Erase Personal Data

It would be easy to assume that the Erase Personal Data tool removes the user’s account, but this is not the case. In fact, the Erase Personal Data tool may not erase all personal data. The tool specifically targets identifiable user data, like the user’s name and email address. By default, WordPress leaves any comments the user has made to a post and changes the username to anonymous for those comments. However, plugins are available that will instead delete the comments whenever you use the Erase Personal Data tool. To remove ALL of a user’s data, it is best to use the Erase Personal Data tool followed by deleting the user’s account. This will save the record that you complied with the request and remove all of the user’s data from the site.

Here’s how to use the Erase Personal Data tool:

Step 1: Go to the Erase Personal Data page. In the WordPress dashboard, navigate to Tools > Erase Personal Data.

Step 2: Submit the erasure request. Just like with exporting data, enter the username or email of the person requesting data deletion, and WordPress will send them a confirmation email. You can also bypass the confirmation email by unchecking the Confirmation email box. If you get a request to erase user data, it’s a good idea to send the confirmation email to verify that the request legitimately came from the user. If you were cleaning up old user records on the other hand, you might not need to send the confirmation email. Submit the request by clicking the Send Request button.

Step 3: Once the user confirms the request through their email, or if you bypassed the Confirmation email, you can proceed to erase their personal data. WordPress will remove any identifiable information like their name and email, but it won’t delete their content unless you choose to manually do so. On the line with the user’s email address, click the red Erase personal data link on the far right.

Step 4: The Erase personal data link will change to Erasure Completed, along with a confirmation message. Hovering over the name will bring up a Complete request link; click it.

Erasure completed will change to Remove request, but best practice is to keep a record of the completed erasure requests. This ensures that if there is ever a question, you can show proof that you’ve complied with privacy laws and completed the erasure request.