Set up cookie consent and Google Consent Mode on WordPress

Add a cookie banner that passes visitors’ choices to Google tags, then check acceptance, refusal and changed preferences.

• Outcome: Tracking & measurement
• Tools: WordPress, Site Kit by Google, Google Analytics 4, Google Tag Assistant, Complianz, WP Consent API
• Responsible: People who manage a WordPress website and its visitor tracking
• Estimated time: 50 minutes

Scope

This SOP covers:

• Configure a free Complianz banner with Site Kit and WP Consent API
• Use Site Kit’s consent defaults for the EEA, United Kingdom and Switzerland
• Check all four Google consent signals before and after visitor choices in the browser you use for this procedure

This does not cover:

• Decide which privacy laws apply to the business
• Write or approve legal policies or accept data-processing agreements
• Configure worldwide or custom regional consent defaults
• Guarantee legal compliance or future modeled reporting
• Install tracking for non-Google services
• Audit compatibility across multiple browsers and devices

Requirements

• WordPress administrator access and a current site backup
• Site Kit installed and connected to WordPress, plus an existing GA4 property and web stream receiving website visits
• The intended GA4 web stream’s Measurement ID, starting G-, supplied by the website owner or tracking installer
• The website owner’s approved privacy and cookie policy URLs, business contact details, and instructions to use an opt-in banner for the EEA, United Kingdom and Switzerland
• Owner-confirmed website services, analytics/ad use and any already accepted Google data-processing agreement; do not guess these answers
• A browser test from the EEA, United Kingdom or Switzerland, where this method’s denied defaults apply

Related SOPs

• SOP 001: Install Google Tag Manager on a WordPress site using Site Kit
• SOP 012: Install GA4 through Google Tag Manager
• SOP 135: Create your first Google Analytics account and website setup

01. Match the setup to the website’s privacy instructions

Record the owner-approved collection mode: basic blocks Google tags until consent; advanced can send cookieless pings while consent is denied. A Denied signal alone does not prove that all requests are blocked. Compare actual behavior with that decision before publishing. See Google’s consent mode behavior. This recipe checks the named European regions; do not assume identical defaults elsewhere. Record any other required regions and test them separately.

A banner collects choices. Consent Mode tells Google tags how to act on those choices; it does not write your privacy policy.

1. Create a note called Cookie consent setup with sections Website, Owner instructions, and Checks. Enter the website URL, the intended G- Measurement ID supplied by the website owner or tracking installer, and the policy URLs. That ID tells Google where this website’s visits belong. In Owner instructions, enter the supplied business details, services and banner requirements.

2. In WordPress, open Site Kit > Settings > Connected Services and inspect Analytics. Compare the website’s measurement ID with Website in your note. Inspect Plugins and your Google Tag Manager container, if installed, to identify any existing cookie banner or Consent Mode implementation.

   • Warning: Two banners or Consent Mode managers can send contradictory choices. Have the website maintainer remove the conflicting setup before continuing.
   • Warning: Keep one GA4 installation. If Tag Manager already sends GA4 visits, Site Kit must not place a second Analytics tag.

3. Connect Site Kit to your existing GA4 stream so its consent controls can work. If Analytics is already connected, go directly to its saved settings check below.

   • Warning: Site Kit may turn its Analytics code on when you connect. If another tool already places GA4, check and turn Site Kit’s code off immediately after setup, before testing visitors’ choices.

   1. If Analytics is not connected, open Site Kit > Settings > Connect More Services > Analytics > Set up Analytics. Sign in with the account that manages the property and allow the requested access. On Connect Service, check the selected account, property and web stream against Website in your note; change them if they point to another site.

   2. For a new connection, keep Enable enhanced measurement off. That option would enable extra automatic visit actions; this guide keeps your existing tracking setup. Click Set up to finish the connection, then open Site Kit > Settings > Connected Services > Analytics > Edit.

   3. Check Place Google Analytics code. Turn it off if Tag Manager or another tool already places the GA4 tag; keep it on if Site Kit places your website’s only GA4 tag. For a new connection, turn Plugin conversion tracking off to avoid adding automatic form or purchase events. Click Confirm changes, then reopen Analytics settings to check the saved choices.

4. In Checks, add columns Choice, analytics_storage, ad_storage, ad_user_data, and ad_personalization. The first controls Analytics cookies. The other three control advertising cookies, sending user data for advertising, and personalized advertising. Denied and Granted are the states you will check.

02. Install the banner and connect it to Site Kit

Use one manager: Site Kit sends Google consent instructions, WP Consent API carries the choices, and Complianz displays the banner.

1. In WordPress, open Plugins > Add New Plugin, search for Complianz – GDPR/CCPA Cookie Consent by Complianz, then Install Now > Activate. Choose No, Thanks if an optional Website Scan offer asks for email registration. Open Complianz > Wizard and use Continue to proceed past optional scan or external-service connection offers; the local banner setup does not require those accounts.

2. Open Site Kit > Settings > Admin Settings. Turn Consent Mode on. If Site Kit shows an Install button for WP Consent API, use it to install and activate the plugin.

3. Return to Complianz > Wizard. In General, choose the owner-approved region for the opt-in banner and fill in the supplied business contact details. Select the existing privacy and cookie policy pages or enter their approved URLs when the wizard asks.

   • Warning: Use the owner’s actual privacy decisions. A generated page or a plugin’s suggested answer does not establish legal compliance. If the required region or policy needs a paid feature, stop and ask the owner to choose another supported setup.

4. In Wizard > Consent > Statistics, choose the option matching the tool that places your existing GA4 tag: Yes, and Google Tag Manager fires this script when Tag Manager places it, or Yes, with Google Analytics when Site Kit places it directly. Choose Yes when asked to require consent for statistics. Save and continue.

   • Warning: Select data-processing, sharing or IP-handling assertions only when the owner confirms they are true. Leave unknown assertions unchecked and ask the owner; never claim an agreement has been accepted.

5. In Wizard > Consent > Services, answer the advertising, first-party marketing and embedded-service questions from the owner’s website inventory. For a third-party service you use, select it and answer its hosting questions truthfully. Save and continue. The banner may offer Marketing for third-party services even when the site does not run ads.

   • Warning: A consent category gives permission; it does not install advertising tags. Keep service answers factual rather than inventing ads to make a category appear.

6. In Wizard > Consent > Plugins, confirm Google Site Kit is detected. In Statistics configuration, keep Complianz’s own Google Consent Mode V2 option at No; Site Kit provides Consent Mode through WP Consent API. Continue without adding another Analytics tag or signing up for an external cookie-database service.

7. Configure the public banner and its persistent preference control in Complianz > Consent Banner.

   1. Choose Accept - Deny - View Preferences under Categories. Use the wording and policy links from Owner instructions. Keep Disable banner off, then save.

   2. Set Manage consent display options to Show everywhere, then save. This prevents the plugin’s mobile-hide option from hiding the preference control on smaller screens. On the public website, use Manage consent to reopen the choices after an initial selection.

   3. Complete the remaining wizard questions from Owner instructions. At Finish, set Show consent banner and Enable script and cookie blocker to Yes, then finish setup. Use Continue for an optional external cookie-database connection instead of registering. Clear the site/page cache if the website uses one.

03. Check the public website’s consent behavior

For basic mode, a missing Google destination before acceptance can be expected: confirm blocking through the browser Network and storage panels, then check the consent update after acceptance. For advanced mode, verify defaults before measurement and inspect the effective updates below. In both modes, repeat acceptance, refusal and withdrawal on mobile and after navigation. Record observed requests/cookies as well as consent signals. Site Kit’s consent documentation explains its regional defaults and the WP Consent API integration.

The banner must change Google’s signals, not merely disappear. Test the real published website.

1. End any existing Tag Manager Preview session. Clear saved site data for this website only in your browser’s site settings, then connect its homepage in Google Tag Assistant. Keep the banner unanswered. Click the intended G- measurement-ID chip along the top, then the website page-title row in the left timeline, then Consent. This page-level view shows the page’s current consent. Record the date and test region in Checks.

2. Select the earliest Consent event in the left timeline. Under API Call, click the rendered call to expand its fields. Check that analytics_storage, ad_storage, ad_user_data and ad_personalization all default to Denied in the taught regions. Add a Before choice row to Checks. For subsequent choices, return to the page-level Consent view described above: when On-page Update is a dash, its On-page Default value still applies.

   • Warning: In advanced mode, an empty Consent tab or defaults set after measurement begins means the setup is unfinished. In basic mode, validate the initial blocking and then inspect consent after the tag is allowed to load. Recheck the Site Kit toggle, WP Consent API, conflicting implementations and cache before continuing.

3. On the website, click Accept. Return to the page-level Consent view and read the effective values. Statistics consent grants analytics_storage; the visible Marketing category grants the three advertising signals, even without an Ads tag. If Marketing is absent, those stay Denied. Add an Accept row to Checks. For command details, select the latest Consent event and expand its rendered API Call; that event’s table may show the earlier state.

4. Open Manage consent on the website. Enable Statistics and turn Marketing off, if present, then Save preferences. Return to the page-level Consent view, read its effective values, and add a Statistics only row to Checks.

5. Open Manage consent again, refuse Statistics and Marketing, then save or click Deny. Read the effective values in the page-level Consent view and add a Withdraw after accept row to Checks. Reload the page, return to that view, and confirm the refusal is retained.

6. Disconnect Tag Assistant, clear this website’s saved site data again, and reconnect. Click Deny on the fresh banner. Select the intended G- measurement-ID chip, the website page-title row, then Consent. Read the effective values and add a Deny on first visit row to Checks.

7. For a denied and an accepted visit, use the intended G- measurement-ID chip, website page-title row and Consent tab to check the Google tag’s current effective values against Checks. In owner-approved advanced mode, a tag may load and send cookieless requests while consent is denied. In basic mode, confirm that Google measurement remains blocked until consent. Evaluate the result against the selected mode. End the session when finished.

04. Give the owner the working setup

Keep the settings and observed choices together so future site changes can be checked.

1. Send the website owner Cookie consent setup. Include the policy links, plugin names and the completed choice table. Ask them to review the public banner wording and repeat these checks after adding tracking services or changing the banner.