When GDPR was implemented on the 25th of May in the year of 2018, people were in a panic. Most of them did not understand what to do to make their websites GDPR compliant. And a year has passed by and there are still websites that are not compliant with GDPR. It may not be easy to be fully compliant with GDPR, but it is important to take all the necessary steps towards compliance.
Even if you are not an EU citizen and your business is not based in the EU, you have to make your website comply with the law if you have an audience in the EU. Luckily for WordPress websites, there are a lot of plugins for GDPR compliance that can help get a head start with GDPR. But that’s not all. WordPress, as part of making its core software GDPR compliant, has brought in amazing features.
WordPress and GDPR Compliance
There are some additional features that WordPress has brought to make the core software GDPR compliant. The changes can be seen in WordPress version 4.9.6 and higher. For a simple WordPress website or blog, these features are enough to make the website comply with the EU Law. So, let’s take a look at the changes that WordPress has brought.
The Policy Generator
- The policy should detail all the data collection and processing in a simple and understandable language.
On the website footer:
Erase Personal Data and Export Personal Data
GDPR gives some rights to the users of the data that is collected, stored, and processed by the organizations. These are the following
- The right to be informed
- The right to object
- The right to restrict processing
- The right to data portability
- The right to be forgotten
- The right to access
- The right to rectification
- The rights in relation to automated decision making and profiling
In order for the users to be able to invoke the right, it would be convenient for both the users and the website owners to have a contact form on the website or contact information that the users can use to do invoke their right. After that, you, the admin of the website have received such a request, you can go to your WordPress dashboard, then go to Tools and then click on Erase personal data. As shown in the screenshot.
From the Erase personal data page, enter the ID of the user who has raised the request and hit Send request.
This will send an email to the user to confirm the request and after the user confirms the request, the admin can click on Erase data to erase all the personal data that has been stored in the WordPress website. The admin will also have the option to Force erase personal data from the website under requester name
Important Note: When the personal data of a user is deleted from a website, it does not include any archives files or backups of the website. So, when restoring the website from backups or archive files, the users delete request should be respected. Also, the data deleted are the one that has been collected by WordPress and participating plugins. You may have to take extra caution to delete the personal data and comply with the requests.
The Next part is the Export personal data menu. This is useful to address the right to access personal information of the user. Similar to erase personal data, when a user raises a request to get access to their personal data, the admin of the website can enter the ID of the user the corresponding field in Export Personal data page. After the request is sent, the request will be pending for confirmation as shown in the screenshot.
After which the user will get a confirmation email. When the user has confirmed the request, the admin can honor the request and the user will be sent a link using which they export their personal data that has been stored on the website.
The Comment Cookie Opt-in Checkbox
1 – session cookies
2 – comment cookies
The session cookies are what enables you to log in to the site and keep logged in. These cookies do not store any personally identifiable data.
The comment cookies are used when a user comments on a post. In this case, the data entered in the comment box, including name and email ID, which are personally identifiable data, are stored in these cookies. This data is used to auto-fill the data, the next time the user decides to post a comment on a post.
Sometime you might not be able to see the checkbox under the comment section. There are two reasons that the comment box will not appear under the comment section even if you have changed the settings so.
1 – You are checking if the box appears logged in as admin.
You need to check the website as a user to be able to check whether or not the checkbox is there. So log out or access your website from a private window and you will be able to see the checkbox.
2 – Your theme is not compatible with WordPress version 4.9.6, or there is something in the theme files that could be overriding the feature.
Now that you have an opt-in checkbox for comment cookies, these cookies will only be set if the commenter checks the checkbox, and submits the comment. If the checkbox is not checked, he/she will have to manually enter the details the next time he/she enters a comment. That’s all.
A Cookie Notice
Now the above is the case when there are no plugins installed, and there are no third-party services involved. Usually, the comment cookies are not the only cookies that need attention, are they? If there are plugins installed on a website and third-party cookies used, there is no escaping from the cookies.
So, in order to be compliant with GDPR, you need to display a cookie notice that shows up when the site loads. With GDPR you need to inform the users of the data collection at the point of data collection. Since most cookies are installed when at the time the site is loaded, and they can be sometimes crucial in the functioning of the website and you need prior consent from the user to be using them, you should display the cookie consent notice at the first load of the website to a user. Now, there are a lot of GDPR plugins that can help display a cookie notice bar on your WordPress website. Some of them are listed below.
- GDPR Cookie Consent
- GDPR Cookie Compliance
- WP GDPR Compliance
- Cookie Notice for GDPR
- EU Cookie Law (GDPR)
In this article, we will be using the GDPR Cookie Consent plugin to see how to display a cookie notification and get users’ consent for using them. First, activate and install the plugin on your WordPress website. Once activated, a cookie consent banner will be displayed on the front end of your website.
The default notification banner may not complement the theme of your website. So you will need to customize the banner according to your preferences. The plugin sure does provide a lot of customization options that can make the cookie banner look as though it is the part of your website. There are different layouts of the banner as well which you can choose from.
The next part is blocking the cookies prior to consent. Or in other words, only use the cookies when the user agreed to the usage of the cookies. GDPR together with ePrivacy Directive mandates that any non-necessary cookies of the website be used only if the user has agreed to use it. But in case of cookies that are absolutely essential for the website to function in a proper intended way, consent need not be taken.
So, you need to identify the cookies that are used by your website. You can either use your browser developer console or using any online tools like Cookiechecker, or CookieServe, etc. To find out what cookies are being used using your browser, all you need to do is go to the developer console and find the cookies being used from there. But in this case, it is important to check the cookies from an incognito window. This is because, when you use your regular browser, it must have cookies that have been installed from other websites as well. The following is a screenshot taken using the Chrome developer console.
Alternatively, you can use different online tools that help find out the cookies that they are using and most of the purpose of these cookies. The Cookie-checker will help you generate a report of the cookies being used on your website. This will require you to enter your email ID to your website and the report will be sent to your email ID after a while. In CookieServe, if you enter the URL of your website the tool will show instantly what cookies are being used on the entered URL and show the details of the cookies like the purpose and the duration of how long the cookies will be stored for.
After you have found out what cookies are being used on your website you have to find out what cookies are necessary for the functioning of the website and what cookies are not and which of them collect personally identifiable data from the visitors of the website. Now to block the third-party cookies of the website, what you need to do is remove the scripts from your website and add them to the non-necessary cookies section in the plugin. This will help the plugin to insert those scripts to the website only if the user of the website have given their explicit consent.
Complying with GDPR sure does seem like a daunting task, but it sure should not be. Especially when you understand its requirements, and have the right tools with you, it can easily be done.
Where Should We Send
Your WordPress Deals & Discounts?
Subscribe to Our Newsletter and Get Your First Deal Delivered Instant to Your Email Inbox.
Thank you for subscribing.
Something went wrong.