How can I have more confidence that WP plugins aren't getting and storing user data? This is in regard to making my website GDPR-compliant.

Perhaps an automatic scanning tool? Are there any existing security-scan tools, perhaps that could scan plugins for known methods of getting user data. E.g. in WP you can get the users' IP using $_SERVER['HTTP_CLIENT_IP'] and from there, I don't know, make a note of it at least, or see about tracing where that IP is used and observing if the data gets put into a DB table somewhere or what not.

Perhaps a 3rd-party certification? Are there any existing WP plugin manual certification services that can confirm behavior of WP plugins with regard to GDPR, among other manual security/performance checks?

Anyways, personally, on my website, there's all kinds of things I can do to ensure GDPR compliance (or just privacy and security in general):

  • Read and learn about GDPR
  • Understand my users needs/wants
  • Follow along with whatever WP core does
  • Make sure all data collection is opt-in, and on first-visit prompt users on our policy and ask what they'd like to do
  • For users that do opt-in, provide them with a way to view, export and delete their data


  • Make sure any 3rd-party software I use is also GDPR-compliant. This is easier with major software, e.g. Gravity Forms, CPanel or Google Analytics, as they already actively and publicly pursue this topic.

... but what I cannot do is manually scan millions of lines of code of random useful WP plugins made by John Smith or Jane Doe from 5000km's around the world who wish for me to trust them after one plain-text paragraph of platitudes & promises and an empty support forum.

Some suggestions with regard to this sound like "Oh, just test your site and look for any cookies being added". To me this is ridiculous because cookie storage is just one aspect of privacy/security; all kinds of other things are possible. For example, something that has nothing to do with cookies, but equally under the umbrella of GDPR, is storing the visitor's IP address in a server log or grabbing the IP within plugin PHP code and sending it off the data to who-knows-where, locally or externally.

After days of article surfing, I find these concerns unanswered and I wonder how much page-builder services (e.g. Squarespace, Wix) are pushing this as a pretty hard selling point in their favour, since they have more closed systems that are easier to get to 99% compliance.

In the end, I know my own website and what I do personally (I'm honorable, but only I know that), but there's a bunch of clients I need to educate and help them make informed decisions.

  • Check if a plugin collects any data, read their privacy policy and/or terms of service. If it's an open source project than you need to check their public repository, like for example GitHub or something. I'm afraid that there's no automatic scanner or a way to do this in an automatic way. You really need to check each plugin. You could also check your browser's cookies and dig in the code of every plugin, but this will be time-consuming Nov 3, 2018 at 22:35
  • Plugins don't need to be GDPR compliant. You need to be GDPR client, as a business. You need to be aware about what data you're collecting on visitors/customers and how you use it. No automated scan or verification service can tell you how you're using data. Regardless, this is a legal question about 3rd-party plugins and themes, so is off-topic here. Nov 4, 2018 at 3:47
  • I've updated the original post with better wording. Thank you Remzi.
    – Kalnode
    Nov 4, 2018 at 4:47
  • Hi @MarsAndBack Thank you. Could you look at my answer below? Nov 5, 2018 at 8:58

1 Answer 1


GDPR is about data collection, if a theme, plugin or any other software for that matter is not collecting any data especially personal data aka data and/or information that could potentially refer to a natural person than you don't need to worry about GDPR. If you or the plugin and/or theme aren't collecting anything than you automatically comply with the law.

For example:

If a page builder is collecting data than it needs to state which data it is collecting and how it handles this. (stores this) and before collecting the plugin needs to ask you permission to collect this. This permission needs to ask for everything the plugin wants to collect.

Another example would be if you're buying a theme, the developers need your contact information, like your email to send you a license key or something to prove that you have bought the theme, this handling of personal data needs to be documented (how they store the data, how you could file a complain and for how long they store the data)

You have always a right to demand erasure, meaning deleting all the data they got on you.

So again: if you don't collect any data you don't need to do something. You need to check which plugins and/or theme is collecting (personal) data. The law is about collecting data, how you handle this (store this) and for how long. And giving people an option of how to contact you for any complaints and/or demands.

  • My original post goes beyond the general understanding of GDPR and instead is getting into specifically how to confirm whether plugins are following security/privacy principles. "You need to check which plugins and/or theme is collecting (personal) data." yes, I think we all agree on that. How to do that is what my original post is about.
    – Kalnode
    Nov 5, 2018 at 17:58
  • @MarsAndBack Yes, and my answer would still be the same. Check their Terms of Service and/or Privacy Policy and if you don't know for sure their code. This is the only way to check. There is no automatic way. Nov 6, 2018 at 6:05
  • @MarsAndBack Also, I don't think you're liable when a developer of a theme or plugin state they don't collect any data. Consult with a lawyer or somebody who could give you legal advice. Nov 9, 2018 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.