WooCommerce Cookie Compliance — Complete GDPR Guide for 2026

Why WooCommerce stores need cookie compliance

GDPR applies to any business that processes personal data of EU residents — regardless of where your WooCommerce store is hosted or where your business is incorporated. A shopper in France buying from a US-based WooCommerce store triggers GDPR obligations the moment tracking cookies are set.

The ePrivacy Directive (often called the "cookie law") reinforces this: non-essential cookies cannot fire until the user has actively opted in. Pre-ticked checkboxes don't count. Continued browsing doesn't count. Consent must be freely given, specific, informed, and unambiguous.

WooCommerce is particularly exposed because it's built on WordPress — a platform with thousands of plugins, most of which set cookies without any built-in consent management. Every plugin you install is a potential compliance gap that your cookie consent banner may not cover.

Default WooCommerce cookies — categorised by type

Before configuring consent, you need to know exactly what your store sets. WooCommerce and WordPress core set several cookies by default, before any plugins are considered.

Common WooCommerce plugins that set cookies requiring consent

These are the most common sources of consent-requiring cookies across WooCommerce stores. If you use any of these, your cookie banner must cover them — and they must not fire before consent is granted.

WooCommerce Analytics & MonsterInsights (GA4)

WooCommerce's built-in analytics sets _wc_session_ variants, but if you connect Google Analytics 4 via MonsterInsights or a manual GTM implementation, the _ga, _gid, and _ga_* cookies are set immediately on page load unless you implement Consent Mode v2. MonsterInsights has a consent mode integration, but it requires explicit configuration — it is not on by default.

Jetpack

Jetpack sets its own analytics cookies (jetpackState, Jetpack site stats pixel) for WordPress.com stats. These are analytics cookies that require consent. Jetpack also integrates with several third-party services (Akismet, VideoPress, social sharing) that each introduce their own cookies. Check Jetpack's active modules — each active module is a potential cookie source.

Mailchimp for WooCommerce

The official Mailchimp plugin sets tracking cookies for e-commerce purchase attribution and email campaign tracking. These cookies (typically _mc_id variants) are marketing cookies that require consent. The plugin fires its tracking scripts on page load regardless of consent state unless you explicitly configure otherwise.

Google Analytics via Google Site Kit

Google Site Kit is the official Google plugin for WordPress and handles GA4, Google Ads, and Search Console integration. By default it loads GA4 immediately on every page view. Since Google Consent Mode v2 became mandatory for Google Ads remarketing in March 2024, Site Kit requires explicit Consent Mode v2 configuration — not just a cookie banner.

How to audit cookies on a WooCommerce site

A cookie audit tells you every cookie your store sets, which plugins set them, and whether you're disclosing them correctly. Do this before configuring your consent banner — consent for cookies you don't know about is meaningless.

Option 1: Manual audit with Chrome DevTools

Option 2: Automated scanning with CookieGuard

CookieGuard crawls your WooCommerce store across all key page types, discovers every cookie set by WooCommerce core, plugins, and custom scripts, and classifies them by category. It catches cookies that manual audits miss — including those triggered by user interactions — and re-scans automatically when your store changes.

Consent Mode v2 for WooCommerce + Google Tag Manager

If you use GA4 or Google Ads, Consent Mode v2 is now mandatory — Google stopped modelling conversion data for advertisers without it in March 2024. For WooCommerce stores, the most common setup is Google Tag Manager (GTM) deployed via a plugin like Google Site Kit, MonsterInsights, or a manual <script> tag in your theme.

The core requirement: four consent signals must default to denied before GTM fires any tags. Those signals update to granted when the user accepts the relevant cookie category.

// This tag fires BEFORE all other GTM tags via the Consent Initialization trigger
// Set all four signals to 'denied' by default
window.dataLayer = window.dataLayer || [];
function gtag(){ dataLayer.push(arguments); }

gtag('consent', 'default', {
  ad_storage: 'denied',
  analytics_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied',
  wait_for_update: 2000
});

// Fire this tag when your CMP updates consent state
// Map your banner's consent categories to Google's four signals
gtag('consent', 'update', {
  ad_storage: window.cookieConsent.marketing ? 'granted' : 'denied',
  analytics_storage: window.cookieConsent.analytics ? 'granted' : 'denied',
  ad_user_data: window.cookieConsent.marketing ? 'granted' : 'denied',
  ad_personalization: window.cookieConsent.marketing ? 'granted' : 'denied'
});

CookieGuard vs manual compliance for WooCommerce

WooCommerce GDPR Cookie Compliance Checklist (2026)

Use this checklist to verify your store's compliance status. Every Critical item is a potential fine.

Common WooCommerce cookie compliance mistakes

These are the issues we see most frequently when scanning WooCommerce stores:

1. Plugin conflicts bypassing the consent banner

Many WooCommerce compliance setups break at the plugin interaction layer. A typical failure mode: your cookie consent plugin blocks GTM by adding a type="text/plain" attribute to the GTM script tag, but a separate plugin (Google Site Kit, MonsterInsights) also injects GTM — independently, without the blocking attribute. Result: two GTM instances, one blocked, one not. All tracking fires pre-consent through the unblocked instance.

Fix: Use exactly one method to load GTM. If you use a consent plugin that manages GTM, remove all other GTM injection points in wp-admin, plugins, and theme code. Verify with the Network tab in DevTools that GTM loads exactly once.

2. Caching plugins serving cookies before consent

WP Rocket, W3 Total Cache, and LiteSpeed Cache can serve cached page HTML that already contains inline scripts with pre-existing cookie values. Even if your consent plugin correctly blocks fresh page loads, a cached version may bypass this. This creates an intermittent compliance gap that's hard to catch because it only affects users who hit the cache.

Fix: Configure your caching plugin to exclude pages from cache for first-time visitors (no consent cookie present), or use a consent plugin with native caching integration that modifies cached HTML at serve time. Test after every cache flush by clearing cookies and loading from a cold cache.

3. Mailchimp and email plugins firing at checkout

Email marketing plugins (Mailchimp for WooCommerce, Klaviyo, ActiveCampaign) often fire their tracking scripts on the order confirmation (thank you) page to capture purchase data and trigger post-purchase flows. If a customer rejected marketing cookies at the banner, these scripts should not fire — but many default plugin configurations don't check consent state before firing on checkout completion.

Fix: Check whether your email plugin offers a Consent Mode integration or supports conditional script loading. If not, wrap the plugin's tracking call in a check against your CMP's consent state API before the script fires on the thank you page.

4. Checkout cookie gaps from payment processors

Payment processor integrations (Stripe, PayPal, Klarna) often inject their own JavaScript and set cookies on checkout pages for fraud detection and session continuity. Some of these are technically essential (required for the payment to function). Others are analytics or marketing cookies for the payment processor's own tracking. Distinguish between the two: essential payment cookies don't need consent; processor analytics cookies do.