Best cookie consent plugins for WordPress, 9 compared

What should a WordPress cookie consent plugin do?

A cookie consent plugin has to stop non-essential cookies and trackers from running until the visitor agrees, then honor and record the choice. A WordPress cookie popup that shows a notice while Google Analytics and the Meta Pixel load anyway does not do that job, however good it looks. Check that yours:

• Blocks trackers before consent. Analytics, ad pixels and embeds wait for a yes, even tags in the theme or Google Tag Manager.
• Makes Reject as easy as Accept. Both buttons on the first screen, with the same weight.
• Offers granular categories. Analytics, marketing and other purposes, each off until the visitor switches it on.
• Keeps consent records. Who chose what, when, and which banner wording they saw.
• Lets visitors withdraw. A link or small icon on every page reopens the choices.
• Sends Google Consent Mode v2 signals. So Google tags follow each visitor's choice.
• Supports the IAB TCF if you run ads. IAB Europe gave participants until 28 February 2026 to adopt version 2.3.
• Handles regions and Global Privacy Control. Geo-targeting shows the right banner where rules differ; GPC is a browser opt-out signal used under US privacy laws.
• Scans the site. So the banner and the cookie policy list what each page really loads.
• Works with the WP Consent API. This free plugin (200,000+ active installations) shares the choice with other plugins that support it.

Chat widgets load third-party code too, so check how your banner handles the one you pick from our guide to the best chatbot for WordPress.

What do cookie consent rules require?

For GDPR cookie consent on WordPress, the UK and EU rules are the strict ones: non-essential cookies need consent before they are set. Most US state laws give visitors the right to opt out instead. In brief:

• UK. The ICO's guidance on storage and access technologies, finalized on 29 April 2026, says a consent mechanism should make it "as easy to refuse consent as it is to accept", that "silence or inactivity doesn't qualify", and that people must be able to withdraw "with the same ease that they gave it". Since the Data (Use and Access) Act 2025, some analytics and appearance cookies are exempt, with clear information and a free way to object, but never for advertising.
• EU. The EDPB's cookie banner taskforce reported in 2023 that most of the authorities taking part saw a banner with no reject option on any layer as an infringement, and that pre-ticked boxes are not valid consent. It also warned against labeling cookies "essential" when they are not.
• Google. Google's EU user consent policy asks sites using its products to get valid consent from users in the EEA, the UK and Switzerland, keep records of it and explain how to revoke it. Publishers serving personalized ads through AdSense, Ad Manager or AdMob there must use a Google-certified CMP that integrates with the IAB TCF. Consent Mode passes the choice to Google tags but is not a banner.
• US states. California's Attorney General says covered businesses must honor Global Privacy Control as a valid request to stop selling or sharing personal information. Other states have their own laws, so check where your visitors live.

This is not legal advice. It is a summary to help you choose a tool. Which rules apply depends on your visitors and your site, and no plugin makes a site compliant on its own, so check your setup with a privacy professional.

How we compared these plugins

Every fact comes from the vendor's own pricing, feature and wordpress.org pages and from Google's certified CMP list, all checked on 10 October 2026. We focused on what decides whether a plugin protects you: blocking before consent, Consent Mode v2, IAB TCF and Google certification, consent records and price.

One tool is ours. Disclosure: WPCentrify is our product, we use no affiliate links, and our comparison methodology explains how we research and correct these pages. We left out WordPress cookie banner plugins that block nothing, and Termly's plugin, last updated on wordpress.org on 9 January 2026, although Termly is on Google's certified list.

WordPress cookie consent plugins at a glance

The 9 WordPress cookie consent tools, one by one

1. WPCentrify: best for consent across many WordPress sites

WPCentrify handles cookie consent from the dashboard that already runs updates, backups and uptime for every connected site, so there is no banner plugin to install and license on each one. (Disclosure: it is our product.) Visitors get Accept, Reject and Manage choices, with Reject all next to Accept all at the same weight, and analytics and marketing trackers wait until they choose, including ones pasted into the theme.

It lists the third parties each site really loads, sends Google Consent Mode v2 signals and logs every choice with the banner wording and policy version that were live. You build the banner once and apply it to as many sites as you like, with per-site branding and overrides. It is one part of a WordPress website management platform; read more about WordPress cookie consent in WPCentrify.

Good for: anyone responsible for several WordPress sites.

Watch out for: it is not a Google-certified CMP and does not support the IAB TCF, so a site serving personalized Google ads in the EEA, the UK or Switzerland should choose a certified tool. It is free during early access.

2. CookieYes: best free plan

CookieYes has 1+ million active installations on wordpress.org and was last updated on 10 September 2026. Its free plan includes automatic blocking, a scanner, Google Consent Mode v2 and a consent log you can export as CSV, for up to 5,000 pageviews a month. Paid plans are per domain, from $10 a month or $100 a year plus tax; geo-targeting, IAB TCF v2.3 and Global Privacy Control need Pro, at $25 a month or $250 a year. It is on Google's certified CMP list, and scanning and consent logs run in the CookieYes cloud.

Good for: a single site with modest traffic that wants real blocking for free.

Watch out for: the free pageview limit, and one free plan per account, so each extra domain needs a paid plan.

3. Complianz: best set-up wizard

Complianz also has 1+ million active installations and was last updated on 8 September 2026. A wizard scans up to 50 posts and configures the banner for your region, and the free plugin blocks known services such as YouTube, Google Maps and Facebook embeds, with a script center for the rest. Its pricing FAQ lists Google Consent Mode v2, the Google-certified IAB TCF integration, per-visitor records of consent and geo IP banners as premium: $59 a year for one site, $179 for five and $399 for 25, with no pageview limits. It is on Google's certified list, and iubenda's website names iubenda as its parent company.

Good for: sites of any traffic level that want a guided setup and a cookie policy generator.

Watch out for: the free version sends no Consent Mode v2 signals and keeps no per-visitor consent records.

4. Cookiebot by Usercentrics: best for busy sites with few pages

Cookiebot is Usercentrics' consent platform, and its WordPress plugin has 100,000+ active installations, last updated on 8 October 2026. It crawls your site, keeps a cookie declaration current and is on Google's certified list. The free plan covers one domain with up to 50 subpages and includes Consent Mode and Global Privacy Control, but blocking is manual only. Paid plans are priced by page count, not traffic, from €7 a month plus VAT, and add automatic blocking, IAB TCF, geotargeting and CSV export. Consent records are kept for up to 12 months.

Good for: busy sites with a modest number of pages.

Watch out for: you need a Cookiebot account, and larger sites move into higher page-count tiers.

5. Real Cookie Banner: best for consent data on your own server

Real Cookie Banner, from devowl.io, has 100,000+ active installations, was last updated on 8 October 2026 and runs entirely inside WordPress: consents are stored on your own server, and content blockers hold scripts and embeds until the visitor agrees. Its developer says the free version has every feature needed for a legally compliant setup. PRO, from €59 a year for one site to €299 for 25 with VAT included, adds design presets, service templates, Consent Mode, IAB TCF, geo-restriction and consent forwarding across websites. It is on Google's certified list.

Good for: keeping consent records in your own WordPress database.

Watch out for: Consent Mode and TCF need PRO, and the free version leaves more service setup to you.

6. Borlabs Cookie: best all-in-one paid license

Borlabs Cookie is a paid plugin sold on borlabs.io, not wordpress.org. Every license includes every feature: a content blocker for embeds such as YouTube and Google Maps, a scanner, Google Consent Mode v2 and IAB TCF, with visitor data kept on your own server and separate handling for EU and non-EU visitors. Licenses run from €49 a year for one site to €499 for 99, plus VAT, with unlimited pageviews. There is no free version or trial, but there is a 30-day money-back guarantee. It is on Google's certified list.

Good for: the full feature set, including TCF, at a fixed yearly price.

Watch out for: there is nothing to try for free first.

7. iubenda: best for policies and consent in one place

iubenda is a privacy compliance platform, and its WordPress plugin has 200,000+ active installations, last updated on 1 September 2026. Besides the banner and prior blocking, it generates privacy and cookie policies and terms, and records consent for web forms. iubenda says Consent Mode is included even on its free plan. Paid plans are per site, from $5.99 a month billed yearly for 25,000 pageviews, then €0.05 per 1,000, plus VAT, with IAB TCF on every paid plan and geo-targeting from Advanced. It is on Google's certified list.

Good for: getting the banner and your legal documents from one provider.

Watch out for: pageview-based pricing with charges once you pass the quota.

8. Cookie Compliance by Hu-manity.co: best for an equal-choice banner

Cookie Compliance for WordPress, formerly Cookie Notice, has 800,000+ active installations and was last updated on 9 October 2026. Its banner gives three equal choices: accept none, some or all. On its own the plugin only shows a banner; a free or paid Cookie Compliance account adds automatic script blocking, categories, consent records, Consent Mode v2 and Global Privacy Control. The free account covers 1,000 visits a month with 7 days of log history, and Professional starts at $14.95 a month. It is not on Google's certified list, and its pages do not mention the IAB TCF.

Good for: a fair, simple banner with Global Privacy Control support.

Watch out for: the free account's limits, and no automatic blocking without an account.

9. GDPR Cookie Compliance by Moove: best free plugin for hand-placed scripts

GDPR Cookie Compliance, from Moove Agency, has 300,000+ active installations and was last updated on 8 October 2026. It stores all data on your own website, supports Consent Mode v2 and offers Accept, Reject, Close and Settings buttons, loading the scripts you add to its settings, such as Google Analytics or the Meta Pixel, only after consent. A premium add-on adds a consent log, geo-location, an iframe blocker and Multisite consent sync; its price did not appear in the page text when we checked. It is not on Google's certified list, and its pages do not mention the IAB TCF.

Good for: a site where you control every tracking script.

Watch out for: its pages describe no automatic blocking or scanner, so trackers added elsewhere need moving into its settings.

How do you test that a cookie banner really blocks cookies?

Open your site in a private window and check in your browser's developer tools that no analytics or advertising cookies appear before you make a choice:

1. Start clean. Use a private or incognito window, so no earlier choice is stored.
2. Open the cookie list. In Chrome, right-click the page, choose Inspect, then open Application, Storage, Cookies and select your site. Click Clear all and reload.
3. Look before you click. Only strictly necessary cookies, such as a session or cart, should appear. Cookies such as _ga, _gcl_au or _fbp mean Google Analytics, Google Ads or the Meta Pixel ran before consent.
4. Watch the Network tab. Filter for google-analytics.com, facebook.net or clarity.ms. Under Consent Mode's advanced setup, Google tags send cookieless pings by design, but they should set no cookies.
5. Reject, then browse. Click Reject all, open a few more pages and check again.
6. Accept, then check. Clear the cookies, reload and click Accept all. The trackers should now load.
7. Withdraw. Reopen the preferences from the footer link or icon and withdraw. Trackers should stop on the next page.

Repeat on the home page, a post, the contact form and checkout. A leak usually comes from a tag manager container, a theme setting or code pasted into a header. A WordPress tracking code manager keeps every tag in one list, and our story of fixing cookie consent on 30+ WordPress sites shows the leaks we found.

Do cookie consent plugins slow down WordPress?

Only a little when the banner is built well, but a badly built one can hurt your Core Web Vitals. Every tool adds a script and styles to each page, and cloud-based tools also fetch the banner from their own servers. Google's web.dev guidance on cookie notices flags four things:

• Layout shift. It calls cookie notices "a very common source of layout shifts". An overlay or a bar fixed to the bottom of the screen avoids pushing content down.
• LCP on phones. A banner full of text can become the largest element on a small screen.
• Script loading. Load the consent script directly in the page HTML, not through a tag manager, asynchronously where blocking allows, with a preconnect hint for another server.
• The Accept click. Releasing many trackers at once can make the page slow to respond (INP).

Measure on a phone-sized screen before and after you install a plugin. Core Web Vitals monitoring shows whether a banner changed anything, and our guide on how to improve Core Web Vitals on WordPress covers the fixes. In WPCentrify, the cookie consent banner is an optional visitor-facing feature that adds a small script, and cookieless analytics for WordPress counts visitors without setting a cookie.

How do you manage cookie consent across many WordPress sites?

Use one tool that applies the same setup to every site, scans each site on its own and keeps each site's consent records where you can find them. Site by site works for two sites; at twenty, settings drift and nobody knows which banner still blocks what.

Several plugins above help to a point: CookieYes, Cookie Compliance and Cookiebot's paid plans manage several domains from one account, and Complianz's Agency plan covers 25 sites. Each site still runs its own plugin, settings and tests.

This is the job we built cookie consent into WPCentrify for. (Disclosure: it is our product.) You switch consent on for any connected site, apply one setup with per-site overrides, and see consent status beside updates, backups and uptime in the WordPress maintenance dashboard. WordPress code snippets show the tracking code already on each site before you add more, and the WordPress activity log shows who activated a plugin and when, which is often when a new tracker arrives. If you look after client sites, our page on GDPR for WordPress management explains where WPCentrify stands as a processor, and the same approach covers the rest of the work when you manage multiple WordPress sites.

Sources

• CookieYes pricing and CookieYes on wordpress.org
• Complianz pricing, Complianz pricing FAQ and Complianz on wordpress.org
• Cookiebot pricing and Cookiebot on wordpress.org
• Real Cookie Banner and Real Cookie Banner on wordpress.org
• Borlabs Cookie and Borlabs Cookie prices
• iubenda pricing and iubenda on wordpress.org
• Cookie Compliance pricing and Cookie Compliance on wordpress.org
• GDPR Cookie Compliance by Moove and GDPR Cookie Compliance on wordpress.org
• Termly on wordpress.org and WP Consent API on wordpress.org
• Google consent management requirements for publishers, with the list of certified CMPs
• Google EU user consent policy and Google consent mode overview
• IAB Europe Transparency and Consent Framework
• ICO guidance on storage and access technologies: managing consent in practice and the exceptions
• EDPB report of the Cookie Banner Taskforce
• California Attorney General on the CCPA and Global Privacy Control
• web.dev best practices for cookie notices and Chrome DevTools guide to cookies

All sources checked on 10 October 2026.