Does WPForms require consent to render contact forms?

No. WPForms is classified as functional. Its core scripts serve from the host site's own domain, set only an anti-spam session cookie, and post submissions to the site's own server. No third-party tracking cookies are written by the base plugin.

Does WPForms send data to third-party servers?

The core WPForms plugin does not send data to WPForms' own servers during form submissions. Data posts to the host WordPress server. When add-ons for Stripe, PayPal, Mailchimp, or Constant Contact are active, those integrations load their own external scripts independently.

How does ConsentStack classify WPForms?

ConsentStack classifies WPForms as functional and allows it to load without a consent gate. Contact forms, payment forms, and surveys remain accessible to all visitors. If third-party add-ons like Stripe or Mailchimp are active, ConsentStack manages consent for those integrations separately.

What tracker domains does WPForms use?

ConsentStack has catalogued tracker domains for WPForms including wpforms.com. These are the network destinations WPForms's scripts contact, which a consent platform blocks until a visitor agrees.

WPForms - WordPress Form Plugin Privacy Controls

Back to Vendor Library

Overview

WPForms is a drag-and-drop form builder plugin for WordPress, deployed on hundreds of thousands of sites ranging from small blogs to enterprise portals. Rather than operating as a third-party tracking service, it executes entirely within the host site's own WordPress environment. Its client-side scripts render the form interface and handle submission logic, with optional integrations that extend functionality to external payment processors and email platforms.

What This Script Does

The WPForms loader script (wpforms.min.js) is enqueued by WordPress and served from the host site's own domain, not a third-party CDN. On page load it initializes form validation, conditional logic, and multi-step navigation.

Cookies and storage: WPForms sets a session cookie to implement its anti-spam honeypot mechanism, preventing duplicate or bot-generated form submissions. This cookie does not contain personally identifiable information and is scoped to the host site domain. No persistent cross-site tracking cookies are written.

Network requests: Core form submissions POST to the host site's own server via the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) or a REST API route. No data is sent to WPForms' own servers as part of a standard form submission.

Third-party integrations: When configured with add-ons, WPForms can load additional scripts from Stripe (js.stripe.com), PayPal, Mailchimp, or Constant Contact. These third-party scripts operate under their own privacy terms and may set their own cookies independently of WPForms itself.

Consent & Compliance

GDPR and ePrivacy Directive: The core WPForms script does not set persistent tracking cookies and does not transmit data to third-party servers, placing it outside the consent requirement of the ePrivacy Directive for core functionality. However, when third-party payment or marketing add-ons are active, those integrations load external scripts that require consent depending on their purpose. The form itself collects personal data (name, email, etc.) which is subject to GDPR data processing requirements, but form submission is a controller-side obligation, not a consent-for-cookies matter.

CCPA/CPRA: WPForms does not sell or share personal information. Data submitted through forms is processed by the site operator acting as the data controller.

Consent category: functional. The plugin serves an operational purpose — enabling visitors to contact the site, complete orders, or respond to surveys — and does not track users across sessions or sites for advertising purposes.

Should You Block This Without Consent?

No.

The core WPForms scripts are functional and necessary for form rendering. Blocking them would make contact forms, payment forms, and survey widgets non-functional for all visitors. If third-party payment or marketing add-ons are enabled, consent should be managed for those specific integrations rather than the WPForms scripts themselves.

Is WPForms GDPR compliant?

WPForms typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So WPForms can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads WPForms, not on WPForms itself.

Visit website