Donation forms are where a charity's privacy practice becomes visible to its most committed supporters. They are also, on a typical WordPress install, the page with the least examined stack of third party code on the whole site.
The donor came to give money away. What the page gives away about the donor, before any consent choice, is worth an afternoon of your attention.
What loads on a donation page, in practice
Start with the inventory. The donation plugin itself, a payment provider like a card gateway or wallet, reCAPTCHA or a similar anti fraud tool, analytics, and frequently a social pixel installed site wide by a marketing volunteer two campaigns ago. Each of those can set cookies or send data to a third party.
Load the form logged out, in a private window, and list network calls before interacting with the banner. Charities are routinely surprised by their own list, especially the advertising pixel, which has no business learning who donates to a health, faith, or political cause.
Why donor data deserves the stricter standard
A donation can reveal political views, religious affiliation, or a personal connection to a disease charity. Under GDPR, data revealing beliefs or health is special category territory, and even where a simple donation record does not formally cross that line, the sensitivity is obvious to anyone who thinks about it for a minute.
That sensitivity should drive configuration choices: no advertising pixels on donation pages, analytics configured without advertising features there, and a data retention period for failed or abandoned donation attempts that someone has actually chosen, rather than whatever the plugin keeps by default.
Hold scripts until consent, without breaking the payment
Use your consent tool's blocking for the donation page templates specifically, and test the full flow after blocking: select an amount, complete a test donation, confirm the confirmation email and the thank you page all still work. Payment and fraud prevention functions needed for the transaction have a necessity argument. Analytics and marketing tags do not, and they can wait.
Gift Aid or tax receipt declarations, where relevant, are separate consents with their own wording and records. Do not merge them into the cookie flow or the marketing opt in. Three permissions, three records, each provable on its own.
The marketing opt in on the donation form
A checkbox asking donors to hear more is legitimate and valuable. It must be unticked by default, worded for email specifically if email is what you mean, and stored with the same record quality as any other consent: who, when, and what the wording said.
Pre ticking it because donors are warm leads is how a charity ends up unable to prove permission to the very people most likely to complain to a regulator out of principle. Supporters hold charities to the standard charities publish. Meet it on the form.
Related reading
These earlier guides go deeper on connected questions: WordPress Consent for Webinar and Event Registrations A webinar signup on WordPress mixes a registration, a calendar invite, reminders, and marketing in one form. Separating the consents so registrants get the event and only the follow up they chose., WordPress Consent After a Plugin Update: What to Retest Consent setups break quietly in updates: banners reset, categories remap, tags start firing early. A retest checklist for every WordPress or consent plugin update., and WordPress Consent for Online Course Platforms Course sites collect consent in more places than blogs do: enrolments, quizzes, video platforms, and community tools. Mapping the consent points on a WordPress course site..
Frequently asked questions
Why is a donation page a special privacy case?
Donations can reveal beliefs, politics, faith, or health connections, which are sensitive categories. Advertising or analytics tracking on that page carries more risk than the same tracking on a shop page, so the configuration should be stricter and deliberate.
Can I block scripts on a WordPress donation form without breaking payments?
Yes, if you block selectively and test. Hold analytics and marketing tags until consent, allow what the transaction itself needs, then run a complete test donation to verify amounts, payment, receipts, and the thank you page all work.
Should the donor marketing opt in be pre ticked?
No. Use an unticked box with clear wording about what the donor will receive and how often. Pre ticked boxes do not meet the clear affirmative action standard for consent under GDPR style rules.
What should I check first on an existing donation page?
Load it logged out in a private window and record third party calls before any consent choice. Compare that list with your cookie declaration. Advertising pixels and unlisted domains on a donation page are the findings to fix first.