If your WordPress site does anything beyond serving static pages — runs Google Analytics, shows ads, embeds a YouTube video, lets people comment, sells anything through WooCommerce, or uses a form tool that drops a tracking cookie — you almost certainly need both a cookie policy and, in most cases, a consent banner in front of it. The handful of sites that don’t need one are genuinely bare: no analytics, no ad network, no embeds, no e-commerce, nothing but WordPress’s own login cookies.
That’s the practical answer. The legal answer depends on which rulebook applies to your visitors, and it’s worth understanding both, because they don’t work the same way.
Two Different Laws, Two Different Triggers
GDPR and the ePrivacy Directive (EU/UK) regulate the act of placing a cookie, not your business size. If your site is reachable by and reasonably likely to have visitors in the EU or UK, the ePrivacy Directive requires prior opt-in consent before you set any cookie that isn’t “strictly necessary” — before it fires, not just a banner that discloses it after the fact. There’s no small-business or low-traffic exemption. A hobby blog with 200 monthly visitors and Google Analytics installed is technically in scope the same as a large retailer. In practice, small sites are rarely the target of an enforcement sweep, but the legal obligation doesn’t scale with traffic the way some site owners assume it does.
CCPA/CPRA (California) works differently — it’s threshold-based. You’re only covered if your business meets at least one of these: over $26,625,000 in annual gross revenue, buys/sells/shares the personal information of 100,000 or more California consumers or households a year, or derives 50% or more of annual revenue from selling or sharing personal information. Most small WordPress sites and blogs simply don’t hit any of those numbers and aren’t directly regulated by CCPA — though if you do cross a threshold, the requirements are specific: a “Do Not Sell or Share My Personal Information” link (or a unified “Your Privacy Choices” link), honoring Global Privacy Control (GPC) browser signals as a valid opt-out, and — per 2025-2026 California Privacy Protection Agency (CPPA) enforcement — symmetrical banner design, meaning “Accept” and “Decline” have to take equal effort and get equal visual weight. A banner that makes accepting one click and declining a three-click hunt through settings is itself a violation now, independent of what the cookies do.
There are other state laws (Colorado, Virginia, Connecticut, and others) with their own thresholds and opt-out mechanics, but for a typical WordPress site owner, GDPR/ePrivacy and CCPA/CPRA are the two that come up most often, and GDPR is the one with no size exemption to hide behind.
What’s Actually in Your Cookie Jar
WordPress core sets a small set of cookies on its own, and not all of them need consent.
Strictly necessary (no consent required): wordpress_[hash] and wordpress_logged_in_[hash] (login/authentication), wp-settings-{time}-[UID] (admin interface preferences), and wordpress_test_cookie (a temporary check that cookies work). These exist to make the site function and are generally exempt from consent requirements under both GDPR and CCPA.
Not strictly necessary (consent required): the three comment cookies — comment_author_{hash}, comment_author_email_{hash}, comment_author_url_{hash} — which WordPress only sets when a commenter opts in via the “Save my name and email” checkbox. That opt-in checkbox is doing real legal work; don’t let a theme or plugin override it to save the cookie automatically.
Beyond core WordPress, most sites are carrying more than they realize: Google Analytics (_ga, _gid, and related cookies — non-essential, require consent), Jetpack (sets its own functional and stats cookies depending on which modules are active), WooCommerce (cart/session cookies are generally treated as strictly necessary for the checkout to function, but anything WooCommerce-adjacent for marketing or abandoned-cart tracking is not), embedded YouTube videos (YouTube sets tracking cookies the moment the standard embed loads — before anyone presses play — unless you use youtube-nocookie.com or a click-to-load facade), and any ad network, affiliate tracking pixel, or email-signup widget, all of which typically drop their own third-party cookies on page load.
The point of a cookie audit — which every legitimate cookie-consent plugin does automatically, and which you can also do manually by opening your browser’s dev tools and checking Application > Cookies on a fresh, logged-out visit — is finding out what your site is actually setting versus what you assume it’s setting. Plugins and page builders add cookies you didn’t explicitly configure.
What a Cookie Policy Actually Needs to Say
A compliant cookie policy (usually a dedicated page, separate from or linked out of your general privacy policy) needs to specify, in plain language: the categories of cookies you use (necessary, functional/preferences, analytics/statistics, marketing/advertising), ideally an actual table of the specific cookies set, who sets them (you vs. a named third party like Google or Jetpack), what each one does and how long it lasts, and — critically — a working mechanism for visitors to withdraw or change consent after the fact, not just a “close” button that never appears again. WordPress.org’s own cookie policy and Automattic’s cookie policy are reasonable real-world examples of the format if you want to see one written by a company operating at scale.
What It Costs to Skip This
For GDPR, the ceiling is the number that gets cited most — up to €20 million or 4% of global annual turnover, whichever is higher, for the most serious violations — but that figure is for large, deliberate, repeat offenders, not the realistic exposure for a small site with an outdated banner. The more instructive examples for a site owner this size are California’s recent CPPA enforcement actions against mid-size, non-tech companies: American Honda Motor Co. was fined $632,500 in March 2025 largely over how its cookie consent tool was configured and how it handled opt-out signals, and menswear retailer Todd Snyder was ordered to pay $345,178 in May 2025 for letting its opt-out request process sit broken for 40 days and asking consumers for more information than necessary to process an opt-out. Neither is a household name in the privacy-fine conversation the way Meta or Google is — which is exactly the point: regulators are reaching well below the Fortune 500 now, and “we used a consent management plugin” was explicitly not a defense in the CPPA’s own enforcement commentary on the Honda case.
Getting Compliant, in Practice
Audit first — find out what your site actually sets, using either a plugin’s built-in scanner or your browser’s dev tools. Write or generate the actual cookie policy page — Complianz and Termly (covered in our plugin roundup) both auto-generate one from the scan, which is faster and more accurate than writing it from a template. Install a consent solution that blocks non-essential cookies before consent, not just one that shows a banner while Google Analytics loads in the background anyway — that gap between “banner is visible” and “tracking is actually blocked” is the single most common compliance failure on small sites, and it’s the difference between a decorative banner and a functional one. Link the cookie policy from your site footer and from your privacy policy. And revisit it periodically: new plugins, new embeds, and new ad tags all add cookies you didn’t audit for on day one.
Bottom Line
Almost every WordPress site with analytics, ads, embeds, comments, or e-commerce needs a cookie policy, and most of those also need a real (not cosmetic) consent banner in front of non-essential cookies. GDPR/ePrivacy applies regardless of your size or traffic if EU/UK visitors can reach your site; CCPA/CPRA only kicks in once you cross specific revenue or volume thresholds, but its enforcement has been getting more aggressive against exactly the kind of mid-size, non-tech sites that assumed they were too small to notice.
For the fuller legal picture behind these rules, see our GDPR vs CCPA vs ePrivacy comparison. Not sure yet whether you specifically need a consent banner (as opposed to just a policy page)? Run through our consent-management checklist.
Sources
- gdpr-info.eu (GDPR fine tiers)
- cppa.ca.gov enforcement announcements on Honda (March 2025) and Todd Snyder (May 2025)
- developer.wordpress.org “Cookies” (WordPress core cookie list)
- Jetpack’s cookie documentation (jetpack.com/support/cookies)
- usercentrics.com CCPA/CPRA cookie banner guide (2026 symmetrical-design and GPC requirements)
- WordPress.org and Automattic’s own published cookie policies (as format references)
Discover more from software info by fk
Subscribe to get the latest posts sent to your email.
