A forum collects personal data from day one: email addresses, IP addresses, usernames, private messages and cookies. This page is a starting point, not legal advice. Consult a lawyer for your specific situation.
List the personal data your forum stores: registration details, IP logs, private messages, analytics and advertising cookies, and newsletter sign-ups. Then decide how long you really need each one. Collecting less means less risk.
If your forum serves people in the EU, the General Data Protection Regulation can apply even if you're located elsewhere. The European Commission: data protection pages explain the principles: a lawful basis for processing, transparency, data minimization, security, and individual rights such as access and deletion. In practice, forum owners commonly add a clear privacy policy, a cookie consent banner for non-essential cookies, and a way for members to request deletion of their account and data.
The COPPA Rule (16 CFR Part 312) applies to websites directed to children under 13, and to sites that knowingly collect personal information from children under 13. It requires verifiable parental consent, among other things. Most general-audience forums require members to be 13 or older and don't knowingly collect children's data. phpBB, for example, has a COPPA registration setting in its admin panel.
Use HTTPS, keep the software updated, limit admin accounts, and protect your backups. They contain member data too (see backing up your forum).
See our own privacy policy for an example of the format. Related: moderation guide
Published October 25, 2026. Some links may be affiliate links; see our Affiliate Disclosure.