Are You Ready? GDPR for WordPress Based Online Course Membership Sites

Discover what GDPR is and how WordPress and LifterLMS are here to help you with compliance for your self-hosted online course membership site. Join Leo Postovoit and the LifterLMS team as they guide you through GDPR.

---

GDPR For WordPress Course And Membership Sites

This webinar breaks down what GDPR actually requires for WordPress-powered course and membership sites: what counts as personal data, the rights students now have over it, and the explicit consent rules that change how you collect email addresses and run remarketing. GDPR consultant Leo of XWP explains the law in plain language, then LifterLMS’s Thomas demos the WordPress core and LifterLMS tools built to handle student data export and erasure requests.

What You’ll Learn

• What GDPR defines as personal data, including data you collect without realizing it
• The difference between a data controller and a data processor, and why it matters for course sites using Stripe, PayPal, or MailChimp
• How to get explicit consent for opt-ins, chat widgets, and remarketing
• What WordPress core’s privacy tools do, and what LifterLMS adds on top for course and membership sites
• How to handle a student’s request to export or erase their data

Key Takeaways

• Write a privacy policy using the WordPress core Privacy Policy Guide and LifterLMS’s sample language, then have a lawyer review it
• Turn on explicit consent messaging on your enrollment, registration, and checkout forms
• Run a privacy impact assessment to find out what data you are actually collecting and why
• Decide whether to retain order and course progress data during a student erasure request under LifterLMS’s account settings
• Treat email addresses, IP addresses, and other identifiers with the same caution as a credit card number

Frequently Asked Questions

Full Webinar Transcript

Meet Leo And Why GDPR Became His Focus

Chris Badgett: Hello everyone, welcome to this webinar on GDPR for your WordPress powered online course and membership site. We’ve got a special guest, Leo, and we have Thomas from LifterLMS with us today. Leo, can you tell us a little bit about you, where you come from, and your relationship with GDPR before we get started?

Leo: Sure. My name is Leo, I work for a company called XWP. We’re a WordPress VIP agency, we solve problems at enterprise scale for WordPress companies, publishers, e-commerce sites, and all kinds of big, messy places. I’m also a co-organizer with Thomas for WordCamp Los Angeles 2018, which is coming up in just a few months. Most people have no idea what GDPR is or how it affects them, and even fewer understand how data privacy matters, especially here stateside in the United States. I realized a few months into learning about GDPR, back in October last year, that no one was really doing anything to get the word out, so I started doing a ton of research. I found out WordPress core had a couple of efforts underway, plus a few developers who’d launched their own GDPR plugins, all marching toward the May 25th deadline, which is this Friday.

The Trust Gap That Led To GDPR

Leo: I have to tell you to brace yourself, GDPR is coming in just a few days. My background is in journalism, media agencies, and education, and I’ve worked with WordPress for a long time. I organize WordCamp Los Angeles, WordCamp Orange County, and the LA WordPress Meetup group. My friend Brendan, out of Australia, also works at XWP and helped me put this presentation together. I’m a consumer of craft coffee and I’m not a lawyer, for the record.

This is my favorite chart of everything we’ll cover today, because it sets the pace. Back in 2016, 62 percent of people in France, and only 48 percent of Americans, thought companies were not being honest about their data use. That was before the Equifax breach, the Target breach, the Home Depot breach, and the Cambridge Analytica scandal. At that point about half of people believed companies were misusing their data, while only about a quarter of Europeans believed the United States was handling data correctly. The European Union looked at that gap and decided it was time to do something more elegant, more direct, and with more enforcement built in. That solution was the General Data Protection Regulation, or GDPR.

What GDPR Actually Changes About Data Privacy Law

Leo: GDPR is a new regulation, but it’s really an addendum and overhaul of data privacy laws that already existed. It isn’t wildly different, it’s a cleaner version of things that already existed, with more enforcement built in. If you’re already familiar with the ePrivacy Directive, the current cookie law, GDPR sits in addition to that, and the cookie law itself is going to be overhauled soon. GDPR goes into force just a couple of days from now, on Friday.

A Quick Primer On The Cookie Law

Chris Badgett: Would you mind giving a quick primer on what the cookie law is?

Leo: The cookie law requires you, and again I’m not a lawyer, to request consent before placing a cookie on a user’s browser. If you use that cookie in ways they wouldn’t necessarily expect, you have to tell them. Typically there’s a prompt that says something like “you agree to use this site,” and by clicking that button you give some data in exchange for some deeper service. That might power embed scripts, commenting, or real-time processing, and it could also cover analytics or advertising. Cookies tend to be a really important topic because they’re a specific version of information about a given user.

Why GDPR Matters Beyond Avoiding Fines

Leo: So what are we actually doing here? We want to do things better, we want users to trust us more, we want fewer vulnerabilities by default, and we want breaches to be less bad and less frequent. I look at GDPR as a major opportunity, industrywide, for businesses to reduce their data and legal exposure. At XWP we believe it’s an opportunity to help our agency clients navigate this, and I think LifterLMS believes it can help you navigate it too. But the reason I’m excited to be part of the community trying to solve this is that it’s an opportunity for all of us to do privacy better.

The very first thing you should take away is that you should be designing for privacy, architecturally and infrastructurally, from here on out. Privacy is a principle, not an end result, and if you’re designing for privacy you might as well design with ethics in mind too, since the two are closely related. My friend Morten Rand-Hendriksen, who works for LinkedIn Learning, recently wrote in Smashing Magazine that making ethics part of our design process helps us build the world we all want to live in. That’s why GDPR matters, and why we’re willing to move some data points, and maybe reduce some sales or conversions in the short term, for a better long-term trust with our users.

The Real Cost Of Non-Compliance

Leo: This is the number you’ll hear every time someone talks about GDPR, and I’m going to call it out even though I don’t think it’s actually the thing that matters most. It’s 4 percent of gross global revenue or 20 million euros, whichever is greater. That means if you have a really severe data breach involving data you weren’t supposed to be collecting or processing, and it directly impacts your users, you could face very serious punishment under the most extreme scenario. The first time I heard that number, I thought it was scary too. But in short, all this really means is: be a good data steward. We already know we’re not supposed to be collecting data carelessly. Here in the United States we’ve had multiple laws and Federal Trade Commission practices that require this anyway, so being a good data steward is something you should be doing regardless.

The One-Slide Summary Of GDPR

Leo: If you were to take away a single slide from this entire talk, or take a screenshot of one thing, this is it. Your too-long-didn’t-read version of GDPR, which is really about 200 pages and sounds super scary but really isn’t that bad: don’t get data without consent, don’t have data without consent, don’t give data to someone else without consent, don’t use data without consent, and don’t lose data, especially sensitive data. If you do lose it, tell people. That’s really all GDPR does, and it’s basically asking people to handle things the way they should already be handled.

What Counts As Personal Data

Leo: Personal data, in the broadest definition, is any information relating to an identified or identifiable natural person, what GDPR calls a data subject. An identifiable natural person is someone who can be identified directly or indirectly, whether through a name, an ID number, location data, an email address, a cookie, an IP address (which is new under GDPR), or any other online identifier, especially anything involving physical location, physiological data, genetic data, mental health data, or economic data. Even anonymized or pseudo-anonymized data can still count as personal data if it can be parsed back into something identifiable, like a unique cookie.

Sensitive Personal Data Categories

Leo: What’s really sensitive, and requires extra care, is racial or ethnic origin data, political opinions, religious or philosophical beliefs, trade union membership, health data, sex life or sexual orientation, and past or expunged criminal convictions.

How You Collect Sensitive Data Without Realizing It

Leo: Before we go further, I want to talk about indirect data collection, because people tend to think about this in the most direct sense. You might think, “I don’t collect religious data or biometric data, I just run events.” But sometimes this gets collected indirectly. If I ask Thomas what his T-shirt size is, I now have metrics on his biometric construction, which is technically a form of health data. If I ask Chris what his meal preference is, and whether he eats kosher, I might now have his religious or philosophical beliefs stored in my data set. It becomes harder to understand where the line is, which is exactly why I want to spend some time on processing, since this is the part most people have the hardest time understanding, and I think it’s genuinely the most interesting part of this conversation.

What Processing Personal Data Actually Means

Leo: So what is processing? I want to talk about personal data and the techniques it gets used with, some of which you’re probably already using beyond just your WordPress site. Things like direct business communication, CRMs, marketing tools that reach beyond your website, whether through Facebook or MailChimp, and remarketing tools through Google or Facebook, especially lookalike targeting and profiling. Personal data does all kinds of things, but you have responsibilities to remember as a website owner or admin. You collect and use data all day long, and you design interfaces to collect and interact with that data, sometimes indirectly, in ways you might not see as serious even when they are.

Your Responsibilities As A Data Collector

Leo: The one question you have to keep asking is: do you know what’s there? Do you know what’s in your database? I now advocate pretty heavily for doing a privacy impact assessment, which is a longer version of an audit. What we’re asking here is: have you found out, and have you reported internally, what’s actually on your website?

Personal data is good to collect in a lot of ways, it can make services more convenient. Targeted data helps you make friends, find old colleagues, or complete a purchase. But sometimes it’s also about influencing behavior, and that’s where advertisers, whether a company or a political group, might be influencing your behavior in ways you wouldn’t agree with. Think about upsells you don’t really want, or ratings you’re pressured into inflating. If you misuse data, or use it in subversive ways, you can end up changing users’ actual opinions, and losing track of what’s true about your own service.

How Personal Data Gets Used To Influence Behavior

Leo: My favorite quote in this conversation is from Napoleon Bonaparte: war is 90 percent information. Which brings me to a touchy subject, Cambridge Analytica.

The Cambridge Analytica Wake-Up Call

Leo: By the most recent count, 89 million Facebook users in the United States had their information compromised, including names, phone numbers, email addresses, activity, location history, and their entire network of connections. This is a complicated subject, and I was one of the people whose data was leaked, likely through my network, since I probably never opted into the original survey. That information went on to influence elections in Argentina, the United Kingdom, the Czech Republic, Kenya, India, Nigeria, and the 2016 United States election. It leads to an important recognition: personal data is sensitive, and there are real questions here around consent, use, and opting out.

Real Data Breaches That Changed The Conversation

Leo: Uber famously took about two years of back and forth before it stopped tracking users after they’d turned off tracking, and it was even tracking users who’d uninstalled the app entirely. Equifax leaked about half of United States credit reports last year. Every single person who’s ever had a Yahoo account has had their data breached, some of it very sensitive. Target’s credit card processing was compromised, as was Home Depot’s, in similar stories. Sony’s PlayStation Network had a major hack. The United States Office of Personnel Management leaked information on government employees, including spies, along with their personal information. It raises real questions about where we should be collecting information, how closely related different data points should be, and just how dangerous misused data can be.

Does GDPR Apply To Your Site

Chris Badgett: We’ve got a question about how this would affect a project doing remarketing.

Leo: I’m going to save my full answer for the explicit consent slide, but first I want to address the elephant in the room. The thing people have the hardest time grasping, especially here in the United States, is whether GDPR even applies to them. Any company collecting or processing the personal data of data subjects in the European Union has to be aware of extraterritoriality. It doesn’t matter where your company is located or the nationality of your users, they may still be subject to GDPR. If you’re in the “maybe” or “no” category, definitely talk to a lawyer. I’m not one, and I can’t give specific legal advice, but here’s what I’ve seen to be generally true: if you’re definitely in the EU, or you’re selling, targeting, or processing EU resident data, you need to understand your users’ rights. If you actively block EU traffic and avoid EU-based clients entirely, you might be able to skip GDPR, but that’s extremely challenging, and it also means cutting out about half of your potential customer pool, depending on your services.

How The EU Enforces GDPR Outside Europe

Chris Badgett: If there’s a law in the EU, how do they enforce that in the United States?

Leo: That’s a big, sticky question, and we don’t have a great answer yet, since jurisprudence hasn’t played out. Precedent will set policy moving forward, but the United States FTC and several EU member state agencies have bridged similar gaps in the past. Extraterritoriality is always in effect, which could mean issues with visas, shipping products across international lines, or the United States allowing the EU to bring you to court here. We don’t know exactly what that looks like under GDPR yet, but other versions of extraterritoriality already exist in American jurisprudence, and organizations like Interpol exist specifically to bridge gaps like this between countries. Regardless of enforcement mechanics, I believe it’s better to play by the rules because it’s the more ethical path.

When You Might Fall Into The GDPR Maybe Category

Leo: Depending on how far you scale, you might land in the “maybe” category. A lot of hobby sites and organizations fall here, the catchall example being an LMS site with European users. Are you collecting and processing data about them? Did you get their consent? If you write about the EU, or your services target the EU, like a travel site, this matters to you. There are also patchwork problems if you have employees in the EU. We don’t fully understand the scope and shape of all of this yet, but it’s best to take a risk-averse, conservative approach to data collection, and honestly you probably shouldn’t be collecting some of the data you’re collecting in the first place. Services like Google Analytics and MailChimp actually require you to understand how their data handling works, and if you violate their terms of service or don’t disclose things properly in your privacy policy, they could deny you access to your own data or simply remove it, since the processors themselves carry liability too.

The Rights Your Users Now Have

Leo: Users can now come to you and ask for a copy of everything collected about them, whether through analytics, remarketing, or anything else. That’s the right to portability. They have the right to rectification, so if you’re showing incorrect data about them, they should be able to correct it or have a clear process to request a correction. They have the right to object, which is a big one, so if you have an EU client or someone doing remarketing, you have to let them say “I don’t want that processing to happen” and respect it. There’s also the right to know about profiling, which may not matter much in the LMS space specifically, but matters in the wider GDPR conversation. If you’re comparing someone’s data to other users’ data, you have to tell them they’re part of that comparison.

When Comparing User Data Becomes Profiling

Chris Badgett: Just a quick question, in LifterLMS analytics, if somebody’s looking at their progress against the average, is that an example of profiling by comparison?

Leo: Potentially, it’s sticky. Understanding that consent is generally the safer path will lead you through the right principles. Data becomes less sensitive when it’s anonymized and aggregated, but small data sets carry a higher sensitivity, which can create real challenges.

Why Small Data Sets Are More Sensitive

Leo: If you’re polling international data and you only have three users in the UK or four in Paris, your analytics might accidentally reveal exactly who those users are. It’s genuinely hard to map out every way data might become risky, so I recommend treating most of your data with extreme sensitivity, the same way you’d treat a credit card number, a social security number, or a birth date. Treat email addresses and IP addresses the same way, with real caution.

The Right To Be Forgotten

Leo: My favorite right, and I look forward to seeing it play out because it’s going to be messy, is the right to be forgotten, sometimes called the right to erasure. A user can come to your site and say, “I no longer want my information in your systems, please remove everything about me across all your services.” That means you can’t keep the data, short of financial or legally required records, once they ask. You need to understand what this actually means for your systems, while staying compliant with other obligations like accounting or tax requirements.

When You Need A Data Protection Officer

Leo: This probably doesn’t apply to most of you, but I’m calling it out since it’s part of the conversation. If you process large volumes of different kinds of data, you may need to hire a Data Protection Officer. Most of you tuning in today probably don’t need one, which is fortunately the easiest item on this list to skip.

Getting Explicit Consent Right

Leo: On to the fun one: explicit consent. Someone asked earlier about remarketing, and here’s my answer. Ask for consent as much as you can, and explicit consent specifically means you can’t use a pre-checked box, you need an unambiguous, specific, affirmative action. That’s a direct quote from Article 4, paragraph 11, and Recital 32 of GDPR, which basically means you want people clicking twice to say yes. If remarketing is critical to your business, understand that your numbers may drop with European clients unless you have that explicit consent documented in your privacy policy. Revoking consent needs to be just as easy as giving it, so you need a clear place for people to do that.

Why You Can’t Repurpose Data You Already Collected

Leo: You have to define the scope of the data you collect, because you can’t misuse it or give it away outside that scope. A common bad practice with tools like MailChimp: you can no longer sell an email list, or reuse data for a campaign that goes beyond what you originally told people you were collecting it for. Users should have a clear understanding of what their data is actually used for.

What To Do If You’re Already Holding Data Without Consent

Leo: For most of you who already have European users in your data set, you might have GDPR obligations kick in on data you already collected. Depending on how it was originally consented to, you may be able to keep it, or you may be required to remove it, generally within a few days of finding out. If you’re holding on to data you weren’t supposed to have, or it wasn’t properly consented, you may already technically be in breach of GDPR.

Your 72 Hour Breach Notification Window

Leo: Another major responsibility: plan for breaches. You have 72 hours to report a breach to data protection authorities, and you have to notify affected users without undue delay about what was leaked, exposed, or lost. It’s a hard reality, but you should have policies and procedures in place well ahead of time, so you have an umbrella ready before it rains.

New Categories Of Personal Data Under GDPR

Leo: IP addresses and mobile device IDs are now explicitly considered personal data. Geolocation data matters, as does sensitive personal data like health, race, religion, political orientation, and biometric data such as fingerprints, iris scans, or genetic data. If you’re running an LMS site you’re probably not collecting most of this, but it’s still worth knowing. All we’re really asking is that you be a good steward of your data, know where it lives, and understand what’s actually there, or you might get a visit from lawyers.

Data Controllers Versus Data Processors

Chris Badgett: Could you talk through the controller and processor distinction, and our responsibilities? In WordPress there are lots of plugins and integrations, so a course creator uses LifterLMS to power their school, but also integrates best-in-class tools like Stripe for payments.

Leo: The most important thing is understanding, and asking questions. Read the fine print, and have an agreement with anyone you give data to or process data with. If you use Stripe or PayPal, they already have these agreements available. If you use MailChimp, you can generate one right in the panel. If you don’t do that, you’re in real legal trouble here in the US and in Europe. A controller tends to be the origin of the data, and the processor is the third party working with it on the controller’s behalf.

Chris Badgett: So Stripe would be the processor, and my LMS website is the controller?

Leo: Correct. Depending on your services, you’ll have other examples too, Facebook, Google Analytics, and possibly YouTube if you’re using embeds. We don’t actually know yet how embeds are going to look in a few weeks, since a strict reading of GDPR means auto-embeds might require a consent click before a YouTube video preloads. I haven’t seen a single site take that conservative an approach yet, but the law is clear that you need to be cautious about data leaving your site through third parties like that, including telemetry data that plugins and WordPress core itself might collect. You’re likely a data controller if you run your own site, and a data processor if you’re working with someone else’s data, but either way you’re equally liable under the law.

Getting Consent Right In Chat Widgets And Comment Forms

Chris Badgett: In a similar vein, we have a question from Tim about chat widgets on websites, where somebody types a question and maybe drops in their email.

Leo: I’d build in explicit consent right at the start of that conversation. Say something like “by clicking yes, I agree to share my location and email,” and explain what the data exchange actually looks like. There was a fun example I saw this morning around blog comments. A site currently reads “notify me of new posts via email” next to the comment checkbox. A more GDPR-appropriate version would be “I consent to having this website store my information so that I can be notified of replies.” You define the scope of what you’re collecting, manage when consent was given, and let people unsubscribe at any moment.

Why GDPR Applies To Everyone On Your Team

Leo: GDPR applies to everyone in your company, everyone touching the website. You, Thomas, Kathy, all of you, matter here, and you have to think about how you manage data day to day, because you’re going to be dealing with this information regularly. If data ends up in the wrong place, or you’re not thinking about it in a risk-averse way, you’ll create exposure. Risk is something we all have to manage together.

Where To Start If You Feel Overwhelmed By GDPR

Chris Badgett: There’s a sense of overwhelm, feeling like there’s so much to do and everyone’s already behind. For a course creator, where’s the best place to start? Opt-in forms? Enrollment and checkout?

Leo: Get your privacy policy, SSL, and your data agreements sorted quickly. If you don’t have a clear way to manage consent with your European users, you’re opening yourself up to exposure you may not have realized you had. If you can’t solve it by Friday, in some cases that might mean pausing registration briefly while you sort out consent issues. But there’s also a reality check here: the vast majority of sites on the internet will not be GDPR compliant by Friday. Fortune 500 companies have spent a million dollars or more each to get compliant, and a lot of publishers have spent six or seven figures too. Focus on your biggest vulnerabilities: privacy policy, explicit consent, and data agreements matter most, and you’ll keep refining the rest over time.

The Reality Check On Friday’s Deadline

Chris Badgett: Someone also asked about the browser plugins you recommended earlier.

Leo: Ghostery is great, so is Privacy Badger, made by the Electronic Frontier Foundation, and Cookie AutoDelete. I’ve got screen shares if folks want to see what they look like.

Browser Tools That Show You What Data Sites Collect

Leo: Ghostery gives you a full panel showing what trackers are running on a given site. Privacy Badger, from the EFF, asks the same question from a slightly different, more user-focused angle. Cookie AutoDelete stops your browser from keeping certain cookies at all, and you can set allow lists and deny lists to control what sites can legally collect. If this matters to you as a user, or you want to understand what your own site is collecting, a tool like Ghostery can reveal that.

What To Tell Subscribers In Your Opt-In Forms

Chris Badgett: What’s your recommendation going forward for opt-in forms? A lot of course creators run a lead magnet or a free email mini-course to get to know their audience.

Leo: Set explicit consent as a real goal, with a required checkbox, and a second one if you need it. If you’re doing a gated download, a common lead-generation move in education, say clearly that you’ll also be emailing them again in the future about X, Y, and Z. Be above board, you don’t have to lie, and honestly lying is illegal under both US and European privacy law.

Will Small Companies Actually Get Sued

Chris Badgett: Tom’s asking about GDPR enforcement showing up at a small company’s door, when they might only have a couple of users in Europe. Won’t regulators go after the big fish first?

Leo: I believe this is mostly a problem for very large companies, the Facebooks, Apples, Googles, and Amazons of the world, where 4 percent of revenue is a genuinely enormous number. That said, if you have a serious data breach, you’re still liable under United States law too. You’re probably not a major target, but ethics is something we should all practice regardless of enforcement odds, the same way we want every building to be fire-safe, not just the stadium. Recognize where your exposure points are and mitigate the risk you actually have.

Can You Just Block EU Traffic Instead

Chris Badgett: Tim’s wondering, if his site isn’t intended for people outside the United States, does putting that in his terms of service solve the “I don’t need to worry about GDPR” question? I think some hosts, maybe WP Engine, can block traffic by country.

Leo: I actually posed this exact question in the GDPR compliance chat today. If you have server-side, low-level IP processing that’s lawfully consented to, because that’s simply how the technology has to work, it might be legal, if you’re specific about what your blocking actually does. But it’s very hard to do accurately, geo-IP tracking is still only about 97 to 98 percent successful, and you’ll run into VPN users and managed networks with unusual DNS setups who sidestep it entirely. I believe trying to dodge GDPR and the ethics conversation is the wrong direction. It’s better to think seriously about data, consent, and mitigating your actual risk by collecting less to begin with.

Rethinking Email Lists After GDPR

Chris Badgett: Peter’s raised the idea that business models need to be redesigned, and that old list-building strategies aren’t the way forward, that treating customers with respect can actually be a big business advantage. Can you speak to the emotional side of that? There’s a lot of fear that our email list is our business, and now the list is going to be smaller.

Leo: The most extreme example I’ve seen in the wild is Manchester United. Their customer loyalty was so strong, and their risk was high enough, that they ran a full re-opt-in campaign, with their top players personally asking fans to sign back up, specifically to wipe out any data with questionable consent and start clean. That’s more extreme than most people need to go, but if people love your brand, you’d be surprised how much engagement you can rebuild. From a business perspective, a smaller list with higher engagement means higher success rates and less friction. If you’re holding data on people who haven’t clicked anything in a year, that’s just exposure at this point. Google Analytics, MailChimp, and Facebook all have tools now to help you remove people who’ve gone stale in your data set.

Choosing An Email Marketing Tool Under GDPR

Chris Badgett: Amy’s asking for an email list tool recommendation, since she’s just getting started.

Leo: I’m an ActiveCampaign user myself and I like what they’ve published around GDPR. I don’t have a way to play favorites, honestly, ActiveCampaign, MailChimp, and ConvertKit are all big names in the LifterLMS ecosystem, and there’s a newer one called MailerLite too. I do know MailChimp sponsors NPR, so I like them for that, and I think they’ve led on some genuinely smart email templates and have been fairly vocal about GDPR in the email space. That’s my first suggestion, though they do charge per subscriber, which gets expensive, though at that point you probably have plenty of subscribers to worry about.

What Happens To Serial Lawsuits And Email List Brokers

Chris Badgett: A couple of speculative questions from Tim: do you think there’ll be a wave of plaintiff’s attorneys filing serial lawsuits, and will this put email list brokers out of business?

Leo: We briefly touched on lookalike targeting for Facebook and Google Ads, and honestly those tools are only getting smarter, that’s where I’d put my money if I were investing. Email list brokers, the kind selling lists of real estate agents in Nevada or whatever, are frankly evil, and I hope they disappear. On serial lawsuits, that’s genuinely complicated, but the EU already has dozens of prepared lawsuits staged, and some of GDPR’s specific provisions, like the right to be forgotten, actually trace back to a Google AdWords case in Spain. Companies fight surprisingly hard to avoid being ethical here. My hope is that we get more of these companies to come around and build opt-in into what they do from the start.

Chris Badgett: Leo, I really want to thank you, this is the best presentation I’ve personally seen on GDPR, and thank you for bringing it to the LifterLMS community and answering our questions.

Why A Great Course Beats A Big Email List

Chris Badgett: As we shift into the LifterLMS side of things, one of our core driving philosophies has always been about your customer’s customer, meaning your student’s experience of taking your course, buying your course, and having their data treated with privacy and freedom. If we take care of your customer’s customer, everybody wins, and that’s been part of how we’ve approached LifterLMS from the beginning. GDPR just shines a light on that. I also want to speak to the fear and overwhelm in the room a bit. If we focus on building courses that actually work, that are engaging, and that create a real transformation, that’s the best marketing there is. Given a choice between a hundred-thousand-person email list with a 10 percent open rate, or a course where 90 percent of students get the result the course promises, I’ll take the great course every time. There’s a lot of fear and anxiety out there right now, but I think the world is changing, and having a great learning experience that gets real results matters more than having a huge list. Just make your course, membership, or training so good it can’t be ignored.

Touring The New WordPress Core Privacy Tools

Thomas: Thank you again, Leo, I’ll echo everything Chris said. I want to cover two things: what WordPress core has added, since there’s some things your plugins can do for you and some things they can’t, and then how LifterLMS integrates with those core functions. Last Thursday WordPress 4.9.6 was released, and shortly after that we released LifterLMS 3.18 to integrate with it. When you load 4.9.6 you’ll see a privacy notice pointing you to new tools under Tools, where you can export personal data and erase personal data, that’s the right to portability and the right to be forgotten Leo mentioned. Those are the two paths that let your students, or “users” in WordPress terms, get their data out of your database and into their hands, or have it removed from your site entirely so they’re no longer a student or user there.

The other piece lives under Settings, under a new Privacy menu item, which is really just an interface for creating a dedicated privacy policy page. One of the genuinely cool things WordPress core has done is give plugin developers, including us, WooCommerce, Gravity Forms, and Ninja Forms, a hook into an example privacy policy, so we can expose exactly what data we collect. We’re not your legal counsel, we’re only telling you what LifterLMS itself collects into your website, you still need a lawyer to finalize the actual language of your privacy policy.

Building Your Privacy Policy Page With LifterLMS

Thomas: If you don’t already have a privacy policy, you can create a new privacy policy page right from that Privacy settings screen, and it pre-fills with example data straight from WordPress core. Don’t hit publish on that yet, it’s an example, not a real policy, and you’ll still want legal review before it goes live. There’s also a privacy policy guide, which is how plugins like LifterLMS, WooCommerce, and WordPress core itself surface sample language about what data they collect and why. If you scroll down to the LifterLMS entry, you’ll see sample language about what LifterLMS gathers and what it does with it, which you can copy directly into your privacy policy page as a starting point. Some of it will show up highlighted, meaning you’ll want to delete or customize that part before publishing. Publishing the page doesn’t automatically place it anywhere on your site, you still need to add it to your footer or menu yourself.

Adding Explicit Consent To Enrollment And Checkout

Thomas: In previous versions of LifterLMS you could already add a terms and conditions page. Now, once you’ve created a privacy policy page through that WordPress interface, LifterLMS automatically pre-selects it, and in the spirit of the explicit consent Leo talked about, you can customize a message that displays anywhere LifterLMS collects data, on enrollment forms, registration forms, and checkout forms. Before we had a privacy policy set, a free-course checkout just showed a standard enrollment confirmation, with nothing about what we’re doing with the student’s data or why. After creating the privacy policy, that same checkout now shows a customizable privacy message with a link straight to the policy. One important caveat: LifterLMS doesn’t know what your other plugins are doing. The average site runs maybe 20 plugins, and any of them might be handling personal data in ways LifterLMS’s default language doesn’t cover, so you’ll need to adjust your language to match your actual setup.

If you also have a terms and conditions page selected, LifterLMS adds a required checkbox for that too, so students explicitly consent before enrolling. You can rename that page anything you want. You already had this terms and conditions checkbox before, but now you can freely customize its language, and the link to the page, without touching any code or templates, all from your settings.

How A Student Requests Their Data

Thomas: The bigger half of this is how you actually handle a right-to-portability or right-to-erasure request. WordPress hasn’t defined a required intake method, so realistically someone emails you, or submits a contact form, asking for their data. Let’s say a student named Justin emails asking for a copy of everything you have on him. As the admin, you’d go to Export Personal Data under Tools, submit a request using his email address, and WordPress creates a new data export request and emails Justin a confirmation link, so we know it’s actually him asking and not someone fishing for data with a random address. Once Justin confirms, the admin screen shows the request as confirmed, and you can email the compiled data straight to him with one click.

What’s Inside A LifterLMS Personal Data Export

Thomas: That export compiles everything your WordPress site knows about Justin: name, the custom fields he filled out through LifterLMS like first name, last name, address, email, city, state, zip, and phone number if you collect it, plus his course progress, certificates, achievements, quiz attempts, and purchases. Justin gets an email with a link to download the file, and the filename itself is deliberately obscured with random characters, security through obscurity, so nobody but Justin can guess the download URL. Downloading it gives you a zip file containing an HTML file you can open in any browser. The top section comes from WordPress core, and everything further down is gathered by LifterLMS. You’ll see things like the IP address we capture during checkout, order history if the student purchased anything, quiz results, and if you’re running the Social Learning add-on, a list of their social learning timeline posts and uploads too. For a full exhaustive list of everything LifterLMS exports, check the LifterLMS privacy documentation and getting-started guide.

How A Student’s Data Gets Erased

Thomas: The eraser screen looks nearly identical, just labeled “erase” instead of “export.” Submitting a request the same way sends the student a new confirmation email, and this part really matters: there’s no coming back from an erasure. You want to be sure it’s genuinely your student before you erase their data, because once it’s gone, it’s gone, short of restoring from a backup.

Do Backups Violate The Right To Be Forgotten

Thomas: That actually raises a question in my mind, Leo. How do we think about backups with regard to erasing personal data from a website?

Leo: That, my friend, is a hundred-thousand-dollar question. I’d genuinely never considered it before this moment. It’s a big deal for a lot of sites, for a variety of reasons, and there are a couple of angles worth thinking through, like whether you keep a log of data requests, whether exports or erasures, which you almost have to. Here’s the messiest version of the problem, and I don’t have a clean answer: say you’re upset with a company, you ask for a copy of all your data, they give it to you, then you ask them to erase it, and they do. Now you go to court claiming they mishandled your data, but they no longer have the copy needed to defend themselves. There are places where GDPR just doesn’t have clean answers yet, especially around backups, and I hope enforcement clarity gets there eventually, because nearly every host out there is trying to work through this because it genuinely matters.

Thomas: Tim asked an interesting related question: what about governmental requirements that continuing education contact info be stored forever?

Leo: Another example is tax rules around retaining order data. In higher education, disclosure laws often specify exactly how long you keep data and for what purpose, typically published in a catalog. I’d approach it the same way: define the parameters up front, say the data will be kept for this long, and removed after that point once someone unenrolls, and actually follow through on that. You don’t need to hold data forever just because you can.

Retaining Order And Course Data After An Eraser Request

Thomas: This is exactly where LifterLMS gives you some control. Under LifterLMS Settings, under Accounts, there are options to retain order data or student LMS data specifically during an account erasure request. If you retain order data, an erasure removes the student’s name and personal information from the order, but leaves an anonymized order behind for your bookkeeping and tax records. Same idea for LMS data, you can remove everything about the student except their course progress, leaving a shell record behind. Both settings are off by default, meaning by default an erasure removes that information along with everything else. It’s up to you, working with your lawyer or your accrediting institution’s own rules, to decide what you’re required to retain.

Leo: One more pattern I’ve seen outside of WordPress plugins, on SaaS platforms generally, is disclosing that retention window directly, saying you’ll keep order data for five years for audit reasons, for example. A common higher-ed pattern is that the student information system holds final grades, while the LMS itself wipes course progress data every semester, specifically to keep that data set as risk-averse as possible, since even progress comparisons between classmates can be considered a vulnerability in some environments.

Forcing An Erasure Without Student Confirmation

Thomas: During both the export and erasure flows, you’ll also notice you can force the action without waiting on student confirmation, say for your own records, or because a student isn’t responding to the confirmation email but you still want the data gone for another reason. Doing that removes the student’s data immediately and shows you exactly what was removed, IP address, phone number, certificates, notifications, and so on. If we look at that student’s profile afterward, most of his information is gone, though his name and email remain, since those live in core WordPress user tables rather than LifterLMS’s own tables.

Erasing Personal Data Versus Deleting The User Account

Thomas: The final step, actually deleting the WordPress user account itself, isn’t part of the data eraser, that’s a separate action you take manually. It’s a bit of an odd technicality, but under WordPress’s user model, requesting your data to be removed and requesting your account to be closed are two distinct actions.

Leo: I actually posed this exact question in the GDPR compliance chat around the deadline and got a much less clear answer than that. This genuinely helps.

Thomas: To restate it: requesting your information be removed and requesting your account be closed are technically separate requests, though I’d guess 99 times out of 100 you’d want to delete the account too.

Leo: I’d tend to agree, though there are cases, especially in formal education, where you might have other reasons to keep the account itself active.

Thomas: One simple example on a LifterLMS site: someone using Social Learning who wants their posts gone and their social presence erased, but still wants to keep taking your courses. You could remove their personal data, leave their LMS progress intact, and retain the account so they can keep learning while opting out of the social side entirely.

What’s Coming Next For LifterLMS Add-Ons And GDPR

Thomas: We’re also updating our add-ons. Our ConvertKit add-on shipped this past Friday with explicit consent built in, where it used to automatically add users to your sequences and tag them as subscribers, it now surfaces an easy opt-in checkbox for the mailing list side of things. We’re almost finished with similar updates to our MailChimp add-on, and we have one more data set to add an exporter for, from LifterLMS Private Areas, which you’ll see land before Friday.

Wrapping Up The Webinar

Chris Badgett: Thank you all for coming, and we’ll be posting this webinar in our webinars section, since we make our webinars freely available forever. If anyone wants Leo’s slides, Leo mentioned he plans to release them on GitHub under GPL once they’re finalized, since he wants the community to keep refining them as the law’s enforcement evolves. Leo, Thomas, thank you both for your leadership on this. Thomas is a brilliant technologist, and we’re lucky to be on this journey with him at LifterLMS. It feels great to raise this conversation, to care more about having the best course than the biggest list, and to really fight for our students and their freedom around data privacy. Thank you all for coming, we’ll send out the replay, and I hope everybody has a great rest of your day.