WooCommerce cookie consent splits into two jobs. WooCommerce's cart and session cookies are strictly necessary and need no consent. Its order attribution cookies (sbjs_*) and every analytics or advertising pixel you add, such as GA4 or the Meta Pixel, must wait until the visitor opts in. A consent tool that blocks those scripts, and passes the choice to the WP Consent API, covers both.
WooCommerce sets cookies before you add a single plugin
Every WooCommerce installation places cookies on visitors' devices once someone interacts with the shop. These cookies handle the cart, sign-in and session. Most count as strictly necessary, so they keep the store working and need no prior consent under Article 5(3) of the ePrivacy Directive.
WooCommerce is not tracker-free, though, and the problem grows with every analytics, remarketing or advertising plugin you add. A store whose GA4 or Meta Pixel loads before a visitor selects "Accept" breaks the consent rule under the GDPR and the UK GDPR, and can fall foul of US state laws such as the CCPA.
Which WooCommerce cookies are strictly necessary
WooCommerce core sets a handful of cookies for the cart and session. These need no consent because the store cannot function without them.
| Cookie name | Purpose | Duration | Consent needed? |
|---|---|---|---|
woocommerce_cart_hash | Stores a hash of the cart contents to detect changes | Session | No |
woocommerce_items_in_cart | Flags whether the cart contains items | Session | No |
wp_woocommerce_session_* | Links each visitor to their server-side session and cart | 2 days | No |
woocommerce_recently_viewed | Stores recently viewed product IDs | Session | Arguable (functional) |
wordpress_logged_in_* | Authenticates signed-in customers | Session or 14 days | No |
These cookies are tied to the cart or to sign-in. A cookie banner should list them for transparency, but it does not need to block them. WooCommerce runs its own session handler, so a PHPSESSID cookie on your store comes from another plugin, not from WooCommerce.
Order attribution: WooCommerce's own tracking cookies
WooCommerce's order attribution feature records where each order's visitor came from. According to WooCommerce's documentation, it sets sbjs_session (30 minutes) and session cookies such as sbjs_first, sbjs_current, sbjs_first_add, sbjs_current_add and sbjs_udata, which store traffic sources, referring URLs, entry pages and device details.
These are analytics cookies, not cart cookies, so they need consent for EU and UK visitors. WooCommerce says the feature is compatible with the WP Consent API, which lets a consent tool hold it back until the visitor agrees. You can also switch the feature off under WooCommerce > Settings > Advanced > Features.
Tracking pixels and the cookies they set
Beyond order attribution, most of the risk for WooCommerce stores sits with third-party tracking scripts. Each pixel or tag brings its own cookies, and none of them is strictly necessary.
Google Analytics 4 sets _ga and _ga_<container-id>, each for 2 years. They are analytics cookies that track visitor behaviour, session counts and traffic sources, and they must not be set until the visitor opts in.
The Meta Pixel sets _fbp (90 days) and can set _fbc when a visitor arrives from a Facebook ad. They are marketing cookies used for conversion tracking and audience building, and the Meta Pixel needs explicit consent before it runs for EU and UK visitors.
Other common WooCommerce integrations, such as the TikTok Pixel, the Pinterest Tag and Google Ads remarketing, follow the same pattern: each sets its own cookies and needs consent before loading.
Google Tag Manager and consent-based firing
Many WooCommerce stores use Google Tag Manager as a hub for every tracking script. The tags it fires set cookies, so the key step is making Tag Manager respect consent before any tag runs. Some regulators go further: in March 2025 a German administrative court (VG Hannover) held that loading Tag Manager itself needs consent under the German cookie rule, so check the position in the countries you sell to.
Google Consent Mode v2 provides the framework for Google's own tags. Integrated with a consent tool, it tells Google tags to behave according to the consent state. With consent denied, they set no _ga or _gcl_* cookies, although in advanced mode Google may still receive cookieless pings for modelling.
Non-Google tags in Tag Manager need consent checks of their own. Either block the Tag Manager container before consent, or set each tag's consent settings so it fires only once the visitor grants the matching category. The Consent Initialization trigger is where defaults are set, not a gate for other tags.
Setting up cookie consent on WooCommerce
Step 1: Scan your store for all cookies
Before configuring consent, get a complete inventory of every cookie your store sets. A cookie scanner loads your pages, including product pages and checkout, and lists every first-party and third-party cookie.
WooCommerce stores often have more cookies than expected. Plugins for reviews, wishlists, currency switching and live chat each add their own. Without a scan, you risk missing cookies that should wait for consent.
Step 2: Categorise each cookie
Group cookies into the categories regulators and consent tools recognise:
- Strictly necessary: cart, session, sign-in and CSRF tokens
- Functional: language and currency preferences, recently viewed products
- Analytics:
_ga,sbjs_*, Hotjar, Microsoft Clarity - Marketing:
_fbp,_fbc, TikTok_ttp, Google Ads_gcl_au
Only strictly necessary cookies may load without consent. Everything else waits until the visitor actively opts in.
Step 3: Block scripts before consent
The most common failure on WooCommerce stores is tracking scripts loading on page load whatever the visitor chose. A consent tool should block non-essential scripts until permission is granted, by holding script tags (changing type="text/javascript" to type="text/plain") or through Tag Manager. Kukie.io holds more than 30 known trackers on its own, and Kukie.io for WooCommerce covers the plugin install.
WooCommerce plugin considerations
WooCommerce's plugin ecosystem complicates consent. Each plugin can add cookies and external requests your banner may not catch automatically.
Review plugins set cookies for visitor identification and aggregate ratings. Wishlist plugins store product selections in cookies that can last for months. Live chat widgets from services such as Intercom or Tidio set their own tracking cookies alongside the chat.
The WP Consent API gives WordPress plugins a shared way to check whether the visitor has consented to a category. It needs a consent tool to feed it: its plugin page says that without one, every category returns as consented. The Kukie.io WordPress plugin passes the visitor's choice to the API when it is installed, so API-aware plugins, including WooCommerce's order attribution, wait for consent. Plugins that do not read the API need script blocking.
When you evaluate WooCommerce extensions, check whether each one documents its cookies and supports consent. Undocumented plugin cookies are a frequent source of gaps found in cookie audits.
What regulators expect from online stores
Enforcement in 2025 and 2026 shows that online stores face real scrutiny. On 1 September 2025 France's CNIL fined SHEIN 150 million euros for placing advertising cookies before visitors made a choice and for continuing after a refusal. The UK's ICO said in January 2025 that it had assessed the top 200 UK websites and raised concerns with 134 of them, and in December 2025 reported that 979 of the top 1,000 now met its checks.
Regulators look for specific failures: cookies set before consent, a missing reject option, pre-ticked categories and dark patterns that steer visitors towards accepting. For an online store, they also check whether checkout and payment cookies are classified correctly and whether remarketing pixels fire only after opt-in.
Legitimate interest is not a valid basis for analytics or marketing cookies. The ePrivacy Directive requires consent for any non-essential storage on a visitor's device, whatever GDPR legal basis you use for the data processing behind it.
Server-side tracking and the Conversions API
Server-side tracking is popular with WooCommerce store owners who want to recover data lost to ad blockers and browser limits such as Safari's Intelligent Tracking Prevention. Meta's Conversions API and Google's server-side tagging send event data from your server rather than from pixels in the browser.
Server-side tracking does not remove consent obligations. Sending purchase or add-to-cart events to Meta from your server is still processing personal data under the GDPR, and you still need consent before sending it. The difference is operational, not legal.
WooCommerce cookie consent questions
Does WooCommerce set cookies without any plugins installed?
Yes. WooCommerce sets cart cookies (woocommerce_cart_hash, woocommerce_items_in_cart) and session cookies (wp_woocommerce_session_*) when a visitor uses the store, and these need no consent. With order attribution on, it also sets sbjs_* cookies, which do need consent.
Do I need cookie consent for WooCommerce cart cookies?
No. Cart and session cookies are strictly necessary for the store to work. Article 5(3) of the ePrivacy Directive exempts cookies essential for a service the visitor explicitly asked for, and adding items to a cart qualifies.
Can I use Google Analytics on WooCommerce without consent?
Not for EU and UK visitors. Google Analytics sets cookies like _ga that track behaviour, and these need opt-in consent. Consent Mode can send cookieless measurements while consent is denied, but full tracking needs consent.
How do I block the Meta Pixel on WooCommerce until consent is given?
Use a consent tool that blocks scripts automatically, or load the Meta Pixel through Google Tag Manager with consent settings on the tag. The pixel and its cookies (_fbp, _fbc) must not run until the visitor accepts the marketing category.
Does server-side tracking with the Conversions API remove the need for consent?
No. Server-side tracking sends personal data, such as purchase events, email hashes or IP addresses, to advertising platforms from your server. That is still processing of personal data under the GDPR and needs prior consent.
See every cookie your WooCommerce store sets
Order attribution, pixels and plugins all add cookies a store owner may not know about. The Cookie scanner loads your shop like a visitor and lists every cookie it finds by name and category, including sbjs_*, so you can see what runs before a choice.
