To add cookie consent to WordPress, install a consent plugin or add a consent script to your theme's header, scan the site for the cookies it sets, and make sure analytics and marketing tags wait until visitors opt in. A plain cookie warning that only says "this site uses cookies" is not consent. WordPress core sets only login and comment cookies, so most consent work comes from the plugins, themes and tags you add.
WordPress runs a large share of the web, and regulators notice
WordPress runs 39.7% of all websites, according to W3Techs on 16 October 2026, and 58.4% of sites with a known content management system. That scale draws attention from data protection authorities across Europe, the UK, California, Brazil and beyond.
If your site runs on WordPress, it almost certainly sets cookies. Some are strictly necessary for the platform to function. Others, such as analytics trackers, advertising pixels and social embeds, need visitor consent under the GDPR and the ePrivacy Directive, or an opt-out under the CCPA. Ignoring that carries real financial risk. On 1 September 2025 France's CNIL fined SHEIN 150 million euros, in part because cookies were placed before visitors made a choice and kept being placed after they refused.
So for most WordPress sites, the question is not whether a cookie banner is needed but which cookies it has to control.
The cookies a WordPress site sets
Yes, WordPress uses cookies. WordPress's own cookie documentation lists a small set for signed-in users and commenters, plus a test cookie that checks whether the browser accepts cookies. The login cookies are strictly necessary and do not need consent under Article 5(3) of the ePrivacy Directive.
The moment you add a plugin, a theme with embedded fonts or a third-party tracking script, the picture changes. Many WordPress sites end up with dozens of cookies from several sources, and knowing which cookie belongs to which category comes first.
| Cookie | Set by | Purpose | Category |
|---|---|---|---|
wordpress_logged_in_[hash] | WordPress core | Identifies signed-in users across the admin and the site | Strictly necessary |
wordpress_[hash] | WordPress core | Stores authentication details for the admin area | Strictly necessary |
wp-settings-[UID], wp-settings-time-[UID] | WordPress core | Keeps a signed-in user's admin display preferences | Strictly necessary |
comment_author_[hash] | WordPress core | Remembers a commenter's name and email, for just under a year | Functional |
_ga, _ga_<container-id> | Google Analytics | Distinguishes visitors and measures sessions | Analytics |
_fbp | Meta Pixel | Tracks visitors for Facebook advertising | Marketing |
woocommerce_cart_hash, wp_woocommerce_session_* | WooCommerce | Keeps the cart and the shopping session | Strictly necessary |
sbjs_* | WooCommerce order attribution | Records where a visit came from | Analytics |
tk_ai | Jetpack and WooCommerce | Anonymous traffic tracking | Analytics |
WordPress's documentation writes the admin settings cookie as wp-settings-{time}-[UID], but the browser stores it as the two cookies named in the table. WooCommerce adds its own session and cart cookies, and its order attribution feature sets sbjs_* cookies that need consent. Payment providers, abandoned cart recovery and upsell plugins add more.
What the law actually requires
Two legal frameworks matter most for cookie consent on WordPress sites. The GDPR sets the data protection rules across the EU and EEA, while Article 5(3) of the ePrivacy Directive governs storing information on a visitor's device. Together, they require prior, informed, granular consent before any non-essential cookie is set.
That means your WordPress site must hold analytics, marketing and non-essential functional cookies until a visitor actively opts in. Pre-ticked boxes do not count. A banner that only says "this site uses cookies" without a real choice fails the test, as the EDPB guidelines on consent make clear.
For visitors from California, the CCPA requires a clear opt-out from the sale or sharing of personal information, which includes data collected through tracking cookies. The CCPA regulations in force since March 2023 also require symmetry in choice and bar dark patterns: if opting out takes more steps than opting in, the choice is not symmetrical.
UK GDPR and PECR
Sites aimed at UK visitors fall under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). The ICO applies the same consent standard: non-essential cookies need opt-in consent, and rejecting must be as easy as accepting. Since 5 February 2026, some low-risk analytics and appearance cookies can instead rely on clear information and a way to object, under conditions set in PECR.
Brazil, Canada and South Africa
The LGPD in Brazil, PIPEDA in Canada and POPIA in South Africa each set their own consent or notice requirements. A WordPress site with international traffic cannot rely on one country's rules.
Why a basic cookie warning is not enough
Many WordPress themes ship with a simple dismissible cookie warning that reads something like "This website uses cookies to improve your experience." That notice, on its own, does not meet any major privacy law. It offers no choice by category, does not block scripts before consent and leaves no record of what visitors agreed to.
A real consent banner does several things at once: it names the cookies and their purposes, offers category-level controls (strictly necessary, functional, analytics, marketing), gives an equally prominent reject option on the first layer and blocks non-essential scripts until consent is recorded.
Script blocking is the part most WordPress sites get wrong. Adding Google Analytics through a theme settings panel or a header and footer plugin usually means the tracking script loads on every page view, whatever the visitor chose. That sets _ga and _ga_<container-id> before the visitor has even seen the banner, the pattern behind the SHEIN fine.
Google Consent Mode and WordPress
Since March 2024, Google has required Google Consent Mode v2 signals for advertising measurement and personalisation for EEA and UK traffic. If your WordPress site uses Google Analytics 4, Google Ads or Google Tag Manager, you need a consent tool that sends the right signals to Google's tags.
Without those signals, Google limits conversion modelling and remarketing audiences from European visitors. A consent tool integrated with Consent Mode sends ad_storage, analytics_storage, ad_user_data and ad_personalization to Google's tags based on the visitor's choice.
How to add a cookie banner to WordPress
The Kukie.io WordPress plugin adds the Kukie.io banner to every page. The banner holds more than 30 known trackers until the visitor consents and sends Consent Mode signals once that integration is switched on.
Step 1: Scan your site
Run a cookie scan to find every cookie your WordPress site sets. The scanner finds first-party and third-party cookies, sorts them into categories and shows which ones appear before consent.
Step 2: Install the WordPress plugin
Install the Kukie.io plugin from the Plugins screen of the WordPress admin and connect it to your Kukie.io site. The plugin then adds the banner script to every page. The WordPress installation guide in the Help Centre covers each step.
Step 3: Configure categories and regions
Set up region rules so European visitors see an opt-in banner and Californian visitors see the opt-out they are entitled to. Assign each cookie to its category and adjust the banner design to match your theme.
Step 4: Test and verify
Check that non-essential cookies are actually blocked before consent. Open Chrome DevTools, clear your cookies and reload the page. Only strictly necessary cookies should appear before you interact with the banner. The guide to auditing cookies with Chrome DevTools walks through it.
Common WordPress cookie mistakes
Certain patterns appear again and again on WordPress sites that fail a consent check.
Loading _ga through the theme's built-in analytics field skips any consent logic. Google Analytics should only load after the visitor grants analytics consent. The same applies to the Meta Pixel, Hotjar and any marketing tag added through a header injection plugin.
A cookie wall that blocks page content until the visitor selects "Accept" goes against EDPB guidance. Visitors must be able to browse the site whatever they choose.
WooCommerce analytics cookies are another blind spot. Cart and session cookies are strictly necessary, but order attribution and the Jetpack integration set cookies that fall under analytics.
The WP Consent API and other plugins
The WP Consent API is a feature plugin maintained under the WordPress organisation, not part of WordPress core. It gives plugins a shared way to ask whether the visitor has consented to a category before setting their own cookies, and WooCommerce's order attribution is one of the plugins that reads it.
This matters on sites running several plugins that each set tracking cookies. Without a shared consent layer, each plugin works on its own and may set cookies whatever the visitor chose. The Kukie.io plugin passes the visitor's choice to the WP Consent API when that plugin is installed.
WordPress cookie consent questions
Does a WordPress blog without analytics need a cookie banner?
A plain WordPress install sets only strictly necessary cookies for sign-in plus functional cookies for commenters. With no analytics, advertising pixels or third-party embeds, you may not need a consent banner. Most themes and plugins add more cookies, so run a scan before you decide.
Are WooCommerce cart cookies exempt from consent?
WooCommerce cookies that manage the cart and checkout session are strictly necessary under Article 5(3) of the ePrivacy Directive and need no consent. Order attribution cookies (sbjs_*) and tracking cookies from WooCommerce extensions do need consent.
Can I use a free cookie consent plugin?
Free plugins often show a notice without blocking scripts before consent. Check that the plugin stops non-essential cookies until the visitor opts in, offers category controls and keeps a consent log before you rely on it.
How does Google Consent Mode work with WordPress?
Google Consent Mode sends the visitor's consent state to Google's tags. When a visitor declines analytics cookies, the tags run in a restricted mode without setting cookies, which lets Google model conversions. A consent tool integrated with Consent Mode sends the signals on each page load.
Do I need different cookie banners for GDPR and CCPA?
The GDPR requires opt-in consent while the CCPA requires an opt-out. A consent tool with geo-detection can show each visitor the banner type their region rule calls for from a single installation.
Find the cookies your WordPress plugins add
WordPress core sets a handful of cookies. Your plugins and theme decide the rest. The Cookie scanner loads your site like a visitor and lists every cookie it finds by name and category, so you know what your banner has to control.
