WP Consent API and WooCommerce: The Translator Your Banner Needs

The WP Consent API is not a banner. It is a translator between your banner and every plugin that sets cookies, and without it, your banner and your plugins are speaking different languages while the cookies get set anyway.

The banner and the plugins were not talking

A consent management plugin can block third-party services like Facebook, Google Maps, and Twitter. But if a WordPress plugin places a PHP cookie, a consent management plugin cannot prevent it, because the cookie is set on the server, before the browser ever runs the banner's JavaScript. That is the problem the WP Consent API solves. It standardises the communication of accepted consent categories between plugins, so the banner and the plugins that set cookies can agree on what the visitor chose.

The API sorts consent into five standard categories: functional, statistics-anonymous, statistics, preferences, and marketing. A banner plugin records the visitor's choices through the API, and integrated plugins check those choices before they set cookies or track. With the API in place, all supporting plugins can use the same set of methods to read and register the current consent category, and the banner and the rest of the plugins work together instead of past each other.

The warning in the plugin's own documentation is worth reading in full: the plugin itself will not handle consent. It requires a cookie banner plugin and at least one other plugin that supports the API, and it shows you how many plugins you have without Consent API support. Installing the API without a banner is like installing a translator with nobody to translate for. The API enqueue post covered how the API is loaded in the theme; this post is about what it does once it is there.

The failure mode is silence

The failure mode to check is a site with the API installed but no consent management plugin configured. The consent_type is a function that wraps a filter, wp_get_consent_type. If no consent management plugin sets it, it returns false, which causes all consent categories to return true, allowing cookies to be set on all categories. The API is installed, the dashboard looks complete, and every cookie is allowed, because nothing is telling the API what the visitor chose.

The fix is to check the API's dashboard after installation and confirm that a consent management plugin is connected and that the consent type is set to opt-in. If the dashboard shows plugins without Consent API support, those plugins are setting cookies outside the consent framework, and they need to be replaced or configured. The API's own admin page lists them, which is the point of installing it: it shows you the gap.

The consent without plugin hooks post showed what happens when a site tries to manage consent without the API: the banner and the plugins disagree, and the cookies get set anyway. The API is the fix for that disagreement, but only if it is actually connected to a banner.

Service-level consent is the useful part

The API also supports service-level consent, which is the part most sites should be using. A consent management plugin can grant or deny consent for a specific service, like google-analytics or facebook-pixel, independently from its category, using wp_has_service_consent() to check and wp_set_service_consent() to set. When checking service consent, the API first checks whether explicit consent exists for that service, and the wp_consent_service_changed action hook fires when service consent changes, so plugins can listen for it.

WooCommerce is a consent-requiring plugin in the API's integration list. Its order attribution feature sets sbjs cookies, such as sbjs_session and sbjs_first, that record where a visit came from, and WooCommerce says the feature works with the WP Consent API, so a consent tool connected to the API can hold it back. It can also be switched off under WooCommerce, Settings, Advanced, Features. If your store runs WooCommerce and the API, check that the attribution cookies are gated by the API, because they are the cookies most likely to be set without consent.

Frequently asked questions

What are the five WP Consent API categories?

Five: functional, statistics-anonymous, statistics, preferences, and marketing. The API sorts consent into those five standard categories, and plugins check them before setting cookies or tracking. A banner plugin and a plugin that sets cookies both talk to the API, and that is how they agree.

Does the WP Consent API show a cookie banner?

No. The plugin provides a framework through which plugins can know if they are allowed to place cookies or track. It requires a cookie banner plugin and at least one other plugin that supports the API. It shows you how many plugins you have without Consent API support, and it improves compliance by letting the banner and the plugins communicate.

What happens if no consent plugin sets the consent type?

The consent_type wraps a filter, wp_get_consent_type. If no consent management plugin sets it, it returns false, which causes all consent categories to return true, allowing cookies to be set on all categories. That is the failure mode to check: a site with the API installed but no CMP configured is a site that allows everything.

Can consent be controlled per service, not just per category?

Yes. The API supports service-level consent, checked with wp_has_service_consent() and set with wp_set_service_consent(). A CMP can grant or deny consent for a specific service, like google-analytics or facebook-pixel, independently from its category. When checking service consent, the API first checks whether explicit consent exists for that service.

Does WooCommerce work with the WP Consent API?

WooCommerce is a consent-requiring plugin in the API's integration list, and its order attribution feature sets sbjs cookies that record where a visit came from. WooCommerce says the feature works with the WP Consent API, so a consent tool connected to the API can hold it back, and it can be switched off under WooCommerce, Settings, Advanced, Features.