A staff member updates a webpage, saves a draft and sees the familiar WordPress editor. The privacy question is sensible: does Gutenberg collect user data? For most websites, Gutenberg itself does not send the contents of your pages, drafts or participant information to a central Gutenberg database. However, the full answer depends on your WordPress setup, hosting provider, plugins and the blocks placed on each page.
For disability service providers, this distinction matters. A website may contain enquiry forms, staff details, accessibility information and occasionally sensitive information that should never be public. Understanding where information goes helps protect privacy, maintain trust and support good records practices.
Does Gutenberg collect user data by default?
Gutenberg is the block editor built into modern WordPress. It lets website administrators create pages using blocks for headings, text, images, buttons, columns and other content.
When you type in Gutenberg, the content is normally saved to your own WordPress website database. That database sits with your web host or managed WordPress provider. In practical terms, a draft page is stored on the server that runs your site, not automatically uploaded to a separate Gutenberg service.
Gutenberg also uses browser storage and WordPress features to make editing work properly. For example, it can retain local editing preferences, such as panels you have opened or closed. WordPress can also save post revisions and autosaves to help recover work after an interrupted connection. These are useful operational features, but they still form part of your website’s data handling and should be covered by sensible access controls and retention practices.
The short answer is: Gutenberg is not generally designed as a standalone platform that collects every editor’s content for its own use. But “Gutenberg” is only one part of a broader WordPress environment. That is where the details matter.
What information may be shared outside your website?
WordPress sites can communicate with external services for legitimate technical reasons. This does not necessarily mean personal information is being shared, but an administrator should know which services are involved.
WordPress updates and block searches
WordPress may contact official WordPress services to check for core, theme and plugin updates. If the Block Directory feature is used to search for and install a block from within the editor, WordPress may send a search term and technical information needed to return relevant results.
This is different from sending the complete text of a page or a participant’s details. Still, staff should only install plugins through an approved process. A quick block search is convenient, but every new plugin can introduce its own privacy, security, support and compatibility considerations.
Third-party blocks and plugins
This is the area that deserves the closest review. Gutenberg blocks supplied by another developer may connect to external services. A block for maps, videos, social feeds, fonts, booking tools, live chat, forms or marketing pop-ups may load content from another company when a visitor opens the page.
Some plugins collect usage data, offer optional diagnostic reporting, or use external servers to provide their functionality. The Gutenberg editor does not control those practices. The plugin developer’s settings and privacy information do.
Before adding a block plugin, check what it does, whether it has a current support history, what data it processes, and whether any telemetry or usage tracking can be turned off. If the answer is unclear, do not install it until the website manager has reviewed it.
Embedded content and analytics
An embedded YouTube video, Google Map or social media post can allow that external platform to receive information about a visitor, such as their IP address, browser details and page visit. Website analytics and advertising tools may do the same.
These services are not evidence that Gutenberg is collecting data. They are separate components added to a WordPress page. They should be assessed individually, and your website privacy collection notice should explain how personal information is handled.
Where Gutenberg data is actually stored
For administrators, it helps to think about four locations rather than one vague idea of “the cloud”.
First, page content, revisions, user accounts and WordPress settings are usually stored in the website database. Second, media such as photos and documents are held in the site’s file storage or connected media service. Third, backups may be held by your hosting provider or a separate backup tool. Finally, browser cookies or local storage may sit on the editor’s own device.
Each location needs protection. A secure website is not only about the editor. It is about who can log in, where backups are stored, how quickly updates are applied, and whether old accounts are removed when a staff member changes roles.
For a provider handling disability-related enquiries, avoid placing personal, health or plan information in page drafts, image filenames, media library descriptions or public-facing blocks. A website page should not become a case note system. Use your approved client management and records systems for information that identifies a participant or relates to their supports.
Practical settings for a safer WordPress editor
You do not need to be a developer to reduce risk. Start with clear admin processes and a few practical controls.
- Give each staff member their own WordPress account. Do not share a single administrator login.
- Use strong, unique passwords and multi-factor authentication where available.
- Give people the lowest access level they need. An author or editor account is often safer than administrator access.
- Keep WordPress, themes and plugins updated after checking that updates are compatible with the site.
- Remove unused plugins, themes and former staff accounts. Inactive software can still create risk.
- Review backup arrangements, including how long backups are retained and who can restore them.
- Check forms, maps, videos and other third-party blocks before publishing them.
Also review the WordPress user roles carefully. An Editor can usually publish and amend pages, while an Administrator can change broad site settings and install software. For a larger organisation, limiting administrator access to the small number of people responsible for the website is a straightforward safeguard.
How to check whether a Gutenberg block sends data away
When someone asks whether a particular Gutenberg block is private, the right answer is often: it depends on the block.
Start in the WordPress dashboard and identify the block’s plugin. Check its settings for terms such as “usage tracking”, “telemetry”, “analytics”, “diagnostics”, “API”, “remote content” or “consent”. Read its privacy information and confirm whether the feature is optional. If a block requires an API key, it is very likely communicating with an external service.
Then test the page before it goes live. Open it in a private browser window, check what appears, and ensure any form only asks for information genuinely needed to respond. An enquiry form should not ask for a participant’s full diagnosis, NDIS number or detailed support history unless there is a documented and appropriate reason to collect it through that channel.
If your website uses cookies or optional analytics, make sure your consent approach matches the tools installed. Consent banners do not fix unsuitable data collection. The strongest approach is to collect less information in the first place.
A note on the Gutenberg plugin versus WordPress core
Some websites use the separate Gutenberg plugin to access experimental editor features before they are included in WordPress core. This can be useful for developers or websites that deliberately test new functions. For many service-provider websites, however, the standard WordPress editor is the more predictable choice.
Experimental features may change more frequently and can affect compatibility with themes or other plugins. That does not automatically make them unsafe, but it does make staged testing, backups and clear responsibility more valuable. Do not test new editor features on a live website that receives participant or family enquiries unless there is a recovery plan.
When to seek extra advice
A simple brochure-style website with basic contact details has different risks from a site with online referrals, appointment requests, recruitment forms, client portals or integrated customer relationship tools. If your website collects sensitive information, transfers data overseas, or links directly with service-delivery systems, seek tailored privacy and technical advice before relying on default settings.
Holy Care Support Services values confidentiality, dignity and informed choice. Those principles apply online as much as they do in community support. The practical goal is not to avoid Gutenberg altogether. It is to use a well-managed website, collect only what is needed, and give every person confidence that their information will be treated with care.
