WordPress Consent and the Admin Bar: The Cookies Your Own Dashboard Sets

Log in to WordPress, and the admin bar appears at the top of every page, including the front end. It is convenient, and it is also a consent surface, because WordPress sets cookies for logged-in users, and the admin bar is the most visible sign that those cookies are active. The site owner who audits everyone else's cookies and never audits their own dashboard is missing the cookies that are closest to home.

WordPress core sets no cookies for anonymous visitors. That is the starting point, and it is the reason WordPress is a good platform for consent: a visitor who is not logged in gets no cookies from core, and the only cookies they get are the ones the theme and plugins set. For a logged-in user, core sets three cookies: wordpress_[hash], which is the authentication cookie, wordpress_logged_in_[hash], which indicates the user is logged in, and wp-settings-[UID], which stores the user's admin preferences for a year. The comment cookies, comment_author_*, last 347 days, and wordpress_test_cookie is set to test whether the browser accepts cookies.

The admin bar is a cookie surface

The admin bar is visible on the front end for logged-in users, and it is the most obvious sign that the authentication cookies are active. The cookies are strictly necessary for the login to work, which means they do not need consent under the GDPR, because they are required for a service the user explicitly requested. But strictly necessary does not mean invisible, and it does not mean the site owner should not know they exist. An audit that lists the cookies the site sets should include the admin cookies, with the note that they are strictly necessary, because a regulator who finds them will ask, and the answer should be ready.

The comment consent checkbox, added in WordPress 4.9.6 under Settings, Discussion, is the other half. When a visitor leaves a comment, WordPress can store their name, email, and website in a cookie, so they do not have to retype it next time. That cookie needs consent, because it is not strictly necessary, and the checkbox is the consent mechanism. The checkbox is unchecked by default, and it should stay that way, because a pre-ticked box is not consent, and Planet49 said so in 2019.

What to audit, and what to leave alone

Audit the login cookies, and note that they are strictly necessary. Audit the comment cookies, and confirm the checkbox is present and unchecked by default. Audit the cookies the theme and plugins set, because those are the ones that need consent, and they are the ones most site owners never list. The WordPress Consent API, wp_consent_api, is the mechanism that lets plugins check the consent state before they set a cookie, and plugins that respect it will not set a non-essential cookie until consent is granted.

Do not try to block the login cookies. They are strictly necessary, and blocking them will break the login, which is a worse outcome than a cookie. Do not add a consent banner for the admin bar, because the admin bar is only visible to logged-in users, and logged-in users have already authenticated, which is the service the cookies support. The banner is for anonymous visitors, and anonymous visitors get no cookies from core.

The dashboard is the audit

Log in, open the front end, and look at the cookies. The admin bar is the visible sign, and the cookies are the mechanism. List them, note which are strictly necessary, and confirm the comment checkbox is present. The dashboard is the audit, and it takes five minutes, which is less time than the consent banner took to configure.

Your own dashboard is a consent surface. Audit it, and the rest of the audit will be easier.

Keep reading: WordPress Consent API: The Plugins That Actually Respect It, Consent for WordPress Contact Forms: The Checkbox Is Not the Whole Job, Global Privacy Control: Does Your Site Actually Honour the Signal?.

Frequently asked questions

Does WordPress set cookies for anonymous visitors?

No. WordPress core sets no cookies for anonymous visitors. The only cookies an anonymous visitor gets are the ones the theme and plugins set.

Which cookies does WordPress set for logged-in users?

Three: wordpress_[hash] for authentication, wordpress_logged_in_[hash] to indicate the user is logged in, and wp-settings-[UID] for admin preferences, which lasts a year.

Do WordPress login cookies need consent?

No. They are strictly necessary for the login to work, which is a service the user explicitly requested. But they should still be listed in an audit, with the note that they are strictly necessary.

What is the WordPress comment consent checkbox?

Added in WordPress 4.9.6 under Settings, Discussion, it lets a visitor consent to storing their name, email, and website in a cookie when they comment. It is unchecked by default and should stay that way.