Why Is WooCommerce Showing a Customer Photo Automatically? Gravatar Privacy Fix

A WooCommerce store owner may discover an unexpected customer photo inside the WordPress or WooCommerce customer details screen.

This can be especially concerning when:

The website has no profile-photo upload option.
The customer says they never uploaded the image.
The photo is several years old.
The image appears to have previously been used on Facebook or another platform.
The customer considers its appearance an invasion of privacy.

The immediate assumption may be that WooCommerce accessed Facebook, Gmail, or another social account without permission.

In most cases, however, WooCommerce did not retrieve the photo directly from Facebook. The image is usually being supplied by Gravatar, the global avatar service used by WordPress.

This guide explains where the photo comes from, how to confirm its source, how the customer can remove it, and how store owners can prevent external customer avatars from appearing again.

Why Does WooCommerce Show a Customer Photo?

WooCommerce customer accounts are built on the WordPress user system.

When WooCommerce needs an avatar for a customer, its customer class calls the WordPress get_avatar_url() function using the customer’s email address. WooCommerce does not need a local profile-photo upload field for this to happen.

WordPress then checks whether that email address is associated with a Gravatar profile. WordPress supports retrieving avatars from a user ID, user object, email address, or email hash.

The process normally works like this:

A customer creates a WooCommerce account using an email address.
WooCommerce requests an avatar for that email.
WordPress creates a hash of the email address.
WordPress constructs a Gravatar image URL using that hash.
Gravatar returns the image associated with the email address.
WooCommerce displays the image in the customer details interface.

The raw email address is not placed directly in the Gravatar image URL. WordPress uses an email hash to request the image. Gravatar explains that websites compare these hashes so they can display an associated avatar without sending the email address directly in the image request.

Did WooCommerce Take the Photo from Facebook?

There is normally no evidence that WooCommerce directly accessed the customer’s Facebook account.

WooCommerce core retrieves the avatar through WordPress using the customer’s email address. Its customer avatar method does not contain a Facebook-photo import process.

An old Facebook photo could have previously been:

Uploaded manually to Gravatar.
Added to a WordPress.com or Gravatar profile.
Associated with another email connected to the same Gravatar account.
Imported or synchronized by an older application or profile service.
Added through a social-login plugin on another website.

Gravatar supports multiple email addresses and allows a different avatar to be assigned to each address. Therefore, the email used for the WooCommerce account may already be connected to an old Gravatar or WordPress.com profile.

The fact that the picture was once used on Facebook does not prove that the WooCommerce website retrieved it from Facebook.

It only shows that the same image was used in more than one place at some point.

The Customer Does Not Need a Gmail Login

Gravatar is not limited to Gmail accounts or Google authentication.

The important value is the email address saved in the WordPress customer account. It can be:

Gmail
Outlook
Yahoo
A company email
A custom-domain email
Any other valid email address

The customer does not need to log into the WooCommerce store using Google for a Gravatar image to appear.

The email only needs to be registered with a Gravatar or related WordPress.com account. Gravatar states that an avatar can appear on a supported website when the email used on that website is registered with the Gravatar account.

How to Confirm That the Image Comes from Gravatar

Before changing any settings, confirm the actual source of the image.

Method 1: Inspect the Image URL

Open the WordPress customer details screen and locate the unexpected photo.

Depending on the browser:

Right-click the photo.
Select Open image in new tab, Copy image address, or Inspect.
Check the image domain.

A Gravatar URL will normally contain something similar to:

secure.gravatar.com/avatar/

You may also see query parameters controlling the image size, rating, or default avatar.

Do not publish the customer’s complete avatar URL in a public support post. Although it does not contain the plain email address, it may contain a reusable hash associated with that address.

Method 2: Use Browser Developer Tools

Press:

F12

Open the Elements or Inspector tab and select the avatar image.

Look for the image’s src attribute:

<img src="https://secure.gravatar.com/avatar/..." alt="">

If the URL uses secure.gravatar.com, the image is being supplied by Gravatar.

Method 3: Check the Customer Email

Go to:

WordPress Dashboard > Users > All Users

Open the affected customer and check the email address.

You can also check:

WooCommerce > Customers

The account email is the value WooCommerce uses when requesting the customer avatar.

What If the Image Is Not Hosted by Gravatar?

If the image URL does not contain a Gravatar domain, another plugin or custom feature may be supplying it.

Check whether the image URL contains:

facebook.com
fbcdn.net
googleusercontent.com
wp-content/uploads

Possible sources include:

Social-login plugins
Membership plugins
Community or forum plugins
Local avatar plugins
Customer-dashboard plugins
CRM integrations
Custom user-profile code
Previously imported user metadata

Do not immediately delete the customer account.

Instead, create a staging backup and temporarily disable relevant profile or social-login plugins one at a time.

After each test:

Clear the WordPress cache.
Clear the object cache.
Clear the CDN cache.
Reload the customer screen in a private browser window.

You can also inspect the user’s stored metadata with WP-CLI:

wp user meta list CUSTOMER_USER_ID

Replace CUSTOMER_USER_ID with the affected WordPress user ID.

Look for metadata keys containing terms such as:

avatar
photo
picture
profile_image
social
facebook

Do not delete unfamiliar metadata without taking a database backup and confirming which plugin created it.

Solution 1: Remove or Replace the Photo Through Gravatar

The best solution for one specific customer is for that customer to manage the avatar connected to their email address.

The customer should:

Visit Gravatar.
Attempt to sign in using the same email address saved in WooCommerce.
Use the WordPress.com password-reset process if they do not remember creating the account.
Open the avatar or profile settings.
Delete the old image or upload a replacement.
Review the account’s privacy settings.

A Gravatar account is connected to WordPress.com infrastructure, so password management may take place through the associated WordPress.com account.

The customer can also disable their public avatar or make the profile private. Gravatar’s privacy settings allow users to disable the public avatar, disable the public profile, discourage search-engine indexing, or disable the Gravatar profile entirely.

After changing the avatar:

Clear the browser cache.
Clear the WordPress cache.
Clear any CDN cache.
Reopen the customer screen.

The old image may remain visible temporarily if it has been cached.

Solution 2: Disable Avatars Across WordPress

If the store does not need customer, author, or comment avatars, disable them globally.

Go to:

WordPress Dashboard > Settings > Discussion

Scroll to the Avatars section.

Disable:

Show Avatars

Save the settings.

WordPress provides this setting specifically to suppress avatar display. WordPress uses Gravatar by default for avatars, although plugins can override the standard behavior.

This is the simplest privacy-conscious option for a WooCommerce store that has no reason to display customer photos.

However, some plugins and API-based WooCommerce interfaces may request an avatar URL directly rather than using the normal WordPress avatar HTML function. WooCommerce itself exposes a customer avatar URL through its customer object and REST responses.

Therefore, disabling Show Avatars may not remove the image from every custom dashboard or plugin interface.

If the photo continues appearing, use the code-based solution below.

Solution 3: Replace All External Avatars with a Local Image

A store owner can force WordPress and WooCommerce to use a locally hosted placeholder instead of requesting customer images from Gravatar.

First, upload a generic avatar image to the WordPress Media Library.

A suitable filename would be:

default-customer-avatar.png

Copy its complete URL.

Next, install the Code Snippets plugin or add the code to a small custom plugin.

Avoid editing the parent theme’s functions.php file because a theme update may overwrite the change.

Add:

<?php
/**
 * Replace external WordPress and WooCommerce avatars
 * with a locally hosted placeholder.
 */
function debugnexus_use_local_default_avatar( $args, $id_or_email ) {
	$args['url'] = 'https://example.com/wp-content/uploads/default-customer-avatar.png';
	$args['found_avatar'] = false;

	return $args;
}

add_filter( 'pre_get_avatar_data', 'debugnexus_use_local_default_avatar', 10, 2 );

Replace:

https://example.com/wp-content/uploads/default-customer-avatar.png

with the actual URL of the local placeholder.

The pre_get_avatar_data filter can short-circuit the normal avatar lookup when a URL is supplied. This prevents WordPress from returning the customer’s Gravatar URL and ensures that WooCommerce’s direct avatar requests receive the local placeholder instead.

Activate the snippet and clear all caches.

Then test:

Users > All Users
WooCommerce > Customers
WooCommerce order details
My Account
Product reviews
WordPress comments
REST API integrations

This solution affects all WordPress users, including administrators and authors.

Solution 4: Replace Avatars Only for WooCommerce Customers

If administrators and post authors should keep their normal avatars, restrict the replacement to users with the WooCommerce customer role.

Upload a local placeholder image and add:

<?php
/**
 * Replace Gravatar images only for WooCommerce customers.
 */
function debugnexus_local_avatar_for_woocommerce_customers( $args, $id_or_email ) {
	$user = false;

	if ( $id_or_email instanceof WP_User ) {
		$user = $id_or_email;
	} elseif ( is_numeric( $id_or_email ) ) {
		$user = get_user_by( 'id', absint( $id_or_email ) );
	} elseif ( is_string( $id_or_email ) && is_email( $id_or_email ) ) {
		$user = get_user_by( 'email', $id_or_email );
	} elseif (
		$id_or_email instanceof WP_Comment &&
		! empty( $id_or_email->user_id )
	) {
		$user = get_user_by( 'id', absint( $id_or_email->user_id ) );
	}

	if (
		$user instanceof WP_User &&
		in_array( 'customer', (array) $user->roles, true )
	) {
		$args['url'] = 'https://example.com/wp-content/uploads/default-customer-avatar.png';
		$args['found_avatar'] = false;
	}

	return $args;
}

add_filter(
	'pre_get_avatar_data',
	'debugnexus_local_avatar_for_woocommerce_customers',
	10,
	2
);

Replace the placeholder URL with the actual image URL from the Media Library.

This keeps normal Gravatar behavior for administrators, editors, and authors while replacing avatars for registered WooCommerce customers.

Test the code on staging before activating it on a production store.

Solution 5: Hide the Avatar with CSS

CSS can hide the image visually, but it is not the best privacy solution.

For example:

.woocommerce-customer-details img.avatar,
.woocommerce-account img.avatar {
	display: none !important;
}

This only hides the image after the browser has loaded the page.

The external avatar URL may still exist in:

The page source
Network requests
REST API responses
Administrator screens
Other templates

Use CSS only as a temporary display adjustment.

To prevent the Gravatar URL from being returned, use the WordPress setting or PHP filter instead.

Clear Cached Avatar Images

An old customer photo may remain visible after it has been removed or replaced.

Clear each applicable caching layer:

WordPress caching plugin
Server or hosting cache
Object cache such as Redis or Memcached
CDN cache
Browser cache
WooCommerce application cache
Any customer-dashboard plugin cache

Test again in a private or incognito browser window.

You can also temporarily inspect the page with browser developer tools and disable caching from the Network tab.

Should the Customer Change Their WooCommerce Email?

Changing the customer’s account email to an address without a Gravatar may cause the old photo to disappear.

However, this should not be the first solution.

Changing the email could affect:

Login credentials
Order notifications
Password-reset emails
Subscription notifications
Payment-account matching
CRM integrations
Membership access
Customer records

It is better to remove the Gravatar image or disable external avatars at the website level.

Privacy Recommendations for WooCommerce Store Owners

Even when an avatar is supplied through a standard WordPress feature, customers may not expect an old personal photo to appear inside an ecommerce account.

Store owners should consider the following:

Disable avatars when the website does not need them.
Use a neutral, locally hosted customer placeholder.
Avoid showing customer avatars publicly without a clear purpose.
Review social-login and customer-profile plugins.
Avoid publishing screenshots containing names, emails, addresses, or customer photos.
Blur personal information before sharing screenshots with support.
Document any external profile or avatar services used by the website.
Test new customer accounts using different email providers.
Review both frontend and administrator customer screens.

Gravatar describes itself as a global public-profile service designed to share profile information across websites that use its system. Customers who do not expect this behavior may reasonably find the automatic appearance surprising.

How to Test the Complete Fix

Create a fresh test customer using an email address that has an existing Gravatar.

Check the following locations:

WordPress > Users
WooCommerce > Customers
WooCommerce > Orders
My Account dashboard
Product reviews
Comment sections
Customer profile plugins
Mobile applications
REST API integrations

Confirm that:

The old photo no longer appears.
A local placeholder appears where required.
No avatar image is broken.
Administrator avatars still work if using the customer-only code.
The browser does not request the old Gravatar URL.
Customer account and checkout features continue working.
Order emails are unaffected.

Open the browser Network tab and search for:

gravatar

When the local replacement is working correctly, no customer-avatar image request should be made to the Gravatar domain.

Frequently Asked Questions

Did WooCommerce access the customer’s Facebook account?

WooCommerce core normally uses the customer’s email address to request an avatar through WordPress. It does not need access to the customer’s Facebook account.

An old Facebook picture may have previously been added to a Gravatar, WordPress.com, or connected profile, but WooCommerce alone cannot reveal exactly when or how the image was originally added.

Why is there a photo when WooCommerce has no upload field?

WooCommerce can display an externally hosted Gravatar associated with the account email. The image does not need to be uploaded to the WooCommerce website.

Is the image stored in the WordPress Media Library?

Usually not when it comes from Gravatar.

Inspect the image URL. A Gravatar image normally loads from:

secure.gravatar.com

A locally uploaded image normally loads from:

wp-content/uploads

Can the store owner delete the customer’s Gravatar?

No. The Gravatar account belongs to the person who controls the associated account.

The store owner can disable avatar display, replace external avatars with a local placeholder, or ask the customer to update their Gravatar settings.

Will disabling avatars delete the customer photo?

No.

Disabling avatars only prevents the website from displaying them. It does not delete the original image from Gravatar or another external service.

Can I disable Gravatar without installing a plugin?

Yes.

Use:

Settings > Discussion > Show Avatars

For stronger control over WooCommerce and API-based avatar URLs, add the provided PHP filter through a custom plugin or child theme.

Is Gravatar the same as Facebook?

No.

Gravatar is an avatar and public-profile service operated within Automattic’s WordPress.com ecosystem. Facebook does not automatically become the source of every image that happens to match a Gravatar.

Final Conclusion

WooCommerce usually does not secretly retrieve customer photos from Facebook.

The photo appears because WooCommerce asks WordPress for an avatar using the customer’s email address. WordPress then returns the Gravatar associated with that email.

The safest solutions are:

Ask the customer to remove or replace the image through Gravatar.
Disable avatars under Settings > Discussion.
Replace external avatars with a locally hosted placeholder.
Inspect social-login or profile plugins if the image is not coming from Gravatar.
Clear all caches and test every customer interface.

For stores that do not use customer profile photos, replacing Gravatar with a neutral local avatar provides the most consistent and privacy-conscious result.