A consent management platform (CMP) is software that asks visitors for permission before your site sets non-essential cookies or runs tracking scripts. It then stores each answer, so you can prove later what each visitor agreed to.
Most sites that run analytics, ads, or embedded videos need one. GDPR, the ePrivacy Directive, the CCPA as amended by the CPRA, Brazil’s LGPD, and a growing list of other laws set rules for how that consent is asked for, recorded, and withdrawn.
Here’s the tl;dr:
- Consent management is the process: asking, recording, honoring, and updating consent.
- A CMP is the tool that runs that process on your site.
- A banner that only shows a message while tracking keeps running is not a CMP. It’s a notice.
What is consent management?
Consent management is how a business collects, stores, and respects people’s choices about their personal data. On a website, that mostly means cookies and tracking scripts.
Good consent management follows 4 principles:
- Explicit and informed consent. Visitors are told what data you collect and why, and they agree before you process it.
- Granular choice. Visitors pick which categories to allow (analytics, marketing, functional). “Accept all” is one option, not the only one.
- Easy withdrawal. A visitor can change or withdraw consent at any time, and it’s as easy as giving it.
- A usable interface. The banner and preference settings are readable, accessible, and work on mobile.
What GDPR asks for
GDPR is the strictest common benchmark, so most CMPs are built around it. Under GDPR (Article 4(11) and Article 7), valid consent must be:
- Freely given. You can’t block access to the site unless the visitor agrees.
- Specific. Separate consent for each purpose, such as analytics and marketing.
- Informed. The visitor knows what is collected, by whom, and why.
- Unambiguous. A clear, active choice. Pre-ticked boxes don’t count (the EU Court of Justice confirmed this in Planet49, 2019).
- Provable. You must be able to show that a visitor consented.
- Withdrawable. As easy to withdraw as to give.
The European Data Protection Board (EDPB) says the same thing in its consent guidelines (05/2020). Its 2023 cookie banner taskforce report adds practical detail: a banner must give a real choice, and pre-checked boxes and hidden reject options are not valid consent.
A cookie banner has 2 jobs: give a real choice, and keep proof of that choice.
What is a consent management platform (CMP)?
A CMP is the software that does consent management for you. On a website it usually:
- Shows a consent banner on the first visit
- Blocks cookies and scripts until the visitor makes a choice
- Saves the choice (and the date, time, and banner version) in a consent log
- Passes the choice to tools like Google Analytics, Google Ads, and ad vendors
- Lets the visitor reopen their settings and change their mind
Some CMPs are hosted services you add with a script tag. Others are WordPress plugins that run on your own site. Both types do the same core job. The difference is where the consent data is stored and how pricing works (per pageview, per domain, or per site).
If you’re comparing tools, our list of the best consent management platforms for WordPress puts 12 of them side by side.
Why use a consent management platform?
Manual consent handling breaks fast. A developer adds a new pixel, nobody updates the banner, and tracking runs before consent for months.
A CMP handles the repetitive parts:
- Compliance. It collects and stores consent the way GDPR, the ePrivacy Directive, CCPA/CPRA, and LGPD ask for.
- Proof. If a regulator or a visitor asks, you have a record to point to.
- Lower risk. Tracking runs only when the visitor agreed to it, which is the most common gap regulators find.
- Trust. Visitors see what you collect and can say no, which is what regulators and most visitors expect.
- Clean data. Your analytics and ad platforms get consent signals they can act on, instead of guessing.
Types of user consent
Not every law uses the same model. These are the terms you’ll see most:
| Type | What it means | Example | Where it applies |
|---|---|---|---|
| Explicit | The visitor takes a clear action to agree | Ticking a box to join a newsletter | GDPR uses “explicit consent” as one legal route for sensitive data, such as health data |
| Implied (implicit) | Consent is assumed from behavior | “By continuing to browse, you accept cookies” | Not valid for non-essential cookies under GDPR and the ePrivacy rules |
| Opt-in | Nothing runs until the visitor agrees | Analytics loads only after “Accept” | Default for non-essential cookies in the EU and UK |
| Opt-out | Tracking runs until the visitor says no | A “Do Not Sell or Share My Personal Information” link | CCPA/CPRA and most other US state laws |
| First-party | Consent given to the site the visitor is on | Signing up for a store’s own email list | All laws |
| Third-party | Consent that covers sharing data with outside companies | Sending visitor behavior to an ad network | GDPR requires you to disclose who receives the data and get consent before third-party tracking cookies |
For a deeper look at the first 2, read implied vs explicit cookie consent.
Types of consent banners
The banner is the part of a CMP visitors see. There are 5 common types.
| Banner type | How it works | Compliance |
|---|---|---|
| Notice-only | Says the site uses cookies. No way to decline or customize. | Not compliant where opt-in consent is required (EU, UK). It assumes consent without a clear action. |
| Opt-in | Non-essential cookies stay off until the visitor clicks Accept. | Meets the GDPR and ePrivacy model for non-essential cookies. |
| Opt-out | Tracking starts on page load. The visitor can turn it off later. | Common under CCPA/CPRA. Not enough for EU or UK visitors. |
| Granular | The visitor turns categories on or off (analytics, marketing, functional). | What EU regulators expect, because consent is specific. |
| Preference center | A settings panel with cookie and vendor details, where the visitor can change or withdraw consent at any time. | Supports ongoing compliance. Pair it with an opt-in or granular banner. |
Most sites that get visitors from several regions need more than one type. An opt-in banner for EU visitors and an opt-out banner for California visitors is a normal setup. That’s what geo-targeted cookie banners are for.
How does a consent management platform work?
Most CMPs follow the same 5 steps.
- Install. You add the CMP to your site. On WordPress that’s a plugin. On other platforms it’s usually a script tag in the page head.
- Scan. The CMP scans the site to find cookies and scripts, then sorts them into categories (necessary, functional, analytics, marketing).
- Ask. A first-time visitor sees the banner. It explains what the site collects and asks for a choice.
- Block or allow. Scripts in a category the visitor rejected stay blocked. Scripts in categories they accepted load.
- Record and update. The CMP stores the choice. The visitor can reopen the settings and change it at any time, and the CMP updates the record.
The sections below explain what happens in each step.
Cookie categories
The scan sorts each cookie and script into a category. The category decides whether it needs consent.
| Category | Examples | Needs consent in the EU? |
|---|---|---|
| Necessary | Login session, shopping cart, load balancer, the consent cookie itself | No |
| Functional (preferences) | Saved language, live chat widget | Usually yes |
| Analytics (statistics) | Google Analytics, Hotjar, Microsoft Clarity | Yes. The UK now exempts some analytics cookies, with conditions (see the region table below) |
| Marketing (advertising) | Meta Pixel, Google Ads, TikTok Pixel, LinkedIn Insight Tag | Yes |
Scanners match what they find against a database of known cookies. They often miss scripts that load only after login, on checkout pages, or through Google Tag Manager. Review the results by hand, and re-scan after you add a plugin or a tag.
How script blocking works in the browser
Most CMPs block a script by changing its type attribute, for example from text/javascript to text/plain. The browser doesn’t run scripts with an unknown type. When the visitor accepts that category, the CMP switches the type back and the script runs.
Embedded content (YouTube, Google Maps, Vimeo) works the same way. The CMP holds back the iframe and shows a placeholder with a button such as “Load video”. This is often called a content blocker.
On WordPress, scripts reach the page in several ways: theme files, plugins, page builders, and tag managers. A CMP can only block the scripts it can see. If a script is hard-coded in a theme file or loaded by a tag manager with no consent trigger, it can run before consent even with a CMP installed.
Cookie blocking vs script delay
There are 2 ways a CMP stops tracking before consent.
- Cookie blocking stops cookies from being written until the visitor clicks Accept. It keeps browser storage clean, but it acts on the result of tracking, not on the tracking code.
- Script delay (also called prior blocking) stops tracking code such as Google Analytics or the Meta Pixel from running at all until consent. Many tools set cookies or send data the moment their script loads, so this method is more reliable.
Use both. Delay the scripts, and block any cookies that still get through.
The order of consent signals
For Google tags and ad vendors, timing matters. A correct setup runs in this order on the first page load:
- The CMP loads first and sets default consent to “denied” for every non-essential purpose.
- Google tags load (in advanced Consent Mode) or wait (in basic Consent Mode).
- The visitor makes a choice.
- The CMP sends an “update” command with the new values, and writes the TC String if the site uses IAB TCF.
- On later pages, the CMP reads the stored choice and sends it before any tag fires.
If step 1 happens after the tags load, Google records the first page view without a consent state. This is the most common Consent Mode error.
The 3 parts behind the banner
- Preference storage. Each visitor’s choice is saved (usually in a first-party cookie on their browser) so the banner doesn’t reappear on every page, and so their settings are respected on return visits.
- Audit logs. A server-side record of when and how each visitor gave, changed, or withdrew consent. This is your proof under GDPR Article 7(1).
- Reporting. Accept and reject rates, consent by region, and exports you can hand to an auditor.
What a consent log entry looks like
A useful log entry answers: who (without naming them), when, what they saw, and what they chose.
| Field | Example |
|---|---|
| Consent ID (pseudonymous) | c7f2-91ab-44de |
| Date and time | 2026-11-03 10:42:17 UTC |
| Choices | Necessary: yes. Analytics: yes. Marketing: no |
| Banner version | v3 (text changed on 2026-10-01) |
| Region or law applied | GDPR (visitor from Germany) |
| How the choice was made | “Save preferences” in the settings panel |
| IP address | Truncated or hashed, for example 203.0.113.xxx |
Store no more personal data than you need. Also check where the log lives. If it’s on the CMP vendor’s servers, the vendor is your data processor, and your privacy policy should say so. See consent audit and logging best practices for retention periods and exports.
Withdrawal and preference management
GDPR Article 7(3) says withdrawing consent must be as easy as giving it. In practice:
- Put a “Cookie settings” link in the footer of every page, or a small floating icon, that reopens the preference center.
- When a visitor withdraws consent, the CMP should stop the blocked scripts from the next page load, send updated signals to Google and ad vendors, delete the cookies those scripts set where it can, and log the change as a new entry.
- Withdrawal stops future processing. It doesn’t make past processing unlawful, but data you collected under that consent may need to be deleted if the visitor asks.
When to ask again. No law sets one period. Ask again when you add a new purpose or vendor, or change the banner text in a way that matters. Many sites re-ask every 6 to 12 months. France’s data protection authority (CNIL) recommends keeping a refusal for about 6 months before asking again, so visitors don’t see the banner on every visit.
How consent rules differ by region
The law that applies depends mostly on where your visitors are, not where your business is.
| Region | Main laws | Model for non-essential cookies | What your CMP needs to do |
|---|---|---|---|
| EU and EEA | GDPR, ePrivacy Directive | Opt-in | Block before consent, granular choices, Reject as easy as Accept, consent logs |
| UK | UK GDPR, PECR, Data (Use and Access) Act 2025 | Opt-in, with exemptions since 5 February 2026 | Cookies used only for statistics to improve the site, or only for appearance and functionality, can run without consent if visitors get clear information and a free, simple way to object. Advertising cookies still need consent |
| California | CCPA as amended by the CPRA | Opt-out | “Do Not Sell or Share My Personal Information” link, honor GPC, “Limit the Use of My Sensitive Personal Information” link where it applies |
| Other US states | Virginia, Colorado, Connecticut, Texas, Oregon, and others | Mostly opt-out. Opt-in for sensitive data in several states | Opt-out controls, honor universal opt-out signals where required |
| Brazil | LGPD | Opt-in is the safe default | Specific, freely given consent with easy withdrawal |
| Canada | PIPEDA, Quebec Law 25 | Meaningful consent. Quebec requires tracking that identifies, locates, or profiles people to be off by default | Opt-in banner for Quebec visitors |
| Thailand | PDPA | Consent where no other legal basis applies | Opt-in for non-essential cookies |
| India | DPDP Act 2023, DPDP Rules 2025 | Consent with a clear notice | Consent manager rules apply from 14 November 2026. Notice and consent rules apply from 14 May 2027 |
A CMP with geolocation can apply the right column to each visitor. Without it, the safest choice is to apply the strictest rule (opt-in) to everyone.
What to look for when choosing a consent management platform
These 11 factors decide whether a CMP fits your site.
1. Geolocation settings
Laws depend on where the visitor is, not only where your business is. A good CMP detects the visitor’s region and shows the right banner: opt-in for the EU, opt-out for California, and so on.
2. Banner customization
The banner should match your site: colors, fonts, button text, position, and language. Check that you can do this without code, and that custom CSS is available when you need it. Also check that the Reject button can be the same size and color as Accept.
3. Consent behavior and setup
Check how the CMP connects to your site and your tags. Can it block scripts before consent? Does it work with your page builder and caching plugin? Can it track consent per page view and per event?
4. Global Privacy Control (GPC) support
GPC is a browser signal that tells sites “don’t sell or share my data”. California’s CCPA regulations require businesses to treat it as a valid opt-out request, and Colorado has required businesses to honor universal opt-out signals since July 2024. Your CMP should detect GPC and apply it automatically. More on this in our guide to Global Privacy Control (GPC).
5. Google Consent Mode v2 support
Google Consent Mode passes each visitor’s choice to Google tags (Analytics, Ads, Tag Manager), and the tags change how they behave.
Consent Mode v2 uses 4 main parameters:
| Parameter | What it controls |
|---|---|
ad_storage | Cookies used for advertising |
analytics_storage | Cookies used for analytics, such as visit duration |
ad_user_data | Whether user data can be sent to Google for advertising |
ad_personalization | Whether ads can be personalized (remarketing) |
v2 added ad_user_data and ad_personalization. Since March 2024, Google has required these signals for advertisers who want ad personalization and remarketing for users in the EEA and the UK.
There are 2 ways to run it:
- Basic: Google tags don’t load until the visitor makes a choice. If they decline, nothing is sent to Google.
- Advanced: Google tags load with consent set to “denied”. If the visitor declines, the tags send cookieless pings that Google uses for conversion modeling. If they accept, full measurement starts.
Advanced gives better modeled data. Basic sends less data before consent. Pick the one your legal review is comfortable with.
Check that your CMP sends the signals on the first page load, not after a delay. For setup and testing on WordPress, see Google Consent Mode for WordPress and Google Ads cookies.
6. Cross-device and cross-site consent
If you run several sites, or your visitors log in on several devices, check whether the CMP can share consent across them. Also check how it does this. Sharing consent across sites is itself data processing.
7. Vendor support and resources
Look at the docs, setup guides, and support response times. For agencies and large sites, look for bulk settings, export and import, and an API.
8. Compliance with privacy laws
The CMP should cover every law that applies to your visitors, and the vendor should update it when laws change. The main laws today:
- GDPR (EU and EEA). In force since May 2018. Opt-in consent for non-essential cookies (with the ePrivacy Directive). Fines up to €20 million or 4% of global annual turnover, whichever is higher. See GDPR compliance.
- ePrivacy Directive (EU). The “cookie law”. Article 5(3) requires consent before storing or reading non-essential cookies on a device. See ePrivacy Directive compliance.
- UK GDPR and PECR (UK). Close to the EU model. Since 5 February 2026, the Data (Use and Access) Act 2025 lets some analytics and functionality cookies run without consent, if visitors get clear information and an easy way to object. See UK GDPR compliance.
- CCPA as amended by the CPRA (California). Applies to for-profit businesses that meet its thresholds and handle California residents’ data, wherever the business is based. Opt-out model: sites need a “Do Not Sell or Share My Personal Information” link and must honor GPC. The CPRA took effect on 1 January 2023 and created the California Privacy Protection Agency. Fines are up to $2,663 per violation and $7,988 per intentional violation (2025 amounts, adjusted every 2 years). See CCPA compliance and our CCPA guide.
- Other US state laws. Virginia, Colorado, Connecticut, Texas, and more, mostly on an opt-out model. See the guide to US state privacy laws.
- LGPD (Brazil). In force since September 2020. It has 10 legal bases for processing (consent is one) and gives people 9 rights. Companies must appoint a Data Protection Officer and carry out a Data Protection Impact Assessment if the ANPD (Brazil’s data protection authority) asks for one. See LGPD compliance.
- PIPEDA (Canada). Federal law since 2000 for private-sector businesses. Consent-based, with limits on how data is used. Bill C-27, which would have replaced it, died in January 2025, so PIPEDA still applies. See our PIPEDA guide.
- PDPA (Thailand). Passed in 2019. Full enforcement began on 1 June 2022. Consent is required for most processing that has no other legal basis.
- DPDP Act (India). Passed in August 2023. The DPDP Rules were notified in November 2025, with a phased start: the Data Protection Board first, rules for registered “consent managers” after 12 months, and most other duties after 18 months. Penalties go up to ₹250 crore per breach.
For the full list by country, see data privacy laws around the world.
9. IAB TCF v2.4 support
If you sell ad space through programmatic ad networks, you need a CMP that supports the IAB Europe Transparency and Consent Framework (TCF).
Here’s how it works. The visitor makes choices in the banner. The CMP turns those choices into a TC String, a standard coded record of which purposes and which vendors the visitor allowed. Ad tech vendors read the string and only process data they have permission for.
The current version is TCF v2.4. IAB Europe published it on 23 July 2026, and CMPs had to add its new disclosures on websites by 23 October 2026 (apps and connected TV follow by 23 February 2027). v2.4 adds standard plain-language text and illustrations for each TCF Feature, so visitors can see what each one does, and renames Special Feature 2.
It builds on v2.3 (2025), which made the disclosedVendors segment required in every TC String, so each vendor can confirm it was actually shown to the visitor. A CMP still on v2.2 or v2.3 is out of date.
Also check vendor list management (the Global Vendor List updates often) and how the CMP handles legitimate interest.
10. Automatic scanning and cookie detection
Sites change. Plugins add cookies, and marketing teams add pixels. A CMP should scan on a schedule, find new cookies and scripts, sort them into categories, and flag anything new for review.
11. Data security
Consent logs are personal data too. Check where they are stored, who can access them, and whether the vendor uses encryption, access controls, and audit trails. Standards such as ISO 27001 are a good sign.
How to choose: a quick checklist
| Question | Why it matters |
|---|---|
| Does it block scripts before consent, or only show a notice? | A notice alone doesn’t meet opt-in laws |
| Where are consent logs stored? | Your own database vs a vendor’s server affects who controls the proof |
| Which laws does it cover, and is region detection included? | One banner for all visitors is either too strict or not strict enough |
| Is Google Consent Mode v2 included or paid? | You need it for Google Ads personalization in the EEA and UK |
| Is IAB TCF v2.4 supported? | Required if you run programmatic ads |
| How is it priced? | Pageview-based pricing climbs as traffic grows |
5 consent management platforms compared
We compared 5 CMPs that work on WordPress: 2 hosted, cross-platform CMPs (CookieYes and Cookiebot), 2 WordPress-native plugins (Complianz and Real Cookie Banner), and our own plugin (WP Cookie Consent).
How we compared them: features, free-plan limits, and prices come from each vendor’s pricing page and WordPress.org listing, checked on 3 November 2026. Install counts and ratings come from WordPress.org on the same day. Feature claims are as each vendor states them. Prices change often, so check the vendor’s page before you buy.
Feature comparison
| WP Cookie Consent | CookieYes | Cookiebot | Complianz | Real Cookie Banner | |
|---|---|---|---|---|---|
| Platforms | WordPress | WordPress, Shopify, Wix, Squarespace, Webflow, any site | WordPress, Shopify, Wix, any site | WordPress, Shopify | WordPress |
| WordPress.org installs | 9,000+ | 1M+ | 100,000+ | 1M+ | 100,000+ |
| WordPress.org rating | 4.6/5 (about 50 reviews) | 4.8/5 (3,236) | 4.4/5 (440) | 4.7/5 (about 1,650) | 4.9/5 (492) |
| Free plan limits | 1 site, 20,000 banner pageviews/month, 5 scans/month | 5,000 pageviews/month, 100 pages/scan | 1 domain, 50 subpages | Free plugin | Free plugin |
| Script blocking on free plan | Yes | Yes | Yes | Yes | Yes |
| Consent Mode v2 on free plan | Yes | Yes | Yes | Listed under Premium | No (PRO only) |
| IAB TCF | Paid plans (v2.4) | Pro and up (v2.4) | Premium plans (v2.4) | Premium (version not stated) | PRO (version not stated) |
| Geo-targeting | Paid plans | Pro and up | Premium plans | Premium | PRO |
| Where consent logs are stored | Your WordPress database, synced to the WPLP web app | CookieYes cloud (EU data centers) | Cookiebot servers, up to 12 months | Your WordPress database | Your WordPress database |
| Account needed | No | Optional (needed for scanning) | Yes | No | No |
| Legal pages | Separate free plugin (WPLP Legal Pages). 30+ templates on paid plans | Cookie and privacy policy generator | No | Cookie policy (free). Privacy statement, Impressum, disclaimer and more (Premium) | Auto-generated cookie policy page |
| Pricing model | Per site count, monthly or yearly | Per domain, by pageviews | Per domain, by subpages | Per site count, yearly only | Per site count, yearly only |
Yearly cost by number of sites
The cheapest plan that covers the site count and includes IAB TCF and geo-targeting.
| Sites | WP Cookie Consent | CookieYes Pro | Cookiebot Premium Small | Complianz | Real Cookie Banner |
|---|---|---|---|---|---|
| 1 | $48 | about $250 | €180 | $59 | €59 |
| 10 | $72 | about $2,500 | €1,800 | $399 (25-site plan) | €229 |
| 25 | $168 | about $6,250 | €4,500 | $399 | €299 |
Notes:
- CookieYes lists monthly prices and says yearly billing gives “2 months free”. The yearly figures above are 10 x the monthly price.
- Cookiebot prices depend on subpages per domain. Premium Small covers up to 350 subpages. Prices were shown in euros, excluding VAT.
- Real Cookie Banner prices include VAT.
- WP Cookie Consent monthly billing costs about 2 x the yearly price.
WP Cookie Consent
A free WordPress plugin from WPLP Compliance Platform (our product). Consent logs stay in your WordPress database and sync to the WPLP web app.
- Strengths:Â Consent Mode v2, GPC, script blocking, consent logs, A/B testing, and 5 scans a month on the free plan. Flat pricing by site count, monthly or yearly.
- Limitations:Â the smallest install base and review count of the 5. WordPress only. IAB TCF and geo-targeting need a paid plan. The free plan stops at 1 site and 20,000 banner pageviews a month. No cross-domain consent sharing. Policy pages come from a separate plugin.
- Price:Â free for 1 site. $8/month or $48/year (3 sites), $12/month or $72/year (10 sites), $28 to $98/month for 25 to 100 sites.
CookieYes
A hosted CMP that works on WordPress and most site builders.
- Strengths:Â large install base and review count. Consent Mode v2 on every plan. Built-in cookie and privacy policy generator. One tool across several platforms.
- Limitations:Â priced per domain with pageview caps ($0.30 per 1,000 pageviews over the cap on Basic and Pro). Free plan stops at 5,000 pageviews. Consent logs are stored in the CookieYes cloud. Geo-targeting and TCF start on Pro.
- Price:Â free, then $10, $25, or $55 per domain per month.
Cookiebot (Usercentrics)
A hosted CMP. The WordPress plugin connects your site to a Cookiebot account.
- Strengths:Â cross-domain consent sharing, 47+ languages, and an enterprise product (Usercentrics Advanced) for large companies.
- Limitations:Â needs an account, and consent records are kept on Cookiebot’s servers for up to 12 months. Priced per domain by subpage count. The free plan covers 50 subpages on 1 domain, with no geotargeting or custom design.
- Price: free, then €7/month (Lite, 1 domain, 50 subpages) up to €90/month per domain (XL, 7,000+ subpages).
Complianz
A WordPress privacy plugin that combines a cookie banner with legal document generation.
- Strengths:Â 1M+ installs. Every paid plan has the same features, including TCF, geo-IP consent, and legal documents. Unlimited pageviews and consent records on paid plans.
- Limitations:Â yearly billing only. Plans jump from 5 sites to 25. Complianz’s own docs say caching plugins that minify or combine JavaScript can break script blocking.
- Price:Â $59/year (1 site), $179 (5), $399 (25). 30-day money-back guarantee.
Real Cookie Banner
A WordPress-only plugin from devowl.io, a German company. All consent data stays in your WordPress database.
- Strengths:Â highest rating of the 5 (4.9/5). Large template library (160+ services, 130+ content blockers) on PRO. Staging sites included at no extra cost.
- Limitations:Â Google Consent Mode and TCF are PRO only. Yearly billing only, and the vendor states there is no right of withdrawal for digital goods. No privacy policy or terms generator.
- Price: €59/year (1 site) to €299/year (25 sites).
Which CMP fits your site?
| Your situation | What matters most | Good fits |
|---|---|---|
| One blog or small business site, no ads | A free plan that blocks scripts and logs consent | WP Cookie Consent, Real Cookie Banner, Complianz (free versions) |
| WooCommerce store using Meta Pixel and Google Ads | Script blocking for pixels, Consent Mode v2, consent logs | WP Cookie Consent, CookieYes, Complianz Premium, Real Cookie Banner PRO |
| AdSense or programmatic ads with EEA or UK visitors | Google-certified CMP with TCF v2.4 | Any of the 5 on a paid plan. Confirm the TCF version first |
| Agency with 10 to 100 WordPress sites | Pricing by site count, settings you can copy between sites | WP Cookie Consent, Complianz Agency, Real Cookie Banner Agency |
| Sites on WordPress plus Shopify, Wix, or custom code | One CMP across platforms | CookieYes, Cookiebot |
| Large company needing SSO, many domains, and a contract | Enterprise support | Cookiebot (Usercentrics Advanced), or an enterprise CMP |
For 12 tools side by side, see our list of the best consent management platforms for WordPress.
Consent management challenges (and how to handle them)
1. Different laws in different places. GDPR is opt-in. CCPA is opt-out. A global site needs region-specific banners. Fix: use a CMP with geolocation and per-region banner rules.
2. User experience vs compliance. Too many pop-ups annoy visitors (consent fatigue is real). Too little information creates legal risk. Fix: one clear first layer with Accept, Reject, and Settings. Details go in the preference center.
3. Third-party tracking. Ad networks, embeds, and analytics tools all set cookies, and each one needs consent. Fix: scan regularly and block every third-party script by default until consent.
4. Keeping consent records. GDPR asks you to prove consent. Spreadsheets and screenshots don’t scale. Fix: automatic consent logs with a timestamp, the choice, and the banner version.
5. Handling withdrawal. When a visitor withdraws consent, tracking has to stop, and you may need to delete data you collected. Fix: a “Cookie settings” link in the footer on every page, and a process for data requests.
6. Changing rules and tech. New state laws keep arriving, TCF moved to v2.3 and then v2.4 within about a year, and Google changed its third-party cookie plans more than once. In 2024 Google dropped its plan to remove third-party cookies from Chrome, and in October 2025 it retired most Privacy Sandbox APIs. Third-party cookies still work in Chrome, and they still need consent. (More in Google’s cookieless future.) Fix: pick a CMP vendor that ships updates, and audit your setup at least twice a year.
7 consent management best practices
- Use plain language. Say what you collect and why in short sentences. Skip the legalese.
- Opt in for non-essential cookies. Analytics and marketing cookies load only after the visitor agrees (for EU, UK, and other opt-in regions).
- Give granular controls. Let visitors accept analytics but reject marketing.
- Log and store every decision. Keep a secure record for audits.
- Make updates easy. A visible link lets visitors change or withdraw consent at any time.
- Audit cookies and scripts. Re-scan regularly and check that what runs on the site matches your consent settings and your cookie policy.
- Cover every region you serve. GDPR, CCPA/CPRA, LGPD, and any other law your visitors fall under.
For the banner design side of this, see cookie consent best practices.
How WP Cookie Consent handles consent management on WordPress
Need a CMP for a WordPress site, without a bill that grows with your traffic?
WP Cookie Consent is a WordPress plugin that runs inside your site. What it does:
- Blocks scripts and embeds until consent. The banner holds tracking back until the visitor agrees.
- Logs every decision in your own WordPress database. Records also sync to the WPLP web app. They aren’t stored with a third-party CMP vendor.
- Scans for cookies. The cookie scanner finds and sorts cookies and scripts. The Free plan includes 5 automated scans a month, up to 100 pages each.
- Supports Google Consent Mode v2, GPC, and Do Not Track on every plan, Free included.
- Lets visitors revoke consent and can re-ask for consent on a schedule.
- Covers GDPR, CCPA, LGPD, and COPPA on the Free plan.
Paid plans add IAB TCF v2.4, more laws (ePrivacy, UK GDPR, PIPEDA, Saudi PDPL, Australia’s APP), auto-detect law by visitor location, banner geo-targeting, and more sites and scans. Paid plans start at $8/month or $48/year for 3 sites. See pricing.
The Free plan covers 1 site and up to 20,000 banner pageviews a month.
Limitations:
- Fewer installs and reviews than the other 4 tools above.
- WordPress only.
- IAB TCF and geo-targeting need a paid plan.
- No cross-domain consent sharing.
When another tool fits better:
- Your sites run on Shopify, Wix, or custom code as well as WordPress: CookieYes or Cookiebot.
- You need cross-domain consent across several of your own domains: Cookiebot, or Complianz Agency.
- You want the banner and legal documents in one plugin: Complianz.
One plugin won’t make a site compliant on its own. Pair the banner with an accurate cookie policy (the GDPR cookie policy generator helps) and get legal advice for anything unusual.
FAQs
What is the difference between consent management and a consent management platform?
Consent management is the process of asking for, recording, and honoring people’s choices about their data. A consent management platform (CMP) is the software that runs that process on your website.
Do small businesses need a CMP?
Yes, if the site uses analytics, ads, embedded videos, or any other non-essential cookies. Your visitors’ location decides which laws apply, not your company’s size. A small store in Texas with visitors from Germany still needs GDPR-style consent for those visitors. Some laws, such as the CCPA, have size thresholds. GDPR and the ePrivacy Directive do not.
Is a cookie banner the same as a CMP?
No. A banner is the visible part. A CMP also blocks scripts before consent, stores proof, passes signals to Google and ad vendors, and lets visitors change their choice. A banner that only shows a message does none of that.
Are there different types of cookie consent managers?
Yes. They range from simple banner plugins that show a notice and an Accept button, to WordPress consent plugins that block scripts and log consent on your own site, to hosted CMPs that you add with a script tag and that usually charge by pageviews or domains. Large publishers often use enterprise CMPs with IAB TCF vendor management. Pick the type that matches your laws, your traffic, and where you want consent records stored.
How often should I ask visitors for consent again?
No law sets one period. Ask again when you add a new purpose or vendor. Many sites re-ask every 6 to 12 months, and France’s CNIL recommends keeping a refusal for about 6 months.
