Automattic Inc. is the privately-held San Francisco company behind WordPress.com, Jetpack, WooCommerce, Tumblr, Simplenote, Longreads, Day One, Pocket Casts and Beeper, founded by Matt Mullenweg in 2005 and reporting roughly 1,435 employees and half a billion dollars in annual revenue on its own About page. Its privacy policy discloses minimal signup (email, password, username) but broad automatic collection (log data, device identifiers, precise location via app permissions) and use of cookies/pixel tags plus third-party ad networks and analytics providers to recognize devices and deliver targeted ads, with a state-law disclosure that vendor sharing for advertising, marketing or analytics purposes may be considered a 'sale' or 'share.' In February 2024 Automattic's own blog confirmed it began sharing public WordPress.com and Tumblr content with 'select AI companies' for training, opt-out rather than opt-in by default. Automattic publishes a biannual transparency report (25th edition as of this report, running since 2014) that states the company is 'prepared to go to court' on behalf of users against government over-reach or DMCA abuse, and documents pushback against bulk/abusive takedown demands; no FTC/state-AG privacy order, settlement, or major breach was found in the sources checked. The flagship WordPress app's App Store privacy label discloses data linked to identity for advertising/marketing and analytics purposes but, unlike Tumblr's own app label, does not declare a 'used to track you across apps and websites owned by other companies' category.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
Automattic
THIS FILE HEADS ITS OWN CHAIN.
SUBSIDIARIES ON FILE (1)
TOOLS WE RECOMMEND
PLUS
RECEIPTS
8 ON FILE
COLLECTION
Automattic's privacy policy states that basic WordPress.com account signup requires only an email address, password, and username, but that it automatically collects broad log information -- browser type, IP address, unique device identifiers, language preference, referring site, timestamp, operating system, and mobile network information -- whenever the Services are used.
Automattic's privacy policy names its controlling US legal entity directly, stating Automattic Inc. is the controller for some processing activities across all of its services worldwide, with different Automattic companies serving as controller depending on the specific service and user location.
Automattic's About page discloses concrete operating figures for the private company -- approximately 1,435 employees ('Automatticians') worldwide and roughly half a billion dollars in annual revenue -- and lists the full family of brands it owns, including WordPress.com, WooCommerce, Tumblr, Simplenote, Jetpack, Longreads, Day One, and Pocket Casts.
Automattic's privacy policy states it never directly sells personal information for money, but that sharing information with certain advertising, marketing, or analytics vendors can be considered a 'sale' or 'share' under some U.S. state privacy laws, which users may have a right to opt out of.
Automattic's own company blog, in a February 27, 2024 post, confirmed it was 'working directly with select AI companies' and would share public content hosted on WordPress.com and Tumblr with those partners from sites that had not opted out, i.e. an opt-out rather than opt-in default for AI-training data sharing.
Automattic's transparency report site states the company is prepared to go to court on behalf of its users in response to government over-reach or DMCA abuse, and the most recently published edition (its 25th, covering a series running since 2014) documents concrete pushback against bulk abusive DMCA filings during the reporting period.
Automattic's privacy policy states that ads on its services may be delivered by advertising networks and that other parties may provide analytics services, with these third parties setting cookie-based tracking technologies that let them recognize a user's device to compile information about them or others who use the device.
The WordPress app's App Store privacy label, submitted by developer Automattic, states that data including contact info, search history, browsing history, and device/user identifiers is collected and linked to a user's identity for the developer's advertising/marketing and analytics purposes; the label does not include a 'used to track you across apps and websites owned by other companies' category.