How to manage cookie consent on WordPress

List every service that can set or read cookies, including analytics, advertising pixels, embedded videos, maps, chat widgets, reCAPTCHA and social feeds. Check the browser’s developer tools before consent and after accepting each category.

Classify cookies as necessary, preferences, statistics or marketing. Do not assume that a plugin is necessary just because it runs on your WordPress site. A third-party widget can create non-essential cookies even when the WordPress plugin itself is functional.

Allow only cookies that are genuinely needed for functions such as login, shopping carts, security or storing the consent choice. Explain these cookies in your policy rather than offering a blanket approval for every cookie.

Rules differ by country and region, so check the requirements that apply to your visitors. For example, ICO guidance says non-essential cookies should not be set before a clear positive consent action, and users should be able to enable or disable them easily.

Without a plugin, create a banner or dialog that offers clear choices, records the visitor’s decision, and provides a settings link for changing it later. Your code must prevent non-essential scripts and embeds from loading until the relevant category is accepted, then load them only after the choice is updated.

For Google tags, set the default consent state before the tags run and update it when the visitor chooses. Google’s consent mode does not create a banner itself; it receives consent signals from your banner and changes tag behaviour accordingly.

The drawback is maintenance. You must keep the cookie inventory accurate, handle regional rules, block newly added services, remove cookies after withdrawal where appropriate, and make sure the code works with every theme, plugin and cache layer.

Do not paste analytics or advertising code directly into the header and expect the banner to control it. Add those services through a consent-aware integration, or place the scripts and iframe sources behind your own consent check. A script hard-coded in the theme, inserted by another plugin, or loaded through an external tag manager can bypass the banner.

Google Tag Manager has a Consent Initialization trigger intended to set consent before other tags fire. Use the correct consent settings for analytics, advertising and user-data processing, then publish the container.

Add a clearly labelled cookie policy or cookie section to your privacy page. Describe the cookie or service, its purpose, provider, category, duration where known, and how visitors can withdraw consent. Link to the policy from the banner and keep the preference centre accessible after the banner is dismissed.

A privacy policy hidden behind a difficult-to-find link is not a substitute for consent. The banner must explain the choice at the point where it is made.

Use a fresh private-browsing window and test the site before accepting anything. Confirm that non-essential cookies are absent, analytics and advertising requests are blocked, and embedded services do not load early. Accept one category at a time, reload several pages, then withdraw consent and repeat the checks.

Clear both browser and site caches after changing banner settings. Page caching, JavaScript delay, minification and server-side rendering can make the banner reappear, disappear or show another visitor’s state. Support reports repeatedly identify cache variation and delayed consent scripts as causes of these failures.

For most live sites, the fast way is to use Complianz Privacy Suite GDPR CCPA Pro. Its wizard, cookie scans, consent banner, policy generation, regional settings and integrations reduce the amount of custom blocking code you need to maintain. It still needs checking: the plugin documentation warns that hard-coded scripts, unsupported services and optimisation plugins can require manual configuration, and a scan alone does not prove that cookies are blocked before consent.