Disable Comment Cookies in WordPress for Better GDPR ComplianceWordPress sets some cookies which are not strictly necessary. Here is how to disable comment cookies for better GDPR compliance.
The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union to protect personal data and the privacy of individuals, ensuring data subjects' rights and imposing strict rules on data handling and protection by organizations. It came into effect on May 25, 2018.
Earlier in 2012, the European Union introduced a directive requiring that websites obtain permission to set all 'non-essential' cookies. In the UK, the details are provided by the ICO, which states that sites that set cookies that are not strictly necessary for the site's operation must ask permission from the user.
WordPress, by default, stores cookies on two occasions:
WordPress sets a cookie upon user login, which is essential for users to allow access to the administration system and falls into the strictly necessary bucket. A simple message on the login page stating, "By logging into this site, you agree to cookies being stored on your computer" will suffice.
The other cookie is used to store the name and e-mail address of people leaving comments and is more of a convenience rather than a necessity. You could add a message similar to the one above to the comments form, or if you prefer, you can disable these cookies from being set altogether.
Since WordPress 3.4, there has been a hook that you can use to set comment cookies. This hook is called set_comment_cookies, and you can turn off comment cookies by simply removing actions from it.
In your themes functions.php (or you can create a WordPress plugin) with this code:
remove_action( 'set_comment_cookies', 'wp_set_comment_cookies' ); Earlier versions of WordPress should be upgraded, but if this is not possible, you have to edit one of the core files to turn off cookies. Be careful when modifying core files, as they can often break your site if not done correctly, and any changes you make will be overwritten when you upgrade to a newer version.
In comments-post.php towards the bottom, you will find a code block like this:
if ( !$user->ID ) {
$comment_cookie_lifetime = apply_filters('comment_cookie_lifetime', 30000000);
setcookie('comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN);
setcookie('comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN);
setcookie('comment_author_url_' . COOKIEHASH, esc_url($comment->comment_author_url), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN);
} Comment this out to turn off cookies.
