WordPress ships with more privacy tooling than most site owners ever open. There's a built-in Privacy settings page, a mechanism for plugins to auto-declare what they collect, and (if you run WooCommerce) dedicated tools for handling data export and deletion requests. Almost none of it gets used, because a generic privacy policy template doesn't know any of it exists.
Here's how to write a privacy policy that actually matches a WordPress install: what the built-in Privacy page can do for you, what your plugins and comment form quietly collect, and what WooCommerce adds on top if you're running a store.
Start with WordPress's own Privacy tools
Every WordPress install since version 4.9.6 has a Privacy page under Settings that most site owners never visit. Go to Settings > Privacy and either create a new page or designate an existing one as your Privacy Policy Page. Once you do, WordPress marks it in a way themes and some plugins can detect, and it becomes the page linked from your login and registration screens by default.
The more useful part is the "Suggested Privacy Policy Text" that appears when you edit that page. WordPress core, and any plugin written to use the wp_add_privacy_policy_content hook, can register its own privacy-relevant text directly into that suggested content. Akismet, Jetpack, and WooCommerce all do this: install them, open your Privacy Policy Page editor, and you'll see boilerplate about what each plugin collects appear automatically, ready to review and adapt into your own wording.
That suggested text is a starting draft, not a finished policy. It only covers what the specific plugins you have installed chose to declare, in their own generic phrasing, it doesn't cover your own custom forms, your theme's data handling, or third-party embeds you've added to posts. Treat it as one input into the document, not the document itself.
What your plugin stack collects that the suggested text misses
Three plugin categories account for most of the gap between WordPress's suggested text and what a real site actually collects:
- Contact form plugins (Contoform, WPForms, Gravity Forms, Ninja Forms) store every submission in the WordPress database by default, name, email, message, and whatever custom fields you've added, indefinitely unless you configure entry deletion. Most of these plugins register some privacy text automatically, but rarely mention their own retention default, which is usually "forever" until changed.
- Email marketing plugins and newsletter blocks (Mailchimp for WordPress, Newsletter, Fluent Forms integrations) sync visitor emails to a third-party list provider the moment someone subscribes. That provider, not just WordPress, now holds the data, and your policy needs to name it.
- SEO and analytics plugins (Yoast, Rank Math, MonsterInsights, Google Site Kit) frequently add their own tracking pixels or connect directly to Google Analytics or Search Console, sending visitor data off your server entirely. MonsterInsights and Site Kit both register some suggested text, but the underlying Google Analytics disclosure still needs your specifics, like whether you've enabled IP anonymization or Google Signals.
Common WordPress data sources and what to disclose
| What it collects | Must be named | |
|---|---|---|
| Contact forms | Name, email, message, custom fields | The plugin and your retention period |
| Comments | Name, email, site URL, IP, cookie | That WordPress core stores these |
| Newsletter signup | Email address, subscribe timestamp | The list provider, by name |
| Analytics plugins | Page views, device, approximate location | The analytics service used |
| WooCommerce checkout | Address, phone, order history, payment | The payment processor, by name |
What the comment form collects, specifically
WordPress's native comment form is worth its own line item, because it's one of the few WordPress features that sets a cookie without any plugin involved. When someone leaves a comment and checks the "Save my name, email, and website in this browser for the next time I comment" box, WordPress core sets a small set of cookies (comment_author, comment_author_email, comment_author_url) that persist in the visitor's browser for close to a year, so they don't have to retype their details on their next comment.
That's a strictly-necessary, functional cookie in most privacy frameworks, it exists purely for the visitor's convenience and isn't used for tracking or advertising, but "strictly necessary" doesn't mean "doesn't need disclosing." A policy that lists third-party analytics cookies but says nothing about the comment form is incomplete, especially since the comment itself, along with the commenter's name, email, and IP address, is stored permanently in your database unless you moderate it away.
If you use Akismet for spam filtering, note that too: it sends comment content and some visitor metadata to Automattic's servers to check against its spam database, which is a genuine third-party data transfer that needs naming rather than assuming "anti-spam" is self-evidently fine to skip.
WooCommerce adds a whole second layer
If your WordPress site runs WooCommerce, the privacy policy needs to grow to match. WooCommerce collects and stores substantially more than a content-only site: full billing and shipping addresses, phone numbers, complete order history tied to each customer account, and, depending on your payment gateway, at least partial payment method details.
WooCommerce ships with its own privacy tooling built on top of WordPress core's: under WooCommerce > Settings > Accounts & Privacy, you can enable customer account data export and account erasure requests, which plug into the same request-handling screen WordPress core provides under Tools > Export Personal Data and Tools > Erase Personal Data. Turning these on is what actually lets you honor a GDPR access or deletion request without manually digging through database tables.
Checkout itself is worth listing field by field in your policy: name, billing and shipping address, phone number, email, and payment details are collected on every order, and your payment gateway, Stripe, PayPal, Square, or WooCommerce Payments, handles and stores the sensitive card data independently of your WordPress install. Say so by name. If you've added upsell, subscription, or loyalty-points plugins on top of WooCommerce, each one is a separate data recipient that needs its own line, the same way a Meta or TikTok pixel would on any other e-commerce platform.
Where the finished policy needs to live
Once your Privacy Policy Page is written and saved, confirm it's actually reachable from more than the login screen. Under Appearance > Menus, add it to your footer menu location if your theme supports one (Astra, GeneratePress, OceanWP, and the default block themes all do), so it's visible on every page rather than only during registration. If you're running WooCommerce, also check that a link to the same page appears near your checkout form, most themes and checkout blocks support adding it as a short note beneath the order button, and privacy laws generally expect it to be conspicuous at exactly the point data changes hands.
Get a WordPress-accurate policy without assembling it by hand
Writing an accurate privacy policy for a WordPress site means checking your plugin list, tracking what your comment form and any e-commerce layer collect, and keeping the document current as your stack changes. Our Privacy Policy Generator builds a policy around the data sources, third parties, and jurisdictions you tell it about, so the document you publish names your actual plugins and processors instead of the generic boilerplate a plugin's suggested text alone would give you.
If your site also needs to document the cookies your plugin stack sets, separate from the privacy policy itself, see our companion guide on writing a cookie policy for a WordPress site, or read the anatomy of a compliant privacy policy for a section-by-section breakdown of what a finished policy should contain.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
