WordPress Cookie Banner: Setup & Compliance
Adding a cookie banner to WordPress is easy — there are dozens of plugins. Getting one that actually blocks trackers before consent, rather than just showing a notice, is the part that matters. This guide covers how to add and configure a WordPress cookie banner, how to tell a real blocker from a notice-only plugin, and the US litigation angle most WordPress tutorials skip.
To add a cookie banner to WordPress: install a consent plugin (or a script-based consent tool), enable prior-blocking so non-essential scripts wait for consent, connect it to Google Consent Mode v2, and add your privacy-policy link. The key decision is picking a plugin that blocks, not one that only displays a notice.
- Running GA4, ads, or pixels: you need real script-blocking, not a notice bar — verify in DevTools.
- Session-replay tools + US traffic: Hotjar/Clarity firing before consent creates CIPA exposure — the highest-risk gap.
- Multiple client sites (agency): a script-based tool with flat pricing often beats per-site plugin licences.
Do you need a cookie banner on WordPress?
For most sites, yes. The moment you add Google Analytics 4, a Meta Pixel, an ads tag, an embedded video, or most marketing plugins, your WordPress site places non-essential cookies on visitors. The EU's GDPR and ePrivacy rules require opt-in before those load; California's CCPA and 18 other US state laws require a clear opt-out. A cookie banner is how you offer that choice — and increasingly, how you avoid both regulatory fines and the US wiretapping-lawsuit wave covered below.
WordPress makes the "add a banner" part trivial — that's not the challenge. The challenge is that the ecosystem is full of plugins that show a compliant-looking banner while doing nothing to actually hold your trackers.
The plugin trap: a notice is not the same as blocking
This is the WordPress-specific pitfall, and it's worth understanding before you install anything. Cookie-consent plugins fall into two camps that look identical to a visitor but are legally very different:
- Notice-only plugins display a banner and record the click, but don't stop scripts from firing. GA4, your pixel, and Hotjar load on page render regardless of what the visitor chose.
- Prior-blocking plugins actually withhold non-essential scripts until consent is granted, then release them by category.
Under GDPR, only the second kind meets the requirement. A banner that shows while trackers fire satisfies the notice obligation but not the consent obligation — the exact failure mode enforcement has focused on.
Plugin conflicts: a consent plugin can clash with caching, optimisation, or another script-manager plugin, silently breaking blocking after an update. Manually-added tags: anything you pasted into your theme's header, a code-snippets plugin, or Google Tag Manager may fire outside the consent plugin's control unless explicitly registered.
How to set up a WordPress cookie banner
The correct sequence, whichever tool you choose:
- Pick a consent solution that does prior-blocking (not notice-only), supports Google Consent Mode v2, and honours the GPC signal. This is the decision that matters most.
- Install and activate it. Run its cookie scanner so it categorises the trackers already on your site — analytics, marketing, functional, session-recording.
- Enable auto-blocking so non-essential scripts are held until consent. If you use Google Tag Manager, set the Consent Mode v2 default-deny state to fire before GTM loads.
- Register any manually-added tags (theme header, code-snippets plugin) so they're gated too — these are the ones most setups miss.
- Add your privacy-policy and cookie-policy links to the banner, then save.
- Test in incognito with DevTools → Network: confirm non-essential scripts stay blocked until you consent. Re-test after any plugin or theme update.
See which trackers fire before consent on your WordPress site
A banner that's showing isn't proof anything is blocked. Run a free scan to see every tracker and cookie firing before a visitor opts in — including manually-added and GTM tags — in about 10 seconds. No account needed.
Scan your site free →What most WordPress cookie-banner setups miss
Even with a plugin installed, WordPress consent commonly fails in these ways:
- The plugin only notifies. The most common gap — a banner that doesn't block. Verify in DevTools, don't trust the plugin's marketing.
- GTM fires before the consent default. If Consent Mode v2's default-deny state isn't set before GTM initialises, Google tags fire first.
- Theme-header and code-snippet tags left ungated. Scripts added outside the plugin fire independently.
- A plugin conflict silently broke blocking after a caching or optimisation-plugin update.
- Embeds forgotten. A YouTube or Vimeo embed sets third-party cookies on render.
We built the deeper, WordPress-specific version of this — including plugin-conflict handling and a full native-vs-ConsentPixel breakdown — into our cookie consent for WordPress guide.
Your 3 options for a compliant WordPress cookie banner
Three realistic routes — honestly compared, strongest coverage first.
1. An independent consent tool (e.g. ConsentPixel)
Best for: any WordPress site running GA4, GTM, pixels, or session-replay — especially with US visitors, or an agency managing many sites. A script-based consent layer that blocks trackers before consent regardless of how they were added, passes all four Google Consent Mode v2 parameters, detects GPC, and keeps a timestamped consent log — without depending on the WordPress plugin ecosystem's conflicts. Among independent tools, ConsentPixel — Privacy · Verified is built prevention-first and works the same across every client site.
2. A prior-blocking WordPress plugin (Complianz, CookieYes, Real Cookie Banner, WPConsent)
Best for: single WordPress sites wanting an in-dashboard tool. These are genuine prior-blocking plugins with cookie scanners and policy generators — capable and widely used. The difference is emphasis: confirm auto-blocking is enabled and actually working in DevTools, watch for plugin conflicts after updates, and check GPC/CIPA coverage, which varies by plugin and plan.
3. A notice-only plugin
Best for: honestly, almost no one running real trackers. A simple notice bar is fine only for a site with no non-essential cookies at all. If you run GA4, ads, or pixels, a notice-only plugin leaves you meeting the notice requirement but not the consent requirement.
The US angle most WordPress guides skip: CIPA
Nearly every "WordPress cookie banner" tutorial focuses on GDPR. It matters — but if any of your visitors are in the United States, the more urgent 2026 risk is often the California Invasion of Privacy Act (CIPA). Plaintiffs' firms have built a sustained wave of "wiretapping" lawsuits arguing that session-replay tools, tracking pixels, and chat widgets capturing a visitor's activity before consent amount to unlawful interception. Under California Penal Code §637.2, a plaintiff can seek statutory damages of $5,000 per violation — often read per affected visitor — with no proof of harm required.
Why this hits WordPress sites specifically: WordPress's plugin ecosystem makes it trivial to add Hotjar, Clarity, or Lucky Orange — and notice-only consent plugins won't block them. A WordPress site running session-replay and serving California visitors can carry real exposure even with a banner on screen. The fix is a plugin or tool that hard-blocks those scripts until consent. You can follow the trend on our CIPA Lawsuit Tracker.
If your WordPress site uses any session-replay or heatmap tool and gets US traffic, confirm your consent plugin actually blocks it before consent — many don't. It's the single highest-value privacy fix on most WordPress sites.
See exactly what fires on your WordPress site before consent
Run the same scan a plaintiff's firm would: every tracker and cookie loading before opt-in — plugin, theme-header, and GTM tags included — in about 10 seconds. Then, if it's your site, close the gap and run ConsentPixel free for 14 days.
Scan your WordPress site free →Frequently asked questions
How do I add a cookie banner to WordPress?
Install a consent solution — either a prior-blocking plugin (such as Complianz, CookieYes, Real Cookie Banner, or WPConsent) or a script-based consent tool — then enable auto-blocking so non-essential scripts wait for consent, connect it to Google Consent Mode v2, and add your privacy-policy link to the banner. The important choice is picking a solution that genuinely blocks trackers, not one that only displays a notice. Always test in incognito with DevTools to confirm scripts stay blocked until consent.
What's the difference between a notice-only and a blocking cookie plugin?
A notice-only plugin displays a banner and records the click, but doesn't stop scripts from firing — GA4, your pixel, and Hotjar load regardless of the visitor's choice. A prior-blocking plugin actually withholds non-essential scripts until consent is granted, then releases them by category. Under GDPR, only the blocking kind meets the requirement; a notice-only banner satisfies the notice obligation but not the consent obligation. This is general information, not legal advice.
Why do my trackers fire before visitors consent on WordPress?
Common causes: your consent plugin is notice-only and doesn't block; Google Tag Manager loads before the Consent Mode v2 default-deny state is set; tags were added to your theme header or a code-snippets plugin outside the consent plugin's control; or a plugin conflict (often after a caching-plugin update) silently broke blocking. The fix is a solution that loads first, genuinely blocks non-essential scripts, and gates manually-added tags too. This is general information, not legal advice.
Is a WordPress cookie banner GDPR compliant on its own?
Only if it actually blocks non-essential scripts before consent. GDPR requires non-essential processing to wait for consent, so a banner that merely displays while your GA4, pixel, or Hotjar keep firing meets the notice requirement but not the consent requirement. To make a WordPress site genuinely compliant, use a prior-blocking solution that sets Google Consent Mode v2 and honours GPC — and verify it in DevTools. No tool makes any website fully compliant on its own. This is general information, not legal advice.
Does my WordPress site have CIPA (US wiretapping) risk?
Potentially, yes — if your WordPress site uses session-replay or heatmap tools (like Hotjar or Clarity), tracking pixels, or chat widgets that capture visitor activity before consent, and you receive visitors from California. Under California Penal Code §637.2, plaintiffs can seek statutory damages of $5,000 per violation, often read per affected visitor, with no proof of harm required. WordPress's plugin ecosystem makes these tools easy to add and notice-only plugins won't block them. The protective step is to hard-block session-replay before consent. This is general information, not legal advice.
Which is best for an agency managing many WordPress sites?
Per-site plugin licences add up fast across a client portfolio, and each site's plugin stack introduces its own conflict risk. A script-based consent tool with flat multi-domain pricing often works out cheaper and more consistent, since it behaves identically on every site regardless of that site's plugins. ConsentPixel's agency plans cover multiple domains at a flat rate with the same prevention-first blocking, CIPA coverage, and consent logging across all of them — worth comparing against per-site plugin costs.