What contact forms collect

A WordPress contact form looks innocent: name, email, message, send. Behind it, the average form plugin collects more than the visitor typed. IP addresses in entry logs. Timestamps and user agents. Spam-checking services that send the submission to a third party for scoring. File uploads stored on the server. Some plugins even pre-fill fields from cookies or local storage, which means personal data moves before the visitor clicks anything.

None of this is automatically a violation. Much of it is necessary to deliver the form's function. The consent question is narrower: what fires before the visitor agrees, and does any of it require consent under your legal framework? A form that phones a spam API on page load is doing something different from a form that only processes on submit.

The pre-submission problem

The sharpest issue is data leaving the browser before submission. Some form plugins load tracking or spam-detection scripts on every page that contains a form, not just on submit. Those scripts can set cookies, fingerprint the browser, or send behavioral data to a third party. Under GDPR, that needs prior consent. Under the ePrivacy rules, storing or accessing anything on the visitor's device needs consent regardless of what the data is.

Audit this with the network tab, not the plugin settings page. Load a page with the form as a logged-out visitor and watch what fires before you touch anything. Then type in the form without submitting and watch again. Some plugins send keystroke or interaction data to spam services pre-submission. If yours does, that behavior needs to sit behind consent or be disabled.

Consent-friendly form setup

Four settings cover most of it. First, disable pre-submission tracking and behavioral spam checks, or gate them behind consent. Server-side spam checks on submit are the cleaner alternative. Second, turn off entry storage for IP addresses and user agents unless you have a reason to keep them, and set a retention period for the entries you do keep.

Third, check the spam service. If the plugin sends submissions to an external API, that is a data transfer to a third party, and it needs a data processing agreement and a lawful basis. Some plugins offer local-only spam checks. Prefer those. Fourth, add the form's data practices to your privacy policy: what is collected, where it goes, and how long it stays.

The checkbox question

Do you need a consent checkbox on the form itself? If the form only processes what the visitor submits in order to respond, consent is usually not the right basis: the processing is necessary to perform the requested action. A checkbox asking for consent to process the message is legally confused and annoys everyone.

The checkbox matters when the form does something extra: adding the address to a newsletter list, for example. That needs separate, unticked, opt-in consent, not a bundled checkbox. One checkbox per purpose, none pre-ticked. The form that does one thing needs no checkbox. The form that does two things needs a checkbox for the second.

Frequently asked questions

Do WordPress contact forms need a consent checkbox?

Not for processing the message itself: handling a submitted inquiry is necessary to perform the requested action, so consent is the wrong legal basis and a checkbox just adds confusion. You need a separate, unticked opt-in checkbox only when the form does something extra, like adding the visitor to a newsletter.

What data do form plugins collect before submission?

Potentially quite a bit: tracking scripts loaded with the form, behavioral spam checks that send interaction data to third-party APIs, and pre-filled fields pulled from cookies. Audit with the network tab as a logged-out visitor before trusting the settings page.

Is sending form data to a spam-checking API a problem?

It is a data transfer to a third party, so it needs a data processing agreement and a lawful basis. Prefer server-side checks on submit over scripts that phone home on page load, and consider plugins with local-only spam detection to avoid the transfer entirely.

How long should form entries be kept?

As short as your purpose allows. Set a retention period in the plugin settings and delete on schedule. Keeping years of contact form entries with IP addresses and user agents is a breach waiting to be discovered.