WooCommerce cookie consent & Consent Mode v2: a practical setup guide

WooCommerce gives you total control over your store, which also means nobody has wired consent together for you. A typical WooCommerce site has a cookie plugin, one or two Google plugins, a Meta plugin, a page builder and a caching plugin, and each of them can load scripts in its own way. Getting them to respect one consent choice is the job.

This guide takes you through it in a sensible order. Do it on a staging copy of your site first if you can.

Step 1: Inventory what's loading

Before you change anything, list every tracking tool on the site. Check:

• Plugins: look for Site Kit by Google, Google for WooCommerce, GTM4WP or another GTM plugin, Meta's Facebook for WooCommerce, TikTok, Pinterest, Hotjar, Microsoft Clarity and any "header and footer scripts" plugin.
• Theme settings: many themes and page builders have a box for custom header code.
• Google Tag Manager: if you use it, list the tags inside.
• The browser: run the Network-tab check from our 10-minute consent audit to catch anything you missed.

You're looking for duplicates (GA4 loaded by Site Kit and GTM, for example) as much as for trackers. Pick one loading method per tool and remove the others. Duplicates double-count your data, and usually only one copy respects consent.

Step 2: Choose a consent plugin that supports Consent Mode v2

You need a consent management platform (CMP) that can do three things:

1. Show a UK-compliant banner, with "Reject all" as easy as "Accept all" and nothing pre-ticked.
2. Send Google Consent Mode v2 signals: a denied default and an update when the visitor chooses.
3. Block non-Google scripts by category until consent is given.

Established options include Complianz, CookieYes, Cookiebot and iubenda, among others. Compare their current features and pricing yourself; what matters is that they tick all three boxes. In the plugin settings:

• Set the banner to opt-in for UK visitors (and EEA if you sell there).
• Switch on Google Consent Mode v2 and check the default is denied for all four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.
• Check the category mapping: Analytics to analytics_storage, and Marketing to the three ad signals.
• Turn on script blocking or auto-blocking and review the list of detected scripts.

If the plugin supports the WP Consent API, install that small plugin too. It's a shared standard that lets your CMP tell other plugins what the visitor accepted, and a growing number of plugins listen to it.

Step 3: Connect Google tags properly

How you do this depends on how GA4 and Google Ads are loaded. Use one of these routes.

Route A: Google Tag Manager

1. In GTM, go to Admin › Container settings and tick Enable consent overview.
2. If your CMP publishes a GTM template (Templates › Search Gallery), add it, set the defaults to denied and fire it on the Consent Initialization - All Pages trigger. Otherwise, let the CMP plugin output the default in the page <head> above the GTM snippet. Don't do both.
3. GA4 and Google Ads tags have built-in consent checks and respond to the signals automatically.
4. For non-Google tags in GTM (Meta, TikTok, Pinterest, Hotjar), open Advanced Settings › Consent Settings › Require additional consent for tag to fire and add ad_storage (ad pixels) or analytics_storage (analytics and heatmaps).

Route B: Site Kit or Google for WooCommerce

Both have their own consent settings. Site Kit, for example, includes a consent mode option for visitors in the UK and EEA. Turn it on, and check that your CMP plugin is the one actually collecting consent. Both work with the WP Consent API, so make sure the CMP and the Google plugin are talking to each other. Then verify with the tests below rather than trusting the toggle.

Step 4: Handle Meta Pixel and other non-Google tags

Meta Pixel, TikTok and Pinterest don't read Google Consent Mode. They need to be blocked until marketing consent is given. Your options:

• Let your CMP block them (auto-blocking or manual script rules), or
• load them through GTM with the additional consent check from Step 3, or
• use the platform's own consent mechanism. Meta's pixel supports fbq('consent','revoke') before initialising and fbq('consent','grant') after the visitor accepts.

If you send events server-side through Meta's Conversions API (many WooCommerce Meta integrations do), remember those events bypass the browser entirely. Check how your integration handles consent.

Step 5: Tame caching and speed plugins

This is the step WooCommerce stores most often miss, and it can silently undo everything above.

• Delay or defer JavaScript features (in WP Rocket, LiteSpeed Cache, Perfmatters, Autoptimize and similar) can push the consent default below GTM or delay the banner. Google tags then fire before the default exists. Exclude the CMP script, the consent default snippet and GTM from delay, defer, combine and minify settings. Most CMP vendors publish exclusion lists for popular caching plugins.
• Page caching must never store a page with one visitor's consent state baked in. Most CMPs handle this by deciding on the client side, but check your host's server cache too.
• Script "lazy loading" on interaction can make it look as though nothing fires before consent, when tags actually fire on the first scroll whatever the visitor chose. Test by scrolling before you click the banner.

Step 6: Make sure purchases are tracked once

Place a test order with consent accepted (a 100% discount coupon or a test payment gateway works). In GA4 DebugView you should see exactly one purchase event with the right transaction_id, value and GBP currency. Refresh the order-received page: no second purchase should appear. If it does, check whether two plugins are both sending purchases, or whether your tracking plugin has a "prevent duplicate purchase" option.

Step 7: Test the whole thing

Use a fresh private window for each test, with DevTools › Network open and Google Tag Assistant connected:

Test	Expected result
Land, don't click	All four signals denied; no _ga, _fbp or similar cookies; no Meta or TikTok hits
Reject all, browse and add to basket	Same as above on every page
Accept all	Signals granted (gcs=G111), cookies set, Meta PageView sent
Analytics only	gcs=G101, GA4 works, no ad pixels
Return visit after accepting	No banner; consent applied straight away
Withdraw via footer link	Tracking stops on the next page

Keep it working

Re-run the tests after every plugin update that touches tracking, caching or the theme, and reconcile GA4 purchases against WooCommerce orders monthly. A sudden change in the gap is often the first sign something broke. Our guide to why GA4 doesn't match your orders applies to WooCommerce too, just swap the Shopify reports for WooCommerce › Analytics.

This article is technical guidance, not legal advice. Platform menus change; check the vendor's current documentation if a setting has moved.