WordPress Consent API: The Plugins That Actually Respect It

WordPress has no built-in mechanism for managing cookie consent, so every plugin invented its own. The banner plugin blocks third-party scripts, the analytics plugin sets its own cookies, and the form plugin sets a PHP cookie that the banner cannot block at all, because a consent management plugin cannot prevent a server-side cookie. The result is a site where the banner says one thing and the plugins do another, and nobody notices until a regulator asks.

The gap is first-party cookies, and it is the gap the WP Consent API was built to close. A banner can block a third-party script by not loading it. It cannot block a PHP cookie, because the cookie is set before the page reaches the browser. The only fix is for the plugin itself to check consent before setting the cookie, and the only way for every plugin to check the same consent is a shared API.

Every plugin invented its own consent

The WP Consent API defines five consent categories: functional, statistics-anonymous, statistics, preferences, and marketing. It provides two functions that every plugin can use: wp_set_consent writes the consent state, and wp_has_consent reads it. A consent manager writes, other plugins read, and everyone agrees on what the visitor chose. Service-level consent goes further, with wp_has_service_consent checking a specific service like google-analytics before falling back to its category.

The API also has a rule that catches people out: if no consent manager sets the consent type, every category returns true, and all cookies are allowed. The API alone changes nothing. It is a shared language, not a consent manager, and installing it without a manager is like installing a phone line with no one to call.

Five categories, two functions

That default is the part to understand before anything else. A site with the WP Consent API installed and no consent manager configured will return true for every category, and every supporting plugin will set its cookies as if the visitor consented to everything. The API does not fail closed. It fails open, and the failure is silent, because the site looks compliant: the plugin is installed, the functions exist, and the cookies fire anyway.

The fix is to set a consent manager as the source of truth, and to confirm that the manager sets the consent type to opt-in for visitors in the EU. Kukie, Complianz, and Borlabs are among the managers that register with the API. The manager writes the visitor's choice, the API carries it, and the plugins read it. Without the manager, the API is a language no one is speaking.

The default is everything allowed

List every plugin on the site that sets a cookie or loads a tracker, and check each one against the API. Google Site Kit, WooCommerce, and Jetpack all read the API: Site Kit passes the consent state to Google Consent Mode, and WooCommerce gates its attribution tracking on consent. Those are the easy ones. The hard ones are the small plugins, the form builders, the chat widgets, and the social feeds, which often have no consent support at all.

Keep reading: Pre-Ticked Boxes Are Not Consent: Planet49 Said So in 2019, Global Privacy Control: Does Your Site Actually Honour the Signal?.

Audit your plugin list

For each plugin that does not support the API, the choice is to replace it, gate it behind the banner, or accept the gap and document it. Accepting the gap is a real option, but it is not a quiet one: the gap is a cookie set without consent, and the CNIL fined SHEIN 150 million euros in 2025 for installing cookies before users gave permission. The audit is the work, and the plugin list is where it starts.

Frequently asked questions

What is the WordPress Consent API?

A shared interface that lets consent plugins and other plugins agree on what the visitor allowed, across five categories: functional, statistics-anonymous, statistics, preferences, and marketing.

Does the WP Consent API collect consent itself?

No. It only carries the consent state. A consent manager plugin still has to collect the choice and write it with wp_set_consent.

Which WordPress plugins support the Consent API?

Jetpack, WooCommerce, and Google Site Kit read it. Many smaller plugins do not, and those are the ones to audit.

What happens if no consent manager is installed?

Every category returns true, so all cookies are allowed. The API changes nothing on its own, and the failure is silent.