Most WordPress sites that display a cookie banner are not actually asking for permission. The notice appears, the visitor clicks Accept, and everyone moves on — while Google Analytics and the Meta Pixel have already been setting cookies since the page loaded.
That gap is easy to miss, because the banner and the blocking are two separate jobs. The banner is the design work you can see happening, while holding the tracking scripts back until someone actually agrees is the part that does what the law asks.
In this guide, we’ll walk you through adding a cookie consent banner to a WordPress site properly — one that finds out what your site is really setting, holds those scripts back until the visitor chooses, and keeps your analytics usable either way.
In This Article:
- What a Cookie Consent Banner Does — and Why WordPress Sites Need One
- How to Add a Cookie Consent Banner in WordPress with WPConsent (In 8 Steps)
- 1. Install WPConsent and run the setup wizard
- 2. Scan your site to find out what's actually setting cookies
- 3. Choose your banner layout and position
- 4. Turn on script blocking and content blocking
- 5. Review your cookie categories
- 6. Enable Google Consent Mode v2
- 7. Generate your cookie policy page
- 8. Check your work on the front end
- What a Paid WPConsent Plan Adds
- How to Keep Google Analytics Privacy-Friendly with MonsterInsights
- Consent and Analytics: The Full Picture
- FAQs About WordPress Cookie Consent Banners
What a Cookie Consent Banner Does — and Why WordPress Sites Need One
Get this wrong and the exposure is real: regulators can fine sites that set tracking cookies without permission, and the site owner usually has no idea it’s happening.
Cookies are small pieces of data a site stores in a visitor’s browser. WordPress uses them for ordinary things — recognizing who’s logged in, remembering someone who left a comment.
The ones that attract legal attention are different. Analytics platforms, ad pixels, embedded video players, and map widgets all set cookies that can follow a person across sites, and some of that data is shared with third-party advertising platforms.
In the EU, the UK, and a growing list of US states, you have to tell visitors this is happening and get their agreement before it starts. If your traffic includes those regions, a consent banner isn’t a courtesy — it’s a requirement.
The banner is only half of it, though. Consent means nothing if the scripts fire anyway — which is why the walkthrough below spends as much time on blocking as it does on the notice itself.
Legal Disclaimer: Due to the dynamic nature of websites, no single plugin can offer 100% legal compliance. Please consult an Internet law attorney specialist to determine if you are in compliance with all applicable laws for your jurisdictions and your use cases. Nothing on this website should be considered legal advice.
How to Add a Cookie Consent Banner in WordPress with WPConsent (In 8 Steps)
WPConsent is a consent management plugin. It handles the scanning and the blocking, not just the banner — and everything in this walkthrough works in the free version on WordPress.org.
It’s also self-hosted. Consent records stay in your own WordPress database rather than on a vendor’s servers, and there are no pageview limits. That’s the main structural difference between it and the subscription consent platforms.
1. Install WPConsent and run the setup wizard
Go to Plugins » Add New, search for WPConsent, then click Install Now and Activate. The setup wizard opens on its own once the plugin is active.
The wizard is short — it takes you through the cookie scan, the automatic configuration, and your banner layout in about five minutes. You can redo any of it later from the plugin’s settings, so there’s no need to agonize over choices here.
Click Let’s Get Started to move to the scan.
2. Scan your site to find out what’s actually setting cookies
This is the step that makes everything after it work, and it’s the easiest one to rush past.
Click Scan Your Website and WPConsent crawls your pages, identifies the third-party services running on them, and lists the cookies each one sets. Worth knowing before you click: the scan sends data about your site to WPConsent’s API so it can identify services and pull in cookie descriptions. Your consent records stay local, but the scan itself is not an entirely on-server operation.
When it finishes you get a count of services and cookies found. On the test site I ran this on, three services turned up seventeen cookies — and two of those services turned out to be WooCommerce components I hadn’t thought of as tracking at all.
Leave the detected services checked and click Auto-Configure Selected.
WPConsent sorts each one into a cookie category and fills in its description, purpose, and duration for you.
Don’t Skip The Scan
The scan isn’t housekeeping — it’s the switch. WPConsent only outputs its Google Consent Mode script if the scan has found at least one Google service on your site. I tested this: with no Google service detected, there was no consent signal in the page at all. If Consent Mode looks like it isn’t working later, an unrun or incomplete scan is the first thing to check.
3. Choose your banner layout and position
Next the wizard asks how the notice should look. WPConsent offers three layouts — Long Banner, which spans the width of the page, Floating Banner, a smaller box that sits over the content, and Modal Banner, which centers a dialog on screen. You then set the position to Top or Bottom.
A live preview underneath shows the result, including the three buttons visitors will see: Preferences, Reject, and Accept All. Giving people a genuine reject option in the same place as accept isn’t just good manners — regulators have taken an interest in banners that bury it.
Click Save & Complete Setup when the preview looks right, or use Further Configure Banner Styles if you want to adjust colors, fonts, and button styling to match your theme.
4. Turn on script blocking and content blocking
Now for the part that turns a notice into actual consent. Head to WPConsent » Settings and look through the Cookies Configuration list.
Script Blocking stops known third-party scripts from setting cookies before the visitor agrees. It works from the service database the scan built, so you never have to find or hand-edit a tracking snippet yourself.
Content Blocking handles embeds — YouTube, Vimeo, DailyMotion, Google Maps, and reCAPTCHA. Instead of letting an iframe load and set cookies, WPConsent shows a placeholder in its place until consent is given, so you don’t end up with a blank rectangle in the middle of a post.
Two other toggles on this screen are worth a look. Toggle Services lets visitors approve or block individual services rather than whole categories, and Settings Button adds a floating control so someone can reopen their choices after dismissing the banner.
With blocking switched on, the next thing to check is where the scan actually filed each of your cookies.
5. Review your cookie categories
Miscategorize a cookie here and the mistake follows it everywhere — into the banner, the policy page, and whatever gets blocked before consent.
Further down the same screen you’ll find three categories: Essential, Statistics, and Marketing. Essential covers what the site needs to function and can’t be switched off. Statistics is analytics. Marketing is advertising and retargeting.
Three is the full set by default — there’s no Preferences category, so don’t go looking for one. You can add a category of your own if your site genuinely needs a fourth.
Check where the scan put each service before moving on. If you run a store, this matters more than usual: cart and checkout cookies belong in Essential, and a misfiled payment cookie can break checkout for anyone who declines. Our guide to WooCommerce GDPR compliance goes deeper on the store-specific cases.
6. Enable Google Consent Mode v2
If you run Google Analytics or Google Ads, this is what keeps your reporting from going dark for everyone who declines.
On the same Cookies Configuration screen, find Google Consent Mode. It’s on by default, so usually you’re just confirming it.
Here’s what it actually does, because the mechanics explain the trade-off. WPConsent writes a default consent state into the top of your page’s <head> before any Google tag initializes, with ad storage, ad user data, ad personalization, and analytics storage all set to denied. When the visitor chooses, WPConsent fires a consent update — your Statistics category controls analytics storage, and Marketing controls the three advertising signals.
Leaving the toggle on runs what Google calls advanced mode. Your Google tags still load on page one, but in a restricted, cookieless state — which lets Google model conversions from anonymized signals instead of leaving a hole in your reports. Switching the toggle off while keeping Script Blocking on gives you simple mode: nothing Google-related loads until consent, which is stricter and leaves bigger gaps in your data.
Advanced mode is the default, it’s what Google recommends, and it’s what I’d suggest for most sites.
One thing that surprises people: with Consent Mode enabled, WPConsent deliberately stops blocking the Google Analytics, Google Tag Manager, and Google Ads scripts. That’s intended — those tags are governed by Google’s own consent API once the signals are in place, so blocking them outright would defeat the purpose.
Two adjacent settings are worth switching on while you’re here. URL Passthrough and Ads Data Redaction help conversion attribution survive when ad cookies are denied, which matters if you’re running paid campaigns.
With that, Consent Mode is fully configured.
Why Analytics Doesn’t Go Dark
Letting the Google tags load unblocked once Consent Mode is on isn’t a gap in the setup — it’s how the system is designed to work. Google’s own consent API takes over from there, deciding what those tags can actually do with the signals WPConsent sends. Blocking the scripts outright at that point would just break the modeling that fills in your reports for everyone who declines.
7. Generate your cookie policy page
A copy-pasted cookie policy goes stale the moment you install a new plugin. WPConsent builds yours from what the scan actually found instead.
In the Cookie Policy section, click Generate Cookie Policy Page, or pick an existing page and add the WPConsent shortcode to it. That shortcode is what renders the live cookie table, so the page won’t list anything without it.
Link that page from your banner and your footer, and it stays in sync as your scan results change.
8. Check your work on the front end
Open your site in a private browser window. The banner doesn’t display for logged-in administrators by default, which is the most common reason someone thinks it isn’t working.
If you use a caching plugin, clear the cache first. Then click through the banner and reopen the preferences panel to confirm your choices stuck.
Back in the admin, WPConsent » Dashboard shows a Site Consent Health score with the features you haven’t configured yet. It’s a quick way to see what’s still missing without going back through every screen.
WPConsent also honors Global Privacy Control, so visitors whose browser sends a global opt-out signal are respected without interacting with the banner at all.
What a Paid WPConsent Plan Adds
Everything above runs on the free plugin, with nothing gated partway through setup. A few things do sit behind a paid plan, and they cluster around scale and proof rather than the basics:
- Smart geolocation rules — show a strict opt-in banner to EU visitors and a lighter notice elsewhere, using built-in GDPR, CCPA, and LGPD templates.
- Consent logs — searchable, exportable records of who consented to what, stored in your own database. This is the proof-of-consent an auditor asks for.
- Automatic scanning — scheduled rescans, so a newly added plugin that starts setting cookies gets caught without you remembering.
- Automatic translations — banner and preferences copy translated for multilingual sites.
- Do Not Sell addon — the opt-out link and flow required by CCPA and similar US state laws.
- IAB TCF v2.3 — consent framework support for publishers running programmatic ads. Note that enabling it forces the modal layout, whatever you picked earlier.
For a single site that just needs a working banner and honest blocking, the free version is genuinely enough. The paid tiers are about multi-site licensing, regional targeting, and having records to show.
How to Keep Google Analytics Privacy-Friendly with MonsterInsights
Consent decides whether you’re allowed to track someone. It doesn’t decide what you send to Google once they’ve said yes — and that second question is where a lot of sites quietly leak personal data.
MonsterInsights, the WordPress analytics plugin, handles that side. The division of labor is clean: WPConsent decides whether tracking is permitted, and MonsterInsights governs what the permitted tracking actually collects and how you read it.
The two work together through Google Consent Mode, not through a direct integration. WPConsent’s consent signals apply to the Google Analytics tag MonsterInsights outputs, at the gtag layer — which means there’s no setting to connect and nothing to configure on the MonsterInsights side.
Two features do the actual work here. Privacy Guard automatically stops personally identifiable information (PII) from reaching Google Analytics — the kind of thing that slips through from contact form fields and cart pages without anyone noticing.
The EU Compliance addon handles the broader set: anonymizing IP addresses, switching off demographics and interest reports, and disabling UserID tracking. Both are available on Plus and above.
You’ll find them under Insights » Settings » Engagement once you’ve installed the addon from Insights » Addons.
If you’re on the free version, one useful setting is still available: Anonymize IP Addresses in that same Engagement tab truncates visitor IPs before they reach Google Analytics.
Our post on keeping personal info out of Google Analytics covers what Privacy Guard adds on top of that.
Keep Personal Data Out of Your Analytics
A consent banner controls whether you can track a visitor. Privacy Guard and the EU Compliance addon control what gets sent to Google once you can — anonymized IPs, no demographics data, and no personally identifiable information slipping through from your forms.
See how EU Compliance worksConsent and Analytics: The Full Picture
A cookie consent banner and privacy-friendly analytics solve two different problems, and this guide has covered both. WPConsent handles the front door — scanning your site, blocking scripts until a visitor agrees, and generating the policy page that backs it up. MonsterInsights handles what happens after someone says yes, keeping personally identifiable information out of your reports and letting Google Consent Mode fill in the gaps left by everyone who says no.
A banner without script blocking is just a courtesy notice — the two only add up to real consent when they run together. Add privacy-friendly analytics on top, and you’ve covered both what visitors are told and what actually happens to their data once they say yes.
Already Running a Different Consent Plugin?
If your site is running Cookie Notice, CookieBot, or Complianz, you don’t have to replace it to use MonsterInsights. The EU Compliance addon integrates with all three, automatically adjusting how Google Analytics tracks visitors based on the consent state those plugins set.
See EU Compliance Integration DetailsFAQs About WordPress Cookie Consent Banners
Does a WordPress site need a cookie consent banner?
You need one if your site sets non-essential cookies and has visitors from regions with consent laws — the EU, the UK, and a growing number of US states. Almost every WordPress site running Google Analytics, an ad pixel, or an embedded video falls into that category. Cookies used purely for logging in or remembering a comment don’t require consent on their own.
Does displaying a cookie banner make my site compliant?
No. The banner is the visible part, but the requirement is that non-essential cookies don’t get set until the visitor agrees. A banner that appears while Google Analytics and your ad pixel keep loading normally is closer to a disclosure notice than to consent. Script blocking is the part that does the compliance work, which is why it’s a step in the walkthrough above rather than an optional extra.
Will blocking cookies until consent ruin my Google Analytics data?
It will change it, but Google Consent Mode v2 is designed to limit the damage. In advanced mode your Google tags still load in a cookieless state before consent, so Google can model conversions from anonymized signals rather than reporting nothing. Simple mode blocks those tags outright, which is stricter on privacy and leaves larger gaps in your reports. Advanced mode is the default and the better choice for most sites.
Do I need a paid cookie consent plugin?
For a single site, usually not. The free version of WPConsent covers the banner, the cookie scanner, automatic script blocking, embed blocking, Google Consent Mode v2, and the cookie policy generator. Paid plans add regional targeting, consent logs for audit trails, scheduled rescans, multi-site licensing, and IAB TCF support — worth it if you manage client sites, run programmatic ads, or need documented proof of consent.
Where is my visitors’ consent data stored?
With WPConsent it stays in your own WordPress database. That’s the main structural difference from subscription consent platforms, which send consent records to a vendor’s servers and typically charge by pageview. One nuance worth knowing: the cookie scan does send data about your site to WPConsent’s API so it can identify services and pull in cookie descriptions.
Why isn’t my cookie banner showing up?
The most common cause is that you’re logged in as an administrator — the banner is hidden for admins by default, so check in a private browser window. If you use a caching plugin, clear the cache after changing any WPConsent setting. And if the banner appears but Google Consent Mode doesn’t seem active, confirm the cookie scan has actually detected a Google service on your site, because the consent script won’t load otherwise.
If you liked this article, check out the following beginner-friendly guides:
- Best WordPress Cookie Consent Plugins & CMPs
- Google Analytics GDPR Compliance – Make Your Site Compliant
- Google Analytics CCPA Compliance: Make Your Site Compliant
- Full Guide: Mastering PECR Compliance for Google Analytics
- Google EEA Compliance & Consent Signals Guide (Ads Personalization)
Follow us on Twitter, Facebook, and YouTube for more Google Analytics tips.