Best cookie plugin for WordPress: six consent plugins checked
For a WordPress site with EU or UK visitors, analytics or embeds to hold back, and no privacy staff. Six cookie consent plugins from the WordPress plugin directory, measured on what you get once you click Install: whether the plugin blocks scripts before consent, scans the site, keeps a consent record, runs without an outside account, passes Google Consent Mode v2 and talks to the WP Consent API. Every cell comes from each plugin’s own WordPress.org page or the vendor’s own site. read 2026-11-01
Best for keeping consent records on your own server
Real Cookie Banner
Its free version meets 4 of the 6 rows and documents each consent in your WordPress database, with nothing loaded from a cloud.
Best free plan with Google Consent Mode v2
CookieYes
Its free plan meets 5 of the 6 rows, Consent Mode v2 and the consent log included, for sites under 5,000 pageviews a month.
Best for a small site with a few known scripts
GDPR Cookie Compliance
A free plugin that keeps its data on your site and passes Consent Mode v2; you list the scripts it holds back.
Best cookie consent plugins for WordPress: the checks, plugin by plugin
Each row is something the cookie rule or the GDPR asks of the tool that runs your banner, with the article it comes from, plus the Google and WordPress links that decide whether the choice reaches the rest of your site. “paid plan” marks a feature the free version does not include. For hosted banners that are not WordPress plugins, see our consent management platforms comparison.
| Requirement | CookieYes | Complianz | Cookiebot | GDPR Cookie Compliance | Real Cookie Banner | Termly |
|---|---|---|---|---|---|---|
| Holds back non-essential scripts until the visitor opts inePrivacy Art. 5(3) | yesauto-blocking, free | yesscript center, free | yesautomatic or manual: its pages differ | partialonly scripts you add to it | yescontent blockers | yesAuto Blocker, once enabled |
| Scans the site for what sets cookiesthe “clear and comprehensive information” of Art. 5(3) | yes100 pages a scan, free | yesfree; deeper scan paid | yesone initial scan, free | not statedyou list each script | yesfinds services, not cookies | yesquarterly on the free plan |
| Keeps a record of each visitor’s consentGDPR Art. 7(1) | yesin its cloud, CSV export | paid planRecords of Consent | yeskept up to 12 months | paid planin your database | yesin your database | paid planPro+ plan |
| Runs inside WordPress with no outside accountno outside processor (GDPR Art. 28(3)) | partialscans and log in its cloud | yesself-hosted | noneeds a Cookiebot account | yesdata stays on your site | yesconsents on your server | noneeds a Termly account |
| Passes the choice to Google tags (Consent Mode v2)ad_user_data, ad_personalization | yesAdvanced and Basic, free | paid plana premium setting | yeson the free plan | yesin the free plugin | paid planPRO version | paid planPro+ plan |
| Tells other plugins the choice (WP Consent API)cookies set by other plugins (Art. 5(3)) | yes | yes | yes | yessince version 4.14.0 | not statedhas its own consent API | not stated |
Source: WordPress.org plugin pages, vendor sites and plan pages, read 2026-11-01. “not stated” means the vendor’s own documentation does not say. | ||||||
Plugin or cloud: where the cookie plugin does its work
Six plugins carry the same label on WordPress.org, but they are two kinds of software. Complianz, GDPR Cookie Compliance and Real Cookie Banner run inside WordPress: the banner, the blocking and any consent record live on your server and in your database. Cookiebot and Termly are connectors: the plugin places a hosted banner on your site, and the scans, settings and records sit in an account with the vendor. CookieYes is in between. Its banner works on activation, while scanning and the consent log run in the CookieYes cloud.
The difference decides who holds the consent records. A vendor that stores them for you processes personal data on your behalf, so the GDPR asks for a processor contract with set terms (Art. 28(3)). CookieYes says its consent data is stored in EU-based data centres under a data processing agreement; Cookiebot logs an anonymised identifier, the choice, the page address, an IP-based country and a timestamp. Complianz says that because it runs on your server, the plugin itself needs no extra agreement. Check any cloud plugin’s terms against the clauses our data processing agreement template lists.
A local plugin moves the job, it does not remove it
When the record stays in WordPress, your web host holds it and the retention period is yours to set. GDPR Cookie Compliance’s premium consent log, for one, stores the consent date, the visitor’s IP address, the cookies accepted and, for logged-in users, their email address. Decide how long you keep those rows before the table grows for years. Complianz also sends the results of its site scan (cookie names, the domain and the plugin list) to cookiedatabase.org, its own cookie database, to fetch descriptions for your cookie policy.
The WP Consent API is a separate free plugin that passes the visitor’s choice between plugins. Its own page says it “will not handle consent”: it needs a cookie banner plugin plus at least one other plugin that reads it. What it adds is reach. A banner can block a third-party script, but not a cookie that another plugin sets from PHP on your server; a plugin that reads the API can hold that cookie back itself. CookieYes, Complianz and Cookiebot say they support it, and GDPR Cookie Compliance added support in its version 4.14.0.
AdSense and Ad Manager need a Google-certified consent platform that supports the IAB Transparency and Consent Framework before they serve personalised ads in the EEA, the UK and Switzerland. CookieYes, Complianz, Real Cookie Banner and Termly put that framework on their paid plans. Check the plugin’s vendor against Google’s list on our Google-certified CMPs page before you pick one for an ad-funded blog.
The best free cookie plugin for WordPress: where each free version stops
All six install free from WordPress.org, and each draws its free line in a different place. Some cap traffic or pages, some keep the consent log or Consent Mode for paying customers, and one states no limit but names no scanner either. Match the limit to your site: a blog with heavy traffic and few pages fits a page cap, and a shop with modest traffic and a large catalogue fits a traffic cap.
| Plugin | Free version limit | Kept for paid plans |
|---|---|---|
| CookieYes | 5,000 pageviews a month; 100 pages a scan | Geo-targeting, Global Privacy Control, the IAB framework, scheduled scans |
| Complianz | One site; no pageview or session limit | Consent Mode v2, records of consent, banners per region, the IAB framework |
| Cookiebot | One domain, up to 50 subpages; no traffic limit | More subpages or domains, geotargeting, banner branding |
| GDPR Cookie Compliance | None stated | Consent log, geo-location, iframe blocker, cookie declaration |
| Real Cookie Banner | Unlimited services and content blockers | Google Consent Mode, the IAB framework, geo-restriction, most service templates |
| Termly | 10,000 a month; past that the banner switches off until the next month | Consent Mode v2, consent logs, regional consent rules, the IAB framework |
Source: each vendor’s plugin page and plan page, read 2026-11-01. Termly’s plugin page counts the 10,000 in unique visitors, its plan page in banner views. No prices are shown on this site. | ||
What each plugin’s WordPress.org page shows
The directory page is the quickest health check before you install: how many sites run the plugin, when it last shipped an update and the newest WordPress release its developer has tested. Five of the six were updated in October 2026 and tested up to WordPress 7.1.4, the current release. Termly’s plugin was last updated on 9 January 2026 and is tested up to 6.9.11.
| Plugin | Active installs | Last updated | Tested up to |
|---|---|---|---|
| CookieYes | 1+ million | 2026-10-27 | 7.1.4 |
| Complianz | 1+ million | 2026-10-13 | 7.1.4 |
| Cookiebot | 100,000+ | 2026-10-29 | 7.1.4 |
| GDPR Cookie Compliance | 300,000+ | 2026-10-08 | 7.1.4 |
| Real Cookie Banner | 100,000+ | 2026-10-14 | 7.1.4 |
| Termly | 80,000+ | 2026-01-09 | 6.9.11 |
Source: the WordPress.org plugin directory, read 2026-11-01. | |||
Two directory addresses are older than the names on them. CookieYes lives at cookie-law-info, and Termly’s plugin at uk-cookie-consent, an older plugin whose page now says it is operated by Termly; from its version 3.0, existing users had to sign up for a Termly account and switch the banner on again. Search the directory by the vendor’s name, then check the author line.
Each WordPress cookie plugin in short
What each one is, who it fits, how it meets the rows, and what to confirm before you install it. Already on one of the two big hosted banners and thinking of leaving? Our CookieYes alternatives and Cookiebot alternatives pages compare the switch.
CookieYes
What it is
A consent plugin from CookieYes that shows a banner as soon as it is activated, then syncs scans, settings and the consent log with a CookieYes web app account.
Who it fits
A small site with traffic under the free plan’s 5,000 pageviews a month that wants a scanner, blocking, a consent log and Consent Mode v2 without paying.
What the rule requires and whether it meets it
Its plugin page lists the banner, automatic blocking, the scanner, consent logging and Google Consent Mode v2 (Advanced and Basic) in the free plan. Consent data is stored in EU-based data centres under a data processing agreement, and the plugin shares each choice through the WP Consent API.
Check with the vendor
Geo-targeting, Global Privacy Control and the IAB framework are on paid plans, so a site with California visitors who send a GPC signal needs one. Ask what the banner does in a month that passes the free plan’s pageviews.
Complianz
What it is
A WordPress plugin from Complianz B.V. in the Netherlands, part of iubenda, that runs entirely on your own server and sets up the banner from a wizard and a site scan.
Who it fits
A busy site that wants no traffic meter: neither its free nor its paid plans cap pageviews or sessions.
What the rule requires and whether it meets it
The free plugin includes the banner, the scan, script blocking and policy documents, and works with the WP Consent API. It also checks whether your setup needs a banner at all. Because nothing leaves your server, it says the plugin itself needs no extra processing agreement.
Check with the vendor
Its pricing page puts records of consent and Google Consent Mode v2 on paid plans, and the free plugin’s Consent Mode setting is locked, although its WordPress.org FAQ describes Consent Mode as built in. Confirm before you rely on it. Scan results are sent to cookiedatabase.org for cookie descriptions.
Cookiebot
What it is
The WordPress connector for Cookiebot CMP, a Usercentrics product. The banner, the scanner and consent storage run in Cookiebot, so the plugin needs a Cookiebot account and its Domain Group ID.
Who it fits
A small site of one domain and fewer than 50 subpages that runs Google Ads or Analytics and wants Consent Mode v2 on a free plan.
What the rule requires and whether it meets it
The free plan covers one domain and up to 50 subpages, with an initial scan, automatic blocking and Google Consent Mode. For each consent it logs an anonymised identifier, the choice, the page address, an IP-based country and a timestamp, kept for up to 12 months, and it passes the choice to the WP Consent API.
Check with the vendor
Plans count subpages, not traffic: once the scanner finds more than 50, the free plan ends. Geotargeting, banner branding and more domains are paid. Its plugin page says automatic blocking is available to all WordPress sites, while its plan page lists blocking on the free plan as manual: confirm which mode your account gets. Cookiebot holds the records, so read its processing terms before you connect the site.
GDPR Cookie Compliance
What it is
A free plugin from Moove Agency, with a premium add-on. It stores all user data on your own website, and Moove says it collects none on its servers.
Who it fits
A small site that loads a few known scripts, such as Google Analytics, a Tag Manager container or a Meta Pixel, and wants them held back with no outside account.
What the rule requires and whether it meets it
The free plugin loads the scripts you paste into its settings only after the visitor accepts, supports Google Consent Mode v2 and lets visitors withdraw consent. Its changelog added WP Consent API support in version 4.14.0.
Check with the vendor
It holds back only the scripts you set up in it and names no scanner, and its FAQ says to delete those scripts from the site’s own code so they do not load twice. The consent log is premium and stores the visitor’s IP address in your database: set a retention period for it.
Real Cookie Banner
What it is
A WordPress plugin from devowl.io GmbH, free with a PRO version. Consents are processed and stored on your server, and nothing is loaded from a cloud in the visitor’s browser.
Who it fits
A site full of embeds (videos, maps, web fonts) that wants each one blocked behind a placeholder and the consent record kept in its own database.
What the rule requires and whether it meets it
The free version allows unlimited services and content blockers, scans the site for services that need consent, and documents each consent in the WordPress database, with a checklist that walks you through setup.
Check with the vendor
Google Consent Mode, the IAB framework, geo-restriction and most of the ready-made service templates are PRO. Its scanner finds services rather than single cookies, by design. Its pages name its own consent API, not the WP Consent API.
Termly
What it is
Termly’s cookie consent banner for WordPress. The plugin connects to a Termly account, which runs the scans, the cookie policy and the banner settings.
Who it fits
A site that already writes its privacy policy in Termly and wants the banner and the policies in one account.
What the rule requires and whether it meets it
The free plan includes the banner, the script Auto Blocker, quarterly cookie scans and a cookie policy built from the scan, up to 10,000 banner views a month.
Check with the vendor
When the free plan reaches its monthly limit, the plugin’s FAQ says the banner is deactivated until the next month: weigh that gap. Google Consent Mode v2, consent logs and regional rules are on its Pro+ plan. Its WordPress.org page was last updated on 9 January 2026.
How we compared them
We took six consent plugins from the WordPress.org directory: the WordPress editions of three hosted banners a small site also meets outside WordPress (CookieYes, Cookiebot and Termly) and three plugins that run inside WordPress (Complianz, GDPR Cookie Compliance and Real Cookie Banner). Other cookie notice plugins in the directory are left out. Only the plugin is judged here, not the vendor’s wider platform. One cell, Complianz’s Consent Mode, comes from the plugin’s own code as published on WordPress.org, because its pages disagree with each other.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-11-01; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does a WordPress site need a cookie consent plugin?
Only if it stores or reads something on visitors’ devices that is not strictly necessary for what they asked for, and has EU or UK visitors. Analytics, ad pixels, embedded videos and maps usually fall on the consent side. Art. 5(3) of the ePrivacy Directive then asks for consent before they load. A plain site with none of them may need no banner at all, and Complianz even checks your setup for that. Our cookie banner examples show what a valid banner looks like.
What is the best free cookie consent plugin for WordPress?
The one whose free line falls where your site does not. CookieYes and Cookiebot include Consent Mode v2 on their free plans, but cap pageviews and subpages. Complianz and Real Cookie Banner state no traffic limit, but keep Consent Mode for paying customers. GDPR Cookie Compliance is free with Consent Mode, but names no scanner and keeps the consent log for its premium add-on. The free-version table above sets the limits side by side.
Do I need Google Consent Mode v2 on WordPress?
If the site runs Google Analytics or Google Ads tags for EEA or UK visitors, consent mode is how those tags learn the visitor’s choice. It carries four signals: ad_storage, ad_user_data, ad_personalization and analytics_storage. In basic mode the tags wait for the banner; in advanced mode they load at once and send cookieless pings while consent is denied. Our Google Analytics and GDPR guide covers the rest of what GA4 needs.
Does a cookie plugin make my WordPress site GDPR compliant?
No, and the plugins say so themselves: CookieYes writes that no plugin can guarantee compliance, and GDPR Cookie Compliance that it does not make your website compliant. The plugin only blocks what it knows about, so a script added later by a theme or a page builder can slip past it. Re-scan after every new plugin, and run the result through our cookie banner checklist.
Where does a cookie plugin store the consent records?
It depends on the plugin. Real Cookie Banner and the premium log of GDPR Cookie Compliance keep them in your WordPress database; CookieYes and Cookiebot keep them in their own clouds. Either way you must be able to show that a visitor consented (GDPR Art. 7(1)). A vendor that holds the records for you is your processor, which needs a contract under Art. 28(3).
Do I still need a cookie policy if I use a consent plugin?
Yes. The banner asks; the policy explains which cookies the site sets, why and for how long. Several of these plugins generate one from their scan, which is only as complete as the scan. Our cookie policy template lists the cookies by category if you write it yourself.