Cookie consent is the part of running a website that nobody enjoys and everybody has to get right. This guide covers what the laws require in 2026, what a compliant banner looks like, and how we set it up on WordPress for our own site and for clients.
Updated September 2026. The first version of this guide went up in 2023. Since then Google made Consent Mode v2 mandatory for sites with European visitors, California amended the CCPA through the CPRA, and roughly twenty US states passed their own privacy laws. This rewrite is shorter than the original and built around the setup we actually use. Everything in it is current as of September 2026.
One thing up front: I’m not a lawyer and this isn’t legal advice. It’s a working guide from a web developer who has to make this stuff run on real sites.
What cookie consent means
A cookie is a small file a website stores in your browser. Some cookies are essential, like the one that keeps you logged in or remembers your cart. Others exist to measure or track you, like analytics scripts and advertising pixels.
Cookie consent is the permission a website gets from a visitor before it sets the non-essential kind. Where the law requires consent, the site has to ask first, has to make refusing as easy as accepting, and has to let the visitor change their mind later.
The three sets of rules you need to know
GDPR and the ePrivacy rules (EU and UK)
If anyone in the European Union or the United Kingdom can visit your site, these rules apply to how you treat them. The model is opt-in. Non-essential cookies stay off until the visitor says yes. Consent has to be freely given, specific, informed and unambiguous, which in practice means:
- No pre-ticked boxes, and no “by continuing to browse you agree” banners.
- A reject option that is as easy to find and click as the accept option.
- A plain-language explanation of what the cookies do and who gets the data.
- A way to withdraw consent at any time, usually a link in the footer.
- A record of what each visitor agreed to, in case a regulator asks.
The penalties are the headline that made everyone pay attention: fines can reach 4% of worldwide annual turnover or 20 million euros, whichever is higher. Small sites don’t get fined at that scale. But the rules are the same, and in my experience the small sites are the ones with analytics firing before the banner loads.
CCPA and CPRA (California)
California works the other way round. The model is opt-out. You can set cookies, but you have to tell people what you collect, give them a clear way to opt out of the sale or sharing of their personal information, and honor that choice. The CPRA amended the CCPA in 2023, created a dedicated enforcement agency and raised the thresholds. The law applies to a for-profit business that does business in California and meets any one of these:
- Annual gross revenue over $25 million.
- Buys, sells or shares the personal information of 100,000 or more California residents or households in a year.
- Earns 50% or more of its annual revenue from selling or sharing personal information.
Two practical requirements trip people up. First, the site needs a “Do Not Sell or Share My Personal Information” link that actually does something. Second, California expects you to honor Global Privacy Control, a browser setting that sends an opt-out signal automatically. If your consent tool ignores that signal, you’re not compliant. A nice-looking banner doesn’t change that.
The other US states
As of 2026, roughly twenty states have their own privacy laws, from Virginia and Colorado through Texas and Oregon to Minnesota and Maryland, with more scheduled. There’s still no federal law. The good news is that these laws mostly rhyme with California. You tell people what you collect, you let them opt out of sale and targeted advertising, you honor access and deletion requests, and in many states you honor Global Privacy Control.
Don’t try to build this state by state. Pick a consent tool that handles the differences, or do what we do and give every visitor the strictest version.
Google Consent Mode v2
If you use Google Analytics, Google Ads or Google’s advertising products, this one has teeth. Consent Mode is a messenger between your cookie banner and Google’s tags. When a visitor accepts or rejects, Consent Mode passes that choice along so the tags behave accordingly. Version 2 added two signals, ad_user_data and ad_personalization, on top of the original analytics and advertising ones.
Since March 2024, Google has required Consent Mode v2 for anyone using its advertising services with visitors from the European Economic Area or the UK. Skip it and Google quietly stops recording audiences, remarketing lists and conversions for those visitors. There is no warning. The data just stops.
The fix is a consent tool that supports Consent Mode v2 and sets every signal to denied until the visitor accepts. Google also expects publishers who show its ads to European visitors to use a certified consent management platform, so if you run AdSense or Ad Manager, check that yours is on Google’s certified list.
What a compliant banner looks like
Strip away the vendor marketing and a banner that satisfies all three rule sets does six things:
- It appears before any non-essential script fires. Analytics that loads before the visitor answers is the most common failure we find on audits.
- It offers accept and reject with equal weight. Same size and the same number of clicks to get there.
- It explains in plain words what the cookies are for and who receives the data.
- It links to a cookie policy that lists every cookie and service in use, and that list stays current.
- It leaves a permanent way back in, so a visitor can change their answer from any page.
- It honors Global Privacy Control signals without the visitor doing anything.
Design still matters. Match your brand, keep it readable on a phone, make it work with a keyboard and a screen reader, and do not cover the whole page with a wall the visitor cannot dismiss. A cookie wall that blocks content until you accept is itself a violation in the EU.
How we set this up on WordPress
We use the free version of the Complianz plugin, on this site and on client sites, configured the same way every time.
Show everyone the strict banner. Complianz Free does not detect where a visitor is, so it shows one region’s banner to everybody. We set the region to EU. That gives every visitor, including the US ones, an opt-in banner with scripts blocked until consent. Opt-in is stronger than any US state requires, so it covers both sides without a license fee. The one thing you mustn’t do is set the region to US to get US-specific features, because that downgrades European visitors from opt-in to opt-out.
Turn on the cookie blocker. Complianz rewrites the tags for Google Analytics, reCAPTCHA, YouTube embeds and the rest so they stay inert until the visitor accepts. This is the part most DIY banners get wrong. A banner that asks nicely while the analytics script has already loaded is theatre.
Turn on Consent Mode and respect Do Not Track. Two settings. The first sets every Google signal to denied by default. The second honors Global Privacy Control and Do Not Track headers automatically.
Write the legal pages with real facts. A privacy policy that names your actual data processors (your analytics, your form plugin, your payment provider, your host), a terms page, a cookie policy that embeds the plugin’s live cookie table so it updates itself, and a “Do Not Sell or Share” page with the consent toggle and the contact details for formal requests. Never invent an email address or a retention period. If you do not know, ask the business owner.
Link all four pages from the footer and check the links resolve. A footer that points at /privacy when the page lives at /privacy-policy is a bug we see on more sites than you would expect.
Verify from the outside. Load the site in a fresh browser and confirm the banner appears, the Google tags carry the blocked type until you accept, and the consent default in the page source says denied. Then read the four legal pages once more as a visitor would.
If you need true geo-targeting, so US visitors see a US notice and European visitors see the opt-in, Complianz Premium adds it for about sixty euros a year. For most small business sites the free over-comply setup is enough, and it is what we run here.
We wrote up the same kind of build for regulated sites in our guide to a HIPAA-compliant WordPress website, and there is a shorter piece on adding a privacy policy to WordPress.
Hosted alternatives
If you’d rather pay a service than configure a plugin, these are the names that come up most often.
- Termly bundles a geo-targeting banner, consent records, and privacy and terms generators, and is a Google-certified consent platform. This is what we recommended in the first version of this guide and it still works well for sites that want everything in one dashboard.
- CookieYes and Cookiebot are the other two you’ll hear about constantly. Both are certified and geo-target, and both charge monthly.
- OneTrust is the enterprise option. If you have a legal department, they already know it.
- HubSpot has a cookie banner built into its CMS. If your site runs on HubSpot, use theirs.
Pricing on all of these changes often, so check the vendor’s own page rather than trusting a blog post.
The mistakes we find most often
- Google Analytics or a Facebook pixel loading before the visitor has answered the banner.
- An accept button and no reject button, or a reject hidden behind “manage preferences”.
- Embedded YouTube videos, Google Maps and web fonts that set cookies or send data before consent, because nobody thought of them as trackers.
- A cookie policy written once in 2021 that no longer matches what the site loads.
- Ignoring Global Privacy Control because the tool was never told to honor it.
- No consent records at all, so there is nothing to show if a regulator or a customer asks.
Does this apply to a small US business?
Probably, at least in part. If people in the EU or UK can reach your site, the GDPR rules apply to how you treat those visitors. The US state laws carry revenue and volume thresholds that many small businesses sit under, but the thresholds differ by state and the list keeps growing. The cheap answer is to over-comply once with a free tool and stop thinking about it. That’s a smaller job than reading twenty statutes.
Frequently asked questions
What exactly is cookie consent?
The permission a website gets from a visitor before it sets non-essential cookies such as analytics, advertising and embedded media trackers. Essential cookies that keep the site working do not need consent.
Is cookie consent opt-in or opt-out?
Opt-in in the EU and UK, where non-essential cookies stay off until the visitor accepts. Opt-out in California and most other US states, where you may set them but must let visitors refuse and must honor browser opt-out signals.
Do I need Google Consent Mode v2?
If you use Google Ads or Google Analytics advertising features and any of your visitors are in the European Economic Area or the UK, yes. It has been required since March 2024. Any current consent tool can switch it on.
Can a visitor change their mind after accepting?
Yes, and the site has to make that as easy as the original choice. A “manage consent” link in the footer is the usual answer.
Does CCPA apply to businesses outside California?
Yes, if the business handles the personal information of California residents and meets one of the revenue or volume thresholds. Where the business is based does not matter.
Which other states have privacy laws?
As of 2026 roughly twenty, and the list keeps growing. They broadly follow California’s opt-out model.
What is Global Privacy Control?
A browser setting that sends an automatic opt-out signal to every site you visit. California and a growing number of states require sites to treat it as a valid opt-out, so your consent tool needs to recognize it.
What is the cheapest way to get compliant on WordPress?
The free Complianz plugin set to the EU region for all visitors, with the cookie blocker and Consent Mode turned on, plus four legal pages written with your real details. That is the setup described above and it costs nothing but an afternoon.
If you would rather hand it off
This is a fixed piece of work for us: audit what the site loads, install and configure the consent tool, write the four legal pages from your real details, and verify the result from the outside. It is a common request from the businesses on our care plans, and it is a standalone job for everyone else. Get in touch and tell us what the site runs on. We will tell you what it needs and what it costs before anything starts.