Cookie banners are usually the first interactive element on a page, and often the least accessible: no keyboard path to reject, focus that vanishes, and grey text on grey buttons. On WordPress the fix is choosing a banner built to accessibility standards and then testing it with a keyboard alone.
A consent banner that keyboard users cannot reach or read fails twice. This guide covers the accessibility checks every WordPress banner should pass, from focus order to contrast. This guide walks through the practical details, the common mistakes, and the checks that help you get it right the first time.
Where consent setups break in real life
Most consent failures are not banner design problems. They are loading order problems: tools that fire before a choice, tags added later without consent checks, and embeds or features that were never connected to the consent record at all. The banner works, and everything behind it ignores it.
A reliable setup inventories every tool that sets cookies or collects identifiers, assigns each one a category and a lawful basis, and blocks collection until the required choice exists. That inventory drifts constantly, which is why consent is an operating practice, not a one time installation.
What visitors should experience
The visitor experience should be short and honest: a clear choice presented once, no preselected toggles for non essential tools, an equally easy way to decline, and a permanent settings page where the choice can be changed without hunting. Friction that only applies to declining is a dark pattern, whatever the banner looks like.
After the choice, the site should behave as promised. Accepting enables the agreed tools once. Declining leaves the site fully usable with essential functions only. Anything else teaches visitors that their choice was decorative, which is both a legal and a trust problem.
Keeping the record and the practice aligned
Keep a consent record that shows what was presented, what was chosen, and when, and keep the tools on the site aligned with that record through regular audits. After any change to the tag manager, the marketing stack, or the site itself, repeat the clean browser test: load, decline, accept, and verify behavior each time.
Assign an owner. Consent setups decay when nobody is responsible for them, because every other team adds tools for its own reasons. One named owner with a checklist for new tools is the difference between a setup that stays true and one that quietly stops meaning anything.
Related reading
These earlier guides go deeper on connected questions: Consent on WordPress Multisite: Why Each Site Needs Its Own Settings Multisite networks tempt owners to copy one consent setup everywhere. Different audiences, tools, and legal duties per site mean a single copied banner is usually wrong somewhere., WordPress Consent Logs: How Long to Keep Them and What to Store A consent log proves what a visitor was shown and what they chose. Sites need a retention rule that keeps proof long enough to matter without hoarding personal data forever., and Moving a WordPress Site Without Losing Your Consent Settings Site migrations and host moves routinely drop consent configuration: banner settings stored in one plugin's database tables, custom blocking rules, and region settings that never make the trip. A migration checklist for consent continuity..
Frequently asked questions
What happens if a visitor declines all cookies?
The site should still work. Essential functions such as security, load balancing, and remembering the consent choice itself can continue, but analytics, advertising, and personalization tools should stay off until the visitor chooses otherwise.
How often should a consent setup be audited?
After every change to the site's tools, tag manager, or banner, and on a scheduled basis besides, typically quarterly for active sites. Setups drift as teams add tools, so a pass from last year describes a site that may no longer exist.
Is a cookie banner the same as consent management?
No. The banner is the visible surface. Consent management includes the tool inventory, blocking behavior, the stored record, the settings page, and the audits that keep them aligned. A pretty banner over unmanaged tags is not consent management.
Where should visitors be able to change their choice?
A clearly labeled link, usually in the footer and the privacy page, leading to the same choices the banner offered. If changing a choice is harder than making it was, the setup is steering visitors, intentionally or not.