Privacy policy clauses for WordPress
WordPress is a self-hosted content management system that powers websites and blogs. Website operators install and run WordPress on their own servers, allowing them to create, manage, and publish content without relying on external hosting platforms.
Free scan · No signup · Results in 60 seconds
What data WordPress collects
Your privacy policy must disclose each of the following data types when you use WordPress.
When does WordPress trigger privacy obligations?
When WordPress Installation Triggers Obligations
Installing WordPress immediately creates two data flows that activate privacy and data protection rules:
### Session & Authentication Data
WordPress sets `wordpress_*` cookies for authentication the moment a user logs in or accesses wp-admin. This cookie contains session identifiers. Under ePrivacy Directive Article 5(3) (EU/EEA), you must obtain prior explicit consent before storing *any* cookie, even strictly necessary ones—though consent can be implicit through continued use if your privacy notice clearly discloses the cookie and its purpose. Under CCPA Section 1798.100, authentication data qualifies as personal information; you must disclose its collection in your privacy policy.
### Scope Triggers
- –GDPR applies if your site processes data of EU residents (no threshold; see Article 3 territorial scope).
- –CCPA applies if you operate a for-profit website accessible to California residents and meet one threshold: ≥$25M annual revenue, buy/sell personal information of ≥100K residents/households, or derive ≥50% revenue from selling personal data.
