We had to fix cookie consent on 30+ WordPress sites after a legal notice

The cookie banner problem most site owners do not know they have

Most cookie banners are notices, not gates. They pop up, the visitor clicks something, and the banner disappears. Meanwhile, Google Analytics, the Meta Pixel, heatmap tools and ad scripts have often loaded the moment the page did, long before anyone read the words we use cookies.

That is a real problem, because privacy rules care about timing.

• In the UK and EU, non-essential cookies and similar trackers need the visitors consent before anything is stored on or read from their device, under PECR in the UK and the ePrivacy Directive alongside GDPR in the EU. Asking after the fact does not count.
• In the US, a growing number of state privacy laws give people the right to opt out of their data being sold or shared for targeted ads, and several states expect websites to respect a browsers opt-out signal automatically.

So a banner that looks right but lets trackers fire first is not protecting your client. It is decoration.

Three paid cookie consent plugins, three different problems

We did not want to reinvent anything. We did what most agencies would do: bought a well-reviewed WordPress cookie consent plugin, installed it on a handful of client sites and tested it properly. Then we did it again. And again.

We are not naming the plugins. Each one suits someone, and plenty of single-site owners use them happily. They just were not built for an agency with a portfolio of very different client websites.

Plugin one: a great-looking banner, but trackers still fired

Setup was quick and the banner looked polished. Testing told a different story. Scripts added directly to the theme were caught, but tags added through Google Tag Manager or a page builders header settings loaded straight away. The plugin could only hold back scripts it already recognized, and our clients sites were full of scripts it did not.

Plugin two: it blocked the wrong things

The second plugin was far more aggressive. It did stop the analytics. It also stopped a booking widget, an embedded map and, on one site, the contact forms spam protection. Enquiries quietly stopped arriving for a day before anyone noticed. Every fix meant manually categorizing scripts, site by site, then retesting from scratch.

Plugin three: built for one website, not thirty

The third was the most capable, but clearly designed for a single site owner. Licenses were priced per site. Every site had to be configured from its own wp-admin. The cookie scan returned long lists of technical cookie names our clients could not make sense of, and exporting consent records required a higher tier.

What a working cookie consent setup actually needs

Somewhere around day ten, we stopped asking which plugin, and wrote down what we actually needed. If you are evaluating any cookie consent tool, this is the checklist we would use.

• Trackers wait for a decision. Non-essential scripts do not load until the visitor accepts, and stay off if they reject. Forms, checkout and other essentials keep working.
• A list of what is really on the site. Not a database of every cookie on the internet. The actual tools running on this clients pages, in plain English.
• Rejecting is as easy as accepting. Regulators in the UK and EU have repeatedly pushed back on banners that bury the reject option.
• Policy pages that match reality. A privacy policy and cookie policy that describe the tools the site genuinely uses.
• A record you can produce later. Who accepted or rejected, when, and what wording they saw.
• Respect for browser privacy signals, especially Global Privacy Control.
• Client branding, so the banner looks like part of the site.
• Proof you can check yourself, without taking the plugins word for it.
• One place to manage it all, not 30 separate dashboards.

How to check if your cookie banner is actually blocking cookies

You do not need a paid scanner for this. Every modern browser can show you, in about two minutes, whether a website sets tracking cookies before consent. This is the exact test we ran on every client site.

1. Open a fresh private or incognito window. This makes sure no earlier consent choice is saved.
2. Open Developer Tools. Press F12 on Windows or Linux, or Cmd + Option + I on a Mac. In Chrome or Edge, go to the Application tab. In Firefox, go to Storage. Expand Cookies and select the sites domain.
3. Load the page and do not touch the banner. Look at what is already listed. Common tracking cookies include _ga and _ga_XXXX (Google Analytics), _gcl_au (Google Ads), _fbp (Meta Pixel), _clck and _clsk (Microsoft Clarity) and _hjSessionUser (Hotjar). If any appear before you have clicked anything, trackers are running ahead of consent.
4. Check the Network tab as well. Some tools send data without setting a cookie first. Reload with the Network tab open and filter for terms like collect, google-analytics, facebook, clarity or doubleclick. Requests to those before a choice is made are a red flag.
5. Click Reject and reload. No analytics or marketing cookies should appear, on this page or the next one you visit.
6. Clear site data, then click Accept. In Chrome, use Application, then Storage, then Clear site data, reload and accept. The trackers should now load. If they do not, your clients analytics has been silently broken.

What we use now: cookie consent built into WPCentrify

We were already building WPCentrify to run our own client portfolio: updates, backups, uptime and reporting for multiple WordPress sites from one dashboard. After those two weeks, that checklist became the spec for a new feature: WordPress cookie consent.

Here is what it does for us today.

Legal pages generated from niche-specific templates

Choose the type of business, such as a clinic, an online store or a local service company, and WPCentrify drafts the privacy policy, cookie policy and terms page from a template written for that niche. The clients details are filled in automatically, and US healthcare clients also get a HIPAA notice.

These are drafts for your client, or their lawyer, to review before publishing, not legal advice. But starting from a relevant, niche-specific template beats starting from a blank page or copying generic boilerplate that mentions tools the site does not even use.

A cookie banner that looks like your clients site

Colors, width, wording and preference links are set per client. Visitors see a banner that fits the brand, not a third-party badge that looks bolted on.

Trackers that genuinely wait, and you can verify it

Non-essential trackers are held back until the visitor makes a choice. You do not have to trust us on that. Run the DevTools test above on any site using WPCentrifys cookie consent:

• Before a choice: no analytics or marketing cookies in the list.
• After Reject: still nothing.
• After Accept: the trackers load as expected.

For each client, you also see the actual tools discovered on their pages, named the way a client would recognize them, with a short explanation of what each one does. And WPCentrify checks each published site independently after changes, so you are not relying on a settings screen to tell you everything is fine.

Consent records: who accepted, who rejected and when

Every choice is logged, including the visitors IP address, the date and time, whether they accepted or rejected, and the banner wording they saw. If a business decides a particular service must run regardless, that exception is recorded too, along with who approved it and when.

So when a client, or their solicitor, asks whether you can show what visitors agreed to, you have an answer.

Global Privacy Control, honored automatically

Global Privacy Control, or GPC, is a browser setting that tells every website a visitor does not want their data sold or shared. Brave and DuckDuckGo send it by default, Firefox has a built-in option, and Chrome, Edge and Safari users can turn it on with an extension.

When a visitors browser sends a GPC signal, WPCentrify treats them as having refused, without asking them first.

This is not a nice-to-have. California, Colorado and Connecticut explicitly recognize GPC as a valid opt-out, and as of 2026, twelve US states require businesses to honor universal opt-out signals like it. California has already issued fines to businesses over failures to process opt-out requests and signals properly.

Everything, for every client, from one dashboard

Roll out cookie consent across your portfolio, see which client sites still need review and keep records in one place. No logging into 30 separate wp-admins to change one setting. And it sits alongside the rest of your care plan work, including client reports.

Before and after: cookie consent across 30+ client sites

What no cookie consent tool can do for you

We would rather be upfront, because this space is full of big promises.

No software can make a website legally compliant on its own, and anyone who guarantees that is overselling. Your client is still responsible for their final legal position, generated policies should still be reviewed, and new tools added to a site later still need a decision about whether they are allowed to run.

What the right tool can do is make the work fast, consistent and provable: trackers wait, choices are recorded, policies reflect reality, and you have something concrete to show a client who asks.