WordPress CMPs Compared: Complianz, CookieYes, and the Consent Mode Question

Two plugins dominate WordPress consent, and every comparison of them starts with the price. Complianz is 59 euros a year. CookieYes is 10 dollars a month per domain. The price is the least interesting difference between them, and the sites that choose on price end up reconfiguring six months later. The real split is how each one handles the three things that actually matter: the cookie scan, Consent Mode v2, and the TCF.

The scan is the product

A CMP is only as good as its cookie scan, because the scan is what finds the cookies your plugins set without telling you. WordPress core sets a handful of session cookies, all strictly necessary, and no CMP is needed for those. The cookies that need consent come from comments, plugins, themes, and e-commerce extensions, and they are the ones a site owner does not know about. Complianz scans the site and generates the cookie policy dynamically based on what it finds, which means the policy describes the cookies that are actually there rather than the ones the owner remembers installing. CookieYes auto-detects cookies, categorises them, and blocks them until consent is given, and its scan is faster to set up. Run both free tiers against your own site and compare the results. The one that found more of what is really there is the one to buy, because the missed cookies are the liability, and the price difference is 60 dollars a year against a fine that starts in the thousands. The scan also has to keep running. Plugins update, new cookies appear, and a CMP whose scan ran once at install is describing a site that no longer exists.

Both plugins integrate with Google Consent Mode v2, passing the visitor choice to Google tags, and both support TCF 2.2 and 2.3 for sites that run programmatic ads. The depth differs. Complianz documents jurisdiction specific rules in more detail and its configuration covers more edge cases, which matters for a site with EU traffic and a complex plugin stack. CookieYes is the more widely used plugin, its setup is faster, and its support covers the common cases well. A site with five plugins and no ads will not feel the difference. A site with thirty plugins, WooCommerce, and a header bidding wrapper will.

The WordPress Consent API is the tiebreaker

The WP Consent API is the standard WordPress plugins are supposed to respect: a central API that records the visitor consent state so every plugin reads the same answer instead of each one asking separately. The plugins that actually respect it are the minority, and that is the real test of a CMP. A CMP that sets the consent state through the WP Consent API means your contact form plugin, your analytics plugin, and your e-commerce plugin all see the same choice. A CMP that keeps its own private state means each plugin has to be configured separately, and the one you forgot is the one that sets cookies before consent. Ask the CMP whether it writes to the WP Consent API, and ask your other plugins whether they read it. The answer to the second question is usually no, which is why the tag audit matters more than the CMP choice: list every third party script, check each one for cookies set before consent, and block the ones that fail. The CMP is the banner. The audit is the compliance.

Cookie blocking is the feature to verify, not assume. Both plugins offer blocking until the visitor accepts, but blocking has to be tested per script, because a script that loads through a theme file or a plugin shortcode can bypass the CMP entirely. Reject everything, load the page, and count the cookies. If the count is not zero for non-essential cookies, the blocking is incomplete, and the CMP is not doing the job you bought it for.

How to choose

If your site is small, runs no ads, and has a handful of plugins, pick CookieYes for the faster setup and spend the saved time on the tag audit. If your site runs ads, has EU traffic, or carries a plugin stack you did not build yourself, pick Complianz for the deeper jurisdiction handling and the dynamic policy. Either way, run both scans first, verify blocking by rejecting everything and counting cookies, and check whether your other plugins read the WP Consent API. The CMP is a tool. The audit is the work. And the price is the smallest number in the whole decision.

Keep reading: WordPress Consent API: The Plugins That Actually Respect It, Third-party scripts that set cookies before consent: the tag audit, Consent for WordPress Contact Forms: The Checkbox Is Not the Whole Job.

Frequently asked questions

How much do Complianz and CookieYes cost for WordPress?

Complianz starts at 59 euros a year for a single site. CookieYes starts at 10 dollars a month per domain. The headline prices hide the real cost: the time to configure the banner, the cookie scan, and the consent mode wiring, which is where most small sites spend the money either way.

Which WordPress CMP handles Google Consent Mode v2 better?

Both integrate with Consent Mode v2, and both pass the visitor choice to Google tags. Complianz generates its cookie policy dynamically based on what its scan finds, and its documentation covers jurisdiction specific rules in more depth. CookieYes is the more widely used plugin and its auto detection and categorisation are faster to set up. The difference is depth versus speed, not capability.

Do WordPress CMPs support the IAB TCF?

Complianz and CookieYes both support TCF 2.2 and 2.3, including the vendor list and the consent string handling that programmatic advertising needs. A site that runs ads through Google Ad Manager or a header bidding wrapper needs TCF support; a site that runs no ads does not, and should not pay for it in complexity.

Should I pick a CMP by price or by the cookie scan?

By the scan. The CMP that finds the cookies your plugins actually set is worth more than the cheaper one that misses them, because the missed cookies are the liability. Run both free tiers against your site, compare the scan results, and pick the one that found more of what is really there.