WordPress Adds Privacy Tools

A maintenance release with a purpose

WordPress 4.9.6 came out today. It is a minor release, the kind most sites install automatically within a day or so, and it arrives eight days before Europe's new privacy rules apply.

Most of it concerns privacy. It adds a helper for writing a privacy policy, tools for handling requests from people who want a copy of their data or want it removed, and a new checkbox on comment forms.

The tools are genuinely useful. They are also easy to mistake for more than they are, so it is worth knowing exactly what each one does.

What arrives with 4.9.6

• A privacy settings page for choosing or creating a privacy policy page.
• A policy guide with suggested wording from WordPress, the theme and plugins.
• An export tool that gathers one person's data into a downloadable file.
• An erasure tool that removes or anonymises one person's data.
• A comment checkbox asking whether to remember the commenter's details.

The fifth is the one most often misread. It asks logged-out commenters whether their name, email and website should be saved in a cookie for next time. It is not consent to collect the comment itself.

The privacy policy helper

Under Settings, a new Privacy screen lets you pick an existing page as the privacy policy or create a new draft from a template.

A linked guide offers suggested text: what WordPress itself collects through comments, cookies and embedded content, plus whatever the theme and plugins choose to add.

It is a starting point, not a policy. The template cannot know that your contact form emails three people, that your newsletter lives with another company, or that bookings sit in a separate system.

Somebody has to write those parts, and they are usually the parts that matter most.

Where a plugin has added its own suggested text to the guide, read it. It is a useful summary of what that plugin collects.

Export and erase, on request

Under Tools, two new screens handle requests. You enter the person's email address or username, and WordPress emails them a link to confirm the request is genuine.

Once confirmed, the export produces a zip file containing a readable report of what WordPress holds about that person. The erasure removes or anonymises the same data, turning a comment's author into an anonymous one, for example.

Both cover data WordPress stores itself, such as comments, and data held by any plugin updated to join in. Plugins that store information and have not yet added support are invisible to both tools.

What the tools cannot see

Most of the personal information a small business holds never sits in WordPress at all.

Contact form messages land in somebody's inbox. Newsletter subscribers live with the email service. Bookings, invoices and customer notes sit in other systems, and visitor data sits in Analytics.

Copies sit in backups, and in the tables of form plugins that have not yet added support. An export showing almost nothing does not mean the business holds almost nothing.

A worked example

A go-kart track takes registrations for its summer racing league through a form on its WordPress site. It also has a blog with comments, a newsletter sent through an email service and a separate booking system for group events.

Run against a regular racer's email address, the new export tool finds what WordPress holds: a few blog comments. That is all it can see.

The league registrations sit in the form plugin's own tables, out of the tool's reach until that plugin is updated.

The confirmation emails sit in the track's inbox, the subscription with the email service, and the group bookings in the booking system.

So the track's web company listed every place a racer's details go, and who can reach each one. That list sits beside the draft privacy policy, and it is what the track will work from when a request arrives.

The tools handle one part of a request well. The list handles the rest.

Who handles a request

The tools do not decide anything. Somebody still has to notice a request, run the right screen and deal with everything WordPress cannot see.

Name that person now, and decide where requests arrive: a privacy address on the policy page, or the ordinary contact form. Requests that land in a general inbox tend to wait.

Time matters. European rules expect an answer within a month, and Canadian privacy law sets a similar limit for requests to see personal information.

The comment checkbox in practice

The new checkbox appears on comment forms built the standard WordPress way. Themes with their own custom comment forms may not show it until they are updated.

If your site has comments switched on, leave a test comment while logged out after the update and see what appears. If comments are off, as they are on many business sites, nothing changes.

Installing it

Minor releases install themselves on most WordPress sites, unless automatic updates have been switched off. Check the version number at the bottom of the dashboard over the next few days.

A site still showing 4.9.3 has not updated itself since February, because that release contained a bug that stopped automatic updates. It needs updating by hand.

As with any update, take a backup first, and send a test message through the contact form afterwards.

The counter-case

On many small business sites, the new tools will find very little.

A site with no comments, no customer accounts and a form that only sends email holds almost nothing in WordPress itself.

For that site the update is still worth installing, for its fixes and the policy guide, but the export tool will mostly come back empty.

None of the tools makes a site compliant with anything on its own. Use them for what they do well, and have whoever maintains the site map where the rest of your data goes.

After the update

1. Confirm the site is on 4.9.6.
2. Open Settings, then Privacy.
3. Read the suggested wording in the guide.
4. List every place customer data goes.
5. Edit the policy to match that list.
6. Test the export tool on your own address.
7. Check the comment form while logged out.

Step four is the one the tools cannot do for you. A privacy policy and a request process are only as accurate as the list of places personal information actually goes.

The last WordPress change that added a safeguard to the dashboard is covered in WordPress 4.9 and the code editor warning.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.