A blog asks for consent in a couple of places. A course site asks everywhere: the enrolment form, the video player, the quiz engine, the community plugin, the email tool that nudges students who stall. Each integration arrived separately, and nobody owns the whole map.
Students also hand over more than visitors do: names, progress, answers, sometimes payment details and certificates. A consent review built for blogs will miss most of what a course site actually does.
Map the integrations before touching settings
List every plugin and embed that loads on course pages, then check which set cookies or call third parties before any choice is offered. Video platforms and analytics inside lesson pages are the usual surprises, loading on enrolment pages where students least expect marketing technology.
Use a fresh browser profile and watch the network requests on an enrolment page and a lesson page. The difference between the two lists is your course specific consent surface, and it is almost always longer than the site owner's guess.
Consent at enrolment is a contract moment
Enrolment bundles several things: the purchase, the account, the course emails, and, too often by default, marketing. Unbundle them. Transactional course messages ride on the enrolment itself; marketing needs its own unticked choice, exactly as in any other checkout.
The privacy notice at enrolment should say plainly what learning data is stored: progress, quiz answers, completion, and for how long, including after the course ends. Students accept a great deal when told honestly, and resent discovering it later.
Video and embeds inside lessons
Embedded video players frequently set cookies and track across sites. Where your consent framework requires it, gate embeds behind the same choices as the rest of the site, or use privacy enhanced modes and self hosted alternatives for core content.
Students should not have to accept marketing cookies to watch a lesson they paid for. If the player cannot work without tracking, that is a procurement problem to solve with a different player, not a consent banner to hide it in.
Community, certificates, and the long tail
Forum and community plugins add profiles, messages, and notifications, each with retention questions. Certificate generators may share verification data. Webinar tools replays live on third party platforms with their own cookies and accounts.
Give each a line in the privacy notice and a retention decision. Course data outlives courses: decide how long progress records, forum posts, and certificates remain after a student's access ends, and honour deletion requests against that schedule.
Related reading
These earlier guides go deeper on connected questions: WordPress Consent at WooCommerce Checkout WooCommerce checkout collects plenty and loads more. How consent interacts with checkout trackers, payment iframes, and the order data you must keep anyway., Consent and WordPress Comment Forms: The Forgotten Data Comment forms collect names, emails, and IP addresses, and most WordPress sites never think about their consent and retention. A small, fixable corner of site privacy., and Consent on WordPress Membership Sites: Logged In Does Not Mean Consented Membership sites track logged in users heavily and often assume the account terms cover everything. Separating account consent from tracking consent on WordPress..
Frequently asked questions
Do enrolled students still need a cookie banner?
Yes. Enrolment is consent to the course, not to tracking technologies. Banners and consent controls apply to logged in students the same as visitors, and the consent state should persist across their sessions properly.
Can I require marketing consent as a condition of enrolment?
No, that bundling undermines the consent's validity. The course is bought with money, not with marketing permission. Keep the marketing choice separate, optional, and genuinely without penalty.
What learning data should the privacy notice name?
Progress through lessons, quiz and assignment answers and scores, time spent, completion and certificate records, and community contributions. If a plugin collects something beyond that list, either stop it or add it to the notice.
How do free courses differ from paid ones for consent?
A free course paid for with data and marketing attention needs even clearer consent, because the exchange is the product. State plainly what signing up includes, especially email marketing and any sponsor sharing.