Checkout is the most sensitive page a WordPress store runs. Payment details, addresses, and order history meet there, usually alongside a crowd of marketing tools that followed the shopper from the product pages.
Consent at checkout is where good intentions meet plumbing. Trackers that behaved politely on the blog forget their manners at the till, and the store owner, not the plugin authors, answers for the result. Here is how the pieces fit.
Necessary versus optional at the till
Completing an order justifies processing names, addresses, and payment information. It does not justify firing advertising pixels before consent, loading chat widgets that profile visitors, or embedding content that phones home to third parties.
Audit the checkout page specifically, in a clean browser, before consent. Marketing tags are often injected site wide by a tag manager or a marketing plugin that never learned to exclude checkout. What you find there is frequently a surprise to the store running it.
Payment iframes are their own world
Card fields on most gateways are iframes served by the payment provider. Your consent tool cannot see inside them, and blocking them would block payment itself. That is normal and defensible, since the shopper is actively transacting with the provider at that point.
What you owe the shopper is honesty: the privacy notice should name the payment providers and explain that entering card details shares data with them directly. Surprises, not iframes, are what create complaints.
Consent choices must survive the funnel
A shopper who declined marketing cookies on the homepage must still be declined at checkout, after login, and on the thank you page. Account creation and order completion are exactly where consent state gets lost, overwritten by a fresh profile or a post purchase script.
Test the full path with a declined profile: browse, add to cart, check out, pay in test mode, land on the thank you page. Watch what fires at each stage. Any stage that resurrects a tracker is a defect, full stop.
Order data and retention duties
Consent is not the basis for keeping order records. Tax and accounting law is, and those records follow retention schedules that cookie preferences cannot shorten. Stores confuse shoppers when a delete my data promise collides with invoices the law requires them to keep.
Write the distinction into your notices: marketing data follows consent and deletion requests, order records follow legal retention and are then removed. Clear words here prevent the most common privacy argument WooCommerce stores have.
Related reading
These earlier guides go deeper on connected questions: Consent on WordPress Membership Sites: Logged In Does Not Mean Consented Membership sites track logged in users heavily and often assume the account terms cover everything. Separating account consent from tracking consent on WordPress., WordPress Consent Logs: How Long to Keep Them and What They Must Show A consent banner without a log is a claim without evidence. What a WordPress consent record needs to contain, and how long retention should run., and Consent on Multilingual WordPress Sites: One Site, Several Legal Conversations Multilingual WordPress sites often run one banner with translated strings and call it done. Language, law, and plugin behavior need more care than that..
Frequently asked questions
Can I block payment gateway iframes until consent?
No, and you should not try. The card fields are the transaction itself, served by the payment provider the shopper is actively paying. Blocking them breaks checkout. The correct approach is disclosing the providers clearly in your privacy information.
Why do marketing pixels fire on my checkout page?
Usually because they were installed site wide through a tag manager, a header script, or a marketing plugin with no page exclusions. Review what loads on checkout in a clean browser and restrict optional tags to fire only after consent and never rely on checkout presence.
Does placing an order count as consent for marketing?
No. An order permits processing needed to fulfill it and related service messages. Marketing emails, advertising pixels, and profiling are separate uses needing their own basis, usually explicit consent gathered clearly, not assumed from a purchase.
What should I test after changing consent settings on a store?
The whole funnel as a declined visitor and as an accepted one: product page, cart, checkout, test payment, thank you page, and a return visit. Consent state must persist and trackers must match it at every step, including after account creation.