Cookie Consent Plugins for WordPress: Five Tools Compared
A consent banner is easy to install and easy to get wrong. This is what EU law asks for before a cookie is set, what Google Consent Mode v2 changed for ad accounts, and how the five best known WordPress plugins differ once you look past the banner design.
A cookie consent plugin has become standard equipment on almost any WordPress site that runs ads, analytics or embedded third party content. The banner itself is the easy part. Every one of these plugins can put a box on the screen. The differences show up underneath: whether scripts are actually held back, whether a visitor can say no as easily as yes, and whether the record you would need in an argument exists at all.
This article compares the five plugins that turn up in almost every WordPress recommendation list, sorts out the legal background without turning it into a scare story, and explains why Google Consent Mode v2 is barely optional any more once AdSense or Analytics is involved.
What EU law asks for before a cookie is set
First, the honest caveat: this is orientation, not legal advice. If your setup is unusual or the stakes are high, take the details to a qualified lawyer or your data protection officer. What follows is the framework most WordPress sites operate in.
The GDPR applies to you if you offer goods or services to people in the EU or monitor their behaviour there, regardless of where your company or your hosting sits. For most non-essential cookies the lawful basis is consent under Art. 6(1)(a) GDPR, and Art. 7 adds the condition that catches people out: you have to be able to demonstrate that consent was given.
The rule that specifically covers storing or reading information on someone's device is older and sits elsewhere. Article 5(3) of the ePrivacy Directive requires consent for that access, whether or not personal data is involved, with an exception for what is strictly necessary to deliver the service the user asked for. A cart, a login session or a language preference falls under that exception. An analytics or advertising cookie does not.
The ePrivacy Directive is a directive, so each member state wrote its own national implementation, and the wording differs from country to country. Germany is one example among many: § 25 TDDDG, the successor to the former TTDSG, is the provision German sites are measured against. If your audience sits in one particular country, that country's implementation is the text that matters for you, and it is worth checking rather than assuming.
Two things are consistent across implementations and worth building for. Timing comes first: consent has to be obtained before the technology that needs it loads, not afterwards. A banner that merely covers the page visually while scripts already run behind it does not meet that. Second, refusing has to be as easy as agreeing. A large coloured Accept button next to a quiet Settings link, with the reject option several clicks deep, is treated as a dark pattern by many supervisory authorities.
Google Consent Mode v2 and why ad accounts care
Since March 2024 Google has expected sites with EEA visitors to use Consent Mode v2 wherever Google Ads, AdSense remarketing, Google Analytics or Floodlight tags are in play. Without it you can expect reduced measurement data, weaker remarketing, and in the worst case restrictions on the Google Ads or AdSense account itself.
Technically Consent Mode v2 signals four states to Google tags: ad_storage, analytics_storage, ad_user_data and ad_personalization. While no consent exists, the tags run in what Google calls basic or advanced mode with reduced and partly modelled data instead of sending nothing at all.
This is where consent plugins separate. Not every tool wires Consent Mode v2 up automatically. Check that specifically before you choose, because retrofitting it by hand is considerably more work than switching on a feature that is already there.
What a cookie consent plugin has to do
Whether a plugin holds up shows in a handful of technical details that many site owners only notice when a complaint or a regulator's question arrives.
- It blocks scripts for real: Analytics, AdSense, YouTube embeds and the rest may only load after agreement, not in parallel while the banner is still open.
- Refusing is as easy as agreeing: an equivalent button on the first layer, with no detour through submenus.
- Consent can be withdrawn at any time: a permanently reachable link or small icon that lets visitors change or revoke their choice later.
- Consent is logged: a record with a timestamp and the categories chosen, for the day you have to prove what was agreed.
- Granular categories instead of all or nothing: necessary, functional, statistics and marketing selectable separately.
- Consent Mode v2 supported natively: without you adding code by hand to connect AdSense and Analytics properly.
Five WordPress consent plugins compared
Borlabs Cookie, Real Cookie Banner, Complianz, Cookiebot and CookieYes all meet the requirements above. Where they differ is price, handling and the kind of site they were built for. Pricing changes more often than feature sets, so check the current plans with the vendor before you decide.
| Free version | Pricing model | Distinctive feature | Best suited to | |
|---|---|---|---|---|
| Borlabs Cookie | No, trial only | One-off payment per site, optional renewal | Very granular script blocker templates, TCF 2.2 support | Agencies and shops with a complex script mix |
| Real Cookie Banner | Yes, solid basics | Subscription, tiered by services and domains | Automatic service scanner, German handling concept | Starting free and scaling up when needed |
| Complianz | Yes, extensive | Freemium, premium as subscription or one-off | Automatic geo-IP region detection | International sites with visitors from several countries |
| Cookiebot | Yes, for small sites | Subscription, tiered by pageviews | Automatic cookie scan of the whole domain | Larger and corporate sites needing a CMP |
| CookieYes | Yes, generous | Subscription, usually cheaper than Cookiebot | Fast, simple setup | Smaller sites on a limited budget |
Borlabs Cookie
Borlabs Cookie comes from Germany and has a reputation among agencies as one of the most precise options: ready made blocker templates for dozens of services, clean TCF 2.2 handling and an interface built deep into WordPress. The catch is that there is no permanently free version, you pay per site, and anyone looking after many domains watches the cost grow accordingly.
Real Cookie Banner (devowl.io)
Real Cookie Banner, also from Germany, already offers solid basics in its free version on WordPress.org, including an automatic scanner that detects embedded services. That makes the start cheap. Advanced integrations and more domains move you into the paid subscription tiers fairly quickly.
Complianz
Complianz from the Netherlands stands out with an unusually generous free version and automatic geo-IP detection, which shows different legal bases and banner variants depending on the visitor's country. That is useful if your audience spans several jurisdictions. In exchange the interface feels more dashboard heavy than the leaner WordPress native alternatives.
Cookiebot (Usercentrics)
Cookiebot scans the entire domain automatically for cookies and trackers in use and offers a very wide language selection, which is one reason it often ends up on international corporate sites. The downside: pricing follows pageview volume and can climb noticeably on a high traffic blog or shop.
CookieYes
CookieYes is quick to set up, has a generous free tier and usually costs less than Cookiebot. In return, the WordPress specific integrations and design options in the free version are a little more limited than with Borlabs Cookie or Real Cookie Banner. For smaller sites on a modest budget it remains a fair choice.
Consent inside the ad plugin: Adjet ships its own banner
Anyone serving ads with Adjet runs into consent anyway, because AdSense and most other ad networks set personalised cookies. That is why version 1.8.0 added a consent banner directly inside Adjet, including support for Google Consent Mode v2. There is nothing to retrofit, it is part of the plugin.
The idea behind it is straightforward. The banner templates sit in Adjet, you pick your own privacy policy, and ads only load once consent has been given, tied to the same logic the consent cookie gating already uses. If you are serving ads you need consent management regardless, so keeping one category system instead of two is one less thing to maintain. Since version 2.1.0 there are several cookie illustration variants for the banner, and Adjet Pro can A/B test consent banners against their acceptance rate.
If you need a dedicated consent tool for the whole site because analytics, embeds and web fonts are in play alongside advertising, one of the plugins compared above is still the right call. Adjet's consent cookie gating keeps working with those. If you are weighing up a move from another ad plugin, our Ad Inserter alternative comparison covers that side of it.
No banner for the banner's sake
A cookie consent plugin is more than a mandatory strip at the bottom of the page. It has to block scripts technically, make refusing as easy as agreeing, allow withdrawal, log what was agreed and ideally bring Consent Mode v2 with it. Which of the five fits you depends mostly on budget, site size and whether your audience sits in one country or many. All five are established, serious tools, and none of them is a wrong answer. If you serve ads with Adjet, the built in banner may save you a second tool entirely. Prices for our own plugins, Adjet included, are on the pricing page. None of this replaces legal advice, so take individual questions to someone qualified in your jurisdiction.
Serve ads with Adjet, keep consent in view
Adjet manages your ads centrally, with consent cookie gating for common tools, lazy loading and local statistics. Its own consent banner has been on board since version 1.8.0.
Frequently asked questions
Is a cookie banner always required?
No. If your site only uses strictly necessary cookies, for a cart, a login or a language setting, you do not need a consent banner. As soon as analytics, marketing or embedded third party services such as AdSense, Google Analytics or YouTube embeds are involved, consent is generally required under the GDPR and the national implementation of the ePrivacy Directive that applies to your audience. The key point is timing: consent has to be collected before the technology loads, not after.
What is Google Consent Mode v2?
Consent Mode v2 is a standard through which a website tells Google tags such as AdSense, Analytics or Google Ads whether consent exists and how far it goes. Since March 2024 Google effectively requires it for advertising and measurement services with EEA visitors. Without it you can expect reduced and partly modelled measurement data, weaker remarketing and, in the worst case, restrictions on the Google Ads or AdSense account. Not every consent plugin supports it automatically, so check that specifically when choosing.
Is a free cookie consent plugin enough?
For many smaller sites yes. Real Cookie Banner, Complianz and CookieYes all bring solid basics in their free versions. With a complex script mix, several domains under your care or an international audience, a paid tier with more automation often pays off, for example automatic service scanning or geo-IP detection. Borlabs Cookie is the only one of the five compared here with no permanently free version at all.
What happens if I set cookies without a consent tool?
Setting cookies that require consent without valid consent breaches the applicable data protection and ePrivacy rules, whether or not personal data is processed in the process. Depending on the country that can lead to complaints, regulatory action or fines. How serious the risk is in any individual case depends on the scale and type of technology involved, for instance whether a single analytics tool or several ad networks run without consent. Strictly necessary cookies, for a cart or a login, are exempt from the requirement.
Does Adjet have its own consent banner?
Yes. Since version 1.8.0 Adjet ships a consent banner of its own, including Google Consent Mode v2. The banner templates sit in Adjet, you select your own privacy policy, and ads only load once consent has been given. Since version 2.1.0 there are several cookie illustration variants to choose from, and Adjet Pro can A/B test consent banners against their acceptance rate. If you already run a dedicated consent tool for the whole site you can keep it: Adjet's consent cookie gating works with common external consent tools.
