Running a site
GDPR and cookie consent on WordPress, practically
12 July 2026 · 7 min read
On this page
Most cookie banners on small business sites are wrong in one of two directions: either there is no banner on a site loading advertising trackers, or there is an elaborate banner on a site that sets no cookies at all.
This is not legal advice. It is a practical summary. If you handle sensitive data or operate at scale, take proper advice.
What actually requires consent
The rule is simpler than the banners suggest: consent is required for cookies that are not strictly necessary for the service the user asked for.
No consent needed:
- Session cookies that keep someone logged in
- A shopping cart cookie
- A cookie remembering their consent choice
- Security and load balancing cookies
Consent needed, before they load:
- Google Analytics
- Advertising pixels — Google Ads, Meta, LinkedIn
- Heatmaps and session recording
- Embedded YouTube in its default mode
- Most chat widgets
- Social sharing widgets that track
The word doing the work is before. A banner that appears while the trackers have already loaded is decorative.
The practical implications
If your site has no analytics, no ads and no embeds, you likely need no cookie banner at all. A privacy policy, yes. A banner, probably not. Plenty of small sites have one because it felt expected.
If you run Google Ads or Analytics, you need a proper consent mechanism that blocks them until the visitor agrees — and for EEA and UK traffic, that now means Consent Mode v2. Without it, conversions from those regions are increasingly modelled or dropped, so this is a measurement problem as well as a compliance one.
If you use YouTube embeds, switch to youtube-nocookie.com, which avoids setting tracking cookies until playback.
What a compliant banner looks like
- Reject is as easy as Accept. No "Accept All" button next to a "Manage preferences" link that takes four clicks. This is the most commonly enforced failing in the EU.
- No pre-ticked boxes.
- Nothing loads before consent. The banner must actually block scripts, not just record a preference.
- Consent is withdrawable, with a visible way to change it later.
- Granular by category — analytics separate from marketing.
Plugins that do this properly on WordPress: Complianz, CookieYes, Cookiebot. Any of them handles the blocking and the Consent Mode v2 signals, which is the part a hand-rolled banner usually gets wrong.
The rest of GDPR
The banner is the visible part and the smallest part.
A privacy policy that says what you collect, why, on what legal basis, how long you keep it, and who you share it with. Specific to your site, not a template naming services you do not use.
Form data. Contact form submissions are personal data. Do you need to store them in WordPress as well as emailing them? If not, turn that off — data you do not hold cannot leak.
Right of access and erasure. WordPress has built-in tools under Tools → Export Personal Data and Erase Personal Data. Know they exist before someone asks.
Processors. Your host, email service and analytics provider all process data on your behalf. You should know who they are and ideally have their terms on file.
Breach notification. Certain breaches must be reported within 72 hours. This is one reason knowing whether you have been hacked is not only a technical question.
What is theatre
A cookie banner on a site with no cookies. Adds friction, signals nothing.
"By using this site you accept cookies." Implied consent is not consent.
A banner that loads after the trackers. Common with hand-rolled implementations.
A generic privacy policy listing services you do not use. Worse than a short accurate one.
Blocking the whole site until someone clicks. Disproportionate, and terrible for conversion.
The practical minimum
- Work out what actually sets cookies — DevTools → Application → Cookies, in a private window
- If it is only essential ones: privacy policy, no banner
- If not: a consent plugin that genuinely blocks until consent, with Consent Mode v2 if you run Google Ads
- A privacy policy describing your actual setup
- Do not store form submissions you do not need
If you advertise to EU or UK audiences, treat Consent Mode v2 as a measurement requirement as much as a legal one. Without it your conversion data from those regions degrades, which affects bidding as well as compliance.