If your WordPress site is reachable from the EU — which, unless you're actively geo-blocking it, it is — GDPR applies to it. That's true regardless of where your business is registered or where your server sits. A default WordPress install, straight out of the box, is not compliant on its own. Contact forms, comment sections, analytics, even the default login system all touch personal data in ways GDPR has specific rules about.
Most site owners know GDPR exists and know it's "something about cookies." That's the smallest part of it. Here's what actually matters.
Cookie Consent Is the Visible Tip
The cookie banner is the part everyone notices, but a technically correct one is stricter than most sites implement: no non-essential cookie — analytics included — may load before the visitor actively consents, "reject" has to be as easy to click as "accept," and the choice has to be stored and respected on every subsequent visit. A banner that loads Google Analytics in the background regardless of what the visitor clicks is extremely common on WordPress sites, and it defeats the entire purpose.
Forms Collect Personal Data — and GDPR Has Opinions
Every contact form, newsletter signup, or comment field is a personal data collection point. GDPR requires a stated purpose for why that data is being collected, a defined retention period rather than storing submissions forever by default, and a real mechanism for someone to request their data be deleted. Plugin-based form builders vary enormously in how well they support this out of the box — some make it straightforward, others require manual configuration you have to know to look for.
Where Your Data Actually Lives
Hosting location and data processors matter more than most site owners realize. If your hosting provider, backup service, email plugin, or analytics tool stores data outside the EU without adequate safeguards, that's a compliance gap — regardless of how good your cookie banner looks. This extends to seemingly unrelated tools: a form plugin that routes submissions through a US-based API, a chat widget, an embedded video player that sets tracking cookies. Each one is a data processor you're responsible for vetting.
The Admin Side Nobody Thinks About
GDPR isn't only about visitor-facing features. It also expects reasonable technical measures to protect the personal data you're storing — which loops directly back into basic WordPress security. A site that gets hacked and leaks its customer database isn't just a security incident; under GDPR it's a reportable data breach, potentially with regulatory and financial consequences on top of the technical cleanup.
Where This Gets Genuinely Complicated
Full GDPR compliance touches legal areas — data processing agreements with third parties, lawful basis documentation, breach notification procedures — that go beyond what any technical fix alone can resolve, and this article isn't a substitute for legal advice specific to your business. What is squarely a technical responsibility is making sure your WordPress setup isn't quietly working against you: leaking data through misconfigured plugins, loading trackers before consent, or storing form submissions indefinitely with no retention policy at all.