Accounts and Privacy Settings

Go to WooCommerce > Settings and select the Accounts and Privacy tab.

Use these settings to enable or disable guest checkout, control customer account creation, decide how your store retains or removes personal data, and set your privacy policy notices. The settings include:

• Checkout and Accounts
• Privacy Policy
• Personal Data Retention

Additionally, we explain what WooCommerce adds to the WordPress personal data exporter and personal data eraser.

Checkout and Accounts

↑ Back to top

Checkout

• Enable guest checkout — Allow customers to check out without creating an account. Guest orders are not tied to a WordPress user account. Customers still need an account to purchase subscriptions.
• Enable log-in during checkout — Allow customers to log in to an existing account during checkout. If a customer is not logged in, WooCommerce displays a login prompt and form.

Account creation

• After checkout — Allow customers to create an account after placing their order. Use the linked site editor template to customize the account creation message.
• During checkout — Allow customers to create an account before placing their order.
• Allow subscription customers to create an account during checkout — This setting appears only when WooCommerce Subscriptions is active. It is unavailable when During checkout is enabled.
• On “My account” page — Display a registration form on the My Account page. Visitors can create a customer account without placing an order. This setting works independently of Anyone can register under Settings > General.

Account creation options

• Send password setup link — Send new users an email with a link to set up their password.
• Generate account login (recommended) — Generate a username from the customer’s first and last name, falling back to their email address when needed. If disabled, customers choose a username when creating an account. When your site uses the Checkout block, WooCommerce generates usernames automatically and hides this setting.

To let customers confirm their email address and link matching past guest orders to their account, manage the Confirm email address email under WooCommerce > Settings > Emails. See Customer email confirmation and guest order linking.

Account erasure requests

• Remove personal data from orders on request — Choose whether WooCommerce removes personal data from orders when processing an account erasure request.
• Remove personal data from subscriptions — Choose whether WooCommerce removes personal data from subscriptions when processing an account erasure request. This setting appears only when WooCommerce Subscriptions is active.
• Remove access to downloads — Choose whether WooCommerce revokes access to downloadable files and clears download logs when processing an account erasure request.
• Allow personal data to be removed in bulk from orders — Add an option to the Orders screen for removing personal data from multiple orders. Removing personal data cannot be undone. See Removing personal data from orders.

Protect customer registration

↑ Back to top

Automated signups can create unwanted customer accounts and trigger account emails. If your store syncs customer accounts to a marketing service, unwanted addresses may also reach that service.

WooCommerce’s My Account registration form is separate from WordPress registration. Disabling Anyone can register or adding protection only to wp-login.php does not protect this form. WooCommerce core does not include a CAPTCHA for My Account registration.

Use an integration that supports WooCommerce registration. For example, reCaptcha Integration for WooCommerce supports Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha.

Configure your chosen provider and enable protection for WooCommerce registration. WordPress registration protection is a separate option. See the setup instructions.

Ask your host or firewall provider to apply appropriate bot protection to your store’s My Account page. Use your store’s actual page address, which may differ from /my-account/.

If an extension adds a registration form, check its supported protection options separately. Confirm compatibility with any checkout forms you also want to protect.

CAPTCHA and bot protection can reduce automated signups, but they don’t guarantee that every unwanted submission will be blocked.

Check your registration setup

↑ Back to top

After changing your settings, open your store in a private browser window while logged out. Confirm that the intended registration form appears, any configured challenge works, and a legitimate registration succeeds. If you also protect checkout registration, test that flow separately.

If you don’t want visitors to register from My Account, clear On “My account” page under WooCommerce > Settings > Accounts & Privacy > Account creation, then save your changes. Confirm that the registration form is hidden while the login form remains available.

This setting controls the My Account form. Checkout and extension-provided registration routes have their own settings. If unwanted signups continue, ask your host or security provider to help identify which route is receiving them.

Privacy policy

↑ Back to top

This section lets you select a privacy policy page and display privacy notices on the customer registration and checkout pages.

• Privacy page — Open Settings > Privacy, where you can select your privacy policy page. Add [privacy_policy] to either notice below to link to that page. Some themes also use this setting to add a privacy policy link elsewhere, such as in the footer.
• Registration privacy policy — Add a privacy notice to the registration form on the My Account page. Include a link to your privacy policy page.
• Checkout privacy policy — Add a privacy notice to the checkout form. Include a link to your privacy policy page.

Personal data retention

↑ Back to top

Use this section to decide how long your store keeps order data. State your retention periods in your privacy policy, and make sure they comply with applicable laws, such as the EU GDPR.

For each option, enter a number and choose days, weeks, months, or years. Leave an option blank to retain that data indefinitely.

• Retain inactive accounts — Delete accounts that have not been used to log in or place an order for the specified duration. When WooCommerce Subscriptions is active, customers with a subscription are excluded.
• Retain pending orders — Pending orders are unpaid or abandoned and should not need to be fulfilled.
• Retain failed orders — Failed orders are unpaid or abandoned and should not need to be fulfilled.
• Retain canceled orders — Canceled orders were intentionally canceled by an administrator or customer, or timed out while waiting for payment.
• Retain refunded orders — Anonymize the personal data in refunded orders after the specified duration.
• Retain completed orders — Completed orders have been fulfilled.
• Retain ended subscriptions — Retain ended subscriptions and their related orders for the specified duration before anonymizing their personal data. This setting appears only when WooCommerce Subscriptions is active.

When enabled, WooCommerce runs this cleanup daily. It tracks inactive accounts using anonymous metadata and removes only accounts with the subscriber or customer role.

• WooCommerce moves cleaned-up failed, pending, and canceled orders to the trash.
• WooCommerce anonymizes cleaned-up completed and refunded orders so sales statistics remain accurate.
• WooCommerce deletes inactive accounts. An inactive account has not been used to log in or place an order for the specified duration.

Personal data exporter

↑ Back to top

WordPress can export personal data associated with an email address to an HTML file. Go to Tools > Export Personal Data to create a request. WooCommerce adds the following data to the generated file:

• Customer address and account information
• Orders associated with the given email address
• Download permissions and logs associated with the given email address
• Saved-for-later and wishlist entries, including the product ID and name, quantity, date added, and product URL when the product is still available

WordPress sends a confirmation email to verify that the request is genuine. The verification process is:

1. Enter an email address or username.
2. Select Send Request. WordPress emails a confirmation link to the person.
3. The person selects the confirmation link. WordPress marks the request as Confirmed.
4. Select Send Export Link. WordPress emails the person a link to download their personal data.

The export groups entries under Shopper List: saved-for-later and Shopper List: wishlist:

Personal data eraser

↑ Back to top

Go to Tools > Erase Personal Data to create an erasure request for an email address. WordPress uses the same email confirmation process before personal data can be erased.

After the request is confirmed, WooCommerce deletes the registered customer’s saved-for-later and wishlist entries. After a successful erasure, it retains no records from either shopper list.

WooCommerce handles orders, accounts, subscriptions, downloads, and other customer records separately through their own erasers and the retention and erasure settings described above. WooCommerce may anonymize or retain that data when your settings or legal obligations require it.

Questions and support

↑ Back to top

Do you still have questions and need assistance? 

• If you’re looking to extend the core functionality shown here, we recommend reviewing available extensions in the WooCommerce Marketplace.
• Need ongoing advanced support or a customization built for WooCommerce? Hire a Woo Agency Partner.
• Are you a developer building your own WooCommerce integration or extension? Check our Developer Resources.

If you weren’t able to find the information you need, please use the feedback thumbs below to let us know.