How to Add a Cookie Consent Banner to WordPress and WooCommerce (2026)

A customer opens your pizza menu, adds a margherita, and meets a cookie banner covering the checkout button. Meanwhile, an advertising tag has already fired in the background. That setup manages to annoy the customer and miss the point of consent.

A good WordPress cookie consent setup does two jobs: it gives visitors meaningful control over optional tracking, and it leaves essential ordering functions alone. The banner is just the visible part. Script blocking, saved preferences, payment behavior, and testing do most of the work.

Does Your WordPress Website Need a Cookie Consent Banner?

The answer depends on your visitors, applicable laws, and the technologies your site uses—not simply on having WordPress installed. A restaurant website running only necessary functionality has a different consent problem from one using Google Analytics 4, advertising pixels, and embedded ordering services.

Essential functionality versus optional tracking

WooCommerce uses cookies such as woocommerce_items_in_cart, woocommerce_cart_hash, and wp_woocommerce_session_ to support cart and session behavior. Where these are necessary to provide shopping functionality a visitor requests, they generally don’t require the same opt-in treatment as advertising technologies.

GA4 measures visitor activity and conversions. Remarketing tags can help advertising platforms reach people who viewed your menu but didn’t order. Neither becomes essential merely because the resulting reports are useful to your business.

Classify technologies by what they actually do. A plugin labeled “customer experience” might still transmit advertising identifiers. Conversely, a security cookie protecting checkout may serve a necessary purpose.

Location changes the requirements

EU rules generally require prior consent for nonessential storage or access on a visitor’s device, subject to limited exemptions. UK requirements also distinguish necessary uses from other purposes, with specific exceptions and conditions that should be checked against current guidance. The ICO’s guidance on cookies and similar technologies is a useful reference.

US requirements aren’t identical. For businesses covered by California’s privacy law, sale or sharing of personal information can trigger opt-out duties, including honoring qualifying signals such as Global Privacy Control. Other states have their own rules.

Don’t assume every site needs the same worldwide pop-up. Equally, don’t assume a local restaurant only receives local visitors. A banner alone doesn’t establish compliance: disclosures, consent records where needed, vendor arrangements, retention, and actual tracking behavior must agree. Get qualified advice when your obligations are unclear.

Find Out Which Cookies and Trackers Your Site Uses

Start with an inventory, not a color picker. You can’t offer an honest “Reject optional cookies” button until you know what it needs to stop.

List your active plugins, theme integrations, header scripts, and Google Tag Manager containers. Check analytics extensions, advertising integrations, embedded maps, videos, chatbots, reservation tools, and third-party ordering widgets. A map on the contact page is easy to forget when you’re concentrating on checkout.

Combine a scanner with a manual ordering test

1. Run a cookie scanner across public pages, including your menu, contact page, cart, and checkout. Treat its classifications as suggestions.
2. Open a clean browser profile without extensions. In developer tools, use the Application or Storage panel to inspect cookies, local storage, and session storage.
3. Open the Network panel before loading the site. Watch requests before consent, after rejection, and after acceptance—not just the cookie list.
4. Complete realistic journeys: choose delivery, enter a postcode, customize an item, open chat, and test checkout using your payment provider’s test environment.

For each technology, record its provider, purpose, proposed consent category, identifiers or storage keys, duration, pages where it appears, and how it is loaded. Add the responsible plugin or tag so you know where to change it later.

An inventory entry might read: “GA4; Google; audience measurement; analytics; _ga and related identifiers; configured retention and cookie duration to verify; loaded through GTM.” Another might identify the WooCommerce session cookie as necessary for maintaining a customer’s cart.

Automated scans can miss checkout-only scripts, logged-in pages, location-dependent widgets, and tags triggered by interaction. Cookies aren’t the whole picture either: a script can send data without storing one. An empty cookie panel doesn’t prove nothing left the browser.

[IMAGE: Browser developer tools beside a restaurant tracking inventory showing WooCommerce session cookies, GA4 requests, an embedded map, and their proposed consent categories]

Choose a WordPress Cookie Consent Plugin

Complianz, CookieYes, and Real Cookie Banner are established names in WordPress consent management. None should be judged by its banner screenshot alone. What matters is whether the specific edition and configuration control your scripts correctly.

Feature packaging changes, so treat pricing and free-versus-paid boundaries as a live purchasing check for 2026. Don’t assume an older comparison still describes the current WordPress plugin, connected service, or subscription tier.

What to verify for each option

• Complianz: Its approach includes a setup wizard, scanning, and service integrations. Check which regional configurations, consent-record features, policy tools, and Consent Mode capabilities are included in the current edition. Confirm coverage for your actual WooCommerce extensions.
• CookieYes: Review how its WordPress integration relates to the connected platform. Verify current limits for scans, pages or traffic where applicable, consent logs, geographic targeting, and Google Consent Mode configuration.
• Real Cookie Banner: Examine its service-template and content-blocker approach. Check which templates, scanning features, regional controls, and Consent Mode integrations require a paid license, and how custom services are handled.

These are evaluation points, not a claim that every feature comes with every plan. Read the current documentation and release notes before relying on a feature for compliance.

Your shortlist needs prior blocking where required, a persistent withdrawal control, clear categories, and appropriate regional behavior. If you use Google tags, check support for the relevant consent signals—not merely a “Google compatible” label.

Accessibility deserves a practical check: can someone reach every control by keyboard, see the focus indicator, understand the buttons with a screen reader, and use preferences at increased zoom? A banner shouldn’t strand keyboard focus or hide essential controls on a small screen.

Install only one consent-management system. Two plugins can issue conflicting defaults, reopen each other’s banners, and block scripts in different ways. Also check whether your theme or analytics extension already supplies consent controls.

For the example below, assume an existing restaurant site already has Complianz installed. The workflow illustrates configuration rather than endorsing a particular plan; exact labels and available integrations vary by version.

Set Up Your Banner and Cookie Preferences Step by Step

1. Prepare the site and confirm installation

Back up WordPress and work on staging first. If you’re starting from scratch, install your vetted consent plugin through Plugins → Add New or its verified vendor package, then activate it. Avoid unofficial downloads for software controlling what runs in visitors’ browsers.

On our example site, first check the installed Complianz version and whether another banner, theme script, or tag-manager consent template is already active. Resolve duplicate consent systems before proceeding.

2. Complete the wizard using real business details

Enter the business information and relevant regional settings. Answer questions about analytics, advertising, embedded content, and data sharing from your inventory—not from what you hope the site does.

If geographic rules are involved, establish what happens when a location can’t be determined. A global opt-in configuration can be operationally simpler, but it doesn’t replace jurisdiction-specific requirements such as applicable sale/share opt-outs.

3. Scan and review the classifications

Run the available scan and examine its results. Keep necessary cart, session, and security functionality separate from optional analytics and marketing. For preferences or functional categories, assess whether each technology genuinely requires consent in your context.

Don’t reclassify analytics as necessary to avoid gaps in reports. Unrecognized scripts need manual investigation and, where appropriate, a custom service definition or blocking rule.

4. Configure actual prior blocking

In an opt-in setup, nonessential categories should start off. Map services to their categories and verify that integrations or blocking rules prevent execution before permission.

A saved consent value doesn’t automatically stop a script pasted into your theme header. Remove uncontrolled duplicates and connect custom scripts to the consent system using its documented method.

5. Add understandable controls and policy links

Provide clear accept, reject, and preference controls. Where refusal must be as easy as acceptance, don’t hide “Reject optional” behind several clicks while presenting a prominent first-layer acceptance button.

Link the banner to your privacy and cookie policies. Explain providers, purposes, relevant durations, and how choices can be changed. Generated policy text still needs checking against your site’s behavior.

For a site using analytics and marketing, straightforward copy could be: “We use necessary cookies to keep your basket and checkout working. With your permission, we also use analytics and marketing technologies. You can accept optional cookies, reject them, or choose your preferences.”

6. Keep preferences available after dismissal

Add a persistent “Cookie settings” control, such as a footer link connected to the preference panel. Withdrawal should be easy, not a scavenger hunt.

Finally, test the layout on a phone. Keep the order button, preference controls, and readable policy links accessible. A hungry customer shouldn’t need precision thumb gymnastics to reject analytics.

[IMAGE: Mobile restaurant menu with a compact cookie banner offering Accept optional, Reject optional, and Preferences, alongside an open category panel and a visible Cookie settings footer link]

Connect GA4 Without Breaking WooCommerce Checkout

The tricky part is coordinating the consent interface, Google tags, and WooCommerce extensions. Each should have a defined responsibility. Otherwise, one integration waits for consent while another quietly sends the same event.

Give GA4 one loading path

Check whether GA4 is loaded through Google Tag Manager, a WooCommerce analytics extension, your theme, or a manually inserted script. Choose one controlled implementation and remove duplicates. Sending purchase events twice is a reporting problem, not evidence of twice as many orders.

Your consent integration should establish default states before relevant tags run, then update those states when the visitor chooses. In GTM, use the documented consent-initialization mechanism or integration template rather than assuming a normal page-view trigger runs early enough.

Review analytics_storage, ad_storage, ad_user_data, and ad_personalization as appropriate to your Google implementation. They address different storage and advertising permissions. An “analytics allowed” choice shouldn’t silently become permission for personalized advertising.

Basic versus advanced Google Consent Mode

In basic Consent Mode, Google tags are blocked until consent is granted. Where consent isn’t granted, data isn’t sent to Google through those blocked tags. This is easier to reason about when your requirement is no optional Google tracking before opt-in.

In advanced Consent Mode, Google tags load with consent defaults, and denied states can still allow cookieless pings. Those signals may support modeling. “Cookieless” doesn’t mean “no network requests,” “no data,” or automatic legal compliance.

Consent Mode is a mechanism for communicating choices to supported Google tags. It doesn’t obtain valid consent, write your disclosures, or automatically control unrelated advertising pixels. Decide whether advanced mode is appropriate with your privacy adviser, and verify behavior against Google’s current Consent Mode documentation.

Protect the ordering path

Don’t put the entire WooCommerce script bundle behind an analytics switch. Customers who reject optional tracking should still be able to add toppings, maintain a basket, select pickup, and submit an order.

For restaurants using FoodMaster’s WooCommerce restaurant ordering system, include delivery, pickup, and QR table-ordering journeys in the test plan. FoodMaster provides those ordering capabilities; it doesn’t make every third-party integration on the website necessary or consent-exempt.

Audit payment integrations individually. Hosted payment fields, fraud-prevention scripts, express-payment buttons, and extra analytics can have different purposes. Blocking a gateway wholesale may break payment, but allowing everything from a payment provider is too broad. Check its documentation and what actually loads.

Test add_to_cart, begin_checkout, and purchase events under each consent state. Check server-side tracking too: moving collection off the browser doesn’t remove privacy obligations. And remember that withdrawing consent can’t recall information already sent; it should control future activity according to your implementation and obligations.

Test Your Setup and Fix Common Cookie Banner Problems

Test on staging, then repeat key checks on production after clearing relevant caches. Keep developer tools open. A banner that looks correct can still leave trackers running.

A practical test matrix

• New visitor: With clean site storage, inspect cookies and requests before interacting. Confirm the intended defaults.
• Rejection: Reject optional categories, browse several pages, and place a test order. Necessary shopping functions should remain available.
• Acceptance: Confirm only approved services activate. Check that analytics events aren’t duplicated.
• Withdrawal: Reopen settings, revoke permission, and inspect subsequent activity. Verify whether a reload is required and which cookies the implementation can remove.
• Returning visitor: Confirm the saved choice is respected without unwanted tracking or unnecessary repeat prompts.
• Mobile checkout: Test menus, modifiers, address entry, payment authentication, and banner controls on actual phones.

Fix the common failures

Trackers firing early usually point to hard-coded scripts, duplicate integrations, incorrect tag triggers, or consent defaults initialized too late. Trace the request’s initiator in developer tools to find its source.

A missing banner may reflect saved consent, regional settings, stale cached HTML, or script optimization—not necessarily a broken plugin. Test clean storage, purge caches, and follow documented exclusions for script delay or combination. Check that location-specific responses aren’t incorrectly shared through caching.

Blocked maps and videos can be intentional. Provide an explanatory placeholder and a usable alternative, such as the restaurant’s written address. Repeated prompts can come from inconsistent domains, short preference lifetimes, blocked storage, or conflicting consent tools.

Are free cookie plugins enough?

Sometimes. Adequacy depends on your scripts, jurisdictions, and required controls—not the price. Verify current plan limits and actual blocking behavior.

Do I still need a cookie policy?

A banner doesn’t replace required disclosures. Explain your technologies and choices; depending on applicable rules, that information may sit in a dedicated cookie policy or an appropriate privacy-notice section.

Should rejecting analytics prevent ordering?

No. Optional analytics shouldn’t be a condition of placing an ordinary restaurant order. Keep the basket working, honor the choice, and retest whenever you add a payment method, marketing tag, or ordering integration. That’s how the banner becomes a working privacy control rather than decoration.