Cookie banners are an unavoidable part of our web browsing experience these days. As much as we hate them as users, site owners need them to not only demonstrate to visitors that they have privacy options and to build trust, but to make sure they are complying with a variety of laws.
It’s a tricky world because the average site owner is not a lawyer but it feels like we have to become one to understand what is required of us.
You might think that your site doesn’t require a cookie plugin, but the vast majority will. Common features like Google Analytics (pretty much any Google product in fact), Facebook tracking pixels and more all indicate the need for cookie consent. This article does a good job of breaking this down in more detail. And PrivacyChecker has some useful articles on their blog.
There are so many options for WordPress plugins that manage cookie consent. Many are freemium, meaning there is a free version with paid upgrades, but I know most site owners, especially of smaller non-monetized sites, won’t want to add yet another subscription to their website maintenance costs.
I’ve tested many of the available plugins and and found that there’s only a few free options worth looking at, along with a couple of Premium.
What features does your cookie plugin need to have?
Again, I’m not a lawyer so this post cannot be taken as legal advice or with any guarantee that your specific site will be covered by any of these plugins.
From my own understanding, I identified some important features your cookie plugin should have:
- Compliance with GDPR (Europe) and possibly CCPA (California) laws.
There are others but I would say these are the minimums. GDPR led the way in setting privacy standards requiring explicit opt-ins from users. The California law on the other hand allows sites to provide an opt-out option. Satisfying these should give you good coverage. Technically small businesses and low traffic sites may not need to comply with CCPA, but the opt-out format is used by other jurisdictions so including it can be a good idea. - Compliance requirements are not based on where you or your website is located, but where your visitors are based. So don’t be misled into thinking that if you are in the US you only need a plugin that covers the CCPA – if your site receives visitors from other countries you need to meet their standards. So you either need geolocation to accurately target visitors with the correct consent method, or a cookie notice that covers all necessary option.
- The ability to automatically block cookie-related scripts until consent is given.
This means features like Analytics, YouTube videos and more, won’t be available until the visitor consents. - If your site is cached the cookie function still needs to be compatible.
- Don’t make your visitors jump through hoops to reject cookies. There should be something like a “reject all unnecessary cookies” button. This is actually required under GDPR – you can’t make it difficult to opt-out, so make sure your cookie solution provides clear buttons.
- Ideally the cookie plugin should scan your site to identify the cookies that are in use, otherwise you would need to do this manually.
- Records of consent should be logged.
- Respect GPC (Global Privacy Control) – this is a setting that users can set at the browser level to tell websites not to share or sell your personal info. Your cookie solution should detect and respect this accordingly.
- If you run ads on your site, you will need an IAB compliance features.
The best free cookie compliance plugin for WordPress: Faz Cookie Manager
In my opinion the best totally free, no strings attached option is the Faz Cookie Manager plugin. It has all the features mentioned above, and then some!
It’s pretty easy to set up, with one of the better onboarding experiences of all the plugins I tried, and also explains the features pretty well within the UI.
The second best free option (if your host uses Softaculous): CookieAdmin
A lot of hosts have Softaculous installed as an option for managing WordPress installations. They make their own cookie compliance plugin – CookieAdmin – which has a free and a Pro version. The free version is available in the WordPress repository to all users. The Pro version is available for free to those sites on hosting that uses Softaculous.
To see if you have access to the Pro version, go into your hosting cPanel and look for this icon: WordPress Manager by Softaculous.
This is unlikely to be available on managed WordPress hosts, but if you use a more general hosting company, like GreenGeeks, you should have this.
After clicking into that section, you should see a list of all your WordPress installs. Click on Manage Plugins, then you should see the option to install the Pro version of Cookie Manager.
A great free option for low-traffic sites: CookieYes
CookieYes has a free plan if your site receives less than 5000 page views per month. You’ll get the critical features for a site that size. If you outgrow it, paid plans start at $10/month.
The difference between CookieYes and Faz Cookie Manager and CookieAdmin is that CookieYes requires connection to a 3rd party service where you actually manage most of the settings. So you do have to set up an additional account for that. I imagine this could be beneficial for larger sites, to move the load of cookie scanning, consent logging etc off your own server.
Premium Options
If you are looking to go straight for a Premium solution, I would recommend going for Cookieyes.
Termageddon is highly regarded overall for their suite of compliance tools including auto-updating privacy policy generators. However, this will incur costs for the Termageddon subscription and their integration with the Usercentrics cookie banner, which has its own cost. So this is a solution best for higher revenue businesses.