Every website targeting European users must notify visitors about cookie usage. Since 2018, GDPR (General Data Protection Regulation) has transformed this from a gentlemen's practice into a legal requirement with potential fines up to 4% of annual revenue. And the ePrivacy Directive adds specificity: consent must be explicit, informed, and revocable.

But the reality is: a small WordPress site owner doesn't hire a lawyer for a banner. They look for a plugin, free, not slowing down the site, with auto-blocking of third-party scripts. And here the market has changed. The Popups plugin, which was recently a popular solution for cookie windows, has been closed since July 2022 due to a vulnerability. Using it is not allowed, it's a security hole.

Fortunately, 2026 offers mature alternatives. In this guide, step-by-step setup of a cookie banner on WordPress through Complianz (free, 1+ million active installations, tested on WordPress 7.0) and a review of alternatives for different budgets and scenarios.

💡 Quick overview:

• Choosing a plugin: Complianz as the main one, CookieYes and GDPR Cookie Compliance as alternatives
• Installing and running the setup wizard: 10 minutes to a ready banner
• Scanning the site, blocking third-party scripts, customizing appearance
• Testing: Consent Mode, consent withdrawal, accessibility

What the law requires: the minimum a site owner needs

GDPR and the ePrivacy Directive require a site to do three things before installing any tracking cookies:

• Inform which cookies exactly, for what purpose, who sets them (own / third parties).
• Obtain explicit consent, pre-checked boxes are not consent. The user must actively click "Accept".
• Allow withdrawal, a "Manage consent" / "Cookie settings" link must be available at any time after acceptance.

Plus for California, CCPA/CPRA applies, where notification and opt-out option (Do Not Sell My Personal Information) are sufficient. For Brazil, LGPD, for Canada, PIPEDA, for South Africa, POPIA. A good plugin covers them all out of the box.

Important nuance for 2025-2026: Google Consent Mode v2 became mandatory for sites showing Google ads in the European Economic Area. This is a protocol where Google tags (Analytics, Ads, Floodlight) are not simply blocked until consent, but work in "cookieless mode", sending anonymized pings. Complianz and CookieYes support Consent Mode v2 natively, without dancing with Google Tag Manager.

Comparison table: top 3 cookie plugins for WordPress (2026)

Installing and configuring Complianz: step-by-step guide

Step 1: installing the plugin

Go to the WordPress admin panel: Plugins → Add New. In the search bar, enter "Complianz", click "Install" on the plugin from Complianz author, then "Activate". After activation, you are immediately greeted by a welcome screen with a "Start Wizard" button.

Step 2: setup wizard

This is the main reason to choose Complianz: instead of 30 manual settings, the plugin asks 10-15 questions about your site and forms the correct configuration itself. Go through it sequentially.

On the first screen, the wizard asks which regions the site is configured for. Select all relevant ones: European Union, United Kingdom, United States (for CCPA/CPRA). You can add Canada (PIPEDA), Brazil (LGPD), Australia, South Africa, the choice doesn't slow down the site, but simply adds corresponding legal documents.

Next, site type: business website, webshop, or personal blog. This affects whether consent is mandatory for statistics. For a WooCommerce online store, the plugin automatically picks up all cart and payment cookies.

On the third step, the wizard determines whether you need a cookie notice at all: it analyzes the target audience and cookie type. For European traffic, the answer is almost always "yes". Here you also choose the banner template: Cookie Wall (blocks access without consent, allowed in the EU for strictly necessary cookies), Accept/Dismiss, Consent per Category, Consent per Service.

The final wizard step generates a Cookie Policy, a full legal document based on the answers, compiled by IT lawyers. It is automatically inserted on a separate page and updated when settings change. This saves 500-1000 euros on lawyer drafting services.

Step 3: scanning cookies

Go to Complianz → Dashboard → Cookie Scan. Click "Scan", the plugin goes through the site pages and frontend, collecting all cookies: own, third-party (through integrated services like Google Maps, YouTube, Recaptcha, Facebook), plugins.

The scanner result is a table with fields: cookie name, domain, duration, function. Complianz automatically pulls cookie descriptions from cookiedatabase.org, the largest open cookie database. No need to google what _ga or _fbp does, the description is already filled in English.

The scanner runs automatically once a week. If a new plugin or script appears on the site, you will receive a notification about new cookies in the dashboard. This is important: GDPR requires the Cookie Policy to be current at all times.

Step 4: auto-blocking third-party scripts

The Complianz → Integrations section is where the magic happens. The plugin knows signatures of popular services and blocks them before consent automatically. The out-of-the-box list: Google Maps, YouTube/Vimeo embeds, Facebook/Instagram widgets, Twitter/X, Google AdSense, HubSpot, ActiveCampaign, Recaptcha, and dozens of others.

What this looks like for the user: instead of a YouTube video, a static placeholder with the text "Click Accept to load video". Instead of a Google map, a placeholder with the "Marketing" category. No JS loads until the user's explicit consent. This is exact compliance with the letter of the ePrivacy Directive.

For blocking custom scripts, use the Script Center: add the script URL, link it to a cookie category (functional / statistics / marketing). Dependencies are supported: for example, Facebook Pixel depends on Marketing consent and doesn't load until the user has given this consent.

The plugin doesn't use jQuery, the entire banner and blocking is in pure JavaScript. This gives a plus to PageSpeed and no conflicts with themes using React/Vue.

Step 5: customizing banner appearance

Complianz → Cookie Banner → Styling. Four presets: animated, classic, minimal bottom, center popup. Each is customizable: button colors, border-radius, fonts, screen position, appearance animation.

1
/* Example: minimal bottom banner with rounded buttons */
2
.cmplz-cookiebanner .cmplz-buttons .cmplz-btn {
3
    border-radius: 8px;
4
    padding: 10px 24px;
5
    font-weight: 600;
6
    transition: background 0.2s;
7
}
8
.cmplz-cookiebanner .cmplz-btn.cmplz-accept {
9
    background: #1a56db;
10
    color: #fff;
11
}
12
.cmplz-cookiebanner .cmplz-btn.cmplz-accept:hover {
13
    background: #1e40af;
14
}
15
.cmplz-cookiebanner {
16
    box-shadow: 0 -4px 24px rgba(0,0,0,0.12);
17
}

The CSS block is added to Complianz → Cookie Banner → Custom CSS and applied without clearing the cache. The banner is accessible (WCAG 2.1 AA): all buttons have aria labels, colors are contrasting, keyboard control works. Since June 2025, the European Accessibility Act has been in effect, and Complianz is ready for it.

Step 6: Consent Mode v2 and consent recording

If you use Google Analytics, Ads or Floodlight, activate Google Consent Mode. In Complianz Premium, this is one checkbox: Complianz → Dashboard → Consent Mode → Enable. In CookieYes, available for free.

Consent Mode v2 transmits two critical signals to Google: analytics_storage (can you read/write Analytics cookies) and ad_storage (can you use advertising cookies). Before consent, Google tags send anonymized pings, page view data without user identifier. This allows you not to lose 100% of data when cookies are declined.

The Complianz → Dashboard → Proof of Consent section stores records of each user's consent action: time, IP (hashed), set of categories. For GDPR, this is an accountability requirement, you must prove that consent was given in case of a supervisory authority request.

Alternatives: CookieYes and GDPR Cookie Compliance

CookieYes (1M+ installations), the main competitor to Complianz. Pros: Consent Mode v2 in the free version, 5 banner templates, 3,220 reviews on wordpress.org. Minus: the cookie scanner is less detailed, some data goes to CookieYes cloud servers for enriching descriptions. If zero-cost with full compliance is your priority, take CookieYes.

🔗 CookieYes on WordPress.org | 🔗 CookieYes website

GDPR Cookie Compliance from Moove Agency (300K+ installations), a simpler option. Three templates, basic color and text settings, no auto cookie scanner. Plus: minimal footprint, no external requests. Minus: uses jQuery, which adds dependency. Suitable for simple business card sites with minimal third-party services.

🔗 GDPR Cookie Compliance on WordPress.org

Which plugin to remove: dead and dangerous solutions

The Popups - WordPress Popup plugin (previously popular for creating cookie windows) was closed on WordPress.org on July 5, 2022 with the note "Security Issue". Not updated for 6 years, not tested with WordPress versions above 5.3.21. If you have it installed, remove it immediately and replace it with one of the three plugins above.

The same goes for any custom jQuery solutions from 2015-2020 tutorials: they don't support Consent Mode, don't block scripts before accept and are incompatible with modern Gutenberg and React themes. Ten minutes of installing Complianz or CookieYes gives more compliance than a week of manual coding.

Testing: checklist before launch

• Cookie banner appears, open the site in Incognito, check that the banner is visible, doesn't cover critical content on mobile.
• Accept / decline works, after clicking "Accept", Analytics and embedded videos load. After "Decline", they don't load.
• Consent withdrawal, the "Manage Consent" / "Cookie Settings" button is visible, clickable, opens the same banner with categories.
• Scanner worked, in the Complianz dashboard all cookies are identified, no "Unknown" rows.
• Cookie Policy in place, the /cookie-policy-eu/ page (or equivalent) opens, contains an up-to-date list of cookies and purposes.
• Google Consent Mode, in the browser (F12 → Application → Cookies) before consent there are no _ga/_gid cookies; after accept, they appear.

⁉️🤔 Frequently asked questions

Is a cookie banner needed if the site doesn't use analytics cookies?

Yes, if the site has embed elements: YouTube videos, Google Maps, social media buttons. They set cookies when loading. Plus many hosting providers and WordPress themes set technical cookies, which also need to be declared. Complianz shows "no cookies detected", then a banner is not needed. For a purely static site without a single embed and without server cookies, a banner is not required, but there are very few such sites on WordPress.

What's the difference between Consent Mode v2 and simple blocking?

Simple blocking: no consent → Google tag doesn't load → zero data about the visit. Consent Mode v2: no consent → Google tag loads in cookieless mode, sends anonymized pings (country, time, referral source without user identifier). This gives 30-70% recovered data in GA4 when cookies are declined without violating GDPR.

Can one plugin be used for cookies and for marketing popups?

No. A cookie banner is a legally significant compliance element. A marketing popup is marketing. Mixing them creates risk: if the user declined cookies and the popup continues to collect email, it's a violation. Use Complianz/CookieYes for cookies and a separate plugin (OptinMonster, Convert Pro) for marketing popups.

What to do if the site is in multiple languages?

Complianz integrates with Polylang, WPML, qTranslate-X and Loco Translate. The banner, Cookie Policy and all legal documents are automatically translated to the active site language. For Russian, the translation is complete. For a multilingual site on WPML, setup takes 5 minutes: Complianz → Settings → Enable WPML integration.

Do consent records need to be stored?

GDPR Article 7(1) requires the data controller to "demonstrate that the data subject has consented". Complianz stores a record of each consent action: timestamp, set of categories, IP hash, unique consent ID. This data is your proof of compliance during an audit. The retention period is configurable, by default, 12 months.

What to choose: Complianz or CookieYes?

If you need maximum compliance out of the box (legal documents, auto-blocking, scanner) and are willing to pay for Premium if needed, Complianz. If the priority is zero-cost and Consent Mode v2 for free, CookieYes. For a simple site without complex integrations, GDPR Cookie Compliance. All three are tested on WordPress 7.0 and actively supported in 2026.

Which cookie consent plugin to install in 2026

The choice comes down to three scenarios, and each is covered by a working free solution.

If you are launching a commercial project with traffic from the EU, install Complianz. The setup wizard in 10 minutes gives you: a cookie scanner, auto-blocking for 30+ services, ready Cookie Policy from IT lawyers, accessibility out of the box and consent recording. For a WooCommerce online store, integration is already in the wizard, nothing needs to be added.

If the budget is zero and Consent Mode v2 is critical right now, take CookieYes. Consent Mode v2 in the free version, 5 banner templates and the best rating on wordpress.org (3,220 ratings). Note: some data goes to the CookieYes cloud for enriching cookie descriptions, for strict corporate policies this may be a stop factor.

If the site is simple, a business card / landing page / personal blog with a couple of embeds, GDPR Cookie Compliance from Moove is enough. Minimal settings, no external requests, 300,000+ sites use it. The plugin is a bit simpler than the two leaders, but does its job without surprises.

The main rule for 2026: don't use dead and unsupported solutions. Popups is closed due to a security issue. Old custom jQuery banners are not compatible with Consent Mode and WordPress 7.0. Switching to a modern plugin is an hour of work and several years of calm compliance.