The WP Consent API is a WordPress plugin that gives every theme and plugin on a site one shared place to read a visitor's cookie choices. Your consent banner plugin writes each choice with wp_set_consent(), and other plugins check it with wp_has_consent(), in PHP or JavaScript, before they set cookies. It uses five categories (functional, preferences, statistics, statistics-anonymous and marketing) and a consent type such as opt-in or opt-out. It does not show a banner or block anything by itself.
Before the API, every consent tool needed its own integration with every plugin that set cookies, or had to rewrite the page to hold scripts back. A new plugin meant a new rule. The WP Consent API plugin, with more than 200,000 active installations and at version 2.1.0 as of October 2026, replaces that with one shared vocabulary.
When a visitor makes a choice in your consent banner, the banner plugin passes it to the API, and every plugin that listens can act on it.
Developers check whether a category is allowed before running their code. If a visitor rejects marketing, a plugin that checks the API holds back its tracking pixels. This matters most for cookies a WordPress plugin sets itself in PHP, which a banner's script blocking cannot stop. It removes some of the guesswork about whether a script fired before or after the visitor chose.
Regulators judge the result, not the plumbing
Data protection authorities across Europe penalise companies whose tracking runs without a valid legal basis. On 24 October 2024 the Irish Data Protection Commission fined LinkedIn EUR 310 million over the lawfulness, fairness and transparency of its processing of members' data for behavioural analysis and targeted advertising. Fines of this size show how seriously regulators treat tracking without proper permission.
You cannot rely on visitors adjusting their browser settings. Under the General Data Protection Regulation and the ePrivacy rules, the site owner is responsible for getting opt-in consent before non-essential cookies are set.
A fragmented setup increases that exposure. A social sharing widget might load a tracker before the visitor even sees your banner. The WP Consent API helps only when two things are true: a consent plugin declares the consent type, and the plugin that sets the cookie checks the API first. Without a consent plugin, the API reports every category as allowed. Blocking by default only starts once a consent plugin sets the type to opt-in and records the visitor's choices.
Every part of your site still has to respect the exact cookie categories the visitor approved.
The five consent categories
The API sorts storage and tracking into five categories, defined on the plugin's own page. A consent tool shows its own categories to visitors and maps them onto these five.
The functional category covers storage that is strictly necessary for a service the visitor asked for. You can read more about where these sit in the guide to functional cookies.
The other four are preferences, statistics, statistics-anonymous and marketing. A consent tool handles the interface and records the visitor's choices against these categories. When a plugin wants to load a marketing pixel, it checks the marketing category. If the visitor said no under an opt-in consent type, the check returns false and the plugin should not load the pixel.
This separation lets visitors who are happy to help with your site statistics refuse targeted advertising. Choice per purpose is part of valid consent under the GDPR.
How a choice reaches your WordPress plugins
Functions developers call
Integrating the API into a theme or plugin takes a few lines of code.
The main function is wp_has_consent(), which checks a category such as 'marketing' or 'statistics'. The API also offers wp_has_service_consent(), which checks a named service such as 'google-analytics' independently of its category. wp_has_consent() works in PHP and in JavaScript, and the JavaScript side fires events such as wp_listen_for_consent_change when the visitor changes their mind.
If no consent plugin sets a consent type, the type is false and every category returns true. That fallback means you can add API support to a plugin without breaking sites that have no consent tool, but it also means the API on its own protects nobody.
The JavaScript check matters on sites with page caching. A cached page is the same HTML for every visitor, so a PHP check that ran when the page was cached cannot reflect the next visitor's choice. Plugins that set cookies in the browser should check consent there.
Handling regional logic
The consent type comes from the wp_get_consent_type filter, and a consent plugin can also set window.wp_consent_type in the browser. Under opt-in, a category returns true only if the visitor chose "allow". Under opt-out, it returns true unless the visitor chose "deny". European visitors usually need opt-in, while visitors from California fall under the opt-out model of the CCPA. The API only reflects what the consent plugin tells it, so regional logic lives in your consent tool.
What each layer does
The WP Consent API does not replace script blocking. Its own page says third-party scripts have to be blocked by the blocking feature of a consent management plugin, and that the API is aimed mainly at first-party cookies and tracking set by WordPress plugins.
| Layer | What it does | What it cannot do |
|---|---|---|
| Consent banner plugin | Shows the banner, records the choice, blocks third-party scripts and passes the choice to the API | Stop a cookie a WordPress plugin sets in PHP |
| WP Consent API | Stores the consent type and categories, answers wp_has_consent() | Collect consent or block anything itself |
| Plugins that support the API | Check consent before setting cookies or loading tracking | Know the visitor's choice without a consent plugin |
Support among plugins that set cookies is real but not universal. The plugin page lists Burst Statistics, Google Site Kit, Pixel Manager for WooCommerce and WP Statistics among the plugins that read the API. WooCommerce's own order attribution cookies also respect it. Scan your site after any change to see what still sets cookies before a choice.
Connect the API to a consent plugin and test it
Installing the API plugin is only the first step. You need a consent management platform that pushes choices into the API, and plugins that read it.
Without a connected consent plugin, the API is a dormant set of rules that allows all tracking. You need a tool that shows the banner, records proof of consent and handles regional rules. The consent plugin decides, and the API passes the decision on to your other plugins.
Check that your consent tool lists WP Consent API support in its documentation. Then test your live site with developer tools or a cookie scanner. Clear your cookies and load the site as a visitor from the EU. Confirm that no marketing or analytics cookies appear before you choose, and that rejecting keeps them away.
Keep a note of how and when you tested. It helps you spot regressions after plugin updates and shows a regulator what you checked.
Questions about the WP Consent API
Do I need a consent banner if I use the WP Consent API?
Yes. The API does not display a banner or collect consent. It passes choices from your consent management plugin to your other plugins.
Which plugins support the WP Consent API?
The plugin page lists consent tools and plugins that read the API, including Burst Statistics, Google Site Kit, Pixel Manager for WooCommerce and WP Statistics. WooCommerce's order attribution also respects it.
What does the WP Consent API do if no consent plugin is installed?
It allows everything. Without a consent plugin, the consent type is false and every category returns true, so plugins that check the API still set their cookies.
Is the WP Consent API legally required?
No. No law requires this framework. It is one way to make WordPress plugins follow the choices visitors make in your banner, alongside script blocking for third-party services.
How do I install the API on my website?
Install WP Consent API from the WordPress plugin directory, then use a consent plugin that supports it. The API works in the background once both are active.
Does the API block third-party cookies directly?
No. The API does not stop cookies being set in the browser. It tells your plugins whether they may run the scripts that set them, and third-party scripts still need your consent plugin's blocking.
Use the WP Consent API with Kukie.io on WordPress
The Kukie.io plugin for WordPress connects to the WP Consent API automatically when both are installed. It maps Kukie.io's categories onto the API's five, writes "deny" for every category until the visitor chooses, and declares the opt-in consent type, so plugins such as Site Kit do not treat a visitor as consenting while the banner is still on screen.
