Is Magic Link Login GDPR Friendly and Privacy Safe?

Q: How do I remove a user's magic links?

Go to Users → All Users, and use the Revoke Magic Links row action (or the bulk action) to invalidate that user's active links. This does not delete the audit-log history of past events. For account deletion, remove the WordPress user as you normally would and apply your retention policy to the audit log.

Worried that adding passwordless login means collecting more personal data? Magic Link is designed to work with your existing WordPress user system, so it stores no separate user profiles or extra personal data beyond what WordPress already collects. It does keep an audit log of login events (such as email address and IP address) so you can monitor security. This page explains exactly what Magic Link does and does not store, so you can align it with your own privacy policy.

What data Magic Link stores

Magic Link is an email-only passwordless login plugin. It sends a one-time sign-in link to a user's existing WordPress email address. It does not create parallel accounts or a separate identity store.

Users: Magic Link uses your standard WordPress users. It does not create a second profile or copy user records into its own tables.
Magic links: Each generated link is stored with its target user, expiry, and usage state so it can be validated and revoked.
Audit log: Magic Link records login-related events — generated, sent, opened, used, expired, revoked, failed, delivered, and bounced. These entries can include the user's email address and the IP address involved, which is personal data under GDPR.

What Magic Link does not do

Magic Link does not add tracking cookies, third-party analytics, or external data sharing on its own. It does not store passwords (there are none in passwordless login), and it does not send personal data to KaizenCoders.

Note on privacy tooling

Magic Link does not currently register WordPress privacy data exporters or erasers, so its audit-log entries are not automatically included in WordPress's built-in "Export Personal Data" or "Erase Personal Data" tools. If a data-subject request requires removing audit-log entries, handle that manually and treat the audit log as personal data in your retention policy.

What this means for your compliance

Because Magic Link relies on the WordPress user system, most of your obligations are the same as they already are for any WordPress site. The main additions to account for are the login audit log and the emails Magic Link sends.

Mention magic-link login and the audit log in your site privacy policy if you disclose the data you process.
Treat the audit log as personal data — it can contain email and IP addresses — and decide how long you retain it.
Confirm your email handling (deliverability service, logs) meets your requirements, since links are delivered by email.
Use the Revoke Magic Links action to invalidate a user's active links when an account is closed or a request is made. See troubleshooting for the exact steps.

Conclusion

Magic Link keeps a clean privacy story: it adds no separate user profiles and stores no personal data beyond what WordPress already holds, apart from a security audit log of login events. Because it does not ship automated data-export or erase tooling, treat the audit log as personal data in your own retention and data-subject processes. To review what login events are recorded, see the audit log guide.

FAQs

Magic Link is built to be privacy-friendly: it uses your existing WordPress users and stores no extra personal profiles. It does keep an audit log of login events that can include email and IP addresses, which is personal data under GDPR. Compliance ultimately depends on your own privacy policy, retention practices, and how you handle data-subject requests.

What personal data does Magic Link store?

Magic Link stores the magic links it generates (linked to existing WordPress users) and an audit log of login events. Audit entries can include a user's email address and IP address. It does not create separate user profiles, store passwords, or copy WordPress user records into its own data store.

Can Magic Link export or erase a user's data automatically?

No. Magic Link does not currently register WordPress privacy data exporters or erasers, so its audit-log entries are not automatically included in WordPress's built-in personal-data export and erase tools. If a request requires removing audit-log data, handle it manually and account for the log in your retention policy.

Does Magic Link send personal data to third parties?

No. Magic Link does not send personal data to KaizenCoders or add third-party trackers. Emails are delivered through your site's own mail setup. If you use PRO integrations or webhooks, review where those send data, since webhooks post login-event payloads to the endpoints you configure.

How do I remove a user's magic links?

Go to Users → All Users, and use the Revoke Magic Links row action (or the bulk action) to invalidate that user's active links. This does not delete the audit-log history of past events. For account deletion, remove the WordPress user as you normally would and apply your retention policy to the audit log.