GDPR – software info by fk

GDPR vs CCPA vs ePrivacy: What WordPress Site Owners Actually Need to Know

Posted on October 12, 2026 by Filip Keser

These aren’t three versions of the same rule — they’re two different legal traditions bolted together, plus a third that works almost backwards from the first two. The ePrivacy Directive controls the moment a cookie gets placed on a visitor’s device. GDPR controls everything that happens to the data after that cookie has collected it. CCPA/CPRA doesn’t require a cookie’s permission slip at all by default — it requires you to honor a visitor’s request to stop, after the fact. Which one applies to your WordPress site depends entirely on who’s visiting it, not where you or your server happen to be.

The Three Laws, in Plain Terms

ePrivacy Directive (EU/UK, 2002/58/EC) is the actual “cookie law” — the reason consent banners exist in the first place. It says you need prior opt-in consent before you set any cookie or similar tracking technology that isn’t strictly necessary for the site to function, full stop, regardless of your size or revenue. It’s a Directive, not a Regulation, which matters mechanically: each EU member state passed its own national law implementing it, so enforcement and fine structures vary somewhat country to country (Spain and France’s regulators, for instance, have historically been more cookie-banner-active than most). It’s enforced by national data protection authorities, and in most member states, violations get folded into GDPR’s penalty structure rather than carrying a separate fine schedule.

GDPR (EU, Regulation 2016/679) is the general data protection law — it governs what you’re allowed to do with personal data once you have it, cookie-derived or not. That includes having a valid legal basis for processing (consent is only one of six), giving people the right to access, correct, delete, or export their data, notifying regulators of serious breaches within 72 hours, and restricting how you move EU personal data outside the EU. A cookie consent banner is where GDPR and ePrivacy meet in practice: ePrivacy is why the banner has to appear and be opt-in before tracking starts, and GDPR governs everything the plugin, your analytics tool, or your ad network does with the data once someone clicks “accept.”

CCPA/CPRA (California, effective as amended 2023, with ongoing CPPA rulemaking through 2026) runs on a different model entirely: opt-out, not opt-in. A covered business can process and even sell personal information by default — it just has to give consumers clear, low-friction ways to say no, and to actually honor that “no” without retaliating (no charging a fee or degrading service because someone opted out). It only applies once your business crosses a specific size threshold; unlike GDPR, small sites are exempt by law, not just by enforcement priority. As of the CPPA’s most recent Consumer Price Index adjustment (effective January 1, 2025), that threshold is: annual gross revenue over $26,625,000, OR you buy, sell, or share the personal information of 100,000 or more California consumers or households a year, OR 50% or more of annual revenue comes from selling or sharing personal information.

Side by Side

Dimension	ePrivacy / GDPR (EU/UK)	CCPA/CPRA (California)
Trigger	Any EU/UK visitor reaching your site, regardless of your size or location.	Only once your business crosses the revenue/volume thresholds below.
Consent model	Opt-in — required before the cookie fires.	Opt-out — the default is “on” until a visitor tells you to stop.
What’s regulated	ePrivacy: placing a cookie/tracker. GDPR: everything done with the data afterward (legal basis, rights, breaches, transfers).	Sale/sharing of personal information, plus the same rights model (access, deletion, correction, opt-out, limiting sensitive-data use).
Small-site exemption	None — a 200-visit/month blog with Google Analytics is technically in scope.	Yes, by statute, below the revenue/volume thresholds.
Required mechanic	A prior-consent banner that blocks non-essential scripts until accepted.	A “Do Not Sell or Share”/”Your Privacy Choices” link, honoring GPC as a valid opt-out, with symmetrical accept/decline design (per 2025-2026 CPPA enforcement).
Maximum penalty	Up to €20M or 4% of global annual turnover (most serious Article 83 violations; not realistic exposure for a small site with a stale banner).	Up to $2,663 per violation ($7,988 for intentional or minor-involving violations); private right of action of $107–$799 per incident for certain breaches.

Why This Actually Matters for Your Site, Not Just in the Abstract

If your WordPress site can be reached by EU or UK visitors — which, unless you’ve geo-blocked the region, it can — the ePrivacy/GDPR combination applies the moment you set a non-essential cookie, no matter your traffic or revenue. That’s the one with no small-business door to walk through. CCPA/CPRA is the one most WordPress site owners in this series’ audience won’t actually be legally required to comply with yet, because most personal blogs, niche review sites, and small WooCommerce stores don’t clear $26.6 million in revenue or handle 100,000+ Californians’ data a year. But two things make it worth building for anyway: first, a lot of consent plugins (see our plugin roundup — Complianz in particular) handle GDPR, CCPA, and a dozen other regimes in the same free tier, so there’s rarely a reason to configure for GDPR only; second, CCPA’s thresholds are revenue-based, and a site that starts small doesn’t always stay that way.

The Other State Laws You’ve Probably Heard Of

CCPA isn’t the only U.S. state privacy law anymore — it’s just the oldest and best-known. As of 2026, twenty U.S. states have comprehensive consumer privacy laws in effect, including three (Indiana, Kentucky, and Rhode Island) that took effect January 1, 2026. Most of the newer ones — Colorado, Connecticut, Virginia, Utah, Oregon, Texas, and the rest — largely follow Virginia’s template rather than California’s or the EU’s: opt-out by default, revenue/volume thresholds, and (increasingly) a requirement to honor the Global Privacy Control signal specifically. Twelve states now require GPC compliance by law: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. Practically, if your consent plugin already honors GPC for CCPA, you’re most of the way to compliant with the other eleven states’ GPC requirement too — it’s one signal, not twelve separate integrations.

What’s Actually Changing Right Now

Two developments are worth knowing about. First, the long-proposed EU ePrivacy Regulation — which would have replaced the 2002 Directive outright — was formally withdrawn by the European Commission (approved July 16, 2025; published October 6, 2025). The current ePrivacy Directive and GDPR remain the binding law exactly as described above; nothing in this withdrawal changes what your site needs to do today.

Second, and still genuinely unsettled: the EU’s November 2025 “Digital Omnibus” package proposed folding cookie-consent rules directly into the GDPR through two new articles, 88a (consent mechanics — a single-click refusal option, equal-prominence accept/decline design, and a cooldown before re-prompting someone who refused) and 88b (a more ambitious browser- or OS-level consent signal that sites would have to recognize automatically, similar in spirit to Global Privacy Control). Since then, the text has moved more than once in Council negotiations: a Council position reported around June 18, 2026 dropped Article 88b while keeping 88a; a separate Council Presidency compromise dated June 22, 2026 did the opposite — proposing to delete Article 88a and revert cookie consent entirely to the existing ePrivacy Directive, while leaving 88b’s browser-signal idea “still under discussion” pending a Coreper-flagged impact assessment. As of the most recent check we could verify (mid-September 2026), that second, more recent position — 88a proposed for deletion, 88b undecided — is the latest documented state, though the Council’s own negotiating mandate has itself been repeatedly delayed, and the European Parliament hasn’t taken a position on either article yet. None of this has reached a final, adopted text, so treat it as a live negotiation to watch rather than a rule to comply with: the current ePrivacy Directive and GDPR described in this piece remain exactly what applies to your WordPress site right now, regardless of which way the Digital Omnibus eventually lands.

Bottom Line

Think of it less as three competing laws and more as two layers plus one outlier: ePrivacy is the door (can you set the cookie at all, and did you ask first), GDPR is the house (what you’re allowed to do with the data once you’re in), and CCPA/CPRA is a different building altogether that assumes entry is fine by default and regulates the exit instead. A WordPress site reachable from the EU/UK needs to satisfy the door-and-house combination regardless of size; a site that also crosses CCPA’s revenue or volume thresholds needs the opt-out mechanics on top of that. Most consent plugins worth using (see our roundup) are built to handle all of this — and the dozen-plus U.S. state laws behind it — from one configuration screen, which is the practical reason to set one up correctly once rather than chase each law individually.

For the practical “now what” — do I need a policy page, a banner, or both — see our companion piece, Do You Need a Cookie Policy on Your WordPress Site? And if you haven’t picked a tool yet, start with our plugin roundup.

Sources

eur-lex.europa.eu — Directive 2002/58/EC (ePrivacy Directive) and Regulation (EU) 2016/679 (GDPR), including Article 83 fine tiers
European Commission — formal withdrawal of the proposed ePrivacy Regulation (approved July 16, 2025; published October 6, 2025)
cppa.ca.gov — “Updated Monetary Thresholds in CCPA” (CPI adjustment effective January 1, 2025): revenue exemption, administrative fine, and private-right-of-action figures
cppa.ca.gov enforcement announcements — American Honda Motor Co. (March 2025) and Todd Snyder (May 2025) cookie/opt-out enforcement actions
clym.io and multistate.us — 2026 U.S. state comprehensive privacy law tracker and 12-state Global Privacy Control requirement list
EDRi — analysis of the Digital Omnibus Council compromise text (Articles 88a/88b safeguards)
PPC Land — EU Council drops cookie signal after Google lobbying (June 18, 2026 Council position: Article 88b dropped, 88a retained)
praxikon.com — Digital Omnibus and the GDPR tracker (June 22, 2026 Presidency compromise: Article 88a proposed for deletion, 88b still under discussion; checked Sept 15, 2026)

Cookie Consent

Does My Site Need Consent Management? A Checklist for WordPress Site Owners

Posted on October 12, 2026 by Filip Keser

If you check even one box below, some form of consent management belongs on your site — the only open question is how much. Most WordPress sites check at least one box without realizing it, because “consent management” isn’t just a banner for EU visitors; it’s also what keeps your Google Ads and GA4 data working correctly, and what CCPA and a growing list of US state laws require once you cross specific size thresholds.

Work through the three sections below in order. Each one changes what you actually need.

Section 1: What’s Running on Your Site

Check every box that applies. These are the things that actually set cookies or load trackers — not your traffic level, not your location.

Google Analytics or GA4 is installed
You run Google Ads, remarketing, or any Google conversion tracking
You have a Meta (Facebook/Instagram) pixel installed
You embed YouTube videos using the standard embed code (not youtube-nocookie.com or a click-to-load facade)
You run WooCommerce or another store, and use cart-abandonment or marketing-retargeting tools (not just the checkout itself — checkout session cookies are generally “strictly necessary” and don’t need consent)
Comments are open, and your theme/plugin sets the “Save my name and email” cookie automatically instead of via opt-in checkbox
You run display ads from any ad network (AdSense or otherwise)
You use an email signup tool, live chat widget, or affiliate-tracking plugin that sets its own cookies
You embed content from other platforms that set their own cookies (maps, social feeds, review widgets, font/analytics CDNs that track)

If you checked none of these and your site really is just static pages plus WordPress’s own login cookies, you’re one of the rare exceptions — you likely don’t need a consent banner at all, just a short cookie disclosure covering the strictly-necessary cookies (see our companion piece, “Do You Need a Cookie Policy on Your WordPress Site?,” for the full list of what WordPress sets by default).

If you checked one or more boxes, move to Section 2 — what you owe depends on who’s reading, not just what’s running.

Section 2: Who Actually Visits Your Site

Your site is reachable by, and reasonably likely to have, visitors in the EU, UK, or Switzerland
Your site has visitors in California
Your site has visitors in other US states with their own privacy laws (as of 2026, roughly 20 states now have one in effect, including Virginia, Colorado, Connecticut, Texas, and others)
You run Google Ads or GA4 with any EEA/UK traffic at all

Here’s why each box matters differently.

EU/UK/Switzerland (ePrivacy Directive + GDPR): there is no small-site exemption. If your site is reachable by EU or UK visitors and you checked any box in Section 1, you need prior opt-in consent — a banner that actually blocks non-essential scripts until someone clicks “accept,” not just a notice that appears alongside tracking that’s already running. A 200-visit-a-month hobby blog with Google Analytics installed is technically in scope the same as a large retailer. This is the box that most often surprises small site owners.

California (CCPA/CPRA): unlike GDPR, this one is threshold-based. As of the CPPA’s most recent inflation adjustment (effective for 2026), you’re only a covered business if you meet at least one of: annual gross revenue over $26,625,000; you buy, sell, or share the personal information of 100,000 or more California consumers or households per year; or 50% or more of your annual revenue comes from selling or sharing personal information. Most individual blogs and small review/affiliate sites don’t cross any of these thresholds and aren’t directly regulated by CCPA — but if you do, you need an opt-out mechanism (a “Do Not Sell or Share My Personal Information” link, or a unified “Your Privacy Choices” link), you must honor the Global Privacy Control (GPC) browser signal as a valid opt-out, and per current CPPA enforcement, your banner’s “accept” and “decline” options need equal visual weight and effort — no one-click accept next to a three-click-deep decline.

Other US states: state privacy laws have expanded fast — roughly 20 states now have one in effect as of 2026, with more arriving in 2027. The thresholds are generally lower than CCPA’s revenue figure but keyed to consumer counts instead: Virginia’s VCDPA applies at 100,000+ consumers a year (or 25,000+ if 50%+ of revenue comes from selling data); Colorado’s CPA applies at 100,000+ residents (or 25,000+ if you derive any revenue from selling that data); Connecticut’s CTDPA, after its 2026 amendments, applies at 35,000+ consumers, or at any volume if you sell personal data or process sensitive data. A handful of states (Texas among them) apply to any business processing personal data with no small-business carve-out at all. If your site has meaningful traffic from a specific state and you’re monetizing visitor data there, it’s worth checking that state’s specific threshold rather than assuming CCPA’s number is the only one that matters.

Google Consent Mode v2: this box is easy to miss because it isn’t really a legal requirement — it’s a Google product requirement, and it applies regardless of your size. Since March 2024, Google requires valid Consent Mode v2 signals for any Google Ads or GA4 property serving or measuring EEA, UK, or Swiss users. Nothing gets fined if you skip it, but Google simply won’t build remarketing lists or serve personalized ads from unconsented EEA traffic, and your conversion tracking and attribution will quietly under-report — no error message, just data that slowly stops adding up. If you checked “Google Ads or GA4” above and have any EEA/UK traffic, you need a consent tool that specifically supports Consent Mode v2, not just a generic banner.

Section 3: What You Actually Need, Based on Your Answers

Match your checkmarks to the row that fits:

Any tracking (Section 1) + any EU/UK/Swiss visitors (Section 2): you need a real consent-management banner that blocks non-essential scripts until a visitor opts in, not a passive notice. This is the strictest combination and the one a generic “cookie notice” plugin won’t satisfy on its own.
Any tracking + Google Ads/GA4 + EEA/UK traffic: you additionally need Consent Mode v2 support specifically, or your ad and analytics data will silently degrade even if your banner is otherwise compliant.
Any tracking + US-only traffic, below all state thresholds: a clear cookie policy page covering what you actually set is likely sufficient on its own, though a banner is still good practice and costs you nothing to add.
Any tracking + US traffic, above the CCPA threshold or any state threshold above: you need, at minimum, a working opt-out mechanism, GPC signal recognition, and a symmetrical-effort banner design — the specific plugin features to look for are covered in each of our individual reviews.
No tracking at all, any location: a short strictly-necessary-cookies disclosure covers you. No banner needed.

Where to Go Next

If you landed in one of the “you need a real banner” rows, start with our roundup, “Best WordPress Cookie Consent Plugins in 2026,” which compares Complianz, Cookie Compliance (formerly Cookie Notice), Termly, and lighter alternatives on exactly the factors above — free-tier limits, Consent Mode v2 support, and US state-law features. From there:

If you want the deepest free tier and broad legal-document coverage: read our Complianz review.
If you’re already running Google/Meta ad tracking and want a tool built around those consent signals specifically: read our Cookie Compliance review.
If you want a bundled policy generator alongside the banner and can live with (or plan to outgrow) a monthly view cap: read our Termly review.

If you’re still unsure whether you need a cookie policy at all, or want the fuller legal picture behind GDPR, ePrivacy, and CCPA, our companion explainers (“Do You Need a Cookie Policy on Your WordPress Site?” and “GDPR vs CCPA vs ePrivacy: What WordPress Site Owners Actually Need to Know”) cover both in more depth than this checklist does.

Sources

CCPA/CPRA 2026 revenue threshold and business-definition tests per the California Privacy Protection Agency’s (cppa.ca.gov) published thresholds and 2026 inflation-adjustment commentary
Google Consent Mode v2 mandatory-status and enforcement mechanics per Google’s own Consent Mode documentation and third-party 2026 enforcement coverage
US state privacy law counts and thresholds (Virginia VCDPA, Colorado CPA, Connecticut CTDPA) per 2026 state privacy law trackers

Cookie Consent

Do You Need a Cookie Policy on Your WordPress Site?

Posted on October 12, 2026 by Filip Keser

If your WordPress site does anything beyond serving static pages — runs Google Analytics, shows ads, embeds a YouTube video, lets people comment, sells anything through WooCommerce, or uses a form tool that drops a tracking cookie — you almost certainly need both a cookie policy and, in most cases, a consent banner in front of it. The handful of sites that don’t need one are genuinely bare: no analytics, no ad network, no embeds, no e-commerce, nothing but WordPress’s own login cookies.

That’s the practical answer. The legal answer depends on which rulebook applies to your visitors, and it’s worth understanding both, because they don’t work the same way.

Two Different Laws, Two Different Triggers

GDPR and the ePrivacy Directive (EU/UK) regulate the act of placing a cookie, not your business size. If your site is reachable by and reasonably likely to have visitors in the EU or UK, the ePrivacy Directive requires prior opt-in consent before you set any cookie that isn’t “strictly necessary” — before it fires, not just a banner that discloses it after the fact. There’s no small-business or low-traffic exemption. A hobby blog with 200 monthly visitors and Google Analytics installed is technically in scope the same as a large retailer. In practice, small sites are rarely the target of an enforcement sweep, but the legal obligation doesn’t scale with traffic the way some site owners assume it does.

CCPA/CPRA (California) works differently — it’s threshold-based. You’re only covered if your business meets at least one of these: over $26,625,000 in annual gross revenue, buys/sells/shares the personal information of 100,000 or more California consumers or households a year, or derives 50% or more of annual revenue from selling or sharing personal information. Most small WordPress sites and blogs simply don’t hit any of those numbers and aren’t directly regulated by CCPA — though if you do cross a threshold, the requirements are specific: a “Do Not Sell or Share My Personal Information” link (or a unified “Your Privacy Choices” link), honoring Global Privacy Control (GPC) browser signals as a valid opt-out, and — per 2025-2026 California Privacy Protection Agency (CPPA) enforcement — symmetrical banner design, meaning “Accept” and “Decline” have to take equal effort and get equal visual weight. A banner that makes accepting one click and declining a three-click hunt through settings is itself a violation now, independent of what the cookies do.

There are other state laws (Colorado, Virginia, Connecticut, and others) with their own thresholds and opt-out mechanics, but for a typical WordPress site owner, GDPR/ePrivacy and CCPA/CPRA are the two that come up most often, and GDPR is the one with no size exemption to hide behind.

What’s Actually in Your Cookie Jar

WordPress core sets a small set of cookies on its own, and not all of them need consent.

Strictly necessary (no consent required): wordpress_[hash] and wordpress_logged_in_[hash] (login/authentication), wp-settings-{time}-[UID] (admin interface preferences), and wordpress_test_cookie (a temporary check that cookies work). These exist to make the site function and are generally exempt from consent requirements under both GDPR and CCPA.

Not strictly necessary (consent required): the three comment cookies — comment_author_{hash}, comment_author_email_{hash}, comment_author_url_{hash} — which WordPress only sets when a commenter opts in via the “Save my name and email” checkbox. That opt-in checkbox is doing real legal work; don’t let a theme or plugin override it to save the cookie automatically.

Beyond core WordPress, most sites are carrying more than they realize: Google Analytics (_ga, _gid, and related cookies — non-essential, require consent), Jetpack (sets its own functional and stats cookies depending on which modules are active), WooCommerce (cart/session cookies are generally treated as strictly necessary for the checkout to function, but anything WooCommerce-adjacent for marketing or abandoned-cart tracking is not), embedded YouTube videos (YouTube sets tracking cookies the moment the standard embed loads — before anyone presses play — unless you use youtube-nocookie.com or a click-to-load facade), and any ad network, affiliate tracking pixel, or email-signup widget, all of which typically drop their own third-party cookies on page load.

The point of a cookie audit — which every legitimate cookie-consent plugin does automatically, and which you can also do manually by opening your browser’s dev tools and checking Application > Cookies on a fresh, logged-out visit — is finding out what your site is actually setting versus what you assume it’s setting. Plugins and page builders add cookies you didn’t explicitly configure.

What a Cookie Policy Actually Needs to Say

A compliant cookie policy (usually a dedicated page, separate from or linked out of your general privacy policy) needs to specify, in plain language: the categories of cookies you use (necessary, functional/preferences, analytics/statistics, marketing/advertising), ideally an actual table of the specific cookies set, who sets them (you vs. a named third party like Google or Jetpack), what each one does and how long it lasts, and — critically — a working mechanism for visitors to withdraw or change consent after the fact, not just a “close” button that never appears again. WordPress.org’s own cookie policy and Automattic’s cookie policy are reasonable real-world examples of the format if you want to see one written by a company operating at scale.

What It Costs to Skip This

For GDPR, the ceiling is the number that gets cited most — up to €20 million or 4% of global annual turnover, whichever is higher, for the most serious violations — but that figure is for large, deliberate, repeat offenders, not the realistic exposure for a small site with an outdated banner. The more instructive examples for a site owner this size are California’s recent CPPA enforcement actions against mid-size, non-tech companies: American Honda Motor Co. was fined $632,500 in March 2025 largely over how its cookie consent tool was configured and how it handled opt-out signals, and menswear retailer Todd Snyder was ordered to pay $345,178 in May 2025 for letting its opt-out request process sit broken for 40 days and asking consumers for more information than necessary to process an opt-out. Neither is a household name in the privacy-fine conversation the way Meta or Google is — which is exactly the point: regulators are reaching well below the Fortune 500 now, and “we used a consent management plugin” was explicitly not a defense in the CPPA’s own enforcement commentary on the Honda case.

Getting Compliant, in Practice

Audit first — find out what your site actually sets, using either a plugin’s built-in scanner or your browser’s dev tools. Write or generate the actual cookie policy page — Complianz and Termly (covered in our plugin roundup) both auto-generate one from the scan, which is faster and more accurate than writing it from a template. Install a consent solution that blocks non-essential cookies before consent, not just one that shows a banner while Google Analytics loads in the background anyway — that gap between “banner is visible” and “tracking is actually blocked” is the single most common compliance failure on small sites, and it’s the difference between a decorative banner and a functional one. Link the cookie policy from your site footer and from your privacy policy. And revisit it periodically: new plugins, new embeds, and new ad tags all add cookies you didn’t audit for on day one.

Bottom Line

Almost every WordPress site with analytics, ads, embeds, comments, or e-commerce needs a cookie policy, and most of those also need a real (not cosmetic) consent banner in front of non-essential cookies. GDPR/ePrivacy applies regardless of your size or traffic if EU/UK visitors can reach your site; CCPA/CPRA only kicks in once you cross specific revenue or volume thresholds, but its enforcement has been getting more aggressive against exactly the kind of mid-size, non-tech sites that assumed they were too small to notice.

For the fuller legal picture behind these rules, see our GDPR vs CCPA vs ePrivacy comparison. Not sure yet whether you specifically need a consent banner (as opposed to just a policy page)? Run through our consent-management checklist.

Sources

gdpr-info.eu (GDPR fine tiers)
cppa.ca.gov enforcement announcements on Honda (March 2025) and Todd Snyder (May 2025)
developer.wordpress.org “Cookies” (WordPress core cookie list)
Jetpack’s cookie documentation (jetpack.com/support/cookies)
usercentrics.com CCPA/CPRA cookie banner guide (2026 symmetrical-design and GPC requirements)
WordPress.org and Automattic’s own published cookie policies (as format references)

Cookie Consent

Best WordPress Cookie Consent Plugins in 2026

Posted on October 12, 2026 by Filip Keser

If your WordPress site sets cookies for analytics, ads, or embedded content, you’re legally required in most of the world — the EU/UK under GDPR and the ePrivacy Directive, California under the CCPA/CPRA, and a growing list of other regions — to ask visitors before you track them, not just tell them after the fact. A cookie consent plugin handles that: it shows a banner, blocks non-essential scripts until someone opts in, and keeps a record in case you ever need to prove compliance.

We tested and compared the most-installed options on WordPress.org to help you pick the right one for your site.

Quick comparison

Plugin	Price (from)	Installs & Rating	Best For
Complianz GDPR/CCPA	Free (Personal $59/yr)	1M+ installs, 4.7★ (1,659 ratings)	Deep legal coverage without a subscription
Cookie Compliance	Free (Pro $14.95/mo)	800,000+ installs, 4.8★ (2,851 five-star reviews)	Already using Google Consent Mode v2
Elementor Cookie Consent	Free (capped)	40,000+ installs, 4.3★ (4 reviews)	Sites built in Elementor wanting a native banner
Termly	Free (Starter $10/mo annual)	204 ratings, 3.6★	Bundled policy generator, modest traffic
Beautiful Cookie Consent Banner	Fully free	94 ratings, 4.5★	Simple sites, no dashboard needed
Okito Cookie Consent	Free	10 ratings, 4.9★	IAB TCF v2.3 without Complianz Premium

1. Complianz GDPR/CCPA Cookie Consent Banner

Complianz is the closest thing to an all-in-one option. The free version — not a trial, the actual free tier — includes a setup wizard, automatic cookie scanning, script/iframe blocking with placeholders, consent logging, and auto-generated cookie and privacy policies covering GDPR, UK-GDPR, CCPA/CPRA, LGPD, POPIA, PIPEDA, and more. There’s no page-view or session cap on the free tier, which is unusual in this space.

What’s behind the paywall: A/B testing for the banner, advanced site scanning, IAB TCF v2.0 integration, simultaneous multi-region targeting, and premium support.

Good fit if: you want strong multi-jurisdiction coverage (not just GDPR/CCPA) without paying anything, and you’re comfortable with a slightly more technical setup wizard.

Current version 7.5.5, requires WordPress 5.9+ and PHP 7.4+.

Read our full Complianz review for the deep-dive on pricing tiers and what’s behind the paywall.

2. Cookie Compliance for WordPress (formerly Cookie Notice)

This one operates in two modes. “Banner Only” is fully free and just shows a customizable consent banner — no blocking, no records. “Connected Mode” links the plugin to the vendor’s own platform (free or paid subscription) and adds automatic script blocking, consent categories, Google Consent Mode v2 / Meta / Microsoft consent signal support, multi-domain management, and an audit trail.

Good fit if: you’re already running Google Consent Mode v2 or Meta/Microsoft ads and want a plugin built around those integrations specifically. It has the highest install base and rating of the group, but check whether Connected Mode’s free tier covers your traffic before assuming it’s free at scale — the vendor gates some volume-based features behind paid plans.

Read our full Cookie Compliance review for the free-vs-paid breakdown.

3. Elementor Cookie Consent

Elementor — one of the most-installed page builders in the entire WordPress ecosystem — launched its own native cookie consent plugin in June 2026, built to be designed inside the same Elementor Editor you already use for the rest of the site. It detects cookies by loading your pages in a full headless browser (Chromium) rather than a simpler script scan, and supports both GDPR (opt-in) and CCPA (opt-out) modes with automatic Google Consent Mode v2 integration.

The free tier covers the fundamentals: banner customization, cookie scanning (up to 25 pages), 30-day consent logging, script blocking, and Consent Mode v2 — capped at 800 monthly consents on one site. Designing a fully custom banner requires Elementor Pro’s Popup Builder. Several features that matter more for larger or international sites — geo-targeted banners, GTM integration, scheduled scans, IAB TCF support, and white-labeling (removing Elementor’s own branding) — are gated behind Elementor One, and as of this writing several of those are still listed as “coming soon” rather than actually shipped, so don’t count on them being available yet if you need them now.

It’s genuinely new: version 0.0.11, with only 4 reviews on WordPress.org (4.3★ — three 5-star, one 2-star). Treat that rating as too small a sample to weigh heavily yet, and expect some rough edges typical of a sub-1.0 release from a vendor this size.

Good fit if: your site is already built in Elementor and you’d rather design the consent banner in the same editor as everything else, and your traffic is modest enough to stay under the 800-consent free cap.

Current version 0.0.11, requires WordPress 6.7+ and PHP 7.4+.

4. Termly — GDPR/CCPA Cookie Consent Banner

Termly’s free plan gives you one legal policy, a cookie banner with a script auto-blocker, and quarterly cookie scans, capped at 10,000 banner views a month. Paid tiers start at $10/month with annual billing, or $14/month billed monthly (Starter — 2 policies, monthly scans), and $15/month with annual billing, or $20/month billed monthly (Pro+ — unlimited policies and views, weekly scans, IAB TCF 2.3, custom banner styling, multi-language support, and consent logs).

Good fit if: you want Termly’s policy generator bundled in and your traffic is modest enough to stay under the free tier’s view cap — otherwise budget for Starter or Pro+.

Read our full Termly review for more on the free-tier view cap and what the paid tiers unlock.

5. Lightweight alternatives

If you don’t want to connect your site to an external consent-management platform at all, Beautiful Cookie Consent Banner is a fully free, self-contained option — no account, no data sent to a third-party service, just a customizable banner. It won’t auto-block scripts or generate legal policies for you, so it suits simple brochure sites more than stores or high-traffic blogs. Okito Cookie Consent is a smaller, newer entrant (4.9★ on a small number of ratings) worth watching if you specifically need IAB TCF v2.3 without paying for Complianz Premium.

How to choose

Need broad legal coverage (not just GDPR/CCPA) for free: Complianz.
Already using Google Consent Mode v2 or Meta/Microsoft ads: Cookie Compliance.
Already building your site in Elementor and want the banner designed natively there: Elementor Cookie Consent — but budget for Elementor Pro or Elementor One if you need custom banner design, geo-targeting, or IAB TCF.
Want a bundled policy generator and can live with a view cap, or will pay for Pro+: Termly.
Running a small, low-traffic site and want the simplest possible free banner: Beautiful Cookie Consent Banner.
Running WooCommerce: Complianz and Cookie Compliance both confirm WooCommerce-related integrations (tracking pixels/payment gateways for Complianz; Blocks Checkout handling for Cookie Compliance) — worth testing against your specific checkout setup either way.

Not sure if you even need one of these yet? Start with our consent-management checklist.

None of these plugins are a substitute for actual legal advice on what your specific site needs to comply with — treat this as a starting point for picking a tool, not a compliance guarantee. For more on what the underlying laws actually require, see our GDPR vs CCPA vs ePrivacy explainer and Do You Need a Cookie Policy on Your WordPress Site?