing list

What do you add or remove in the Privacy Policy?

Which external services from A9.3 do you replace or put behind consent?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing