So we are excited to introduce
Mr Mujeebu Rahman as one of the
WordCamp kerala speakers.
Mujeebu has 10 years of experience in the
software development industry.
He is currently working as
software developer
at Mozilor technologies Pvt Ltd
It has several WordPress plugins
that are well out in community
So now I call upon him to present
a lighting talk on the topic
WordPress data privacy
Hi all, I'm Mujeebu Rahman
Working in WordPress ecosystem
for nearly a decade.
I am currently working
as Senior Developer and product owner
at Mozilor Technologies Pvt Ltd
Today, I am here to share my thoughts
and views on Data Privacy in WordPress.
So, Let me begin with the obvious first.
What is Privacy?
Well, let me put it this way.
We all engage in different activities
in our life sometimes alone,
sometimes with friends,
or with any random person
We will enjoy the moment
with the peace of mind
that no one is there to disturb our time
That state of mind in which
we believe we are not observed by anyone
in the moments we don’t want to be
can simply say as privacy.
Now to the point
Privacy in WordPress
The growth of the internet has
fundamentally changed the way we
interact each other and access information
From social media to e-commerce,
the internet has created new opportunities
communication, interactions, transactions
However, it has also created new
shades of risks on our privacy
, as our personal informations
are now more accessible than ever before.
It has raised concerns among users
about their user privacy
At the same time, people are becoming
more aware of their rights to privacy
and are taking proactive steps
to reduce their digital footprints
around the online space.
This is a clear call to have discussions
and make necessary action
to protect users data privacy.
For quite sometime the open source
webtechnologies have been not only
focusing on making the resources accessibl
for free to everyone but also focusing on
user privacy. As an open source ecom
As n open source content management system
that powers 40 perecntage of the websites
on the internet WordPress has a key role
to ensure user data privacy
Many WordPress websites collect and stores
user data in the form of contact form
user registration, online purchases etc.
Is the responsibility of the website owner
to obtain a prior consent before
collecting and storing the user data
also, the site owner should make sure that
the collected data are safe and secure
That means adding a privacy policy page or
cookie consent notice wont be enough on
your part. Privacy laws has become
more stringent, even a slight negligence
can cause you millions of Euros
I hope you know why I mentioned millions
of Euros and not millions of dollars
If not, let me introduce you the GDPR
The General Data Protection Regulation
introduced by the European Union
and made effective on May 2018 and changed
the course of discussion around
consumer privacy
Ever since the GDPR sorry,
Ever since the European union introduced
the GDPR, it has been a nightmare for the
big corporates like Faceboook, Amazon
Google. you might have heard that
Millions of Euros of fines were issue to
these corporates for violating the
GDPR guidelines
So you maybe thinking that it will affect
only the big corporates
well, that's not the case
Even if you are not residing in the
European countries
If you have business or have clients in
European union region
its mandatory for you to comply with the
GDPR
GDPR has heightened the sense of privacy
over the internet around the world
and many governments has introduced
their own version of regulations
like CCPA of California CNIL of France
LGPD of Brazil and last week
kingdom of Saudi arabia has introduced
their regulation PDPL
Having said, this should not be
the only reason that we should restrict
We should consider the user privacy
But its our responsibility to keep the
users trust that their data is protected
on our end
Over the few years WordPress have made
several changes to its core
in regards to the privacy compliance
Lets have a look at the some of the
privacy focused measures that
WordPress have taken
Restricting gravatars
As you all know gravatar is a third-party
service that allows users to upload
a profile picture and use it on multiple
WordPress websites across the web
It has potential risk to expose user
activity and identity on the internet
WordPress now allow the administrator to
disable or block the usage of gravatar
Actually gravatar is uh..... used a
hashed format of the email ID
Hashed formats are subjected to
brute force attack
Delete or export of the personal data
Thats part of the privacy law like users
should have more access and control about
their data stored
Now WordPress allows the admin to delete
or export the personal data thats stored
on the website
This can be done on the request of te user
complying with GDPR
WordPress 4.9.6 and higher versions
WordPress has introduced several
GDPR related enhancement like
privacy policy templates
opt-in option for comments
privacy policy editing helper
These all uh.. GDPR related enhancements
recently introduced in WordPress
As WordPress developers what we can do?
Privacy first, personalization comes later
We all want to provide a better
user experience for our users
for that we need to provide more options
for customization and personalization
for providing that, we may need to collect
more user data
uh.. it increases the uh... increases the
sense of security as well
Whenever there is a decision to be made
between user privacy and personalization
its recommended to prioritize the
user privacy over personalization
user's users matters
whenever we develop a plugin or release
update for a plugin with more features
we should not only consider our users
but as well as their users they might be
residing in any countires with strict
privacy laws
Privacy be design
Usually privacy is applied retrospectively
means toward the end
In privacy by design privacy is applied
from the early stage itself
means, on design stage itself through
development and to the deployment
That will help the developers to have a
clear picture on what data need to be
collected
What website admins can do?
Minimise personal data means collect only
necessary data that we need to function
Ensure data accuracy
make sure the data collected is uh true
and upto-date. Limit the purpose
Use the data collected only for what
intention its collected for
Limit data retention
Do not store data more that it is needed
or do not share it with any other
uh.. secure user data, make sure that
you have taken necessary measures
to secure the user data from
unauthorized access
Show privacy policy and cookie notices
Display, sorry being transparent
about the data you are collecting and
explain it in the privacy policy page
and cookie notice
Obtain prior consent before collecting
any user data.
Grant unser rights
Give the user the access to control and
delete their personal data
Be accountable
Be responsible for the data and if there
is any security breach, inform the user
Handle sensitive informations carefully
Provide a more additional safety layer
for sensitive information like financial
transactions, card informations etc.
Legal compliance
Keep upto date with the privacy laws
and its recommended that the safeguarding
of privacy is not a onetime task
Before installing a plugin or adding
a theme to WordPress
an admin should be aware of the following
what WordPress core privacy tool does the
plugin use or not use
what data it collects and how it is used
what are the effects of the plugin
or theme on your website uh.......
on conclusion, privacy in WordPress is
a community effort
developers should be aware of the
WordPress core changes
Plugins and theme keep-up with the latest
security standards and regulations
Thank you!
Thank you Mujeebu for quick overview on
Data Privacy in WordPress
So now I call upon Sweta to handover
a token of love