WordPress GDPR Compliance: How to Audit Your Site and Fix Consent Gaps

A WordPress cookie banner can appear to do everything it should while trackers are still loading without the right consent. This WordPress GDPR guide helps you look beyond the banner, test your setup, and find the gaps that need fixing.

Adding a cookie banner to WordPress can feel like the job is done. Visitors see the banner, they can accept or reject cookies, and your website has a GDPR consent solution in place.

But what if analytics or advertising trackers load before a visitor makes that choice? Or a WordPress plugin adds a new tracker that your banner does not account for? Displaying a cookie banner is one thing. Confirming that the website respects a visitor's consent choice is another.

That distinction matters because WordPress websites rarely work in isolation. Plugins, analytics tools, embedded content, ecommerce features, and other services can all affect how personal data is collected and when trackers load. Understanding where these pieces fit into WordPress GDPR compliance can help you identify what your website needs. This goes beyond simply displaying a cookie banner.

[H2] Does the GDPR Apply to My WordPress Website?

The General Data Protection Regulation (GDPR) can apply to a WordPress website if you process the personal data of people in the European Union (EU). The GDPR can also apply to businesses outside the EU. This is the case if you offer goods or services to people in the EU or monitor their behavior.

The important question, then, is whether your website processes personal data. And it may process more than you realize. A contact form, for example, can collect names and email addresses. Analytics tools may process IP addresses and cookie identifiers.

WordPress plugins can add another layer. Depending on the tools you use, they may connect your website to advertising, analytics, video, social media, payment, or other third-party services. These services process personal data. And if the GDPR does apply, those different sources of personal data need to be considered as part of your wider privacy compliance responsibilities.

[H2] What’s Required of Website Owners Under the GDPR?

The GDPR sets requirements for how personal data is collected, used, stored, and protected. 

The exact requirements that apply depend on how your business processes personal data. However, website owners will commonly need to consider:

• Lawful basis: You need an appropriate lawful basis for processing personal data, such as consent, a contract, or legitimate interests.
• Information duties: People should be told what personal data you collect and why you collect it. They should also be told how long you keep it and who you share it with.
• Consent: Where consent is required, it needs to meet GDPR requirements. This can include obtaining consent before using certain cookies and tracking technologies, an obligation that derives from Art. 5(3) ePrivacy Directive, while the GDPR sets the standard for valid consent.
• Data protection rights: People have rights over their personal data, including rights relating to access, correction, and deletion. Where processing relies on consent, they must also be able to withdraw it.
• Data minimization and security: You should limit collection to the personal data you need and take appropriate steps to protect it.
• Accountability: You need to be able to demonstrate privacy compliance, which can include maintaining appropriate records of processing and consent.

These requirements extend beyond your cookie banner. A privacy policy, for example, can explain how you use personal data. But it can’t stop an advertising tracker from loading. 

Likewise, a consent banner can ask a visitor for permission. However, it doesn’t tell you whether the technologies on your WordPress site are following that choice.

Is WordPress GDPR Compliant?

WordPress includes several features that can help with GDPR compliance. You can export or erase a visitor’s personal data, create a privacy policy page, and use other built-in privacy settings. However, using WordPress doesn’t automatically make your website GDPR compliant.

WordPress is a content management system. GDPR compliance depends on how your website processes personal data and the measures you have in place to meet its requirements.

Much of that depends on the other tools and services your website uses. Analytics, advertising, ecommerce, forms, and embedded content can all collect, use, or share personal data. Some may also introduce cookies and other tracking technologies that need to be addressed as part of your consent setup.

Does WordPress Collect Personal Data?

Yes, WordPress can collect personal data, but exactly what it collects depends on how your website is configured.

For example, if comments are enabled, WordPress can collect a visitor’s name, email address, IP address, and comment. If visitors can create accounts, WordPress can store their email addresses, usernames, profile details, and other account information.

Plugins and integrations can collect additional data. A contact form may collect names, email addresses, and messages. WooCommerce can process customer, billing, shipping, and order information. Analytics and advertising tools may collect information about how visitors use your website and share that information with third parties.

As a result, two WordPress websites can process personal data in very different ways. And some of what’s happening on your site may not be obvious from looking at the cookie banner.

How to Audit Your WordPress GDPR Setup

Auditing your WordPress consent setup means checking that what happens on your website matches the choices you give visitors. A banner might look correct. That doesn’t necessarily mean cookies and trackers are being blocked, activated, or stopped when they should be.

On WordPress, this can change as your website evolves. Installing a plugin or connecting a new service may introduce tracking that wasn’t part of your original consent setup. Changes to how scripts load can also affect whether prior blocking continues to work.

An audit can help you see what’s happening when someone visits your website.

Identify the Cookies and Trackers on Your Website

Before checking whether your consent setup covers everything it should, it’s best to find out what cookies and trackers are present on your website.

The WordPress dashboard may only tell part of the story. A plugin, embedded feature, or third-party service can introduce cookies or trackers of its own, so checking the site itself is important.

One way to do that is to run a website scan. A scan detects the cookies and trackers it encounters as it checks the site. This gives you a record of what’s in use. You can compare the results with your cookie banner and cookie declaration to see whether everything is accounted for.

If the scan turns up something that isn’t covered, trace it back to the plugin, service, or other feature responsible. From there, you can determine whether the consent setup needs to be updated.

Test Which Trackers Load Before Consent

Once you know which cookies and trackers are present, check whether any of them start running before the visitor makes a consent choice. Under the ePrivacy Directive and the GDPR, technologies that require consent shouldn’t set cookies, send data, or otherwise track visitors. They should wait until visitors have given consent.

You can test this by opening your website in a private or incognito browser window. This starts a new session without a previous consent choice stored in the browser. When the cookie banner appears, don’t accept or reject anything yet.

Instead, check whether any cookies are set or trackers start making requests before you make a choice. You can inspect this activity using your browser’s developer tools. You can also use a scanning tool that checks what loads before consent.

If a tracker that requires consent is already running at this point, the banner isn’t preventing it from loading. The website should only activate that tracker after the visitor gives the required consent.

Review Your Cookie Banner and Consent Options

A cookie banner needs to give visitors a clear choice about cookies and trackers that require consent. Under the GDPR, consent needs to be freely given, specific, informed, and based on a clear action. Your banner needs to support that kind of choice.

To review if yours meets these requirements, start by checking the options visitors see. They should be able to accept or reject non-essential cookies without one option being unnecessarily harder to find or use. If your banner lets visitors manage individual preferences, visitors should be able to make separate choices for relevant purposes rather than accepting everything at once.

Next, look for settings that could make consent invalid. Non-essential categories shouldn’t be preselected where consent is required. Your banner also shouldn’t treat scrolling, continued browsing, or doing nothing as consent.

Finally, read the banner as if you were visiting the website for the first time. Is it clear what you’re asking permission for and what the visitor’s choice will affect? Visitors need enough information to understand what they’re agreeing to, not just a button labeled “Accept.”

Confirm That Consent Is Recorded

If you rely on consent to process personal data, the GDPR requires you to keep enough information to show that you obtained it.

First, identify what handles your cookie banner and consent choices. Check your WordPress plugins for a cookie or consent tool. If you don’t find one, check whether an external service or custom code provides the banner.

Once you know what handles consent, check how it records visitors’ choices. Look in that tool or service for consent records or logs. Alternatively, check its documentation to see where it stores them. If you use a custom setup, ask whoever manages your website where those records are stored.

Test the setup by making a consent choice on your website. Then find the resulting record and confirm that it shows when you made the choice and what you agreed to.

If you can’t find a record of that choice, your current setup may not give you the evidence you need. This evidence is needed to demonstrate consent under the GDPR.

Test Consent Withdrawal and Renewal

Under the GDPR, visitors can withdraw consent at any time, and doing so should be as easy as giving it. Test this by accepting non-essential cookies, then reopening your consent settings and withdrawing that consent. Visitors shouldn’t need to clear their browser cookies or hunt through your website to do this.

Reload the page and check that any trackers that relied on the withdrawn consent no longer load. For example, withdrawing advertising consent should stop advertising trackers that require it.

Also check what happens when you introduce a new use of visitors’ data that their original consent didn’t cover. In that case, your website may need to ask for consent again rather than relying on the visitor’s previous choice.

Retest After WordPress Plugins or Settings Change

Changes to your WordPress site can introduce new cookies or trackers or change how existing ones work. Retest your setup whenever you make a change that could affect how you collect or use visitor data.

This could include adding an analytics or marketing tool, embedding content from a new service, or installing a plugin that adds tracking. After making a change like this, scan your website for cookies and trackers again.

Then repeat your consent tests. Check that anything requiring consent stays blocked until the visitor agrees and responds correctly if they later withdraw consent.

You don’t need to retest after routine content changes, such as editing text or replacing an image, unless the change introduces a new service or tracking technology.

How to Fix Common WordPress Consent Problems

If your audit uncovers a problem, the right fix depends on what’s causing it. A tracker loading before consent requires a different solution. The same applies to a banner that doesn’t offer the right choices or a consent record that’s missing information.

In some cases, you may only need to adjust the configuration of an existing plugin or consent tool. Other issues may require changes to how tracking technologies are loaded or controlled on your website.

Here’s an overview of common WordPress consent issues and how to fix them:

How Can Cookiebot CMP Support GDPR Compliance on WordPress?

Some consent problems can be fixed directly in WordPress, such as removing an unused tracker or changing how a plugin is configured. But managing consent across the website involves more than individual fixes. You also need to know which trackers are present. You must block those that require consent. You must also respond to the choices visitors make, and keep a record of those choices.

Cookiebot by Usercentrics is a consent management platform (CMP) that can help manage this process. Its WordPress plugin connects your website to Cookiebot CMP. There, you can scan for cookies and trackers, manage your consent banner, and keep records of visitor consent.

Cookiebot CMP can also automatically block cookies and trackers that require consent until a visitor has agreed to them. As visitors make their choices, the website can respond to the categories they accept or reject, while giving them the option to return and change those preferences later.

Regular website scans help keep the setup current by identifying cookies and trackers as they’re added to the site. You should still retest after changes to plugins, caching, or script settings that could affect how trackers load.