What is the General Data Protection Regulation (GDPR)?
Let’s start with the basics. What is the GDPR and why should you care about complying with it? You will be able to determine if your WordPress website needs to be GDPR-compliant or not. We will outline crucial elements for privacy compliance on websites, so that you can ensure to cover all of them and become GDPR-compliant. Finally, we will introduce you to the best WordPress GDPR plugins that can help you collect and manage user consent on your website.
What is the GDPR and why is it important?
GDPR is a European Union-wide regulation that seeks to protect the rights and freedoms of individuals when it comes to how their personal data is handled. It has far-reaching implications for any organization worldwide that serves individuals residing in the European Union.
The GDPR sets strict parameters on how organizations must collect and manage data, including procedures, notifications, documentation and user consent, in order to ensure people have control over how their data is used.
The GDPR is important for businesses and organizations that have their own websites. It sets out the requirements for how websites must comply with the regulation, including collecting, storing and handling users’ personal data. It also requires website owners to ensure that users are aware of how their data will be used and to provide them with the right to access, rectify or delete any data that has been collected.
By complying with the GDPR, website owners can protect the privacy of their visitors, as well as avoid high penalties that could be incurred for noncompliance.
How to ensure GDPR compliance on WordPress sites?
The GDPR requires website owners and operators to ensure that users’ personal data is collected and processed according to its requirements. This means that businesses and organizations need a legal basis for data processing, and user consent is the legal basis required by WordPress website operators.
In general, website operators cannot collect personal data from users unless they obtain explicit consent for the specific purposes of how their data will be used. The GDPR also outlines conditions for legally valid user consent.
Cookies are an integral part of using websites, helping to make web browsing easier, more user-friendly, and more efficient. But what exactly are cookies?
A cookie is a small file that is stored on visitors’ computers (commonly in the web browser) or mobile devices. Cookies can be used to track, e.g. how long users stay on a site, where they are located, or which subpages they visit.
For digital vendors, website cookies can provide valuable insights into user behavior. By tracking how users interact with their website, businesses can identify areas of improvement and create more targeted marketing campaigns. Cookies can also be used to personalize content, such as displaying relevant products and offers based on a user’s location or past browsing history.
But the information that cookies collect from your website visitors is classified as personal data, and therefore their consent is needed in order for you to collect and process their information legally.
Information about cookies and trackers must be available to your website visitors at all times. You can include it in your privacy policy. You must also implement an easy way for users to change or withdraw their consent. Moreover, the GDPR requires that consent preferences be logged and that data tracking — including by embedded third parties — be documented. Notification of other countries to which data is sent must be included as well.
All of this sounds complicated, but fortunately there are many online tools to help you comply with the GDPR. You can choose various software and plugins to do most of the work for you. How do you make sure you choose the right tool? Let’s look into key criteria.
What should you consider when choosing WordPress plugins for data protection?
When you’re looking for a suitable solution for WordPress GDPR compliance, there are recommended criteria. Here are the most important features of GDPR plugins for WordPress and how to verify that they deliver.
Compliance with privacy laws
The best GDPR WordPress plugins offer options to comply not only with the GDPR, but also with other international privacy regulations, like the CCPA, LGPD, POPIA, etc. By choosing one of those plugins, you’re covered in case your website has visitors from other regions outside the EU.
Moreover, when a user from outside the EU visits your site, the WordPress GDPR plugin should be able to automatically detect their location and display the cookie banner appropriate for their country.
Cookie consent settings
When choosing your cookie consent plugin, you should also look into its settings. Available features will indicate if the plugin can indeed enable GDPR compliance. What should you look for?
Let’s take a step back for a moment and have a closer look into GDPR cookie consent requirements.
- Before any cookies are enabled (except for whitelisted essential cookies), prior and explicit consent must be obtained.
- Consent must be granular, i.e. users must be able to choose to enable some cookies and not others, and must not be forced to accept all cookies or none at all.
- Consent must be freely given.
- Consent must be as easy to withdraw as it is to give.
- Consent must be securely stored and available at any time as legal documentation.
- Consent must be renewed at least annually (however, other regulations differ and require more frequent renewal).
The questions you need to ask when reviewing your future WordPress GDPR plugin should then be based on the above requirements.
- Does the plugin block cookies automatically?
- Does it enable granular choice of cookies?
- Does it support the consent withdrawal option?
- Does it store user consent data securely?
- Does it offer a ‘Reject’ option?
Cookie banner options
Before choosing your preferred GDPR plugin for WordPress, make sure it enables you to optimize and configure your banner in a way that does not disrupt user experience. You want your users to stay on your website and not get discouraged by a huge banner with no option to close it or reject cookies.
The banner should also look professional and in line with your branding, so make sure the plugin you choose enables you to add your company logo and change colors, for example, so that it matches your website design.
Security, support and updates
When deciding which WordPress GDPR plugin to use in 2023, have a close look at the company behind it and check if they offer regular updates and customer support. Privacy regulations change and new laws come into existence, so in order to make sure your website stays compliant, you need to make the right choice.
Becoming compliant requires you to provide your users with all legal information on how their data is processed and for what purposes. To communicate that, you need very specific legal information. Choose a WordPress plugin with ready-to-use legal templates to save your time and resources and give you peace of mind if you’re not a privacy lawyer.
The 5 best WordPress plugins for GDPR compliance
The GDPR compliance plugins presented below have many things in common. They all enable cookie banners on your website to collect user consent. They differ by level of complexity, pricing, features, and implementation.
They all help you to become compliant with the GDPR and other relevant privacy laws, but that does not mean just installing the GDPR plugin on your site will make you compliant. Certain settings are needed for GDPR compliance. Find details in this article: How to achieve GDPR compliance.
1. Cookiebot CMP by Usercentrics
Company: Usercentrics
Founded: 2012
Country: Denmark
Enables compliance with: GDPR/DSGVO, ePR, LGPD, POPIA, CCPA/CPRA, VCDPA, TCF 2.0
Cookiebot Consent Management Platform (CMP) is a software developed here at Usercentrics. It’s a simple, scalable and easy-to-use WordPress GDPR plugin. It offers all features needed to comply with the GDPR and other privacy regulations listed above. It scans your website regularly for new cookies and trackers and automatically adds their descriptions to your website with the cookie declaration feature. It integrates with Google Consent Mode and Google Tag Manager, as well as with the WP Consent API.
Download Cookiebot CMP pluginUsing Cookiebot CMP you can easily generate an automatic privacy policy and securely store your user consent data. If needed, you can download user consent information. The plugin also enables seamless user experience — it loads fast and banner templates look good right out of the box. Banner content can be customized not only with your own logo, colors, or fonts, but also with an unlimited number of language variants. Default text templates in more than 47 languages are available in the paid version of Cookiebot CMP.
The basic version of our Cookiebot CMP WordPress plugin is free to use for small websites. Advanced features — multiple languages, analytics, cross-domain consent sharing, geotargeting, and more — are available in the paid version of this plugin, which starts at €12/month.
2. CookieYes
Company: CookieYes
Founded: 2018
Country: UK
Enables compliance with: GDPR, POPIA, LGPD, CCPA
The CookieYes plugin is fully customizable, you can even modify CSS classes to change the banner’s appearance. It offers a comprehensive second banner layer with functionality for users to give granular consent (to consent only to specific categories of cookies). It’s free for small websites with a maximum of 25,000 page views per month. It stores user consent in a compliant way and enables you to export the information in a CSV file.
Unfortunately, CookieYes does not block all third-party service scripts automatically. It blocks most of the commonly used ones, though. If you want it to block specific technologies, you would need to set it up manually. It also does not offer extensive reporting.
3. Complianz
Company: Really Simple Plugins
Founded: 2018
Country: Netherlands
Enables compliance with: GDPR/DSGVO/RGPD, ePrivacy, TTDSG, LGPD, POPIA, APA, CCPA/CPRA, PIPEDA
The Complianz plugin offers many advanced features and automation options. It’s quite complex, so it’s especially useful for websites with many visitors from all over the world. Some technical knowledge might be helpful in order to set it up correctly, although the plugin offers a setup wizard to walk you through initial steps.
The basic features of this plugin are free to use, but a premium subscription is available for €49/month. If your site is large or you plan to expand, this may be a worthwhile investment. However, if you have a small website and most of your visitors are from the EU, you may want to consider a simpler solution.
4. Cookie Notice and Compliance for GDPR & CCPA
Company: Hu-manity.co
Founded: 2018
Country: USA
Enables compliance with: GDPR, CCPA (and other US privacy laws), PIPEDA, LGPD, PDPB, ePD/ePR, PECR
This smart plugin from Hu-manity.co gives you access to the latest policies and technical compliance rules for more than 100 countries and jurisdictions. It offers a unique feature to select the consent duration, so you can ask for the user’s consent again after it has expired (some laws require re-consent after a certain period of time).
A basic version of the software is free to use, but depending on your needs and website traffic, you might need a paid plan, which is $14.95/month. Also, the free version comes with some limitations:
- consent is only stored for 30 days
- websites can’t have more than 1,000 visits per month
- only one additional language is supported
5. GDPR Cookie Compliance
Company: Moove Agency
Founded: 2010
Country: UK
Enables compliance with: GDPR/DSGVO, CCPA, PECR
GDPR Cookie Compliance is a very simple plugin, easy to install and set up. It offers geolocation, consent analytics, and the revoke consent option. It’s customizable, enabling you to add your own logo and change colors and fonts.
The free version gives you access to basic features. In order to access all functionality, you need to upgrade to premium for $59 per month per site. The downsides: it only supports 18 languages and does not offer an automated privacy policy.
Best practices for using WordPress GDPR plugins
What should you remember when using a WordPress GDPR plugin?
- Implement plugins per guidelines and instructions provided.
- Check if your plugin setup corresponds with what’s required to comply with relevant privacy laws.
- Set up your banner in a way that enables seamless and undisrupted user experience.
- Enable your consent plugin to scan your website regularly for new cookies and tracking technologies (if it offers that function).
- If possible, analyze reports for opt-in/opt-out rates and adjust your banner to optimize opt-ins.
- Make sure visitors from various countries see the relevant version of the banner on your site.
- Read about dark patterns and adjust your banner setup to avoid them.
Making GDPR WordPress cookie compliance plugin choice
Your final choice will be determined by your website’s size, relevant regulations, and your company’s needs. Some GDPR WordPress plugins don’t have many features, so would work well for non-tech savvy users who need it only for one small website. Some are more comprehensive and require complex customization in order to achieve compliance. If you have just one website for now, but are thinking about expanding your company’s presence online, keep that in mind when choosing a GDPR compliance plugin. In that case, it’s worth looking into the ones covering more laws and languages, and offering more options.
This free cookie scanner can help you determine if your website is compliant and will show you which cookies and trackers it uses.