WordPress PIPEDA Compliance: Privacy Settings for Canadian Websites

WordPress powers a large share of websites on the internet, including many Canadian business websites. Whether you're running a simple blog, a WooCommerce store, or a membership site, PIPEDA applies to personal information collected through your WordPress site. Here's how to configure your WordPress site for Canadian privacy compliance.

Last updated: April 2026

What Personal Information Does Your WordPress Site Collect?

Before configuring anything, understand what your site currently collects:

WordPress Feature	Personal Information Collected
Contact Form 7 / WPForms	Name, email, phone, message content
Comments section	Name, email, website, IP address, comment text
WooCommerce	Name, address, email, phone, payment information, order history
Membership plugins (MemberPress, Restrict Content Pro)	Email, password, subscription details
Google Analytics / Google Tag Manager	IP address, browser data, session behaviour, geographic location
Newsletter plugins (Mailchimp, Klaviyo)	Email address, subscription preferences
Lead generation forms	Whatever fields are included
WordPress user registration	Username, email, IP address
Akismet (spam filtering)	Comment data, IP address

Built-In WordPress Privacy Features

WordPress Privacy Policy Page

WordPress includes a built-in privacy policy generator (since WordPress 4.9.6):

1. Go to Settings → Privacy
2. Create a new privacy policy page using the template
3. Customize it to reflect your specific data practices
4. Link it in your footer and at every data collection point

The default template covers common WordPress data practices but needs customization. Specifically update:

• Your business name and contact information
• What data you actually collect (remove sections for features you don't use)
• Third-party service descriptions (Google Analytics, your contact form service, etc.)
• Data retention periods
• How to exercise access and deletion rights

WordPress Comment Moderation

WordPress comments collect personal information. Settings:

• Settings → Discussion: Configure comment moderation
• Consider disabling comments if they're not essential to your site
• If comments are enabled, the commenter must be informed that their name, email, and IP are collected

Cookie Consent for Canadian Websites

Canadian websites technically need to comply with PIPEDA requirements for cookie consent, though the requirement is less prescriptive than GDPR's.

Under PIPEDA:

• Cookies that collect identifiable personal information (like analytics cookies tied to identifiable users) require consent
• The OPC has taken the position that information involved in online tracking and targeting for behavioural advertising will generally constitute personal information (OPC guidelines on online behavioural advertising)

Practical approach for Canadian sites:

For sites targeting only Canadian users, a cookie notice explaining what cookies are used (without necessarily requiring active opt-in for all non-essential cookies) may be acceptable under PIPEDA. However, given the uncertainty, most businesses opt for a more GDPR-like approach.

Recommended: Use a cookie consent management plugin:

• CookieYes — GDPR + PIPEDA language options
• Complianz — Designed specifically for WordPress, with Canadian law options
• WP Cookie Consent — Simple, lightweight option
• Cookiebot — Enterprise option with detailed scanning

Configure your CMP to:

• Scan your site for cookies automatically
• Categorise cookies (necessary, analytics, marketing)
• Provide users with the ability to accept/reject non-essential cookies
• Record consent with timestamps

Google Analytics and PIPEDA

Google Analytics (GA4) collects IP addresses and behavioural data. For Canadian PIPEDA compliance:

1. Enable IP anonymization in GA4:

   • In GA4, go to Admin → Data Streams → Your stream → Configure tag settings → Redact data
   • Or use the anonymize_ip parameter in your gtag implementation

2. Disclose Google Analytics in your privacy policy — explain that you use GA to collect analytics data and link to Google's privacy policy

3. Data retention settings: In GA4, go to Admin → Data Settings → Data Retention and set the minimum retention period appropriate to your needs

4. If using Google Tag Manager: Every tag you fire through GTM that collects personal information requires the same disclosure. Audit your GTM container for all active tags.

Contact Forms: PIPEDA Compliance

Most WordPress sites use Contact Form 7 or WPForms. For PIPEDA compliance:

Add a Privacy Notice to Your Form

Add text near the form explaining what data is collected and why:

"By submitting this form, you agree to have your contact information used to respond to your inquiry. We won't add you to marketing lists without your separate consent. Privacy Policy"

Configure Form Data Retention

• Contact Form 7: By default, CF7 doesn't store form submissions. If you've enabled the Flamingo plugin (which stores submissions), configure a retention policy and periodically delete old submissions.
• WPForms: Has entry management with the ability to delete entries. Set a process to regularly review and delete old form submissions.

Marketing Consent Checkbox

If you want to add people from contact forms to your email list, add an unchecked checkbox:

"□ I'd like to receive marketing emails about [your products/services]."

Never pre-check this box. Only add people to your email list who explicitly check it.

WooCommerce PIPEDA Compliance

For Canadian e-commerce stores:

Privacy Policy at Checkout

1. Go to WooCommerce → Settings → Advanced → Account & Privacy
2. Link your privacy policy page in the checkout privacy field
3. Enable: "When creating an account, send the new user a link to set their password" for transparency

Data Retention Settings

WooCommerce has built-in data retention settings:

• Go to WooCommerce → Settings → Advanced → Account & Privacy
• Set "Personal data retention" periods for inactive accounts, pending orders, cancelled/refunded orders
• Enable "Allow personal data removal" to let customers request data deletion

Guest Checkout Data

Guest checkout data (order details, shipping addresses) is personal information. Under PIPEDA, you must retain only as long as needed for the transaction + tax/legal purposes (the Income Tax Act generally requires business records to be kept for six years from the end of the last tax year they relate to — s. 230(4)). Configure WooCommerce to automatically purge old guest checkout data after your retention period.

Essential WordPress Privacy Plugins

Plugin	Purpose
Complianz Privacy Suite	Full cookie consent + privacy policy management
WP Cerber Security	Security hardening to protect collected data
Wordfence	Firewall and malware scanning (security safeguard requirement)
WP Mail SMTP	Secure form email delivery
Redirection	Handle privacy policy URL changes

Security as a PIPEDA Safeguard

PIPEDA Principle 7 (Safeguards) requires appropriate security for personal information. WordPress security basics:

• Keep WordPress, themes, and plugins updated — outdated plugins are a common WordPress attack vector
• Use a security plugin (Wordfence or Sucuri)
• Enforce strong admin passwords and 2FA on all admin accounts
• Use an SSL certificate (HTTPS) — required for any site collecting personal information
• Regular backups with an offsite backup solution (UpdraftPlus, BackupBuddy)
• Limit login attempts to block brute force attacks
• Use a reputable hosting provider — don't use shared hosting for sites with significant personal data

Your WordPress PIPEDA Compliance Checklist

• Create and publish a privacy policy (using WordPress's built-in tool + customization)
• Install and configure a cookie consent plugin
• Configure Google Analytics IP anonymization
• Add privacy notice to contact forms
• Configure WooCommerce data retention settings (if applicable)
• Add marketing consent checkbox to all newsletter sign-up forms
• Install and configure a security plugin
• Enable HTTPS (SSL certificate)
• Set up regular automated backups
• Review and update plugin list — remove unused plugins that may collect data

Frequently Asked Questions

Q: My WordPress site is just a blog with no forms. Does PIPEDA still apply? A: If your blog has Google Analytics, Disqus comments, or any plugin that collects user data, PIPEDA applies. Even server access logs can constitute personal information collection in certain contexts.

Q: We use Elementor's built-in form. Does this need a privacy notice? A: Yes — any form collecting personal information requires a privacy disclosure. Add it as text in the Elementor form widget.

Q: What about Facebook Pixel and other marketing trackers? A: Facebook Pixel collects personal information for advertising purposes. Under PIPEDA, this should be disclosed in your privacy policy and covered in your cookie consent setup. For GDPR-standard compliance (appropriate if you have European visitors), active consent for Facebook Pixel is required.

---

Privacy Compliance for Canadian WordPress Sites

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — Canadian compliance that connects with your website.

Related reading: Google Analytics PIPEDA Compliance | PIPEDA Compliance Guide | Shopify PIPEDA Compliance