WORDPRESS GUIDE · REVIEWED 26 SEPTEMBER 2026
WordPress Cookie Banner Checklist UK: 2026 Setup & Testing Guide
WordPress websites can collect data through plugins, themes, Google Analytics, Google Tag Manager, advertising pixels, embedded content, forms, live chat and ecommerce tools. A cookie banner is only useful if those technologies respond properly to the visitor’s choice.
Use this checklist if you own or manage a WordPress website, or need to brief its developer. Work through visible banner choices, installation routes and technical behaviour, then use the findings to decide whether you need a Cookie Banner Audit, a Cookie Policy Review or a focused Google Consent Mode Audit.
Last reviewed: 26 September 2026 · Practical website guidance only. Not legal advice or formal compliance certification.
FREE WORDPRESS TOOL
Optional Starting Point: CookieBanner Check
CookieBanner Check is our free WordPress plugin for scanning visible public homepage signals. It gives you a quick starting point before working through the full checklist below.
- Checks for a visible cookie banner or consent controls
- Looks for cookie and privacy-policy links
- Detects common Google Analytics and Google Tag Manager signals
- Looks for Google Ads and Meta Pixel signals
- Highlights practical areas that may need further review
The plugin provides practical public-page observations only. It does not inspect private WordPress settings, prove that every tag is blocked correctly or provide legal certification.
Does a WordPress Website Need a Cookie Banner?
WordPress itself is not the deciding factor. The important question is what your particular website stores or accesses on a visitor’s device and why. Plugins, themes and third-party integrations can all introduce cookies, pixels, scripts or similar technologies.
Analytics
GA4, analytics plugins and other measurement tools need to be reviewed against their purpose, configuration and the 2026 UK exceptions.
Advertising & Pixels
Google Ads, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag and similar advertising technologies can introduce additional consent requirements.
Third-Party Features
Video embeds, maps, chat tools, forms, booking systems, ecommerce extensions and social widgets can set cookies or load external scripts.
What WordPress Plugins Commonly Add Tracking?
A WordPress cookie review should look beyond the banner plugin. Tracking can come from several unrelated parts of the website.
Analytics & Marketing Plugins
Analytics dashboards, advertising integrations, marketing automation and conversion plugins can add tracking directly or insert Google tags.
Forms, Chat & Booking Tools
Contact forms, live chat, CRM connections, booking systems and call-tracking tools can load third-party scripts or create their own identifiers.
WooCommerce & Ecommerce
WooCommerce extensions, payment services, product analytics and advertising integrations can add both essential and optional storage technologies.
Embedded Media
YouTube, Vimeo, maps, social feeds, review widgets and other embeds may contact third-party services or set storage before the visitor interacts with them.
Theme & Header Scripts
Tracking may be hard-coded into the theme, header, footer or a script-injection plugin and therefore sit outside your normal consent-plugin settings.
Google Tag Manager
GTM can control many tags from one place, but triggers and consent settings still need testing. Tags outside GTM can also create duplicate tracking.
WordPress Cookie Banner Checklist
Work through both sides of the checklist. The visible banner and the technical behaviour behind it should tell the same story.
Banner & Visitor Choice
- Does the banner appear at the right point in the visit?
- Can visitors clearly accept optional technologies?
- Can visitors clearly reject non-essential technologies?
- Can visitors manage analytics and marketing separately?
- Can visitors change their choice later?
- Does the banner work properly on mobile?
- Does the wording explain the purposes in plain English?
- Does the cookie policy reflect the tools actually used?
Technical Behaviour
- Does rejection change optional tracking behaviour?
- Are analytics plugins connected to consent?
- Are header and footer scripts checked?
- Is Google Tag Manager configured as intended?
- Is Meta Pixel reviewed against marketing consent?
- Are embedded videos, maps and widgets reviewed?
- Are duplicate analytics or advertising tags present?
- Has the site been retested after plugin or theme changes?
Check for Duplicate GA4, GTM and Pixel Installations
Check whether the same tracking technology is installed in more than one place. Google’s Site Kit code-management guidance explains how existing tags and plugin-inserted code can overlap. Confirm the active installation routes before asking your developer to change them.
Illustrative Setup: GA4 Installed Three Times
GA4 may be added through Google Tag Manager, an analytics plugin and the theme header at the same time. This can create duplicate page views, inconsistent consent behaviour or confusing debugging results.
Illustrative Setup: Pixel Outside Banner Control
Your consent plugin may control a Meta Pixel added through GTM while a second Pixel inserted by another plugin still loads separately. Use the Meta Pixel consent testing guide to compare the separate installation routes.
- Check whether GA4 is installed directly and through GTM.
- Check analytics, SEO and marketing plugin settings.
- Check theme header/footer scripts.
- Check advertising and ecommerce integrations.
- Check whether your CMP or cookie plugin also injects tags.
- Retest after removing or changing any duplicate installation.
Google Analytics on WordPress: The 2026 UK Position
The UK position changed in 2026. A limited statistical-purposes exception can apply to some analytics use, so it is no longer accurate to say that every analytics implementation always requires PECR consent.
The Exception Is Narrow
The storage or access must be for the sole statistical purpose described by the law, with clear information and a simple free way for the user to object.
GA4 Is Not Automatically Exempt
If analytics is also used for advertising, profiling, audience creation, individual-level tracking or other wider purposes, the exception may not apply.
Read our detailed Google Analytics Cookie Consent UK guide for the full 2026 position.
WordPress and Google Consent Mode v2
For WordPress sites using GA4, Google Ads or GTM, the next step can be our £395 Google Consent Mode audit. We test the agreed consent journey and investigate Google-tag behaviour, including signs of overlapping installations. The fixed scope includes a PDF report and a 30-minute walkthrough, with no VAT added. Implementation and a wider review of other plugins or tracking tools are scoped separately.
If your WordPress site uses Google Analytics, Google Ads or Google Tag Manager, check whether Consent Mode is being used and whether the visitor’s real choice is passed correctly to Google tags.
analytics_storage
Review the analytics-storage state and whether it changes appropriately with your analytics choice.
ad_storage
Review advertising storage and whether marketing choices are kept separate from analytics where appropriate.
ad_user_data & ad_personalization
Websites using Google advertising features should also review the additional Consent Mode v2 advertising signals.
Consent Mode does not replace the cookie banner or determine your legal position. See the full Google Consent Mode v2 UK guide.
How to Test a WordPress Cookie Banner
Use a separate, logged-out browser session with a fresh consent state. Compare before choice, rejection and acceptance, then test changing or withdrawing a saved preference. Record the page, date, starting state and action so the results can be repeated.
Before Any Choice
Check which cookies, requests, pixels and tags appear before the visitor interacts with the banner. Identify whether GTM or plugins are already loading optional technologies.
After Rejection
Reject non-essential technologies and check whether analytics, advertising pixels and optional third-party scripts behave consistently with the visitor’s choice.
After Acceptance
Accept Analytics or Marketing separately where possible. Confirm that only the technologies associated with the selected category change behaviour.
Keep two kinds of evidence: what the visitor sees, and what cookies, storage and network requests do. For Google tags, Google’s Tag Assistant guidance explains how to compare default consent states with updates. A screenshot or detected tag alone cannot establish the full behaviour.
Common WordPress Cookie Consent Issues
Banner Looks Right, Tags Behave Differently
The visitor-facing banner can be configured correctly while tracking added through a different plugin or theme still loads independently.
Two Consent Plugins Are Active
Multiple consent or optimisation plugins may compete to block, defer or inject the same scripts, producing inconsistent behaviour.
Policy Does Not Match the Site
A generic cookie policy may omit newly added plugins, advertising pixels, embedded tools or changes made by an agency or developer.
Turn Your Checklist into a Developer Brief
Record a test your developer can repeat
For each finding, record the URL, test date, browser and device, starting consent state, visitor action, observed storage or request, evidence reference and next step.
Illustrative record — not a test result: Homepage · fresh logged-out mobile session · choose Reject · compare the consent state and optional requests against the intended setup · attach a dated screenshot and redacted request evidence · repeat after any fix.
Repeat independently for no choice, Accept and category choices. Test withdrawal after acceptance, then reload and navigate to confirm the saved preference. Mark anything you could not test as unknown.
For Google-specific findings, see the Google Consent Mode audit scope and deliverables.
Group your findings by what needs attention: banner choices, policy information or tracking behaviour. Include the page and visitor action that produced each observation. If you need a second view, a Cookie Banner Audit provides a practical route to prioritised findings.
- Your public website URL and the pages affected
- The consent plugin and tracking tools you know are in use
- Recent plugin, theme or tag changes
- The visitor choice and the behaviour that concerned you
- Which observations are confirmed by tests and which still need checking
WordPress Cookie Banner FAQs
Does WordPress have a built-in cookie banner?
WordPress itself does not automatically make every site’s cookie and tracking setup suitable for its particular use. Your plugins, theme, analytics tools, pixels, third-party embeds and banner configuration all need to be considered.
Can WordPress plugins bypass a cookie banner?
Yes. A plugin or theme can add a script independently of the consent tool. That is why actual browser and network behaviour should be tested rather than relying only on the banner settings.
Does Google Analytics need consent on WordPress in 2026?
Not every analytics implementation has the same answer. A limited statistical-purposes exception now exists, but it has conditions and does not automatically apply to every GA4 configuration, especially where advertising, profiling or wider tracking is involved.
Does Meta Pixel need checking on WordPress?
Yes. Meta Pixel is an advertising technology and should be reviewed against the marketing consent journey, including what happens before choice and after rejection.
Can Google Tag Manager create duplicate tracking?
Yes. GTM itself may be configured correctly while the same GA4 or advertising tag is also installed by a plugin or theme. Check every installation route.
How often should I retest a WordPress cookie banner?
Retest whenever you add or update a plugin, theme, tag, advertising integration, form, embed or ecommerce feature that could affect tracking. Periodic checks are also sensible because websites change over time.
What does the free CookieBanner Check plugin do?
It scans visible public homepage signals for consent controls, policy links and common tracking technologies. It is a practical diagnostic starting point rather than a legal compliance test.
Official Guidance and Platform Sources
Related WordPress and Cookie Banner Guides
Check Your WordPress Cookie Banner & Tracking Setup
Send your website URL, consent plugin if known and the issue you want help with. A free initial check considers public information and visible signals. For a paid review, discuss the scope, fee, timing and technical tests needed before commissioning work. Findings can help your developer or marketing team prioritise the next changes.
Practical website observations only. Not legal advice or formal compliance certification.