feat(plugin-repo): Add privacy policy content check

[faisalahammad]

Summary

Implements the feature requested in #1249.

WordPress.org guidelines require that every plugin which collects, uses, stores, or passes personal data to a third party must suggest privacy policy text to site administrators using wp_add_privacy_policy_content(). In practice, the vast majority of plugins that handle personal data do not implement this.

This PR adds a new Privacy_Policy_Check (static file check) that detects common personal-data-handling signals and warns if wp_add_privacy_policy_content() is absent.

How it works

The check scans all PHP files in the plugin for signals that indicate potential personal data handling:

Signal	Rationale
wp_remote_post()	Transmitting data to external services
wp_remote_get()	Fetching from external URLs (analytics, tracking)
setcookie()	Setting cookies that may track users
$_COOKIE	Reading cookie data
wp_set_auth_cookie()	Authentication cookie handling

If any signal is found and wp_add_privacy_policy_content() is not called anywhere in the plugin, a single warning (severity 5) is emitted on the plugin's main file with a link to the WordPress privacy developer docs.

Plugins with no signals are completely unaffected — the check stays silent.

Design decisions

• Warning, not error — the presence of these API calls doesn't guarantee personal data is being mishandled; it's a strong enough signal to inform authors but not block submission
• One warning per plugin — avoids noise by stopping after the first matched signal
• Early exit — checks for wp_add_privacy_policy_content() first; if present, skips all signal scanning
• Conservative signals — only high-confidence indicators (remote posts/gets, cookies) are included, not noisy ones like raw $_POST/$_GET

Files changed

• includes/Checker/Checks/Plugin_Repo/Privacy_Policy_Check.php — new check class
• includes/Checker/Default_Check_Repository.php — register as privacy_policy
• docs/checks.md — add row to the checks table
• tests/phpunit/tests/Checker/Checks/Privacy_Policy_Check_Tests.php — 3 test cases
• tests/phpunit/testdata/plugins/test-plugin-privacy-policy-with-errors/ — has signal, no privacy call → triggers warning
• tests/phpunit/testdata/plugins/test-plugin-privacy-policy-without-errors/ — has signal + wp_add_privacy_policy_content() → clean
• tests/phpunit/testdata/plugins/test-plugin-privacy-policy-no-signals/ — no signals → clean

Testing

Manually verified against Mailchimp for WordPress (mc4wp) — correctly fires the missing_privacy_policy_content warning on mailchimp-for-wp.php.

Verified against Akismet (which properly calls wp_add_privacy_policy_content()) — no warning produced.

Closes #1249

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: faisalahammad <faisalahammad@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.