You launched your website. Now a friend says you “need a cookie banner or you will be fined.” You are not sure if that is true, and every guide you find sounds like it was written by a lawyer.
Here is the short version. If your site is in Europe, or sells to people in Europe, you probably do need cookie consent for WordPress. It takes about an hour to set up. This guide shows you how.
Quick summary
- Cookies that are not strictly needed (analytics, ads, some embeds) need the visitor’s permission first.
- “Strictly necessary” cookies, like a shopping cart, do not need consent.
- A good banner has equal Accept and Reject buttons, no pre-ticked boxes, and blocks scripts until the visitor chooses.
- A free plugin can handle this for most small sites.
- You also need a short cookie policy and a way to change the choice later.
What is a cookie, and why does the law care?
A cookie is a small file your website saves in the visitor’s browser. Some cookies are harmless. They remember what is in a shopping cart or keep someone logged in.
Others track behaviour. They tell Google Analytics, Meta or an ad network what a person looked at. That is personal data, and European rules protect it.
Two laws matter here. The ePrivacy Directive says you need permission before storing non-essential cookies. The GDPR says how that permission must look. I am a developer, not a lawyer, so treat this as practical guidance and check your specific case with a legal professional.
Do you actually need a cookie banner?
Not always. Ask yourself one question: does my site use anything beyond strictly necessary cookies?
Your site probably does, if you use any of these:
- Google Analytics or a similar analytics tool
- Facebook or Meta Pixel
- Embedded YouTube videos or Google Maps
- Live chat widgets
- Advertising or remarketing tags
If you use none of them, you may not need a banner. But you still need a privacy policy, and a professional site also helps you avoid the signs your business is losing customers. Many owners find that the moment they add analytics, the banner becomes necessary.
What good cookie consent looks like
Under the GDPR, consent must be freely given, specific, informed and clear. In practice, that means this:
- Nothing loads before consent. Analytics and marketing scripts stay blocked until the visitor clicks Accept.
- Accept and Reject look equally easy. Do not hide “Reject” in grey text or behind a settings menu.
- No pre-ticked boxes. The visitor must choose. The EU Court of Justice ruled on this in 2019.
- Categories are explained. Analytics, marketing and functional cookies are listed in plain words.
- Changing your mind is easy. A small link in the footer should reopen the settings. Withdrawing consent must be as easy as giving it.
- You keep a record. You should be able to show when and how a visitor agreed.
Most “dark pattern” banners fail on point 2. They are also the ones that annoy your visitors.
How to set up cookie consent for WordPress, step by step
You do not need to code anything. Here is a simple path.
- List what your site does. Note every tool that adds tracking: analytics, ads, videos, chat, contact form add-ons.
- Pick a consent plugin. Well-known options include Complianz, CookieYes and WPConsent. Complianz has a free version with a banner, cookie scan and script blocking. Compare current features on each plugin page, because plans change.
- Run the setup wizard. It asks your country, the tools you use, and whether you sell online.
- Scan your site. The plugin finds cookies and scripts that are running.
- Block scripts until consent. This is the step people skip. A banner that only displays a message, while trackers load anyway, does not protect you.
- Generate a cookie policy. Most plugins create one for you. Put it on its own page and link it in the banner and footer.
- Test it yourself. Open your site in a private browser window. Click Reject. Then check that no analytics cookies appear in your browser’s developer tools.
Free plugin or paid plugin?
A free plugin is enough for many small sites with a blog or a simple business site. If you are still planning your budget, our guide to WordPress website costs for startups shows what to expect. Paid versions usually add extras: A/B testing, several sites, and support for Google Consent Mode v2.
You may want the paid version if you run Google Ads, or if you sell across many countries and languages. If you are unsure, start free. You can upgrade later without rebuilding your site.
The honest trade-off: a strict banner may lower your analytics numbers, because some visitors will click Reject. That is fine. Accurate data from fewer people beats data you should not have collected.
Extra notes for online stores
If you run a WooCommerce store, some cookies are strictly necessary. The cart and checkout session are examples. These do not need consent.
Payment tools, marketing pixels and email popups are different. Check each one. Also make sure your privacy policy explains what you collect at checkout and why.
Selling in more than one language? Set the banner to match each visitor’s language. Many plugins do this automatically.
Common mistakes to avoid
- Installing a banner but not blocking scripts
- Copying another company’s cookie policy word for word
- Forgetting embedded videos and maps
- Making “Reject” hard to find
- Never re-scanning after adding a new plugin
Set a reminder to re-scan your site every few months. Every new plugin can add new cookies.
Official sources
For the legal text, read the GDPR on EUR-Lex and the guidance from the European Data Protection Board. For the plugin itself, see the Complianz page on WordPress.org.
Frequently asked questions
Do small businesses need cookie consent?
Yes, if your site sets non-essential cookies. The rules apply based on what your site does and who visits, not on your company size. A tiny shop with Google Analytics needs consent just like a large one.
Can I just show a banner that says “By using this site you agree”?
No. Consent must be an active choice. Simply browsing the site does not count. Visitors need to click Accept, and they need a fair way to say no.
Are strictly necessary cookies exempt?
Yes. Cookies that make the site work, like a shopping cart or a login session, do not need consent. You should still mention them in your cookie policy.
Is a free cookie plugin good enough?
For many small sites, yes. Check that it blocks scripts before consent, offers a real Reject button, and lets visitors change their choice later. If it does those three things, it covers the basics.
How often should I review my cookie setup?
Every three to six months, and each time you add a new plugin, tracking tool or embedded video. New tools often add new cookies.
Does this replace legal advice?
No. This guide covers the practical side. If you handle sensitive data or sell in several countries, ask a privacy lawyer to review your setup.
Your next step
Open your site in a private window today. See what loads before you click anything. If trackers fire straight away, you know what to fix.
If you would rather have someone set this up properly, get in touch. We build WordPress websites and WooCommerce stores for new businesses, and we can set up consent, privacy pages and speed together. No pressure. A short message is enough to start.