What’s left until FluentCommunity is GDPR compliant?
Has anyone made a list of what’s left to address to make FluentCommunity GDPR compliant? If not, please help me complete the list.
- Full user-data exports (update: in development)
- Full user-data removal (update: in development)
Sanitization of meta data from uploaded images(update: already fixed)- Local caching of embedded link’s thumbnails (update: coming)
- Conditional loading of embedded videos and third-party media, including admin control over permitted sources (update: can be solved by third-party tool).
This instance of FluentCommunity loads Gravatars, but I removed the issue from the list since there might be a filter similar to FluentCRM’s fluent_crm/default_avatar to disable the integration. I haven’t looked into it.
What exactly is not compliant and what makes you think so?
André Daus See the list above. User data export and removal features are mandatory. A social media platform cannot allow users to mistakenly upload media with GPS coordinates without stripping them out. Third-party link’s thumbnails are currently not loaded from the WordPress server but from the origin (leaking IP addresses) and video’s from e.g., YouTube are loaded without the user giving its consent.
- Full user-data exports: On Development
- All Community Data will be deleted when a WP user is deleted.
- We already resize and convert images so I think all the related meta data is alreasy get stripped. Also it will work with other WordPress Media plugins.
- Link Thumb: For most user's it will be an extra cost or server load. But I will definitely add a hook to add proxy for this.
- Will think about it.
Shahjahan Jewel Sounds great! Thanks! I’ve updated the post. Regarding the fifth feature, a setting for disabling embedded third-party content (only relying on links with thumbnails) would be good enough for us. If you however already plan to add support for secure CSPs, please consider adding buttons to collect explicit consent before loading third-party content while you’re at it.
When every plugin implements their own functionality based on subjective understanding of the GDPR, how does that strengthen privacy? It doesn't. It creates fragmentation and a compliance nightmare for site owners.
WordPress already has data export functionality. FluentCommunity should simply hook into it. Otherwise, site owners need to manage different exports from different plugins, creating workflow problems when handling data subject access requests.
The obligation to conform to GDPR is solely on the data controller—i.e., the website owners. Many requirements can be handled through Terms of Service, especially for community platforms where users generate content that includes external resources.
Plugins should make handling GDPR easier, not more complicated. Putting redundant "GDPR features" into every plugin fragments the compliance landscape, creates inconsistent user experiences, increases maintenance burden for both developers and site owners, provides false sense of security
FluentCommunity should integrate with WordPress's privacy tools for data the plugin collects. The rest is the site owner's responsibility to handle appropriately through their ToS, privacy policy, and site-wide configurations.
André Daus I fully agree. The two first points are about adding the hooks for WordPress’ native data export and removal features (currently missing). The third and fourth are unique for community plugins and should therefore be handled by the plugin. The remaining one cannot rely on regular WordPress features since FluentCommunity has its very own frontend, bypassing regular consent solutions and what e.g., WP Lyte that can be used otherwise.
Karl Emil Nikka I strongly disagree. The constant requirements in the name of GDPR to “make plugins compliant” create a compliance mess and slow down actual feature development that would actually benefit us.
On WordPress data export/removal hooks: Fair point - FluentCommunity should integrate with WordPress’s native privacy tools for data it collects. That’s just being a good WordPress citizen.
On the “blocking external content until consent” claim: This is fundamentally wrong and shows a misunderstanding of how GDPR applies to community platforms.
No major community platform does this. Reddit doesn’t block YouTube embeds with consent gates. Discord doesn’t. Circle.so doesn’t. Facebook Groups don’t. LinkedIn doesn’t. There’s a reason: it’s not required, and it breaks how communities function.
Login IS the consent boundary. When users create accounts and accept the ToS, they’re consenting to how the platform works - including viewing user-generated content with external resources.
Here’s what actually ensures GDPR compliance for community platforms:
-
Clear Terms of Service explaining that members will see user-generated content including external resources
-
Site-level consent management (if needed) for public areas - using proper tools that work site-wide
-
WordPress privacy tool integration for data export/removal requests
What doesn’t help compliance:
- Building per-plugin consent systems that duplicate and fragment site-wide tools
- Blocking legitimate community functionality behind consent gates that no other platform uses
- Demanding features based on blog posts rather than actual legal requirements
This is what really matters: As site owners running communities in the EU, we need FluentCommunity to integrate with WordPress’s privacy infrastructure and provide clear documentation. We don’t need it to reinvent consent management that already exists at the site level and that no actual community platform implements.
Integration with WordPress’s privacy infrastructure and clear documentation about data flows is what we need. Building separate consent systems that duplicate site-wide tools would actually make our lives as site owners more complicated, not easier.
I’d really appreciate if development focus stayed on the features that improve core community functionality. The fragmentation that comes from every plugin implementing its own interpretation of GDPR requirements makes compliance harder for those of us actually running communities in the EU.
André Daus WordPress already has data export functionality. FluentCommunity should simply hook into it.... Agree and this is what I did in my plugins for FluentCommunity export and better messages. One export all data. And there is no options you must have data export for you community. You can cover something but almost nothing in Term. Even I am getting weekly email without my consent is huge risk.
André Daus The first reason login cannot be the consent boundary for tracking scripts (like the ones embedded content brings in) is that consenting to tracking scripts and giving your data to third parties must be voluntary. It can therefore not be part of the terms and service either.
It can however be part of your consent modals (“cookie banner”). If you don’t give your consent, third-party content is never loaded.
The second reason login cannot be the consent boundary is that visitors who aren’t logged in are welcome as well. This also why you see the click-to-play buttons before you play the first YouTube clip on sites following the GDPR (if you haven’t accepted all third-party content through the site’s consent modal already). Here are a couple of examples.
This is also why e.g., WP YouTube Lyte exists.
If FluentCommunity ran through all WordPress hooks (like e.g., bbPress), everything could be handled through the site’s consent solutions. Since FluentCommunity doesn’t do that, for performance reasons, FluentCommunity needs its own solution for managing consent. And even if other WordPress plugins for consent management adds custom support for FluentCommunity, FluentCommunity needs the necessary hooks for the plugins to hook in to.
Karl Emil Nikka I tested this with a proper CMP (Usercentrics) and it works perfectly with FluentCommunity as-is, without any plugin modifications.
On your examples (Nextcloud, EC website): You're comparing apples to tomatoes. Those are public-facing marketing and information websites, not community platforms. They're completely different use cases with different requirements.
A static marketing site showing product information is fundamentally different from a community platform where users create accounts, accept ToS, and generate content. Even if you choose to make a community publicly accessible, it's still architecturally and functionally different from a marketing website.
This is what's actually happening: You're trying to use WordPress-hook-based consent tools (like WP Lyte) with FluentCommunity, which bypasses standard WordPress hooks for performance reasons. That's why those specific tools don't work - not because FluentCommunity is "non-compliant," but because you're using tools designed for a different architecture.
The solution isn't asking FluentCommunity to change. The solution is using the right tools for your use case:
Option 1: Authenticated community (behind login)
- Users accept ToS when joining
- ToS covers viewing user-generated content with external resources
- No additional consent management needed
- This is how Reddit, Discord, Circle.so, and every other community platform works
Option 2: Public community (visible to non-logged-in visitors)
- Use a proper CMP (Consent Management Platform) like Usercentrics, Cookiebot, or similar
- These work at the browser/DOM level, not the WordPress hook level
- They work perfectly with FluentCommunity without any modifications
- As the screenshot shows, this works out of the box
The fundamental issue: The tool doesn't need to be "compliant" - the process needs to be compliant. FluentCommunity provides the functionality. Site owners choose the appropriate consent management approach for their use case and architecture.
If you're trying to use WordPress-hook-based tools and they don't work with FluentCommunity's architecture, use CMP tools that work at the browser level instead. They work fine. I tested it.
André Daus Thanks for sharing the suggested solutions. I agree that option two is viable and compliant. While I’d prefer not relying on a third-party tool, I understand your reasoning and will test it. I’ll update the post, so it’s clear it can be solved with a third-party tool.
Karl Emil Nikka much appreciated. I might provide a how-to on it.
Are we getting closer to the day when 450 million Europeans celebrate because they received a GDPR-compliant version of FluentCommunity?
Sebastian Kienzle Not yet.
So far no improvements or have In missed anything?
Learning Music Skills I haven’t seen any official announcements for when the GDPR compliant version of Fluent Community will be released.