Protecting User Privacy on Your WordPress Site

Privacy-Focused Alternatives

• Matomo (self-hosted analytics)
• Plausible Analytics
• Fathom Analytics
• Simple Analytics

Data Retention

Automatic Data Cleanup

// Schedule data cleanup
add_action('wpfs_daily_cleanup', function() {
    global $wpdb;

    // Delete old form submissions (90 days)
    $wpdb->query(
        "DELETE FROM {$wpdb->prefix}contact_submissions
         WHERE created_at < DATE_SUB(NOW(), INTERVAL 90 DAY)"
    );

    // Anonymize old comment IPs (30 days)
    $wpdb->query(
        "UPDATE {$wpdb->comments}
         SET comment_author_IP = '0.0.0.0'
         WHERE comment_date < DATE_SUB(NOW(), INTERVAL 30 DAY)
         AND comment_author_IP != '0.0.0.0'"
    );
});

// Schedule the cleanup
if (!wp_next_scheduled('wpfs_daily_cleanup')) {
    wp_schedule_event(time(), 'daily', 'wpfs_daily_cleanup');
}

User Data Rights

Data Export

// Add custom data to WordPress export
add_filter('wp_privacy_personal_data_exporters', function($exporters) {
    $exporters['my-plugin'] = array(
        'exporter_friendly_name' => 'My Plugin Data',
        'callback' => 'export_my_plugin_data'
    );
    return $exporters;
});

function export_my_plugin_data($email_address, $page = 1) {
    $user = get_user_by('email', $email_address);
    $data = array();

    if ($user) {
        // Get user's custom data
        $custom_data = get_user_meta($user->ID, 'my_plugin_data', true);
        if ($custom_data) {
            $data[] = array(
                'group_id' => 'my-plugin',
                'group_label' => 'My Plugin Data',
                'item_id' => 'user-' . $user->ID,
                'data' => array(
                    array('name' => 'Custom Field', 'value' => $custom_data)
                )
            );
        }
    }

    return array('data' => $data, 'done' => true);
}

Data Erasure

// Add custom data to WordPress eraser
add_filter('wp_privacy_personal_data_erasers', function($erasers) {
    $erasers['my-plugin'] = array(
        'eraser_friendly_name' => 'My Plugin Data',
        'callback' => 'erase_my_plugin_data'
    );
    return $erasers;
});

function erase_my_plugin_data($email_address, $page = 1) {
    $user = get_user_by('email', $email_address);
    $items_removed = 0;

    if ($user) {
        delete_user_meta($user->ID, 'my_plugin_data');
        $items_removed = 1;
    }

    return array(
        'items_removed' => $items_removed,
        'items_retained' => 0,
        'messages' => array(),
        'done' => true
    );
}

Third-Party Services

Audit External Services

• Review privacy policies of all services
• Document what data is shared
• Ensure adequate privacy protections
• Use data processing agreements

Privacy Policy Requirements

• What data you collect
• Why you collect it
• How long you keep it
• Who you share it with
• User rights and how to exercise them
• Contact information

Conclusion

Protecting user privacy requires data minimization, proper consent, and respecting user rights. Implement privacy by design and maintain transparency about your data practices.