WordPress Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Which WordPress feature allows users to request and download all personal data the site holds about them, supporting GDPR compliance?
- Export Personal Data tool in Tools menu (Correct answer)
- User profile export button
- WooCommerce data export
- Database backup plugin
Correct answer: Export Personal Data tool in Tools menu
WordPress includes a built-in 'Export Personal Data' tool under the Tools menu to fulfill GDPR data portability requests.
Question 2: Under COPPA, what is the minimum age threshold below which websites must obtain verifiable parental consent before collecting children's personal information in the US?
- 13 (Correct answer)
- 16
- 18
- 12
Correct answer: 13
COPPA (Children's Online Privacy Protection Act) requires verifiable parental consent before collecting personal information from children under 13.
Question 3: A WordPress site uses Google Analytics to track visitors. Under GDPR, this data transfer to Google servers in the US requires which safeguard?
- A local data backup
- Standard Contractual Clauses or equivalent transfer mechanism (Correct answer)
- A VPN connection
- Two-factor authentication
Correct answer: Standard Contractual Clauses or equivalent transfer mechanism
Transferring personal data outside the EU requires a legal transfer mechanism such as Standard Contractual Clauses (SCCs) under GDPR.
Question 4: What is a Data Processing Agreement (DPA) required for under GDPR when a WordPress site uses a third-party email service?
- To grant the email provider access to the site's admin panel
- To legally define how the processor handles personal data on behalf of the controller (Correct answer)
- To transfer ownership of the data to the email provider
- To comply with anti-spam laws only
Correct answer: To legally define how the processor handles personal data on behalf of the controller
A DPA is a contract that defines how a data processor (email service) handles personal data on behalf of the data controller (the site owner).
Question 5: Which US federal law governs the sending of commercial emails and requires WordPress sites to include an unsubscribe mechanism?
- CCPA
- CAN-SPAM Act (Correct answer)
- COPPA
- HIPAA
Correct answer: CAN-SPAM Act
The CAN-SPAM Act requires commercial emails to include a clear unsubscribe mechanism and honor opt-out requests within 10 business days.
Question 6: When a WordPress WooCommerce store processes health-related product purchases, which US regulation may apply to customer health data collected during the transaction?
- FERPA
- HIPAA (Correct answer)
- SOX
- GLBA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) may apply if the site collects protected health information (PHI) during transactions.
Question 7: What does the term 'data minimization' mean in the context of GDPR compliance for a WordPress site?
- Compressing database files to save space
- Collecting only the personal data necessary for the specified purpose (Correct answer)
- Deleting old posts automatically
- Using minified CSS and JavaScript
Correct answer: Collecting only the personal data necessary for the specified purpose
Data minimization under GDPR means collecting only the personal data that is adequate, relevant, and limited to what is necessary for the intended purpose.
WordPress Regulatory Frameworks & Compliance 3
Which WordPress feature allows users to request and download all personal data the site holds about them, supporting GDPR compliance?