Ask a WordPress site owner about their data collection and they will describe their shop, their forms, their analytics. Almost none mention the comment box sitting under every post, quietly gathering personal data since the site launched.
Comments are small data, but they are real data, with real spam tools, cookies, and retention questions attached. The good news is that this corner of privacy is quick to put right once you look at it directly.
What a comment actually collects
Beyond the visible fields, a standard comment submission stores the commenter's IP address and browser details with the comment, and sets cookies so returning commenters skip retyping their details. Plugins may add more: anti spam services receive the data too, sometimes in other countries.
That anti spam point surprises people. The service checking your comments for spam is processing commenter data on your behalf, belongs in your privacy notice, and in stricter regimes needs a processing agreement like any other vendor.
What to say at the form
WordPress includes a privacy note under comment forms on many themes, and the comment author cookies have a built in opt in checkbox pattern in core. Check yours is actually visible and accurate rather than assuming the defaults survived your theme.
Keep the notice short and specific: what is stored, that emails are never published, how long data is kept, and where the full policy lives. Commenters read two sentences at a form. They do not read two pages.
Retention and moderation reality
Comment IP addresses help fight spam floods, which is a legitimate reason to keep them for a while. A while is not forever. Set a period, a year is a common choice, and prune older metadata as part of routine maintenance.
Deleted and spam comments deserve the same discipline. Data held in spam folders and trash is still held. If a tool never empties them, your retention promise and your database disagree, and the database is the truthful one.
Export and deletion requests
WordPress core's privacy tools cover comments: a commenter can be found by email address, exported, and their data erased or anonymized with the built in eraser. Sites break this when custom comment systems or heavy plugin stacks store data outside the core tables.
Test your own tools once a year with a test comment and a test request. Finding out your eraser works is a ten minute job. Finding out it does not, during a real request with a deadline, is a much worse afternoon.
Related reading
These earlier guides go deeper on connected questions: Consent on WordPress Membership Sites: Logged In Does Not Mean Consented Membership sites track logged in users heavily and often assume the account terms cover everything. Separating account consent from tracking consent on WordPress., WordPress Consent Logs: How Long to Keep Them and What They Must Show A consent banner without a log is a claim without evidence. What a WordPress consent record needs to contain, and how long retention should run., and Consent on Multilingual WordPress Sites: One Site, Several Legal Conversations Multilingual WordPress sites often run one banner with translated strings and call it done. Language, law, and plugin behavior need more care than that..
Frequently asked questions
Are commenters' email addresses ever shown publicly?
They should not be. WordPress does not display the comment email, and themes or plugins that leak it are a genuine problem. The website field is public by design, the email field is private and should stay that way.
Why does WordPress store comment IP addresses?
Mainly for spam and abuse moderation: patterns across addresses help tools and humans spot floods and repeat offenders. It is a legitimate purpose that still deserves a retention limit, since the value of an IP address for moderation fades with time.
Do I need consent to set comment cookies?
WordPress core uses an opt in checkbox for the cookies that remember commenter details, which is the right pattern. If your theme or comment plugin sets those cookies without asking, that is worth fixing, since they are convenience cookies, not essentials.
How do I delete a commenter's data on request?
Use the built in privacy eraser in WordPress tools, searching by the commenter's email address, and check any external comment or anti spam systems for copies. Confirm what was erased or anonymized to the requester in plain language.