LifterLMS is great – but unfortunately not fully GDPR-compliant

I’ve been using LifterLMS for a while, and honestly, I think it’s a fantastic system:

• clear course structure
• well-designed membership features
• solid integrations with payment providers

However, there’s one major issue that makes it difficult (or impossible) to use LifterLMS in a GDPR-compliant way within the EU.

When someone signs up for a free course or free plan, no email verification is required.
This means:

• Anyone can register with a fake or disposable email address – ban in any email marketing is guaranteed.
• Even worse, it’s possible to enter someone else’s email address, and that person will automatically get access to the course – without giving consent.

That’s a clear violation of GDPR principles, since personal data (like an email address) must not be processed without explicit permission.

As a result, LifterLMS in its current state is not GDPR-compliant when offering free courses, lead magnets, or free trials. In practice, this means it can only be safely used for paid courses, which is a real pity – especially because free entry-level content is such an important part of modern online learning.

I’d really like to see the LifterLMS team address this by:

• adding mandatory email verification (even for free courses), and
• including a clear note about this issue in the documentation.

That would be a big step toward true GDPR compliance.

• This topic was modified 1 month, 3 weeks ago by hakuna4matata.
• This topic was modified 1 month, 3 weeks ago by hakuna4matata.