Which Cookie Consent WordPress Plugin Should You Use?

The short version: For most small businesses, CookieYes or Complianz on WordPress covers you, both have free tiers that work, and the plugin itself matters far less than whether you've connected it to Google Analytics and Google Tag Manager so it blocks scripts before consent. Pick one, set it up in under an hour, and stop treating the banner as a tick-box exercise because that's where most sites quietly fail an audit.

Why the plugin choice matters less than you think

I've looked at a lot of small business websites over the years, and the cookie banner is nearly always the same story: someone installed a plugin, clicked through the setup wizard, and never touched it again. The banner shows up, looks tidy, and does almost nothing. Scripts still fire before anyone clicks a button. Google Analytics is still tracking visitors who hit "reject all." That's not a plugin problem. That's a configuration problem, and no plugin fixes it on its own.

So before we get into names, here's the uncomfortable bit: the plugin is maybe 30 percent of the job. The other 70 percent is blocking your scripts until consent is given, which involves Google Tag Manager, your theme's script tags, and sometimes a developer for an hour. Most "free cookie plugin" roundups skip this entirely because it's less fun to write about than a feature comparison table.

The four plugins worth considering

There are dozens of cookie consent plugins in the WordPress repository. Most of them are abandoned, poorly maintained, or built by companies that disappeared two years ago. These four are current, maintained, and used by real agencies, not just hobby sites.

CookieYes

CookieYes is my starting recommendation for most small businesses. The free plan covers up to 25,000 monthly page views and includes auto-blocking of scripts (Google Analytics, Facebook Pixel, YouTube embeds) before consent, a scannable cookie policy generator, and geo-targeting so EU and UK visitors get a GDPR-style banner while US visitors get something lighter. Paid plans start around $10 a month and add multilingual banners, consent logs you can export if a regulator ever asks, and Google Consent Mode v2 support, which matters more than people realise now that Google requires it for EEA traffic.

Setup takes about 25 minutes if you do it: install, connect your domain, run the automatic cookie scan (it crawls your site and finds every script), categorise anything it missed, then test the banner in an incognito window to confirm scripts are blocked, not just hidden.

Complianz

Complianz is the more technical option and it shows. The free version is capable, but the paid tier (around 69 euros a year for a single site) gives you a real legal wizard that walks through your specific situation: do you use Mailchimp, WooCommerce, embedded maps, Facebook Pixel, each one gets its own compliant clause in your privacy policy. If your business sells anything through WooCommerce or runs webinars through a third-party tool, Complianz's integration list is longer and more current than CookieYes's.

The trade-off is a steeper learning curve. The settings screens have more tabs, more toggles, and more jargon than most small business owners want to deal with on a Tuesday afternoon.

Cookiebot (via WP plugin)

Cookiebot is the one agencies default to for clients with multiple domains or anything touching financial services, because its scanning engine is the most thorough at finding cookies set by obscure third-party scripts. Pricing starts free for under 100 pages scanned monthly, then jumps to roughly 9 to 13 euros a month for small sites. It's solid but feels like it's built for bigger sites than a five-page local business website really needs.

WP Cookie Consent / Iubenda WordPress plugin

Iubenda deserves a mention because its privacy policy and cookie policy generator is arguably the most lawyer-reviewed of the bunch, and its plugin plugs straight into that. Pricing runs from about 27 euros a year for the basics. If you're a sole trader who wants the legal documents done and the banner is secondary, Iubenda is worth the money.

A worked example: picking between two plugins for a real site shape

Say you run a small accountancy practice with a five-page WordPress site: home, services, about, blog, contact form. You're using Google Analytics, a Calendly embed for booking consultations, and a YouTube video on the homepage explaining your services. You get maybe 1,800 visitors a month, mostly UK based with a handful from the US.

In this case, CookieYes free plan is the right call. Here's why: your traffic is well under the 25,000 page view ceiling, your scripts (Analytics, YouTube, Calendly) are all in CookieYes's auto-detect list, and you don't need multilingual support. The setup would look like this:

• Install CookieYes from the WordPress plugin repository
• Run the cookie scanner, let it crawl all five pages (takes about three minutes)
• Review the detected cookies, it will likely flag Google Analytics, YouTube embed cookies, and the Calendly iframe automatically
• Switch on auto-blocking so these don't fire until the visitor clicks accept
• Generate the cookie policy page and link it from your footer
• Test in an incognito browser: open dev tools, check the Network tab, confirm no analytics request fires until you click accept

Total time: about 40 minutes, and the whole thing costs nothing unless you later want Consent Mode v2 reporting, at which point you're looking at the paid tier for roughly 10 dollars a month. If the same accountancy practice later adds a client portal with WooCommerce for invoice payments, that's the point to reconsider Complianz, because its WooCommerce-specific consent clauses are more developed.

Where this connects to your analytics, not just your banner

This is the part most "best cookie plugin" articles leave out entirely, and it's the part that determines whether you're compliant or just look compliant. A cookie banner that doesn't block Google Analytics until consent is given isn't protecting anyone, it's decoration. If you're not sure whether your setup requires visitor consent before tracking fires, read this breakdown on visitor consent and Google Analytics before you assume your current plugin has it covered, because the honest answer depends on your traffic region and what you're tracking, not just whether you ticked a box in the plugin settings.

And if you're newer to analytics altogether and not fully sure why any of this matters for your marketing, it's worth stepping back to what Google Analytics does for your business before you spend money on a consent tool to protect data you're not even using yet. I've seen small business owners pay for a premium cookie plugin while their Analytics setup is tracking almost nothing useful, which is backwards.

One more technical point that trips people up: a lot of businesses assume the Analytics tracking code only needs to sit on the homepage. If you're not certain whether it needs to be on every single page of your site (it does, and there's a reason why), this piece on whether Google Analytics code needs to be on every page clears it up, and it directly affects where your consent plugin needs to be blocking scripts too.

What gets small businesses in trouble

It's rarely the choice of plugin. It's one of these three things, and I've seen all three repeatedly on sites that otherwise look well run:

• The banner has a "reject all" button that's visually tiny or grey compared to a bright "accept all" button, which is not technically illegal everywhere but is exactly the kind of dark pattern regulators have started fining companies over in the EU
• Scripts are set to "block" in the plugin dashboard but the theme or a separate plugin (like a page builder) loads YouTube or Facebook embeds directly in the page HTML, bypassing the consent plugin entirely
• Nobody ever revisited the cookie scan after adding a new booking tool, chat widget, or ad pixel six months later, so half the current tracking isn't declared anywhere

Fix the first one by making your buttons visually equal. Fix the second by auditing your homepage HTML source for embed codes, not just trusting the plugin's scan was complete. Fix the third by putting a calendar reminder in, literally, to re-scan every quarter.

What this costs if you outsource the whole thing

If you'd rather not touch Google Tag Manager yourself, a reasonable small agency or freelancer will set up a cookie plugin, including script blocking and policy pages, for somewhere between 150 and 400 pounds as a one-off job, depending on how many third-party scripts your site runs. That's cheaper than most businesses assume, and far cheaper than a GDPR complaint investigation, even if the fine never materialises, because the time cost of responding to a regulator's letter is its own expense. If your consent setup is tangled up with a wider analytics or martech mess, that's usually the point where bringing in outside help to sort your site's data and tracking setup pays for itself in the hours it saves you.

My actual recommendation

If you want one plugin and want to stop reading comparison articles: install CookieYes, use the free tier until you outgrow the page view limit, and spend the 40 minutes blocking your scripts rather than just displaying a banner. Move to Complianz only if you're running WooCommerce or need deep legal-wizard hand holding. Consider Cookiebot only once you're managing more than one domain or enterprise-level script sprawl. And if you want a wider view of consent tools beyond just WordPress plugins, including options that cover apps and non-WordPress sites too, the comparison of consent management platforms for small business is worth a read before you commit.

Frequently asked questions

Is a free cookie consent plugin enough for a small business website?

Yes, for most small UK or US small business sites under around 25,000 monthly page views, a free plugin like CookieYes covers script blocking, a basic banner, and a generated cookie policy, which meets the practical requirements most small businesses face.

Do I need a cookie banner if I only use Google Analytics?

If you have any visitors from the UK, EU, or similar regions and you're setting non-essential cookies through Analytics before consent, yes, you need a banner that blocks that tracking until the visitor agrees, not just a notice that it exists.

Which cookie plugin is best for a WooCommerce store?

Complianz tends to have the most developed WooCommerce-specific consent clauses and integrations, making it the better fit once your site is taking payments and storing customer data beyond a simple contact form.

Can a cookie plugin alone make my site GDPR compliant?

No. The plugin is one piece; you also need your scripts blocked before consent, a clear reject option equal in prominence to accept, and a cookie policy kept current as you add new tools, which is where most small business sites fall short even with a good plugin installed.