WordPress Comment Cookies: The Three Cookies Your Comment Form Sets, and the Checkbox That Gates Them

A visitor leaves a comment on your WordPress site, and three cookies land on their device that remember their name, email, and website for just under a year. Nobody asked them. WordPress has shipped the checkbox that asks them since version 4.9.6, and most sites have never turned it on. The cookies are small, the fix is one setting, and the gap is the whole story of WordPress consent: the tooling exists, and nobody enables it.

Three cookies, one checkbox

When a visitor leaves a comment, WordPress can store three cookies on their device: comment_author_[hash], comment_author_email_[hash], and comment_author_url_[hash]. They last just under a year, about 347 days, and they remember the commenter name, email, and website so they need not type them again. They are not strictly necessary. A visitor can comment without them, which is the test that decides whether consent is needed. Under the GDPR and the ePrivacy Directive, you need consent before setting them, because Article 5(3) of the ePrivacy Directive requires prior consent for storing information on, or gaining access to information stored on, a visitor device, with only two exceptions: cookies used only to carry out a communication over a network, and cookies strictly necessary to provide a service the visitor explicitly asked for. Comment cookies fit neither exception. They are a convenience, and a convenience needs a choice.

WordPress addressed this in version 4.9.6 with a consent checkbox, controlled under Settings, Discussion. When it is on, the comment form shows Save my name, email, and website in this browser for the next time I comment, and the cookies are set only if the visitor ticks it. The setting lives under Other Comment Settings, labelled Show comments cookies opt-in checkbox, allowing comment author cookies to be set. It is a single checkbox in the admin, and it has been there since 2018. The reason it is off on so many sites is not that it is hard to find. It is that nobody looks at the Discussion settings after launch, and the comment form works fine without it, because the cookies are invisible to the person who runs the site. The visitor is the only one who would notice, and they have no reason to check.

The cookies that do not need it

WordPress core session cookies are strictly necessary, and none of them needs consent. wordpress_[hash], wordpress_logged_in_[hash], and wordpress_test_cookie handle authentication, and wp-settings-[UID] holds signed-in users admin preferences. All of them exist to provide the service the visitor asked for, which is the ePrivacy exception. The confusion starts because the same site sets both kinds at once: necessary session cookies that need no consent, and comment cookies that do, plus whatever the plugins add. The GDPR compliance plugins in the WordPress directory exist for this split. The free GDPR Compliance and Cookie Consent plugin adds a banner, consent checkboxes for comments and popular form and e-commerce plugins, and a form where visitors can ask for a copy of their data or ask for it to be erased. Its consent expiry defaults to six months, and for WordPress comments the date and time the commenter ticked the checkbox is stored with the comment and shown in the comments list, which is the record Article 7(1) requires: the controller must be able to demonstrate that the visitor consented. A banner acceptance is remembered in a cookie on the visitor browser and, for logged-in users, in their user profile data, until it expires.

The plugin is a tool, not a guarantee, and its own description says so: it does not give legal advice and does not make a site compliant on its own. The owner remains responsible for the privacy policy, the cookies, and the way data is processed. That is the honest framing, and it applies to every CMP on this site. The checkbox is the easy part. The record is the part that matters when a choice is challenged.

The check that takes five minutes

Open Settings, Discussion, and confirm the comment cookies opt-in checkbox is on. Then log out, leave a comment without ticking it, and count the cookies. If comment_author_[hash] appears, the checkbox is not working, or a plugin is setting the cookies itself. Then leave a comment with the box ticked and confirm the three cookies appear with an expiry just under a year. Then check the comments list in admin: the date and time of the consent should be recorded with the comment. If any of those steps fails, the fix is not a new plugin. It is the setting that has been sitting in Discussion since 2018, waiting to be turned on. And if your site does not need comments at all, consider turning them off entirely. Many content sites disable comments and direct engagement elsewhere, and a comment form that collects personal data nobody reads is a liability with no upside.

Keep reading: WordPress Consent and the Admin Bar: The Cookies Your Own Dashboard Sets, Consent for WordPress Contact Forms: The Checkbox Is Not the Whole Job, Pre-Ticked Boxes Are Not Consent: Planet49 Said So in 2019.

Frequently asked questions

Which cookies does WordPress set for commenters?

Three: comment_author_[hash] stores the name, comment_author_email_[hash] stores the email address, and comment_author_url_[hash] stores the website URL. They last just under a year, about 347 days, and they exist so the commenter does not have to type the details again next time.

Do comment cookies need consent?

Yes. They are not strictly necessary, because a visitor can comment without them, so under the GDPR and the ePrivacy Directive you need consent before setting them. WordPress addressed this in version 4.9.6 with a consent checkbox, controlled under Settings, Discussion. When it is on, the cookies are set only if the visitor ticks the box.

Where is the WordPress comment consent checkbox setting?

Settings, Discussion, under Other Comment Settings: Show comments cookies opt-in checkbox, allowing comment author cookies to be set. When it is on, the comment form shows Save my name, email, and website in this browser for the next time I comment. If your site has comments enabled, check that the checkbox is active.

Which WordPress cookies do not need consent?

The session cookies: wordpress_[hash], wordpress_logged_in_[hash], and wordpress_test_cookie, plus wp-settings-[UID] for signed-in users admin preferences. All of them are strictly necessary, so none needs consent. The cookies that do need it come from comments, plugins, themes, and e-commerce extensions.