How to add a WordPress cookie consent banner that really blocks trackers

Do you need a cookie banner on your WordPress site?

Probably, if your site uses analytics, advertising pixels, embedded videos, maps or chat, and people from the EU, UK or other places with consent rules visit it. The EU ePrivacy rules say storing or reading information on a visitor's device needs their consent unless it is strictly necessary for a service they asked for. The UK regulator says the same, and adds that refusing must be as easy as accepting.

A quick way to decide:

This is general information, not legal advice. Laws differ by country and state, and a lawyer can tell you what applies to your business.

Which cookies come from WordPress, and which come from your plugins?

WordPress itself sets very little for an ordinary visitor. According to the WordPress handbook, it sets login cookies for people who sign in and commenter cookies for people who leave a comment. Since WordPress 4.9.6, commenters choose whether their details are saved in a cookie. Almost everything else comes from what you added:

If you paste tracking code into your theme header, that code sets cookies on every page whether or not a banner is showing. Our guide to adding tracking code to WordPress covers where that code usually lives.

What is the difference between a cookie notice and cookie consent?

A cookie notice tells people the site uses cookies. Cookie consent asks first and waits. With consent, analytics and advertising cookies stay blocked until the visitor accepts them, and a visitor who rejects them never gets them. A notice that says "by using this site you agree" while the trackers load anyway is a notice, not consent.

What does a compliant cookie banner need?

Regulators in the EU and UK agree on most of the basics. The European Data Protection Board's cookie banner report, the French regulator CNIL and the UK ICO all point the same way:

• Nothing non-essential runs before the visitor chooses. Analytics, pixels and embeds wait.
• Reject all is as easy as Accept all. Same layer, same weight, one click each.
• No pre-ticked boxes. The EU Court of Justice ruled in Planet49 that a pre-ticked box is not consent.
• Choices by category, such as analytics and marketing, behind a "manage" button.
• Closing the banner is not consent. A visitor who closes it has not said yes.
• A way to change your mind, such as a small button on every page that reopens the choices. Withdrawing must be as easy as giving consent.
• A record of each answer. GDPR Article 7(1) says you must be able to show that someone consented.
• Links to your cookie policy and privacy policy.

How to add a cookie consent banner to WordPress, step by step

These six steps work whatever tool you choose.

1. List what your site loads. Write down every tracker and embed on the site: analytics, advertising pixels, chat widgets, call tracking, YouTube or Maps embeds and anything pasted into the header. A browser private window and the Network tab show what loads on a first visit.
2. Choose how the banner will run. Pick a WordPress plugin, a hosted consent service added with a header script, or a management platform that runs the banner across many sites. Check the free plan limits and where consent records are stored before you commit.
3. Install it and finish the setup. Activate the tool, then finish its setup: run the cookie scan, confirm the categories, and switch blocking on. Most tools need this step finished before they block anything.
4. Set the banner wording and buttons. Show Accept all and Reject all with the same weight on the first layer, add a way to choose by category, and link your cookie policy and privacy policy. Do not pre-tick any category except strictly necessary.
5. Connect Google Consent Mode v2. If you use Google Analytics or Google Ads, switch on Consent Mode v2 in the tool so Google tags get the visitor's choice. Choose basic mode unless you have decided advanced mode is right for you.
6. Clear caches and test in a fresh browser. Empty every page cache and your CDN, open the site in a private window, and check in DevTools that no tracking cookies or tracker requests appear before you click, after Reject all, and only after Accept all.

Which kind of tool should you choose?

If you want a shortlist of tools, our comparison of the best cookie consent plugins for WordPress looks at nine of them.

How do you test that your cookie banner really blocks trackers?

A banner on the screen proves only that the banner loaded. To check blocking, look at what the browser stores and sends. It takes about five minutes:

1. Empty your caches. Clear your caching plugin, your host's cache and any CDN, so you test the current page.
2. Open a private window so no earlier choice is remembered.
3. Open DevTools before the page loads (F12, or right-click and Inspect). Keep the Network tab open, then load your homepage.
4. Do not click the banner. In the Network tab, search for google-analytics, googletagmanager, facebook, clarity and youtube. In Application, open Cookies and look for the names in the table above.
5. Click Reject all, reload, and check again. Nothing new should appear.
6. Open a new private window, click Accept all, and check that the trackers now load. If they do not, your banner is blocking too much.

Two things are allowed before consent: strictly necessary cookies, such as the cookie that remembers the visitor's choice, and, if you chose advanced Consent Mode, cookieless pings to Google. Anything else that appears before a choice is a tracker running without consent.

What we saw when we tested on a real WordPress site

On 8 November 2026 we built a test site on WordPress 7.1.4 with the Twenty Twenty-Five theme. We pasted a Google Analytics 4 tag and a Meta pixel into the header, the way most people add them, and put a YouTube video on the homepage. Then we visited it as a first-time visitor in a fresh Chromium browser and recorded every request and cookie.

With no consent tool, all three loaded on the first visit and set their cookies, including _ga and YouTube's cookies.

Next we tried several popular free consent plugins straight after activating them, before running their setup. In that state none of them held the trackers back. That is expected, because each one asks you to finish a setup first, such as a cookie scan, a wizard or connecting an account, and we did not configure other vendors' tools for this test. The lesson is simple. Installing a consent plugin is not the same as blocking. Finish the setup, then run the test above.

Then we ran WPCentrify's banner with the settings our dashboard uses by default:

This is one test on one site, run by us on our own product, so treat it as an example of the method rather than a ranking. You can repeat the same test on your site in five minutes.

Why does a cookie banner show but not block?

When a banner appears but trackers still load, it is usually one of these:

Speed plugins matter here because the banner must load first. If you also want a faster site, our guide to improving Core Web Vitals on WordPress covers delaying scripts safely.

What is Google Consent Mode v2, and should you choose basic or advanced?

Google Consent Mode lets your banner tell Google tags whether the visitor said yes. Since March 2024 Google has required consent signals from EEA visitors for its ad personalization and measurement features. Google describes two modes in its Consent Mode help page:

Consent Mode is a signal to Google only. It does not block trackers from Meta, Microsoft, TikTok or anyone else, so you still need a banner that holds those back.

Do you have to honor Global Privacy Control?

Global Privacy Control (GPC) is a browser setting that tells websites the person does not want their data sold or shared. Under the California regulations, a business that sells or shares personal information must treat a valid signal like GPC as an opt-out request. In 2022 California's Attorney General settled with Sephora for $1.2 million, partly for not processing GPC opt-outs. If you have California visitors, choose a tool that respects GPC automatically.

What records of consent should you keep?

Keep enough to show what someone agreed to and when. A useful record holds the time, the choices made, which version of the banner and policy was showing, and a shortened IP address rather than the full one. There is no single legal retention period for every case, so keep records at least as long as you rely on the consent and agree the exact period with whoever handles your privacy compliance.

Do you need to ask again when your banner or trackers change?

Yes, when you add new trackers or change what visitors are agreeing to. An earlier yes was given to a different question. Most consent tools can ask returning visitors again when you change the policy version.

What happens to cookies set before a visitor said no?

Blocking stops new cookies being set. It does not remove cookies already on the device from before the banner was installed or from an earlier yes. A good tool deletes your site's own tracker cookies when a visitor rejects. No script can delete another company's cookies, such as those set on facebook.com or youtube.com, because browsers do not allow it.

What do free cookie consent plans really include?

Free plans differ a lot, and some stop showing the banner when you pass a limit. These are each vendor's own published terms, checked on 8 November 2026:

Prices and limits change. Check each vendor's page before you choose, and tell us if anything here is out of date.

Do you need a cookie policy and a privacy policy too?

Yes, in most cases. The banner should link to a cookie policy that lists what the site uses, and to a privacy policy that explains what you do with personal data. WordPress has a built-in privacy policy helper under Settings, Privacy, which creates a draft page with suggested text. Many consent tools also generate a cookie policy. Generated text is a starting point, not legal advice, so have it reviewed.

How do you manage cookie consent across many WordPress sites?

Doing it site by site means one plugin, one setup and one set of records per site, and the settings drift apart over time. Our story of fixing cookie consent on 30+ client sites shows how that goes wrong.

WPCentrify, the WordPress management tool we build, runs WordPress cookie consent on every site you connect, from one dashboard. Here is what it does, in plain terms:

• Holds analytics, advertising and embed trackers until the visitor chooses, including code pasted into the theme header, as the test above shows.
• Shows Reject all beside Accept all with the same weight, a panel to choose by category, and a small button on every page to change the choice later.
• Sends Google Consent Mode v2 signals, in basic mode unless you choose advanced for a site.
• Respects Global Privacy Control.
• Records each answer with the banner wording and policy version that were showing.
• Lists the third parties each site loads, so you can decide what each one is.
• Writes the privacy policy, cookie policy and terms of use pages from templates, without overwriting a page you already have unless you choose to.
• Stands down if another consent plugin is active, so a site never shows two banners.

What it is not: WPCentrify is not a Google-certified CMP and does not support the IAB Transparency and Consent Framework. Google requires a certified CMP for AdSense, Ad Manager and AdMob publishers serving personalized ads in the EEA, UK and Switzerland, so a site in that position should use a certified tool. Cookie consent is included on the Agency and Scale plans and is a $15 a month add-on on Solo and Studio. See pricing for details.

Switching from another consent tool?

If you are moving away from a tool you already use, our comparisons cover what to check first: CookieYes alternatives, Complianz alternatives and WP Legal Pages alternatives.

Sources

All checked 8 November 2026: ePrivacy Directive; GDPR; Planet49 judgment; ICO consent guidance; EDPB cookie banner report; CNIL; Google Consent Mode; Google certified CMPs; California CCPA regulations; WordPress cookies; and each vendor's pricing or plugin page linked in the free plans table.