There is also a German version of this post that offers more interesting reads about DSGVO.<\/a><\/p>\n If you are a blogger based in the EU you have probably heard about General Data Protection Regulation<\/em><\/span> (GDPR), which becomes effective in about one month, on 25 May 2018. It aims to better protect the data of website users in the EU and thus is a very important thing to notice for you as a blogger and website admin.<\/p>\n You may also have heard that the rules are strict and the fines and penalties are high – but the first and most important things to remember is: Don’t panic!<\/strong> You have another month to read through it carefully and think about how your blog saves the data of your visitors and make it GDPR compliant.<\/p>\n In this post I want to show you which actions we have taken, where the problems lie and what the GDPR means for bloggers on WordPress. The checklist below shows you everything we have done so far or plan to do and hopefully helps you to figure out GDPR for yourself.<\/p>\n Important notice: We are no lawyers or data protection specialists and therefor cannot be made liable for anything. This post is no legal advice.<\/strong><\/p>\n <\/p>\n 1. Check where and how your blog collects data from your visitors (e.g. through contact forms, member areas with login forms, newsletter subscriptions etc.). <\/p>\n This is our current checklist for GDPR on our WordPress sites and blogs. We will be updating it regulary as some things are not set yet and need further information, e.g. from WordPress.<\/p>\n If there is a small green lock and a “https” in front of your blog’s url in the browser, then you are already using a SSL encrypted connection to and from your blog. If this is not the case you should take action and add the encryption, e.g. with a free Let’s Encrypt certificate. We have written a whole post about how to establish a secure SSL encryption for your WordPress website<\/a>. The GDPR actually doesn’t force the encryption, but if you send all the data in plain, unencrypted mode the following points won’t make that much sense.<\/p>\n One of the most important points regarding GDPR is the update of your privacy policy. It should state which data you collect on your blog, what for and also which third party services you use that save data of your users. There are several generators out there…. To secure yourself you should set the privacy policy page to ‘no index’ – so it can’t be found autmatically over search engines. This tutorial shows how to set ‘no index’ meta tags in WordPress<\/a>.<\/p>\n If you are hosting your WordPress site on a shared or managed hosting, it’s likely that your hoster will log personal data of your users (mostly the IP address). Therefor you need to sign a data processing agreement (DPA) with them. If you are unsure where to find those, contact your provider directly and ask for their DPA.<\/p>\n Whether you’ve embedded a contact form on your blog or a comment box (which you most likely have as a blogger), you always have to ask for the consent of your users or at least add a disclaimer before processing and saving the data they entered. Hopefully, WordPress will come up with a solution by May 25, but until then you can use the GDPR Framework plugin which will allow you to add checkboxes to your comment form and all contact forms.<\/p>\n If you send a newsletter with Mailchimp and collect email addresses and other data from your users, you not only have to put that into your privavy policy, but also with each newsletter subscription form. We have added this page<\/a> where we tell our readers what they can expect from subscribing to our newsletter, how often it is sent and which data is collected from them. Google Analytics and user tracking in general ist important for many bloggers to get information about their traffic and user behaviour. The good news: Google Analytics can be used in compliance with GDPR, there are just a few steps you will have to take. Most modern websites and WordPress blogs don’t come without webfonts and many not without Google fonts. The problem with them is that they have to be loaded from Google’s servers each time someone opens your blogs – and their IP is sent over during this process. The same goes for loading the small avatar images next to your reader’s comments and WP emojis. They have to be loaded from WordPress’ servers in the US each time and send IP from your users addresses over. If you want to disable them, you can do that for Gravatars at Settings > Discussion > don’t tick ‘Show Avatars’, and for WP Emojis as shown here<\/a>.<\/p>\n To protect your blog from spam comments you should use a special antispam plugin. The very popular Akismet which comes with every WordPress installation, is not compliant with GDPR and shouldn’t be used. Thankfully there is another plugin called Antispam Bee<\/a>, a very good alternative that we are using since many years. It filters spam comments very efficiently and offers a lot of options. <\/p>\n <\/p>\n Pin this for later:<\/strong><\/p>\nThe 3 steps to GDPR compliance<\/h2>\n
\n2. Put all of that into a spreadsheet and check if it is really necessary to collect this data. If not, you can remove the things that you don’t need.
\n3. Otherwise go through the list and check how to make the remaining things compliant with the GDPR rules. Below you can find many examples of services that we use and how to encounter them.<\/p>\nGDPR Checklist for WordPress Blogs<\/h2>\n
SSL Encryption<\/h3>\n
Update your Privacy Policy<\/h3>\n
\nIt is important that the privacy policy page is always visible and easy to find (it should be reachable in two clicks or less). This also means that there must not be a cookie bar hiding the link (check the mobile view, too). It’s best to put the link into the top menu or the footer.<\/p>\nDPA with your hosting provider<\/h3>\n
Forms (Contact, Comments, Newsletter & Co.)<\/h3>\n
Newsletter (Mailchimp)<\/h3>\n
\nIn addition to that you will aldo need to sign a DPA<\/a> with Mailchimp.<\/p>\nGoogle Analytics<\/h3>\n
\nYou have to state the use of GA on your blog in your privacy policy and add apossibility to opt-out. You can use the plugin GA Opt-Out<\/a> to realise that.
\nFurthermore you have to anonymize the tarcked IP addresses. If you use a plugin for embedding the GA code (e.g. Monster Insights), you can find that iption in their settings. If you chose to manually add the code to your blog, Google shows you how to anonymize IPs<\/a>.<\/p>\nGoogle Fonts<\/h3>\n
\nThe better solution is to host your fonts on your own webspace. You can use the plugin Use Any Font<\/a> for doing this. If your theme implements Google fonts and there is no way to deactivate them, you should reach out to the theme support or try the plugin Remove Google Fonts References<\/a>.<\/p>\nGravatar & WP Emojis<\/h3>\n
Antispam Plugin<\/h3>\n
\nImportant: You have to make sure that “Use a public antispam database” and “Allow comments only in certain language” (in the plugin settings) are NOT ticked.<\/p>\nYour GDPR Action Plan:<\/h2>\n
\n