If you check even one box below, some form of consent management belongs on your site — the only open question is how much. Most WordPress sites check at least one box without realizing it, because “consent management” isn’t just a banner for EU visitors; it’s also what keeps your Google Ads and GA4 data working correctly, and what CCPA and a growing list of US state laws require once you cross specific size thresholds.
Work through the three sections below in order. Each one changes what you actually need.
Section 1: What’s Running on Your Site
Check every box that applies. These are the things that actually set cookies or load trackers — not your traffic level, not your location.
- Google Analytics or GA4 is installed
- You run Google Ads, remarketing, or any Google conversion tracking
- You have a Meta (Facebook/Instagram) pixel installed
- You embed YouTube videos using the standard embed code (not youtube-nocookie.com or a click-to-load facade)
- You run WooCommerce or another store, and use cart-abandonment or marketing-retargeting tools (not just the checkout itself — checkout session cookies are generally “strictly necessary” and don’t need consent)
- Comments are open, and your theme/plugin sets the “Save my name and email” cookie automatically instead of via opt-in checkbox
- You run display ads from any ad network (AdSense or otherwise)
- You use an email signup tool, live chat widget, or affiliate-tracking plugin that sets its own cookies
- You embed content from other platforms that set their own cookies (maps, social feeds, review widgets, font/analytics CDNs that track)
If you checked none of these and your site really is just static pages plus WordPress’s own login cookies, you’re one of the rare exceptions — you likely don’t need a consent banner at all, just a short cookie disclosure covering the strictly-necessary cookies (see our companion piece, “Do You Need a Cookie Policy on Your WordPress Site?,” for the full list of what WordPress sets by default).
If you checked one or more boxes, move to Section 2 — what you owe depends on who’s reading, not just what’s running.
Section 2: Who Actually Visits Your Site
- Your site is reachable by, and reasonably likely to have, visitors in the EU, UK, or Switzerland
- Your site has visitors in California
- Your site has visitors in other US states with their own privacy laws (as of 2026, roughly 20 states now have one in effect, including Virginia, Colorado, Connecticut, Texas, and others)
- You run Google Ads or GA4 with any EEA/UK traffic at all
Here’s why each box matters differently.
EU/UK/Switzerland (ePrivacy Directive + GDPR): there is no small-site exemption. If your site is reachable by EU or UK visitors and you checked any box in Section 1, you need prior opt-in consent — a banner that actually blocks non-essential scripts until someone clicks “accept,” not just a notice that appears alongside tracking that’s already running. A 200-visit-a-month hobby blog with Google Analytics installed is technically in scope the same as a large retailer. This is the box that most often surprises small site owners.
California (CCPA/CPRA): unlike GDPR, this one is threshold-based. As of the CPPA’s most recent inflation adjustment (effective for 2026), you’re only a covered business if you meet at least one of: annual gross revenue over $26,625,000; you buy, sell, or share the personal information of 100,000 or more California consumers or households per year; or 50% or more of your annual revenue comes from selling or sharing personal information. Most individual blogs and small review/affiliate sites don’t cross any of these thresholds and aren’t directly regulated by CCPA — but if you do, you need an opt-out mechanism (a “Do Not Sell or Share My Personal Information” link, or a unified “Your Privacy Choices” link), you must honor the Global Privacy Control (GPC) browser signal as a valid opt-out, and per current CPPA enforcement, your banner’s “accept” and “decline” options need equal visual weight and effort — no one-click accept next to a three-click-deep decline.
Other US states: state privacy laws have expanded fast — roughly 20 states now have one in effect as of 2026, with more arriving in 2027. The thresholds are generally lower than CCPA’s revenue figure but keyed to consumer counts instead: Virginia’s VCDPA applies at 100,000+ consumers a year (or 25,000+ if 50%+ of revenue comes from selling data); Colorado’s CPA applies at 100,000+ residents (or 25,000+ if you derive any revenue from selling that data); Connecticut’s CTDPA, after its 2026 amendments, applies at 35,000+ consumers, or at any volume if you sell personal data or process sensitive data. A handful of states (Texas among them) apply to any business processing personal data with no small-business carve-out at all. If your site has meaningful traffic from a specific state and you’re monetizing visitor data there, it’s worth checking that state’s specific threshold rather than assuming CCPA’s number is the only one that matters.
Google Consent Mode v2: this box is easy to miss because it isn’t really a legal requirement — it’s a Google product requirement, and it applies regardless of your size. Since March 2024, Google requires valid Consent Mode v2 signals for any Google Ads or GA4 property serving or measuring EEA, UK, or Swiss users. Nothing gets fined if you skip it, but Google simply won’t build remarketing lists or serve personalized ads from unconsented EEA traffic, and your conversion tracking and attribution will quietly under-report — no error message, just data that slowly stops adding up. If you checked “Google Ads or GA4” above and have any EEA/UK traffic, you need a consent tool that specifically supports Consent Mode v2, not just a generic banner.
Section 3: What You Actually Need, Based on Your Answers
Match your checkmarks to the row that fits:
- Any tracking (Section 1) + any EU/UK/Swiss visitors (Section 2): you need a real consent-management banner that blocks non-essential scripts until a visitor opts in, not a passive notice. This is the strictest combination and the one a generic “cookie notice” plugin won’t satisfy on its own.
- Any tracking + Google Ads/GA4 + EEA/UK traffic: you additionally need Consent Mode v2 support specifically, or your ad and analytics data will silently degrade even if your banner is otherwise compliant.
- Any tracking + US-only traffic, below all state thresholds: a clear cookie policy page covering what you actually set is likely sufficient on its own, though a banner is still good practice and costs you nothing to add.
- Any tracking + US traffic, above the CCPA threshold or any state threshold above: you need, at minimum, a working opt-out mechanism, GPC signal recognition, and a symmetrical-effort banner design — the specific plugin features to look for are covered in each of our individual reviews.
- No tracking at all, any location: a short strictly-necessary-cookies disclosure covers you. No banner needed.
Where to Go Next
If you landed in one of the “you need a real banner” rows, start with our roundup, “Best WordPress Cookie Consent Plugins in 2026,” which compares Complianz, Cookie Compliance (formerly Cookie Notice), Termly, and lighter alternatives on exactly the factors above — free-tier limits, Consent Mode v2 support, and US state-law features. From there:
- If you want the deepest free tier and broad legal-document coverage: read our Complianz review.
- If you’re already running Google/Meta ad tracking and want a tool built around those consent signals specifically: read our Cookie Compliance review.
- If you want a bundled policy generator alongside the banner and can live with (or plan to outgrow) a monthly view cap: read our Termly review.
If you’re still unsure whether you need a cookie policy at all, or want the fuller legal picture behind GDPR, ePrivacy, and CCPA, our companion explainers (“Do You Need a Cookie Policy on Your WordPress Site?” and “GDPR vs CCPA vs ePrivacy: What WordPress Site Owners Actually Need to Know”) cover both in more depth than this checklist does.
Sources
- CCPA/CPRA 2026 revenue threshold and business-definition tests per the California Privacy Protection Agency’s (cppa.ca.gov) published thresholds and 2026 inflation-adjustment commentary
- Google Consent Mode v2 mandatory-status and enforcement mechanics per Google’s own Consent Mode documentation and third-party 2026 enforcement coverage
- US state privacy law counts and thresholds (Virginia VCDPA, Colorado CPA, Connecticut CTDPA) per 2026 state privacy law trackers
