Changes that Affect Theme Authors in WordPress 4.9.6

Welcome!

The WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development team builds WordPress! Follow this site for general updates, status reports, and the occasional code debate. There’s lots of ways to contribute:

Found a bugbug A bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority.? Create a ticket in the bug tracker.

Want to contribute? Get started quickly with tickets marked as good first bugs for new contributors or join a bug scrub. There’s more on the reports page, like patches needing testing, and on feature projects page.

Other questions? Here is a detailed handbook for contributors, complete with tutorials.

Update 5/18: Added note about privacy policy management on multisitemultisite Used to describe a WordPress installation with a network of multiple blogs, grouped by sites. This installation type has shared users tables, and creates separate database tables for each blog (wp_posts becomes wp_0_posts). See also network, blog, site installs.
Update 5/17: Added details about themes passing the fields argument to comment_form().

In WordPress 4.9.6, several tools were introduced to help sites meet the requirements of the new European Union’s new GDPR (General Data Protection Regulation) laws. This post will detail what theme authors need to know about compatibility with the new features.

Theme authors should test their themes to confirm that there are no design conflicts between the new features and their themes detailed below.

Privacy Policy Pages

WordPress 4.9.6 introduced the ability to easily select a page as a privacy policy for a site in the Settings > Privacy section of the adminadmin (and super admin) area (#43435). For new sites, a privacy policy template page will automatically be created in draft status (#43491).

To easily link to the selected page in plugins and themes, three template tags have been added (#43850):

get_privacy_policy_url() – Retrieves the URLURL A specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org to the privacy policy page.
the_privacy_policy_link() – Displays the privacy policy link with formatting, when applicable.
get_the_privacy_policy_link() – Returns the privacy policy link with formatting, when applicable.

Note: On multisite installs, only super admins are allowed to manage privacy policies. If one policy is desired for the entire multisite, the `privacy_policy_url` filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. can be used to accomplish this. See #43919.

Example

The following example will display the privacy policy link surrounded by a <div>.

if ( function_exists( 'the_privacy_policy_link' ) ) {
        the_privacy_policy_link( '<div>', '</div>');
}

Commenter Cookie Opt-Ins

When a logged out user comments on a post, they are asked for their name, email, and website. This information is stored locally in the commenter’s browser for two purposes:

When they leave another comment on the site, their name, email, and website will be pre-populated into the respective fields.
If their comment is held for moderation, they can return to that post and remove the comment before it is approved.

The information stored in this cookie is for convenience and is not essential. Therefore, the user needs to be given the choice to opt in or opt out of the storage of this data.

For this reason, a checkbox has been added to the comment form that allows commenters to opt-in to storing this data in the cookie. This checkbox will be unchecked by default, as opt-in is an action the user must explicitly approve.

The new checkbox field is automatically added to comment forms displayed using the comment_form() function inside a p.comment-form-cookies-consent element.

While most themes will not require any action, it is recommended that you double check that the new input and label does not require CSSCSS Cascading Style Sheets. adjustments in custom themes.

For more information on this change, check out #43436 on TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress.,

Themes Overriding Comment Forms

By default, WordPress automatically displays the new checkbox field discussed above. However, if a theme is passing the fields argument to the comment_form() function, the field will not display and needs to be added to the list of fields.

Example

The following example will only display the email field above the comment message field in the comments form.

comment_form(
	array(
		'fields' => array(
			'email' => 'field markup',
		),
	)
);

After updating, the new comment opt-in field will need to be added.

comment_form(
	array(
		'fields' => array(
			'email' => 'field markup',
			'cookies' => 'opt-in field markup',
		),
	)
);

The default markup for the field can be found in wp-includes/comment-template.php.

A second option for fixing this would be to utilize the comment_form_default_fields filter instead. Using this filter, default comment fields can be added or removed without having to pass the fields argument to the function.

Bundled Themes

All 8 currently supported bundled themes (Twenty Ten-Twenty Seventeen) have been updated to support these changes. Site footers will display a link to the site’s privacy policy when one has been selected (#43715), and the commenter cookie opt-in field has been styled.

Child themes built on top of bundled themes should be checked to see if any adjustments are necessary for the privacy policy link in the footer.

Jose Castaneda 7:57 pm on May 17, 2018

+make.wordpress.org/themes
Pieter 1:29 pm on May 18, 2018

Is there a way to remove the Privacy settings page from the install? Although I appreciate the effort, I like to run my own and have no need for this.
- Jonathan Desrosiers 7:27 pm on May 18, 2018
  
  There are several plugins (such as this one) that will disable the new features if you must remove them: https://wordpress.org/plugins/disable-privacy-tools/
  - Pieter 7:42 pm on May 18, 2018
    
    Great, thank you for pointing it out.
  - onlyonequestion 5:48 pm on June 7, 2018
    
    The pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party does not disable the checkbox. At least not for me. And I did not find any other from the several plugins mentioned.
    
    But the checkbox looks simply odd on my page. I do not have option for users to register, email addreses and webpages are not asked. Only the name – and anybody can write whatever as the name each time. And there are no texts in English on my page. Except next to this checkbox.
    
    Could someone provide a simple script to remove this staff (like those to remove email or webpage fields) ?
zakkath 9:37 pm on May 19, 2018

Out of curiosity, why were these privacy things not just added as a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party?
programmin 4:26 pm on May 21, 2018

On a site using Twenty-Seventeen 1.6 I see a post comment box has “Save my name, email, and website in this browser for the next time I comment.”
No mention of the privacy policy that has been set in the settings. Am I missing a step or misunderstanding this feature?
- Allen Snook 9:29 pm on May 21, 2018
  
  Howdy!
  
  The link is not included there… I’d recommend, if you are interested, to filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. comment_form_default_fields to change the text there
  for the “cookies” field to add in the link.
  
  If you are thinking bigger than just browser cookies, however… and you want to use consent as your lawful basis for processing that comment, you could filter comment_form_default_fields to add an additional required checkbox with that disclosure and the link to your privacy policy there.
  
  Or, lastly, you could just filter the comment template to add a paragraph with a link to your privacy policy if you don’t require explicit consent.
papillon14rose 12:57 pm on May 22, 2018

Hi,
thank you so much for these informations, I’m novice and Ican’t see the checkbox comment (save my name, adress …) when I open my template.comment.php I can’t find the line
comment_form(
array(
‘fields’ => array(
’email’ => ‘field markup’,
),

to add : ‘cookies’ => ‘opt-in field markup’,

thank you for your help
- Jonathan Desrosiers 1:22 pm on May 22, 2018
  
  This is not the proper area for support. I recommend posting in the support forums (https://wordpress.org/support/). This blogblog (versus network, site) is for discussing the development of WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. and communicating changes to developers.
igb10 8:01 pm on May 26, 2018

I think 1 major step is missing in Comments section, in order to comply with GDPR, is that it collects IP address without the required consent. So there either should be the second box: “In order to fight SPAM your IP address will be disclosed if you comment. Proceed anyway?” If not, no comment will be sent. Or Comments Section has to have a optional setting to Anonymize IP.
Behrooz Dante 8:04 pm on May 29, 2018

guys how can disable comment GDPR ?

if(isset($fields['cookies'])) { unset($fields['cookies']); return $fields; }

top code not work, any idea for disable it ?
- Jonathan Desrosiers 12:12 pm on May 30, 2018
  
  This is a question better suited for the WordPress support forums as this blogblog (versus network, site) is for WordPress CoreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development.
gdgraphics 1:33 pm on August 6, 2018

Hi
it appears only site administrators are able to edit the privacy policy page or any page that has been identified as the privacy policy page. While I can understand this restriction on a multi-site install it can cause difficulties on single installs.

A client wanted to edit their privacy policy on a page I set up for them and I had identified as the privacy ploicy under the ‘Settings’ -> ‘privacy’ menu. As they only had editor capabilities they were unable to edit the page. Instead I had to set up a new (temporary) privacy policy page and identify that as the primary privacy policy page. The client could then edit the original page I had set up.

Fortunately in the custom theme I created for them I am not using the ‘the_privacy_policy_link’ function.

Can this restriction be looked at in the next release of WP and maybe in the privacy ploicy dialogue box mention that only site administrators can edit the privacy policy. I wouldn’t call it a bugbug A bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority. as such – just something that needs to be pointed out.

Comments are closed.

Welcome!

Communication

Privacy Policy Pages

Example

Commenter Cookie Opt-Ins

Themes Overriding Comment Forms

Example

Bundled Themes

Share this: