WordPress GDPR Compliance

Yes, if you collect data from people in the EU. GDPR follows the person, not your incorporation, and the number of EU visitors makes no difference to whether it applies. In practice, the risk for a small US business is rarely a regulator. It’s two other things: a data subject request arriving by email, which you have to answer whether or not you expected it, and a procurement questionnaire from an enterprise prospect asking how you handle EU data. CCPA works the same way for California residents.

Yes, with consent gating and the right configuration. GA4 doesn’t log or store IP addresses at all, so the old “enable IP anonymization” step from Universal Analytics no longer exists. What matters now is that analytics loads only after someone accepts analytics cookies, and that Google’s advertising data-sharing settings stay off unless you have consent covering them.

On transfers to the US, the position has settled since the 2022 decisions from the Austrian, French and Italian authorities. The EU-US Data Privacy Framework took effect in 2023, and the EU General Court upheld it in September 2025. Google is certified under it. Further challenges are possible, so your legal team should still confirm the position for your circumstances.

Complianz and CookieYes are the two we use most. Complianz scans your site to auto-detect cookies, has consent blocking built in, and generates a privacy policy from your actual cookie usage. CookieYes is simpler to configure and fits most business sites. Cookiebot is the enterprise option: more expensive, and the one compliance teams recognize. We pick based on your site’s complexity and budget, and we only use plugins that block scripts before consent, which rules out most of the free ones.

It depends on your site’s data collection and current state, quoted after a review. The main factors are how many cookies and third-party scripts run on the site, how many forms collect personal data, whether WooCommerce order data is involved, and the API integrations that pass data to other systems. Most sites need consent management, privacy updates, and form adjustments rather than a rebuild, and we scope the exact work before quoting.

Four things, in order. Inventory every cookie and third-party script, so you know what’s actually running. Install a consent platform that blocks the non-essential ones until someone agrees. Give every form a stated legal basis and say so at the point of collection. Build a route for data access and deletion requests. The privacy policy comes last, because it describes the other four.

Yes. The consent platform logs each choice with a timestamp, the version of the banner the visitor saw and a user identifier, which is what you need if a regulator asks you to prove consent. In our audits, most WordPress consent plugins log the click and nothing else.

We draft it from what the cookie audit and form review show you actually collect: what data, why, how long you keep it, who you share it with and the legal basis. Your legal team reviews and approves it, then we publish it and link it from the consent banner and your forms.

Up to €20 million or 4% of global annual turnover, whichever is higher, for the most serious breaches. €10 million or 2% for the lower tier. In practice, enforcement against smaller organizations usually starts with a complaint and an information request rather than a fine.

Yes. The consent and privacy infrastructure that satisfies GDPR covers CCPA and CPRA too, including the “Do Not Sell or Share My Personal Information” link and opt-out signals. More than a dozen other US states now have comprehensive privacy laws with broadly similar requirements, and the same setup handles them. We configure for the regulations your audience actually falls under.