A request arrives and you have a month. The realistic options are core's privacy tools, a consent plugin you already own, or an afternoon with phpMyAdmin. Here is the honest breakdown against all three.
Core's privacy tools do one thing genuinely well: they run every exporter and eraser that plugins registered with WordPress, which covers WooCommerce and the big form plugins. Their limits are structural. They cannot see a plugin that never registered anything, they email a download link to the subject rather than showing you the data first, they erase but never anonymise, and they keep no evidence beyond a request status. Consent and cookie plugins solve a different problem entirely: they manage what you are allowed to collect, not what you already hold, and being sold as "GDPR compliance" makes them the most common false sense of security on a WordPress site. Searching by hand is the honest fallback, and it works right up until you have to swear the search was complete on a site with forty plugins you did not install. WP SAR Responder (this site) runs core's exporters, then searches everywhere they cannot reach: post, user and comment meta, and the custom tables where form entries, leads, bookings and orders actually live. You read the result before anything is sent, choose to erase or to anonymise, and the compliance log records who did what.
| Feature | WP SAR Responder | Core privacy tools | Consent plugins | By hand |
|---|---|---|---|---|
| Runs registered privacy exporters | ✓ All of them, folded into one result | ✓ Their core job, done well | ✗ Different problem | ✗ You would have to call each one |
| Finds plugins that never registered | ✓ Meta scan + custom table scan | ✗ Invisible | ✗ No | ◐ If you know they exist |
| Searches serialised form entries | ✓ Inside the blob, not just columns | ✗ No | ✗ No | ◐ SQL LIKE, then read it yourself |
| You see the data before it goes out | ✓ On screen, grouped by source | ✗ Link emailed to the subject | ✗ N/A | ✓ Painfully |
| Anonymise as well as delete | ✓ Orders and threads survive | ✗ Erase only | ✗ N/A | ◐ If you write the UPDATE correctly |
| Dry run before anything changes | ✓ Counts, changes nothing | ✗ No preview | ✗ N/A | ◐ SELECT before DELETE, if you remember |
| Guards against wiping staff accounts | ✓ Never you, never an administrator | ◐ Warns, then does it | ✗ N/A | ✗ Nothing between you and the mistake |
| Evidence you handled the request | ✓ Full log, actor, counts, CSV | ◐ Request status only | ◐ Consent records, not requests | ✗ Your memory |
| Says what it could not search | ✓ Scope notes on every result | ✗ Silent | ✗ N/A | ✗ You do not know what you missed |
| Branded response document | ✓ Your letterhead, PDF (Pro) | ✗ A zip of HTML files | ✗ No | ◐ Word, and an hour |
| Retention rules on a schedule | ✓ Daily, dry-runnable (Pro) | ✗ Not a core concept | ✗ No | ✗ Nobody remembers to |
| Cost | From $49/yr · $599 lifetime | Free, in every install | Free tier + paid plans | Free + several hours you cannot bill |
You run a brochure site with no user accounts, one contact form and no store, and core's tools genuinely reach everything you hold. That is a real situation and we would rather say so than sell you something. Core is also the right answer when the request has already been answered and you simply need a fresh export from a plugin that registered properly. Credit where it is due: the privacy exporter API is a good piece of WordPress, and this plugin depends on it rather than reinventing it.
You hold customer data across plugins you did not all choose, on sites you inherited, and the question is not "can I export" but "how do I know I found everything, and what do I show a regulator afterwards?" That is the gap this fills.
One honest line: no tool can promise it found every trace of a person in a database it has never seen, and anyone claiming otherwise is selling certainty rather than software. What this plugin does is search four ways instead of one, and tell you plainly which passes ran and which were switched off, so what you sign is a considered answer rather than a hopeful one.