Category: Cookie Consent

Cookie consent plugins and privacy compliance for WordPress sites.

Posted in Cookie Consent

GDPR vs CCPA vs ePrivacy: What WordPress Site Owners Actually Need to Know

Posted on by Filip Keser

These aren’t three versions of the same rule — they’re two different legal traditions bolted together, plus a third that works almost backwards from the first two. The ePrivacy Directive controls the moment a cookie gets placed on a visitor’s device. GDPR controls everything that happens to the data after that cookie has collected it. CCPA/CPRA doesn’t require a cookie’s permission slip at all by default — it requires you to honor a visitor’s request to stop, after the fact. Which one applies to your WordPress site depends entirely on who’s visiting it, not where you or your server happen to be.

The Three Laws, in Plain Terms

ePrivacy Directive (EU/UK, 2002/58/EC) is the actual “cookie law” — the reason consent banners exist in the first place. It says you need prior opt-in consent before you set any cookie or similar tracking technology that isn’t strictly necessary for the site to function, full stop, regardless of your size or revenue. It’s a Directive, not a Regulation, which matters mechanically: each EU member state passed its own national law implementing it, so enforcement and fine structures vary somewhat country to country (Spain and France’s regulators, for instance, have historically been more cookie-banner-active than most). It’s enforced by national data protection authorities, and in most member states, violations get folded into GDPR’s penalty structure rather than carrying a separate fine schedule.

GDPR (EU, Regulation 2016/679) is the general data protection law — it governs what you’re allowed to do with personal data once you have it, cookie-derived or not. That includes having a valid legal basis for processing (consent is only one of six), giving people the right to access, correct, delete, or export their data, notifying regulators of serious breaches within 72 hours, and restricting how you move EU personal data outside the EU. A cookie consent banner is where GDPR and ePrivacy meet in practice: ePrivacy is why the banner has to appear and be opt-in before tracking starts, and GDPR governs everything the plugin, your analytics tool, or your ad network does with the data once someone clicks “accept.”

CCPA/CPRA (California, effective as amended 2023, with ongoing CPPA rulemaking through 2026) runs on a different model entirely: opt-out, not opt-in. A covered business can process and even sell personal information by default — it just has to give consumers clear, low-friction ways to say no, and to actually honor that “no” without retaliating (no charging a fee or degrading service because someone opted out). It only applies once your business crosses a specific size threshold; unlike GDPR, small sites are exempt by law, not just by enforcement priority. As of the CPPA’s most recent Consumer Price Index adjustment (effective January 1, 2025), that threshold is: annual gross revenue over $26,625,000, OR you buy, sell, or share the personal information of 100,000 or more California consumers or households a year, OR 50% or more of annual revenue comes from selling or sharing personal information.

Side by Side

DimensionePrivacy / GDPR (EU/UK)CCPA/CPRA (California)
TriggerAny EU/UK visitor reaching your site, regardless of your size or location.Only once your business crosses the revenue/volume thresholds below.
Consent modelOpt-in — required before the cookie fires.Opt-out — the default is “on” until a visitor tells you to stop.
What’s regulatedePrivacy: placing a cookie/tracker. GDPR: everything done with the data afterward (legal basis, rights, breaches, transfers).Sale/sharing of personal information, plus the same rights model (access, deletion, correction, opt-out, limiting sensitive-data use).
Small-site exemptionNone — a 200-visit/month blog with Google Analytics is technically in scope.Yes, by statute, below the revenue/volume thresholds.
Required mechanicA prior-consent banner that blocks non-essential scripts until accepted.A “Do Not Sell or Share”/”Your Privacy Choices” link, honoring GPC as a valid opt-out, with symmetrical accept/decline design (per 2025-2026 CPPA enforcement).
Maximum penaltyUp to €20M or 4% of global annual turnover (most serious Article 83 violations; not realistic exposure for a small site with a stale banner).Up to $2,663 per violation ($7,988 for intentional or minor-involving violations); private right of action of $107–$799 per incident for certain breaches.

Why This Actually Matters for Your Site, Not Just in the Abstract

If your WordPress site can be reached by EU or UK visitors — which, unless you’ve geo-blocked the region, it can — the ePrivacy/GDPR combination applies the moment you set a non-essential cookie, no matter your traffic or revenue. That’s the one with no small-business door to walk through. CCPA/CPRA is the one most WordPress site owners in this series’ audience won’t actually be legally required to comply with yet, because most personal blogs, niche review sites, and small WooCommerce stores don’t clear $26.6 million in revenue or handle 100,000+ Californians’ data a year. But two things make it worth building for anyway: first, a lot of consent plugins (see our plugin roundup — Complianz in particular) handle GDPR, CCPA, and a dozen other regimes in the same free tier, so there’s rarely a reason to configure for GDPR only; second, CCPA’s thresholds are revenue-based, and a site that starts small doesn’t always stay that way.

The Other State Laws You’ve Probably Heard Of

CCPA isn’t the only U.S. state privacy law anymore — it’s just the oldest and best-known. As of 2026, twenty U.S. states have comprehensive consumer privacy laws in effect, including three (Indiana, Kentucky, and Rhode Island) that took effect January 1, 2026. Most of the newer ones — Colorado, Connecticut, Virginia, Utah, Oregon, Texas, and the rest — largely follow Virginia’s template rather than California’s or the EU’s: opt-out by default, revenue/volume thresholds, and (increasingly) a requirement to honor the Global Privacy Control signal specifically. Twelve states now require GPC compliance by law: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. Practically, if your consent plugin already honors GPC for CCPA, you’re most of the way to compliant with the other eleven states’ GPC requirement too — it’s one signal, not twelve separate integrations.

What’s Actually Changing Right Now

Two developments are worth knowing about. First, the long-proposed EU ePrivacy Regulation — which would have replaced the 2002 Directive outright — was formally withdrawn by the European Commission (approved July 16, 2025; published October 6, 2025). The current ePrivacy Directive and GDPR remain the binding law exactly as described above; nothing in this withdrawal changes what your site needs to do today.

Second, and still genuinely unsettled: the EU’s November 2025 “Digital Omnibus” package proposed folding cookie-consent rules directly into the GDPR through two new articles, 88a (consent mechanics — a single-click refusal option, equal-prominence accept/decline design, and a cooldown before re-prompting someone who refused) and 88b (a more ambitious browser- or OS-level consent signal that sites would have to recognize automatically, similar in spirit to Global Privacy Control). Since then, the text has moved more than once in Council negotiations: a Council position reported around June 18, 2026 dropped Article 88b while keeping 88a; a separate Council Presidency compromise dated June 22, 2026 did the opposite — proposing to delete Article 88a and revert cookie consent entirely to the existing ePrivacy Directive, while leaving 88b’s browser-signal idea “still under discussion” pending a Coreper-flagged impact assessment. As of the most recent check we could verify (mid-September 2026), that second, more recent position — 88a proposed for deletion, 88b undecided — is the latest documented state, though the Council’s own negotiating mandate has itself been repeatedly delayed, and the European Parliament hasn’t taken a position on either article yet. None of this has reached a final, adopted text, so treat it as a live negotiation to watch rather than a rule to comply with: the current ePrivacy Directive and GDPR described in this piece remain exactly what applies to your WordPress site right now, regardless of which way the Digital Omnibus eventually lands.

Bottom Line

Think of it less as three competing laws and more as two layers plus one outlier: ePrivacy is the door (can you set the cookie at all, and did you ask first), GDPR is the house (what you’re allowed to do with the data once you’re in), and CCPA/CPRA is a different building altogether that assumes entry is fine by default and regulates the exit instead. A WordPress site reachable from the EU/UK needs to satisfy the door-and-house combination regardless of size; a site that also crosses CCPA’s revenue or volume thresholds needs the opt-out mechanics on top of that. Most consent plugins worth using (see our roundup) are built to handle all of this — and the dozen-plus U.S. state laws behind it — from one configuration screen, which is the practical reason to set one up correctly once rather than chase each law individually.

For the practical “now what” — do I need a policy page, a banner, or both — see our companion piece, Do You Need a Cookie Policy on Your WordPress Site? And if you haven’t picked a tool yet, start with our plugin roundup.

Sources

  • eur-lex.europa.eu — Directive 2002/58/EC (ePrivacy Directive) and Regulation (EU) 2016/679 (GDPR), including Article 83 fine tiers
  • European Commission — formal withdrawal of the proposed ePrivacy Regulation (approved July 16, 2025; published October 6, 2025)
  • cppa.ca.gov — “Updated Monetary Thresholds in CCPA” (CPI adjustment effective January 1, 2025): revenue exemption, administrative fine, and private-right-of-action figures
  • cppa.ca.gov enforcement announcements — American Honda Motor Co. (March 2025) and Todd Snyder (May 2025) cookie/opt-out enforcement actions
  • clym.io and multistate.us — 2026 U.S. state comprehensive privacy law tracker and 12-state Global Privacy Control requirement list
  • EDRi — analysis of the Digital Omnibus Council compromise text (Articles 88a/88b safeguards)
  • PPC Land — EU Council drops cookie signal after Google lobbying (June 18, 2026 Council position: Article 88b dropped, 88a retained)
  • praxikon.com — Digital Omnibus and the GDPR tracker (June 22, 2026 Presidency compromise: Article 88a proposed for deletion, 88b still under discussion; checked Sept 15, 2026)
Posted in Cookie Consent

Termly Review: Features, Pricing, and Whether the Free Version Is Enough for Your WordPress Site

Posted on by Filip Keser

At a Glance

SpecValue
Installs80,000+
Rating3.6★ (204 ratings)
Free tier10,000 banner views/month, 1 policy
Starting price$10/month billed annually (Starter; $14/month billed monthly)
Best forBundled policy generator alongside the consent banner

Short Verdict

Termly is the odd one out in this series in one specific way: it’s not just a consent banner plugin, it’s a front end for Termly’s own hosted legal-document platform. The free plan gets you one attorney-drafted policy, a cookie banner with script auto-blocking, and quarterly cookie scans — but it’s capped at 10,000 monthly banner views, and once you cross that line the banner reportedly stops working rather than just losing features. Paid tiers start at $10/month with annual billing ($14/month if billed monthly) and add more policies, more frequent scans, and (at $15/month with annual billing, $20/month billed monthly, the Pro+ tier) the features ad-heavy sites actually want: Google Consent Mode v2, IAB TCF 2.3, consent logs, and multi-language support. If you want a bundled policy generator alongside your consent banner and your traffic is modest, it’s a reasonable one-stop option. If you just want a consent mechanism and don’t want to hand your compliance stack to an external SaaS account, Complianz or Cookie Compliance’s free tiers give you more room before you have to pay anything.

What Termly Is

Termly’s WordPress plugin is still listed on WordPress.org under its original slug, uk-cookie-consent — the plugin started life as an independent “UK Cookie Consent” tool before Termly acquired it and rebuilt it around its own platform starting with the version 3.0 release. As of this writing it has 80,000+ active installs and a 3.6-star rating across 204 ratings (129 five-star, 66 one-star — a more polarized split than Complianz or Cookie Compliance, worth reading the low-end reviews on WordPress.org before you commit if that gives you pause). It’s on version 3.3.1, requires WordPress 5.2+ and PHP 5.6+, and is tested up to WordPress 6.9.10.

Unlike Complianz and Cookie Compliance, which run their scanning and script-blocking logic locally with an optional external account for extra features, Termly’s plugin is built to connect to a Termly account from the start — you create a free account (in-plugin or on termly.io) and the plugin syncs your banner, policies, and scan results to Termly’s platform. That’s the trade Termly is making: instead of a self-contained WordPress tool, you get a WordPress front end for a broader compliance product that also generates privacy policies, terms and conditions, an EULA, disclaimers, and other legal documents, plus DSAR (data subject access request) intake forms and CCPA/CPRA “Do Not Sell or Share My Personal Information” links. Termly says it covers 26+ data privacy laws across the regions it operates in — GDPR and the ePrivacy Directive (EU), UK GDPR, CCPA/CPRA and other US state laws, PIPEDA (Canada), LGPD (Brazil), POPIA (South Africa), and Switzerland’s FADP among them — and is a Google-certified “Gold Status” Consent Mode partner.

What’s in the Free Version

  • One legal policy (you pick which — typically the cookie policy or privacy policy)
  • A cookie consent banner with automatic script auto-blocking until a visitor consents
  • Quarterly automated cookie scans
  • HTML-embeddable policy documents
  • Support for up to 10,000 monthly banner views

That visitor cap is the defining constraint of the free plan, and it behaves differently from the caps on the other two plugins in this series: Cookie Compliance’s free Connected Mode keeps working past its 1,000-visit cap (you just lose access to certain features), but multiple third-party sources describe Termly’s banner as deactivating once you exceed 10,000 monthly views on the free plan — meaning your site could be serving cookies and running scripts with no consent banner at all until you upgrade or the next billing cycle resets the count. If your traffic is anywhere near that threshold, that’s a compliance risk worth planning around, not just a nice-to-have feature you’re missing.

What’s Behind the Paywall

Termly sells three paid tiers, billed monthly or annually (annual billing runs roughly 25% cheaper than paying month-to-month):

  • Starter — $10/month (annual billing; $14/month if billed monthly): 2 legal policies, 10 policy edits, 50,000 monthly banner views, monthly cookie scans, regulation monitoring with policy update notifications, 5 included user seats, and basic Google Consent Mode support
  • Pro+ — $15/month (annual billing; $20/month if billed monthly), Termly’s most-promoted tier: unlimited legal policies and edits, unlimited banner views, weekly cookie scans, auto-updated policies, the Termly logo removed from your banner, advanced Google Consent Mode v2, IAB TCF 2.3 support, custom banner styling, multi-language support, region-specific consent rules, consent logs, and unlimited users
  • Agency — custom pricing for managing multiple client sites, with bulk discounts and multi-domain management on top of everything in Pro+

In plain terms: Starter mainly buys you headroom (more views, more policies, more edits) rather than new compliance capability. The features that matter most for ad-driven sites — IAB TCF, full Google Consent Mode v2, and a consent audit trail — are Pro+-only, the same pattern we saw with Complianz’s paid tiers, though Termly’s Pro+ price ($15/month billed annually, or $180/year — $20/month if paying monthly) lands well above Complianz’s Personal tier ($59/year) and roughly in the same range as Cookie Compliance’s Professional plan ($14.95/month).

WooCommerce and E-Commerce

Neither Termly’s own WordPress solutions page nor its plugin listing makes any specific claims about WooCommerce integration — no mention of tracking-pixel handling, payment-gateway scripts, or checkout-flow testing the way Complianz’s marketing does. That doesn’t mean it won’t work on a store (the script-blocking mechanism should apply to any script it can detect, and WooCommerce’s own cart/session cookies are functionally necessary and exempt from consent requirements regardless of which plugin you use), but if you’re running WooCommerce and want a vendor that’s explicitly tested and documented that use case, Complianz currently has the more detailed claims here.

Setup and Day-to-Day Use

Termly markets the plugin as installable “in minutes” with “no coding experience needed,” and setup does follow a simpler path than Complianz’s multi-step wizard: install the plugin, create or link a Termly account, and the banner and policy sync from your Termly dashboard. The trade-off shows up in where your data lives — your consent records and policy content are hosted on Termly’s platform rather than your own server, which is a meaningful difference from Complianz (self-hosted) if data residency or platform independence matters to you. Support is available via chat, email, and phone, with Pro+ customers getting sub-24-hour response targets versus roughly 48 hours for free/Starter users. On the negative side, a portion of the plugin’s WordPress.org reviews (66 of 204 ratings are one-star) cite performance issues and objections to the mandatory external account requirement — worth reading a sample of the lower-rated reviews directly before deciding, since that’s a heavier complaint pattern than either Complianz or Cookie Compliance shows.

Pros

Bundles a real legal-document generator (privacy policy, terms, cookie policy, DSAR forms, and more) with the consent banner, so you’re not running a separate tool for policy pages. Google Consent Mode v2 Gold Status partner with IAB TCF 2.3 support on Pro+. Regulation monitoring that flags when a law changes and updates your policies automatically. Simple setup process relative to Complianz’s more technical wizard. Phone support is available, which neither Complianz nor Cookie Compliance offers.

Cons

The free plan’s 10,000-monthly-view cap doesn’t just gate features — the banner reportedly stops functioning past it, per third-party reporting, which is a bigger risk than a feature downgrade if you’re not watching your traffic. Requires creating and maintaining an external Termly account rather than running self-contained on your own server. Lowest average rating of the three plugin deep-dives in this series (3.6★, with a notably higher share of one-star reviews than Complianz or Cookie Compliance). No documented WooCommerce-specific integration. Full IAB TCF and advanced Consent Mode v2 are Pro+-only, same paywall pattern as Complianz’s premium tiers.

Who It’s a Good Fit For

Site owners who want a consent banner and a set of attorney-drafted legal policies from a single vendor, and whose traffic comfortably sits under 10,000 monthly banner views on the free plan (or who are ready to pay for Starter/Pro+ from the start). It’s also worth a look if you specifically want phone support as an option, or you’d rather not manage a separate policy-generator tool alongside your consent plugin.

Who Should Look Elsewhere

If you’re not interested in the bundled policy generator and just want the strongest possible free consent-management mechanism, Complianz’s uncapped free tier or Cookie Compliance’s free Connected Mode (1,000-visit cap, but no hard cutoff behavior reported) both give you more compliance functionality without paying, as covered in our earlier reviews. If keeping consent data and policy content on your own server rather than a third-party SaaS platform matters to you, Complianz is the self-hosted option in this series. And if your traffic is anywhere near or above 10,000 monthly visits, budget for a paid Termly tier from day one rather than relying on the free plan.

Bottom Line

Termly’s real pitch isn’t “free cookie banner” — it’s “cookie banner plus legal document generator from one vendor,” and if that bundle is genuinely useful to you, the $10–$20/month range (depending on tier and whether you pay monthly or annually) is competitive with buying a policy generator and a consent plugin separately. But judged purely as a free WordPress consent tool, it’s the most limited of the three plugins in this series: a hard traffic cap that reportedly disables the banner entirely, a mandatory external account, and the most polarized review record of the group. As with any consent tool, this isn’t a substitute for legal advice about what your specific site is required to do — treat it as a strong option if the bundled policy generator is what you’re actually after, not a default pick for a pure consent-banner need.

Not sure if you need any of these three yet? Run through our consent-management checklist.

Sources

Posted in Cookie Consent

Cookie Compliance Review: Features, Pricing, and Whether the Free Version Is Enough for Your WordPress Site

Posted on by Filip Keser

At a Glance

SpecValue
Installs800,000+
Rating4.8★ (3,025 ratings)
Free tierBanner Only (uncapped) or Connected Mode (1,000 visits/month, 7-day retention)
Starting price$14.95/month (Professional, 1 domain)
Best forSites already using Google Consent Mode v2 or Meta/Microsoft ads

Short Verdict

Cookie Compliance splits into two genuinely different free options plus one paid tier, and that split is most of the story. “Banner Only” mode is free forever, needs no account, and just shows a customizable notice — no automatic script blocking, no consent logging. Switching on “Connected Mode” gets you the real compliance engine — automatic script blocking, Google and Facebook/Microsoft consent-mode signals, a consent audit trail — for free as well, but capped at 1,000 monthly visits and 7 days of consent history. Past that traffic level, or if you need unlimited history, more languages, or coverage across several domains, you’re into the Professional plan starting at $14.95/month. It’s the second-most-installed plugin in our roundup (800,000+ installs, 4.8 stars), and it leans harder into Google/Meta ad-consent signals than into generating legal documents for you — that’s the main trade-off against Complianz’s broader, less ad-tech-specific free tier.

What Cookie Compliance Is

Cookie Compliance for WordPress is built by Hu-manity.co and is still listed under its original WordPress.org slug, cookie-notice, even though the plugin itself was rebranded from “Cookie Notice” to “Cookie Compliance” — worth knowing so you don’t think you’ve landed on the wrong listing. As of this writing it has 800,000+ active installs and a 4.8-star rating across 3,025 reviews (2,851 of them five-star), running version 3.1.14. It requires WordPress 4.9.6 or higher and PHP 7.4 or higher, and the developer lists it as tested up to WordPress 7.0.7.

Unlike Complianz, which is built around a setup wizard that scans your site and auto-generates legal documents, Cookie Compliance is built around two operating modes. “Banner Only” runs entirely inside WordPress with no external account — you get a banner, and that’s it. “Connected Mode” links the plugin to Hu-manity.co’s own web dashboard and unlocks the actual consent-management functionality: script blocking, consent categories, analytics, and integration with ad platforms’ consent signals. The vendor’s own compliance claims cover GDPR, the ePrivacy Directive, PECR (UK), LGPD (Brazil), PIPEDA (Canada), CCPA/CPRA and other US state laws including the VCDPA and Colorado Privacy Act, across what it describes as 100+ jurisdictions.

What’s in the Free Version

This is the part worth reading carefully, because “free” means two different things here:

  • Banner Only (free, no account, no cap): a customizable consent banner, synced with your WordPress Privacy Policy page, WP Consent API integration (so other privacy-aware plugins can read the visitor’s choice), and WPML/Polylang compatibility for multilingual sites. It does not block scripts or store a consent record — it’s a notice, not a consent-management platform.
  • Basic (free, requires a Hu-manity.co account, “Connected Mode”): this is where script blocking and consent logging actually turn on. The published plan includes GDPR/CCPA/ePrivacy/PECR-oriented compliance messaging, a consent analytics dashboard, Google and Facebook consent-mode signals, geolocation-based banner logic, and one additional language beyond your site’s default — but it’s capped at 1,000 visits per month, keeps only 7 days of consent history, and gets “basic” (as opposed to priority) support.

In practice: if your site gets meaningful traffic, the free Connected tier’s 1,000-visit cap is the number that will push you toward a paid plan faster than any feature gate will — that’s a different free-tier constraint than Complianz, which caps nothing on its free plan but locks specific features (Consent Mode v2, IAB TCF) behind payment instead.

What’s Behind the Paywall

The Professional plan starts at $14.95/month for a single domain, billed monthly, with a 17% discount for annual billing (confirmed directly on cookie-compliance.co/pricing as of this writing — an earlier draft of this review carried a lower figure from a different source; the vendor’s own “Save 17%” label on the pricing page is the figure to trust). The pricing page also offers 5-, 10-, and 20-domain license bundles, but the per-domain price for those tiers isn’t published as a flat number on the site — it’s revealed by the domain-count selector at checkout, so if you’re licensing more than one site, get the actual figure there rather than assuming it scales linearly from the single-domain rate.

What Professional actually removes or adds versus Basic: unlimited monthly visits, lifetime consent-record storage (versus 7 days), unlimited additional languages (versus one), and premium support. The core compliance mechanics — script blocking, Google/Facebook consent-mode signals, geolocation — are the same feature set as the free Basic tier; you’re paying to remove caps, not to unlock functionality that free accounts don’t have at all. One notable gap either way: we found no mention of IAB Europe TCF support anywhere on Hu-manity.co’s site or in its Google Consent Mode documentation, on either tier. If IAB TCF certification is a requirement for your ad exchange relationships, Cookie Compliance doesn’t appear to offer it — Complianz does, on its paid tiers.

WooCommerce and E-Commerce

Cookie Compliance doesn’t market a specific WooCommerce integration the way Complianz does. That doesn’t necessarily mean it fails on a WooCommerce store — the script-blocking mechanism in Connected Mode works on any script tag it can detect and categorize, cart/session cookies would still be treated as strictly necessary the same as with any consent tool — but there’s no vendor documentation walking through WooCommerce-specific scripts, tracking pixels, or payment-gateway scripts the way Complianz’s marketing does. If you’re running a store and want that mapped out for you rather than configured by hand, that’s a point in Complianz’s favor.

Setup and Day-to-Day Use

Reviewers on WordPress.org consistently describe the plugin as working “out of the box” with minimal configuration for the basic banner case, which tracks with it being one of the higher-rated tools in this category. The friction shows up around the free/paid boundary rather than around setup difficulty: one recurring complaint in user reviews is that Google Consent Mode v2’s more specific parameters felt gated behind a paid plan even though the vendor’s current pricing page lists “Google & Facebook consent modes” under the free Basic tier too — this is worth testing directly against your own ad setup before assuming full v2 parameter support (ad_storage, analytics_storage, ad_user_data, and ad_personalization) is available for free, since the vendor’s documentation and some user reports don’t fully agree on where that line sits. A smaller, more cosmetic complaint that shows up in reviews is that plugin notifications can clutter the WordPress dashboard.

Pros

A real free tier that includes actual script blocking and consent logging, not just a banner — Basic Connected Mode isn’t a stripped-down trial. Banner Only mode is a genuinely no-strings option if you don’t want to connect to an external account at all. Strong install base and rating (800,000+, 4.8★) means most common issues are well documented. Built-in Google, Facebook, and Microsoft consent-mode signal support without needing a separate integration plugin. WPML and Polylang compatibility out of the box for multilingual sites.

Cons

The free Connected tier’s 1,000-visit-per-month cap is a hard ceiling that most active blogs or stores will hit, at which point you’re evaluating the $14.95/month-and-up Professional plan, not the free plugin. No IAB TCF support that we could find, on any tier — a gap if your ad partners require CMP certification. No published WooCommerce-specific integration documentation. Multi-domain pricing beyond the single-domain monthly rate isn’t published as flat numbers, so budgeting for more than one site takes an extra step at checkout. At least some user reviews report confusion about exactly which Google Consent Mode v2 capabilities are free versus paid.

Who It’s a Good Fit For

Sites already running Google Ads, GA4, or Meta ads that want consent-mode signals handled natively, without paying anything, as long as monthly traffic stays under 1,000 visits or you’re fine paying once it doesn’t. It’s also a reasonable pick if you want the option to start with a zero-commitment, no-account banner (Banner Only) and upgrade to real consent management later without switching plugins.

Who Should Look Elsewhere

If your site already gets more than roughly 1,000 visits a month and you want real script blocking and consent records without paying, Complianz’s uncapped free tier is the better starting point — you’d trade Cookie Compliance’s native ad-platform consent signals for Complianz’s broader auto-generated legal documents and WooCommerce-specific coverage. If IAB TCF certification is a hard requirement, neither tier of Cookie Compliance covers it, so it’s worth checking Complianz’s paid tiers or a TCF-focused tool instead. And if you’re running a store and want a plugin that documents WooCommerce script handling explicitly, Complianz has the more detailed vendor documentation for that use case.

Bottom Line

Cookie Compliance’s real strength is that its free tier isn’t a watered-down demo — Connected Mode gives you actual script blocking, consent logging, and native ad-platform consent signals at no cost, which is more than a lot of “free” tools in this space offer. The catch is a hard 1,000-visit monthly ceiling that will push any moderately active site toward the $14.95/month Professional plan faster than a feature gate would, plus a documentation gap around exactly which Consent Mode v2 features are actually free. As with any consent tool, this isn’t a substitute for legal advice about what your specific site is required to do — treat it as a strong mechanism for enforcing whatever your compliance requirements turn out to be, not a compliance guarantee in itself.

Still deciding if you even need one of these? Run through our consent-management checklist, or read our Termly review for the third option in this series.

Sources

Posted in Cookie Consent

Complianz Review: Features, Pricing, and Whether the Free Version Is Enough for Your WordPress Site

Posted on by Filip Keser

At a Glance

SpecValue
Installs1M+
Rating4.7★ (1,659 ratings)
Free tierNo page-view or session cap; auto cookie scan, script blocking, policy generation
Starting price$59/year (Personal, 1 site)
Best forBroadest free legal coverage without ad-tech extras

Short Verdict

Complianz is the most fully-featured free cookie consent plugin for WordPress, and that’s not really in dispute — no page-view cap, no session limit, and a free tier that covers more privacy frameworks out of the box than most competitors offer even on paid plans. Where it gets more complicated is everything past the free tier: Google Consent Mode v2, IAB TCF support, and consent records are all gated behind a paid license, and some site owners report banner reliability issues and conflicts with caching plugins. If you want broad legal coverage for free and don’t need ad-tech-specific integrations, it’s a strong default choice. If Google Consent Mode v2 or IAB TCF certification is a hard requirement for your ad stack, budget for the Personal plan before you commit.

What Complianz Is

Complianz GDPR/CCPA Cookie Consent Banner is a Google-certified Consent Management Platform (CMP) built specifically for WordPress (a separate Shopify app also exists, but that’s outside the scope of this review). It’s the most-installed cookie consent plugin on WordPress.org, with 1+ million active installs and a 4.7-star rating across 1,659 reviews as of this writing, running on version 7.5.5. It requires WordPress 5.9+ and PHP 7.4+, and the developer lists it as tested up through WordPress 7.1.2.

The pitch is coverage breadth: instead of building a banner and leaving the legal research to you, Complianz runs a setup wizard that scans your site, asks a series of configuration questions about what you use it for (blog, WooCommerce store, membership site, etc.), and then generates region-specific banners and policy documents covering GDPR, the ePrivacy Directive, UK-GDPR, CCPA/CPRA, LGPD (Brazil), POPIA (South Africa), PIPEDA (Canada), and others, in 15+ languages.

What’s in the Free Version

This is where Complianz stands out from most of the field: the free tier isn’t a stripped-down trial, and it isn’t capped by traffic. It includes:

  • The full guided setup wizard, no coding required
  • Automatic cookie scanning (covers up to 50 posts/pages per scan)
  • Script and iframe blocking with placeholders for common third-party embeds — Google Maps, YouTube, Facebook, Instagram, AdSense, HubSpot, reCAPTCHA, X/Twitter, and ActiveCampaign are explicitly supported out of the box
  • Region-specific banners for the EU, UK, US, Australia, South Africa, Brazil, and Canada
  • Auto-generated cookie policy and privacy policy documents from the scan results
  • 250+ pre-built plugin and service integrations
  • Native Gutenberg blocks
  • Basic WooCommerce compatibility (see below)
  • WCAG 2.1 AA and ADA-oriented accessibility features on the banner itself

For a genuinely free tool, that’s a lot of legal surface area covered — this is the main reason it topped the “best for deep legal coverage without a subscription” slot in our plugin roundup.

What’s Behind the Paywall

Complianz sells three annual license tiers, all billed per year with a 30-day money-back guarantee:

  • Personal — $59/year, covers 1 website
  • Professional — $179/year, covers 5 websites (roughly $3/site/month)
  • Agency — $399/year, covers 25 websites and bundles a separate multisite plugin (roughly $1.35/site/month)

Across all three paid tiers, you get: Google Consent Mode v2 integration (Complianz received Google’s official certification for this in July 2024), IAB Europe TCF support with a registered CMP ID (332) — vendor and third-party sources describe this as TCF v2.0 and up, so if a specific TCF version is a hard requirement for your ad partners, confirm current version support directly with Complianz before buying — plus Geo-IP-based banner targeting, Records of Consent (a stored, exportable log of who consented to what and when), A/B testing for banner copy and design, advanced/hybrid site scanning, data-subject-request handling tools, and priority support.

In plain terms: the free version handles the “show a compliant banner and generate the right legal documents” job well. The paid version is really aimed at sites running serious ad tech (Google Consent Mode v2 specifically matters if you’re running Google Ads or GA4 with ad personalization) or sites that need a defensible, exportable consent audit trail — which matters more once your site’s size or ad spend puts it on a regulator’s radar, per the enforcement examples we cover in “Do You Need a Cookie Policy on Your WordPress Site?”

WooCommerce and E-Commerce

Complianz’s own marketing confirms WooCommerce compatibility, specifically around tracking pixels, payment gateway scripts, and marketing scripts commonly used in WooCommerce stores — the plugin can categorize and block these the same way it handles other third-party scripts. It doesn’t interfere with WooCommerce’s own cart/session cookies, which are functionally necessary for checkout and are exempt from consent requirements. If you’re running a store, it’s worth testing the integration against your specific checkout and payment gateway setup rather than assuming full coverage out of the box, since payment providers change their own tracking scripts periodically.

Setup and Day-to-Day Use

The setup wizard is the plugin’s strongest usability feature: it walks through cookie scanning, a short questionnaire about what the site does, banner template selection, Geo-IP activation, legal document generation, and script categorization, and independent reviewers consistently describe it as completable in a single sitting without needing to touch code. Where the friction shows up is afterward — troubleshooting a false-positive script block, resolving a conflict with a caching or page-optimization plugin, or fine-tuning an edge case the wizard didn’t anticipate all require more manual digging than the initial setup suggests. Some site owners report banner display or reliability issues, particularly on sites running aggressive caching setups; if your site uses a caching plugin, test the banner on a fresh, logged-out, cache-cleared page load before you trust the default configuration.

Pros

Free tier with no page-view or session cap, unusual in a market where most competitors gate volume behind a subscription. Broad regulatory coverage (GDPR, CCPA/CPRA, LGPD, POPIA, PIPEDA, and more) generated automatically rather than left to you to research. Consent data and legal documents are hosted on your own server rather than routed through a third-party service. A large, well-reviewed install base (1M+, 4.7★) means most edge cases have already been hit and documented by someone else. 250+ pre-built integrations cut down on manual script categorization.

Cons

Google Consent Mode v2, IAB TCF, Geo-IP targeting, and Records of Consent are all locked to paid tiers — if any of those is a requirement rather than a nice-to-have, the “free plugin” framing doesn’t really apply to your use case. Some users report banner reliability problems and conflicts with caching/optimization plugins that require manual troubleshooting. Support quality on paid tiers is reported as inconsistent by some reviewers, with response-time targets (24 hours weekdays, 48 hours weekends) not always met. It’s WordPress- and Shopify-only, so it’s not a fit if you manage properties on other platforms and want one consent tool across all of them.

Who It’s a Good Fit For

Site owners who want strong, automatically-generated multi-jurisdiction legal coverage without paying anything, and who are comfortable spending 20-30 minutes in a setup wizard rather than dragging a banner into place with a page builder. It’s also a reasonable default for WooCommerce stores that aren’t yet running heavy ad-tech stacks requiring Google Consent Mode v2 or IAB TCF specifically.

Who Should Look Elsewhere

If Google Consent Mode v2 or IAB TCF is a hard requirement for your ad or ad-tech setup right now, you’re effectively evaluating the $59/year Personal plan, not the free plugin — at that point it’s worth comparing against Cookie Compliance (which builds its paid tier specifically around Consent Mode v2 and Meta/Microsoft consent signals) before deciding, which we cover in our next deep-dive review. Sites already fighting caching-plugin conflicts with other tools may also want to budget extra testing time before assuming Complianz will resolve cleanly on the first try.

Bottom Line

For the price of $0, Complianz gives you more genuine legal coverage than most paid competitors offer — that’s the headline, and it’s earned. The catch is that the features ad-driven sites tend to care about most (Consent Mode v2, IAB TCF, consent records) all sit behind a subscription, so “free” and “fully covers my ad stack” aren’t the same claim. As with any consent tool, this isn’t a substitute for legal advice about what your specific site is required to do — treat it as a strong starting point for the mechanics, not a compliance guarantee.

Not sure if your site even needs one of these yet? Run through our consent-management checklist first.

Sources

Posted in Cookie Consent

Does My Site Need Consent Management? A Checklist for WordPress Site Owners

Posted on by Filip Keser

If you check even one box below, some form of consent management belongs on your site — the only open question is how much. Most WordPress sites check at least one box without realizing it, because “consent management” isn’t just a banner for EU visitors; it’s also what keeps your Google Ads and GA4 data working correctly, and what CCPA and a growing list of US state laws require once you cross specific size thresholds.

Work through the three sections below in order. Each one changes what you actually need.

Section 1: What’s Running on Your Site

Check every box that applies. These are the things that actually set cookies or load trackers — not your traffic level, not your location.

  • Google Analytics or GA4 is installed
  • You run Google Ads, remarketing, or any Google conversion tracking
  • You have a Meta (Facebook/Instagram) pixel installed
  • You embed YouTube videos using the standard embed code (not youtube-nocookie.com or a click-to-load facade)
  • You run WooCommerce or another store, and use cart-abandonment or marketing-retargeting tools (not just the checkout itself — checkout session cookies are generally “strictly necessary” and don’t need consent)
  • Comments are open, and your theme/plugin sets the “Save my name and email” cookie automatically instead of via opt-in checkbox
  • You run display ads from any ad network (AdSense or otherwise)
  • You use an email signup tool, live chat widget, or affiliate-tracking plugin that sets its own cookies
  • You embed content from other platforms that set their own cookies (maps, social feeds, review widgets, font/analytics CDNs that track)

If you checked none of these and your site really is just static pages plus WordPress’s own login cookies, you’re one of the rare exceptions — you likely don’t need a consent banner at all, just a short cookie disclosure covering the strictly-necessary cookies (see our companion piece, “Do You Need a Cookie Policy on Your WordPress Site?,” for the full list of what WordPress sets by default).

If you checked one or more boxes, move to Section 2 — what you owe depends on who’s reading, not just what’s running.

Section 2: Who Actually Visits Your Site

  • Your site is reachable by, and reasonably likely to have, visitors in the EU, UK, or Switzerland
  • Your site has visitors in California
  • Your site has visitors in other US states with their own privacy laws (as of 2026, roughly 20 states now have one in effect, including Virginia, Colorado, Connecticut, Texas, and others)
  • You run Google Ads or GA4 with any EEA/UK traffic at all

Here’s why each box matters differently.

EU/UK/Switzerland (ePrivacy Directive + GDPR): there is no small-site exemption. If your site is reachable by EU or UK visitors and you checked any box in Section 1, you need prior opt-in consent — a banner that actually blocks non-essential scripts until someone clicks “accept,” not just a notice that appears alongside tracking that’s already running. A 200-visit-a-month hobby blog with Google Analytics installed is technically in scope the same as a large retailer. This is the box that most often surprises small site owners.

California (CCPA/CPRA): unlike GDPR, this one is threshold-based. As of the CPPA’s most recent inflation adjustment (effective for 2026), you’re only a covered business if you meet at least one of: annual gross revenue over $26,625,000; you buy, sell, or share the personal information of 100,000 or more California consumers or households per year; or 50% or more of your annual revenue comes from selling or sharing personal information. Most individual blogs and small review/affiliate sites don’t cross any of these thresholds and aren’t directly regulated by CCPA — but if you do, you need an opt-out mechanism (a “Do Not Sell or Share My Personal Information” link, or a unified “Your Privacy Choices” link), you must honor the Global Privacy Control (GPC) browser signal as a valid opt-out, and per current CPPA enforcement, your banner’s “accept” and “decline” options need equal visual weight and effort — no one-click accept next to a three-click-deep decline.

Other US states: state privacy laws have expanded fast — roughly 20 states now have one in effect as of 2026, with more arriving in 2027. The thresholds are generally lower than CCPA’s revenue figure but keyed to consumer counts instead: Virginia’s VCDPA applies at 100,000+ consumers a year (or 25,000+ if 50%+ of revenue comes from selling data); Colorado’s CPA applies at 100,000+ residents (or 25,000+ if you derive any revenue from selling that data); Connecticut’s CTDPA, after its 2026 amendments, applies at 35,000+ consumers, or at any volume if you sell personal data or process sensitive data. A handful of states (Texas among them) apply to any business processing personal data with no small-business carve-out at all. If your site has meaningful traffic from a specific state and you’re monetizing visitor data there, it’s worth checking that state’s specific threshold rather than assuming CCPA’s number is the only one that matters.

Google Consent Mode v2: this box is easy to miss because it isn’t really a legal requirement — it’s a Google product requirement, and it applies regardless of your size. Since March 2024, Google requires valid Consent Mode v2 signals for any Google Ads or GA4 property serving or measuring EEA, UK, or Swiss users. Nothing gets fined if you skip it, but Google simply won’t build remarketing lists or serve personalized ads from unconsented EEA traffic, and your conversion tracking and attribution will quietly under-report — no error message, just data that slowly stops adding up. If you checked “Google Ads or GA4” above and have any EEA/UK traffic, you need a consent tool that specifically supports Consent Mode v2, not just a generic banner.

Section 3: What You Actually Need, Based on Your Answers

Match your checkmarks to the row that fits:

  • Any tracking (Section 1) + any EU/UK/Swiss visitors (Section 2): you need a real consent-management banner that blocks non-essential scripts until a visitor opts in, not a passive notice. This is the strictest combination and the one a generic “cookie notice” plugin won’t satisfy on its own.
  • Any tracking + Google Ads/GA4 + EEA/UK traffic: you additionally need Consent Mode v2 support specifically, or your ad and analytics data will silently degrade even if your banner is otherwise compliant.
  • Any tracking + US-only traffic, below all state thresholds: a clear cookie policy page covering what you actually set is likely sufficient on its own, though a banner is still good practice and costs you nothing to add.
  • Any tracking + US traffic, above the CCPA threshold or any state threshold above: you need, at minimum, a working opt-out mechanism, GPC signal recognition, and a symmetrical-effort banner design — the specific plugin features to look for are covered in each of our individual reviews.
  • No tracking at all, any location: a short strictly-necessary-cookies disclosure covers you. No banner needed.

Where to Go Next

If you landed in one of the “you need a real banner” rows, start with our roundup, “Best WordPress Cookie Consent Plugins in 2026,” which compares Complianz, Cookie Compliance (formerly Cookie Notice), Termly, and lighter alternatives on exactly the factors above — free-tier limits, Consent Mode v2 support, and US state-law features. From there:

  • If you want the deepest free tier and broad legal-document coverage: read our Complianz review.
  • If you’re already running Google/Meta ad tracking and want a tool built around those consent signals specifically: read our Cookie Compliance review.
  • If you want a bundled policy generator alongside the banner and can live with (or plan to outgrow) a monthly view cap: read our Termly review.

If you’re still unsure whether you need a cookie policy at all, or want the fuller legal picture behind GDPR, ePrivacy, and CCPA, our companion explainers (“Do You Need a Cookie Policy on Your WordPress Site?” and “GDPR vs CCPA vs ePrivacy: What WordPress Site Owners Actually Need to Know”) cover both in more depth than this checklist does.

Sources

  • CCPA/CPRA 2026 revenue threshold and business-definition tests per the California Privacy Protection Agency’s (cppa.ca.gov) published thresholds and 2026 inflation-adjustment commentary
  • Google Consent Mode v2 mandatory-status and enforcement mechanics per Google’s own Consent Mode documentation and third-party 2026 enforcement coverage
  • US state privacy law counts and thresholds (Virginia VCDPA, Colorado CPA, Connecticut CTDPA) per 2026 state privacy law trackers
Posted in Cookie Consent

Do You Need a Cookie Policy on Your WordPress Site?

Posted on by Filip Keser

If your WordPress site does anything beyond serving static pages — runs Google Analytics, shows ads, embeds a YouTube video, lets people comment, sells anything through WooCommerce, or uses a form tool that drops a tracking cookie — you almost certainly need both a cookie policy and, in most cases, a consent banner in front of it. The handful of sites that don’t need one are genuinely bare: no analytics, no ad network, no embeds, no e-commerce, nothing but WordPress’s own login cookies.

That’s the practical answer. The legal answer depends on which rulebook applies to your visitors, and it’s worth understanding both, because they don’t work the same way.

Two Different Laws, Two Different Triggers

GDPR and the ePrivacy Directive (EU/UK) regulate the act of placing a cookie, not your business size. If your site is reachable by and reasonably likely to have visitors in the EU or UK, the ePrivacy Directive requires prior opt-in consent before you set any cookie that isn’t “strictly necessary” — before it fires, not just a banner that discloses it after the fact. There’s no small-business or low-traffic exemption. A hobby blog with 200 monthly visitors and Google Analytics installed is technically in scope the same as a large retailer. In practice, small sites are rarely the target of an enforcement sweep, but the legal obligation doesn’t scale with traffic the way some site owners assume it does.

CCPA/CPRA (California) works differently — it’s threshold-based. You’re only covered if your business meets at least one of these: over $26,625,000 in annual gross revenue, buys/sells/shares the personal information of 100,000 or more California consumers or households a year, or derives 50% or more of annual revenue from selling or sharing personal information. Most small WordPress sites and blogs simply don’t hit any of those numbers and aren’t directly regulated by CCPA — though if you do cross a threshold, the requirements are specific: a “Do Not Sell or Share My Personal Information” link (or a unified “Your Privacy Choices” link), honoring Global Privacy Control (GPC) browser signals as a valid opt-out, and — per 2025-2026 California Privacy Protection Agency (CPPA) enforcement — symmetrical banner design, meaning “Accept” and “Decline” have to take equal effort and get equal visual weight. A banner that makes accepting one click and declining a three-click hunt through settings is itself a violation now, independent of what the cookies do.

There are other state laws (Colorado, Virginia, Connecticut, and others) with their own thresholds and opt-out mechanics, but for a typical WordPress site owner, GDPR/ePrivacy and CCPA/CPRA are the two that come up most often, and GDPR is the one with no size exemption to hide behind.

What’s Actually in Your Cookie Jar

WordPress core sets a small set of cookies on its own, and not all of them need consent.

Strictly necessary (no consent required): wordpress_[hash] and wordpress_logged_in_[hash] (login/authentication), wp-settings-{time}-[UID] (admin interface preferences), and wordpress_test_cookie (a temporary check that cookies work). These exist to make the site function and are generally exempt from consent requirements under both GDPR and CCPA.

Not strictly necessary (consent required): the three comment cookies — comment_author_{hash}, comment_author_email_{hash}, comment_author_url_{hash} — which WordPress only sets when a commenter opts in via the “Save my name and email” checkbox. That opt-in checkbox is doing real legal work; don’t let a theme or plugin override it to save the cookie automatically.

Beyond core WordPress, most sites are carrying more than they realize: Google Analytics (_ga, _gid, and related cookies — non-essential, require consent), Jetpack (sets its own functional and stats cookies depending on which modules are active), WooCommerce (cart/session cookies are generally treated as strictly necessary for the checkout to function, but anything WooCommerce-adjacent for marketing or abandoned-cart tracking is not), embedded YouTube videos (YouTube sets tracking cookies the moment the standard embed loads — before anyone presses play — unless you use youtube-nocookie.com or a click-to-load facade), and any ad network, affiliate tracking pixel, or email-signup widget, all of which typically drop their own third-party cookies on page load.

The point of a cookie audit — which every legitimate cookie-consent plugin does automatically, and which you can also do manually by opening your browser’s dev tools and checking Application > Cookies on a fresh, logged-out visit — is finding out what your site is actually setting versus what you assume it’s setting. Plugins and page builders add cookies you didn’t explicitly configure.

What a Cookie Policy Actually Needs to Say

A compliant cookie policy (usually a dedicated page, separate from or linked out of your general privacy policy) needs to specify, in plain language: the categories of cookies you use (necessary, functional/preferences, analytics/statistics, marketing/advertising), ideally an actual table of the specific cookies set, who sets them (you vs. a named third party like Google or Jetpack), what each one does and how long it lasts, and — critically — a working mechanism for visitors to withdraw or change consent after the fact, not just a “close” button that never appears again. WordPress.org’s own cookie policy and Automattic’s cookie policy are reasonable real-world examples of the format if you want to see one written by a company operating at scale.

What It Costs to Skip This

For GDPR, the ceiling is the number that gets cited most — up to €20 million or 4% of global annual turnover, whichever is higher, for the most serious violations — but that figure is for large, deliberate, repeat offenders, not the realistic exposure for a small site with an outdated banner. The more instructive examples for a site owner this size are California’s recent CPPA enforcement actions against mid-size, non-tech companies: American Honda Motor Co. was fined $632,500 in March 2025 largely over how its cookie consent tool was configured and how it handled opt-out signals, and menswear retailer Todd Snyder was ordered to pay $345,178 in May 2025 for letting its opt-out request process sit broken for 40 days and asking consumers for more information than necessary to process an opt-out. Neither is a household name in the privacy-fine conversation the way Meta or Google is — which is exactly the point: regulators are reaching well below the Fortune 500 now, and “we used a consent management plugin” was explicitly not a defense in the CPPA’s own enforcement commentary on the Honda case.

Getting Compliant, in Practice

Audit first — find out what your site actually sets, using either a plugin’s built-in scanner or your browser’s dev tools. Write or generate the actual cookie policy page — Complianz and Termly (covered in our plugin roundup) both auto-generate one from the scan, which is faster and more accurate than writing it from a template. Install a consent solution that blocks non-essential cookies before consent, not just one that shows a banner while Google Analytics loads in the background anyway — that gap between “banner is visible” and “tracking is actually blocked” is the single most common compliance failure on small sites, and it’s the difference between a decorative banner and a functional one. Link the cookie policy from your site footer and from your privacy policy. And revisit it periodically: new plugins, new embeds, and new ad tags all add cookies you didn’t audit for on day one.

Bottom Line

Almost every WordPress site with analytics, ads, embeds, comments, or e-commerce needs a cookie policy, and most of those also need a real (not cosmetic) consent banner in front of non-essential cookies. GDPR/ePrivacy applies regardless of your size or traffic if EU/UK visitors can reach your site; CCPA/CPRA only kicks in once you cross specific revenue or volume thresholds, but its enforcement has been getting more aggressive against exactly the kind of mid-size, non-tech sites that assumed they were too small to notice.

For the fuller legal picture behind these rules, see our GDPR vs CCPA vs ePrivacy comparison. Not sure yet whether you specifically need a consent banner (as opposed to just a policy page)? Run through our consent-management checklist.

Sources

  • gdpr-info.eu (GDPR fine tiers)
  • cppa.ca.gov enforcement announcements on Honda (March 2025) and Todd Snyder (May 2025)
  • developer.wordpress.org “Cookies” (WordPress core cookie list)
  • Jetpack’s cookie documentation (jetpack.com/support/cookies)
  • usercentrics.com CCPA/CPRA cookie banner guide (2026 symmetrical-design and GPC requirements)
  • WordPress.org and Automattic’s own published cookie policies (as format references)
Posted in Cookie Consent

Best WordPress Cookie Consent Plugins in 2026

Posted on by Filip Keser

If your WordPress site sets cookies for analytics, ads, or embedded content, you’re legally required in most of the world — the EU/UK under GDPR and the ePrivacy Directive, California under the CCPA/CPRA, and a growing list of other regions — to ask visitors before you track them, not just tell them after the fact. A cookie consent plugin handles that: it shows a banner, blocks non-essential scripts until someone opts in, and keeps a record in case you ever need to prove compliance.

We tested and compared the most-installed options on WordPress.org to help you pick the right one for your site.

Quick comparison

PluginPrice (from)Installs & RatingBest For
Complianz GDPR/CCPAFree (Personal $59/yr)1M+ installs, 4.7★ (1,659 ratings)Deep legal coverage without a subscription
Cookie ComplianceFree (Pro $14.95/mo)800,000+ installs, 4.8★ (2,851 five-star reviews)Already using Google Consent Mode v2
Elementor Cookie ConsentFree (capped)40,000+ installs, 4.3★ (4 reviews)Sites built in Elementor wanting a native banner
TermlyFree (Starter $10/mo annual)204 ratings, 3.6★Bundled policy generator, modest traffic
Beautiful Cookie Consent BannerFully free94 ratings, 4.5★Simple sites, no dashboard needed
Okito Cookie ConsentFree10 ratings, 4.9★IAB TCF v2.3 without Complianz Premium

1. Complianz GDPR/CCPA Cookie Consent Banner

Complianz is the closest thing to an all-in-one option. The free version — not a trial, the actual free tier — includes a setup wizard, automatic cookie scanning, script/iframe blocking with placeholders, consent logging, and auto-generated cookie and privacy policies covering GDPR, UK-GDPR, CCPA/CPRA, LGPD, POPIA, PIPEDA, and more. There’s no page-view or session cap on the free tier, which is unusual in this space.

What’s behind the paywall: A/B testing for the banner, advanced site scanning, IAB TCF v2.0 integration, simultaneous multi-region targeting, and premium support.

Good fit if: you want strong multi-jurisdiction coverage (not just GDPR/CCPA) without paying anything, and you’re comfortable with a slightly more technical setup wizard.

Current version 7.5.5, requires WordPress 5.9+ and PHP 7.4+.

Read our full Complianz review for the deep-dive on pricing tiers and what’s behind the paywall.

2. Cookie Compliance for WordPress (formerly Cookie Notice)

This one operates in two modes. “Banner Only” is fully free and just shows a customizable consent banner — no blocking, no records. “Connected Mode” links the plugin to the vendor’s own platform (free or paid subscription) and adds automatic script blocking, consent categories, Google Consent Mode v2 / Meta / Microsoft consent signal support, multi-domain management, and an audit trail.

Good fit if: you’re already running Google Consent Mode v2 or Meta/Microsoft ads and want a plugin built around those integrations specifically. It has the highest install base and rating of the group, but check whether Connected Mode’s free tier covers your traffic before assuming it’s free at scale — the vendor gates some volume-based features behind paid plans.

Read our full Cookie Compliance review for the free-vs-paid breakdown.

3. Elementor Cookie Consent

Elementor — one of the most-installed page builders in the entire WordPress ecosystem — launched its own native cookie consent plugin in June 2026, built to be designed inside the same Elementor Editor you already use for the rest of the site. It detects cookies by loading your pages in a full headless browser (Chromium) rather than a simpler script scan, and supports both GDPR (opt-in) and CCPA (opt-out) modes with automatic Google Consent Mode v2 integration.

The free tier covers the fundamentals: banner customization, cookie scanning (up to 25 pages), 30-day consent logging, script blocking, and Consent Mode v2 — capped at 800 monthly consents on one site. Designing a fully custom banner requires Elementor Pro’s Popup Builder. Several features that matter more for larger or international sites — geo-targeted banners, GTM integration, scheduled scans, IAB TCF support, and white-labeling (removing Elementor’s own branding) — are gated behind Elementor One, and as of this writing several of those are still listed as “coming soon” rather than actually shipped, so don’t count on them being available yet if you need them now.

It’s genuinely new: version 0.0.11, with only 4 reviews on WordPress.org (4.3★ — three 5-star, one 2-star). Treat that rating as too small a sample to weigh heavily yet, and expect some rough edges typical of a sub-1.0 release from a vendor this size.

Good fit if: your site is already built in Elementor and you’d rather design the consent banner in the same editor as everything else, and your traffic is modest enough to stay under the 800-consent free cap.

Current version 0.0.11, requires WordPress 6.7+ and PHP 7.4+.

4. Termly — GDPR/CCPA Cookie Consent Banner

Termly’s free plan gives you one legal policy, a cookie banner with a script auto-blocker, and quarterly cookie scans, capped at 10,000 banner views a month. Paid tiers start at $10/month with annual billing, or $14/month billed monthly (Starter — 2 policies, monthly scans), and $15/month with annual billing, or $20/month billed monthly (Pro+ — unlimited policies and views, weekly scans, IAB TCF 2.3, custom banner styling, multi-language support, and consent logs).

Good fit if: you want Termly’s policy generator bundled in and your traffic is modest enough to stay under the free tier’s view cap — otherwise budget for Starter or Pro+.

Read our full Termly review for more on the free-tier view cap and what the paid tiers unlock.

5. Lightweight alternatives

If you don’t want to connect your site to an external consent-management platform at all, Beautiful Cookie Consent Banner is a fully free, self-contained option — no account, no data sent to a third-party service, just a customizable banner. It won’t auto-block scripts or generate legal policies for you, so it suits simple brochure sites more than stores or high-traffic blogs. Okito Cookie Consent is a smaller, newer entrant (4.9★ on a small number of ratings) worth watching if you specifically need IAB TCF v2.3 without paying for Complianz Premium.

How to choose

  • Need broad legal coverage (not just GDPR/CCPA) for free: Complianz.
  • Already using Google Consent Mode v2 or Meta/Microsoft ads: Cookie Compliance.
  • Already building your site in Elementor and want the banner designed natively there: Elementor Cookie Consent — but budget for Elementor Pro or Elementor One if you need custom banner design, geo-targeting, or IAB TCF.
  • Want a bundled policy generator and can live with a view cap, or will pay for Pro+: Termly.
  • Running a small, low-traffic site and want the simplest possible free banner: Beautiful Cookie Consent Banner.
  • Running WooCommerce: Complianz and Cookie Compliance both confirm WooCommerce-related integrations (tracking pixels/payment gateways for Complianz; Blocks Checkout handling for Cookie Compliance) — worth testing against your specific checkout setup either way.

Not sure if you even need one of these yet? Start with our consent-management checklist.

None of these plugins are a substitute for actual legal advice on what your specific site needs to comply with — treat this as a starting point for picking a tool, not a compliance guarantee. For more on what the underlying laws actually require, see our GDPR vs CCPA vs ePrivacy explainer and Do You Need a Cookie Policy on Your WordPress Site?

Sources