Meh, that's not very good but also not clearly non-compliant.
a bundled consent practice which seems to violate Art.7(4)
Only if they are actually asking for consent on that screen, which does not seem to be the case. Agreement with a privacy policy does not fulfil the conditions for consent, where consent is to be used as a legal basis.
Since such privacy policies are just unilateral notices, it is not required to ask the user to “agree” with them. However, the data subject should be transparently informed about how their data will be used, usually with a layered information approach as suggested by the EDPB guidelines on transparency.
In privacy policies of both companies it is mentioned that they use personal data for marketing purposes in some vague terms. However no opt-out possibility is provided during the signup (bundled consent)
It is not clear that any consent is involved for ordinary processing activities. The WP notice talks about consent e.g. with regards to cookies.
Direct marketing can be a legitimate interest and doesn't always require consent. However, if they were to send direct marketing to existing paying customers via the email address which the user signed up with, that would only be allowed if the user was given the chance to opt out during signup. This is not part of the GDPR, but part of the ePrivacy directive.
Neither [data controller] seems to provide a complete list of data processors according to Art.15(1c).
Yup, not very good. However, it is only necessary to inform data subjects about “recipients or categories of recipients” of the personal data. Some categories of recipients are clearly listed. The GDPR only requires a full list of subprocessors when the company wants to be a processor for another controller, see Art 28(2).
Can't believe they are not GDPR compliant.
Viewing compliance as a binary true/false state is not very helpful. Both companies are probably mostly compliant, but almost certainly have some details that could be improved. Do not expect that any company is fully 100% compliant beyond any doubt. Companies consist of people, and people aren't perfect.
Note than even no Privacy Policy mentioned in WP.com
