An online store sets more cookies than a blog. WooCommerce needs cookies to keep the cart working. Your analytics, ad pixels, and order tracking add more on top.
Some of these need the visitor’s consent before they load. Others don’t, and if you block them, your checkout breaks.
This guide shows which cookies a WooCommerce store sets, which ones need consent, and how to add a cookie banner to your WordPress store, then test it.
What is a cookie consent banner?
A cookie consent banner is a bar or popup that tells visitors which cookies your site uses and asks for their choice.
A working banner also blocks non-essential scripts until the visitor agrees. A banner that shows a message while tracking keeps running doesn’t do that job.
Cookies your WooCommerce store sets
WooCommerce core cookies
WooCommerce sets these cookies on the front end of your store. The details come from the WooCommerce cookies documentation, which says none of them stores personal information.
| Cookie | What it does | How long it lasts | Needs consent in the EU and UK? |
|---|---|---|---|
woocommerce_cart_hash | Tracks when the cart changes | Session | No. Strictly necessary for the cart. |
woocommerce_items_in_cart | Tracks when the cart changes | Session | No. Strictly necessary for the cart. |
wp_woocommerce_session_ | Links the visitor to their cart data | 2 days | No. Strictly necessary for the cart and checkout. |
woocommerce_recently_viewed | Powers the “Recently Viewed Products” widget | Session | Usually treated as functional. Check with your reviewer. |
store_notice[notice id] | Remembers that the visitor closed the store notice | Session | Usually treated as functional. Check with your reviewer. |
Strictly necessary vs functional
A strictly necessary cookie is one the store can’t work without, such as the cart. A functional cookie makes the site easier to use, such as a recently viewed list, but the store still works without it.
In the EU, only strictly necessary cookies are clearly exempt from consent. A shopping cart is the standard example. See the EU’s Your Europe guide to online privacy.
The same cookie can fall into either group depending on how your store uses it. Classify each cookie by what it does on your site, not by its name.
Order attribution cookies
WooCommerce’s order attribution feature records which channel, such as an ad, a search, or a newsletter, led to each order. It sets sbjs_* cookies, such as sbjs_session (30 minutes) and sbjs_first (session). One of them, sbjs_udata, stores details about the visitor’s device and browser (the user agent). See WooCommerce’s order attribution documentation.
Your store doesn’t need these cookies to work. Treat them as analytics or marketing cookies. If you don’t use the data, turn the feature off in WooCommerce > Settings > Advanced > Features.
Cookies from other tools
Most stores add these on top of WooCommerce:
| Source | Example cookies | Needs consent in the EU and UK? |
|---|---|---|
| Google Analytics | _ga, _ga_* | Yes. The UK’s analytics exception is narrow, and a standard Google Analytics setup may not meet its conditions (see the UK row below). |
| Meta Pixel | _fbp, _fbc | Yes |
| Google Ads | _gcl_au | Yes |
| Payment gateways (Stripe, PayPal) | Set by the provider | Fraud-prevention cookies set during checkout are often treated as strictly necessary. If the gateway’s script loads on every page, not just checkout, those cookies are harder to justify. Check with your reviewer. |
Themes and other plugins often add cookies you don’t know about. Run a cookie scan to see what your store actually sets.
Do you need a cookie banner for your eCommerce website?
It depends on where your customers are and which scripts you run.
You sell to the EU or UK and use analytics or ad pixels. Yes. Those scripts need consent before they load.
You sell in the US. Several US state laws require covered businesses to let visitors opt out of the sale or sharing of their data, including for targeted ads. In practice, that means 3 things:
- A “Do Not Sell or Share My Personal Information” link in your footer or banner.
- Treating a Global Privacy Control signal as an opt-out, without the visitor clicking anything.
- Stopping ad pixels for visitors who opt out. Opt-out is the US default, so these scripts can run until then.
You only use WooCommerce’s cart and session cookies. You may not need consent for those. You still need to list them in your cookie policy.
If you sell to several regions, a geo-targeted cookie banner shows each visitor the banner that fits their region.
Laws affecting cookie banners
This is a summary, not legal advice.
| Region | What the law asks for |
|---|---|
| EU: ePrivacy Directive and GDPR | The ePrivacy Directive requires consent before you store or read non-essential cookies on a visitor’s device. The GDPR sets the standard for that consent: freely given, specific, informed, and clear. |
| UK: PECR and UK GDPR | Similar to the EU. The Data (Use and Access) Act 2025 added a narrow exception for analytics. It applies only when you collect information to produce aggregate statistics that help you improve your site, give visitors clear information, and give them an easy way to object. It doesn’t cover tracking individual visitors or advertising. See the ICO’s guidance on the exceptions. |
| California: CCPA | Covered businesses must let visitors opt out of the “sale” or “sharing” of their personal information, which includes cross-context ad targeting. They must also honor Global Privacy Control signals. The law applies only to businesses that meet its thresholds. See the California Attorney General’s CCPA page. |
| Brazil: LGPD | Each use of personal data needs a legal basis, and consent is one of them. Brazil’s data protection authority (ANPD) recommends turning off consent-based cookies by default and showing a clear “Reject” option. |
| Canada: PIPEDA | You need meaningful consent. For ad tracking, opt-out consent can be acceptable if you explain it clearly and the data isn’t sensitive. Quebec has stricter rules for profiling. |
Cookie banner best practices for eCommerce
1. Say what you use and why
Tell visitors in plain words what each type of cookie does. For example: “Analytics: helps us see which products people view.” Say what happens if they accept or reject.
2. Offer choices by category
Let visitors accept or reject each category, such as analytics and marketing, on its own. Strictly necessary cookies, such as the cart, stay on and don’t need a toggle.
3. Make “Reject” as easy as “Accept”
In the EU, withdrawing consent must be as easy as giving it. Regulators have acted against banners that hide “Reject” in a second layer or use pre-ticked boxes. Don’t lock the whole store until the visitor chooses.
4. Link a detailed cookie policy
The banner is a short notice. Your cookie policy gives the detail: each cookie, its purpose, how long it lasts, and who sets it. Link it from the banner.
Your privacy policy covers the rest of the personal data your store collects, such as names and delivery addresses.
5. Design for phones
Many shoppers browse on their phones. Keep the text short, make the buttons big enough to tap, and don’t cover the “Add to cart” button.
6. Review consent and cookies regularly
Ask returning visitors again after a set period, and whenever you add a new type of tracking. Scan your store again after you install a new plugin or marketing tool.
7. Keep consent records
Under the GDPR, you must be able to show that a visitor consented (GDPR Article 7(1)). Keep a record of each choice and when it was made. See consent logging best practices.
How to add a cookie banner to your WooCommerce store
This guide uses WPLP Cookie Consent, a free WordPress plugin. On the free plan, it blocks scripts until the visitor consents, logs each choice in your WordPress database, and supports Google Consent Mode v2 for Google Analytics and Google Ads.
Paid plans add geo-targeting, auto-detect law, IAB TCF, and more scans. See pricing.
Step 1: Install the plugin
- Search for WPLP Cookie Consent and click Install Now, then Activate.
Step 2: Create your cookie banner
- Go to WP Cookie Consent > Create Cookie Banner.
- Select your applicable privacy law and complete the setup.
Step 3: Test your store
- Run a cookie scan and verify that cookies are correctly categorized. Cart and session cookies should be marked Necessary.
- Reject cookies and test the cart and checkout process.
- Check the Network tab in your browser’s developer tools to ensure tracking pixels don’t load before consent.
- Accept all cookies and verify that analytics and tracking pixels load correctly.
Troubleshooting
| Problem | Likely cause | Fix |
|---|---|---|
| The cart empties after a visitor rejects cookies | Cart or session cookies are in a blocked category | Move them to “Necessary” and scan again |
| A pixel still fires before consent | The script is hard-coded in your theme or added by another plugin, so the banner doesn’t control it | Find it in the scan results and give it a category, or add it through the plugin instead |
| The banner doesn’t show, or shows again after a choice | A caching plugin is serving an old version of the page | Clear the cache, and exclude the consent cookie from caching |
| Analytics numbers drop after launch | Visitors who reject aren’t counted | This is expected. Google Consent Mode v2 can model some of the missing data in Google tools |
A cookie banner is one part of store privacy. For the rest, see privacy compliance for WooCommerce stores.
FAQ
Do I need a cookie banner for an eCommerce website?
If you sell to the EU or UK and run analytics or ad pixels, yes. If you’re a covered business under a US state law, you need a way for visitors to opt out of data sales and targeted ads, and a banner is a common way to offer it.
Do WooCommerce cart cookies need consent?
Not in the EU and UK. Cookies that keep the cart and checkout working are strictly necessary, so they don’t need consent. List them in your cookie policy.
Will a cookie banner break my checkout?
Not if your cart and session cookies are set as “Necessary”. Checkout breaks when those cookies get blocked along with marketing cookies. Test a checkout with all cookies rejected before you go live.
How do I add a cookie banner to my store for free?
Install a free plugin such as WPLP Cookie Consent, create a banner, and set your cookie categories. The free plan covers one site, with script blocking, consent logs, and Google Consent Mode v2.
Do I need to block the Meta Pixel and Google Ads tags?
For EU and UK visitors, yes, until they consent to marketing cookies. For Google tags, Google Consent Mode v2 tells Google whether the visitor agreed.
Conclusion
A WooCommerce store needs its cart cookies to work and its marketing scripts to wait. A good cookie banner does both.
Check which cookies your store sets, put each one in the right category, and test a checkout with every cookie rejected. Then link your cookie policy and keep your consent records.
