GDPR and WordPress: cookie banner, Consent Mode and Google Analytics

The banner was there, and so was Google Analytics

I’ve seen this on a lot of sites. A cookie banner in plain view, nicely laid out, and underneath it Google Analytics firing in the first second, before any click at all. The banner becomes a formality, and data collection is unlawful from the very first page view. That’s what I wanted to avoid on pierreturpin.org.

Two texts, three rules

Two texts apply to a European website. The GDPR governs what you do with personal data. The ePrivacy Directive governs what you place on the visitor’s device, and it’s the one that requires the banner: nothing non-essential can be set before the person has said yes.

In Luxembourg, the supervisory authority is the CNPD. In France it’s the CNIL, whose cookie guidelines serve as the practical reference for many French-speaking sites. I take three rules from them. Refusing must be as easy as accepting, so no big “Accept all” button with a “Refuse” tucked away in a sub-menu. Consent has a lifespan, thirteen months at most and six months recommended. And nothing non-essential loads before the choice is made.

Since March 2024, Google has added a requirement of its own. Any advertiser using its services in the European Economic Area must send Consent Mode v2 signals, a kind of traffic light the site passes to Google’s tools to say what the visitor has accepted. Even with no Google Ads campaign, it’s worth complying, so that Google Analytics 4 respects the visitor’s choice properly.

Complianz: what I set

On pierreturpin.org, I use the free version of Complianz. I picked it because the plugin doesn’t just display a banner: it holds back known scripts until the visitor has answered. That’s the difference between a decorative banner and one that actually protects.

Setup runs through a wizard. It scans the site, spots the services in use and asks simple questions. Then, in the Complianz settings, I defined the cookie categories: functional, statistics, marketing. The visitor can accept everything, refuse everything or pick category by category. I took the time to check, in the banner’s appearance settings, that the “Refuse” button has the same size and the same colour as “Accept”. It’s the first thing the authorities look at.

Complianz also writes the cookie policy page from the wizard’s answers. I read it through and filled in the gaps, but the skeleton was there. The link to that page appears in the banner and in the footer.

Site Kit: Google Analytics waits its turn

I installed Google Analytics 4 through Site Kit, Google’s official plugin. Once the account is connected, Site Kit offers a “Consent Mode” switch in its settings. I turned it on. The Google tags then start with every signal set to “denied”, like a red light, and turn green according to the answer given to the banner. Until the visitor accepts statistics, GA4 sets no identifying cookie.

The bridge between the two plugins is called the WP Consent API. It’s a small WordPress standard, a shared language, that lets a banner say “the visitor accepted statistics” and lets another plugin hear it. Complianz sends the signal, Site Kit receives it and adjusts the tags. In Complianz, the Integrations page lists the plugins and services it recognises; that’s where I checked that Site Kit had been detected.

The three-minute test

A configuration is worth nothing until it’s tested. I open a private window, load the site, click nothing, and look in the browser’s developer tools at the list of cookies that have been set. Before consent, only functional cookies should be there, including the Complianz one that remembers the choice. No Google cookie. After clicking “Accept”, the GA4 cookies appear. After clicking “Refuse”, still nothing.

I repeat this test after every plugin or external service I add. It’s the only way to know whether something has slipped in behind the banner’s back.

What gets past the banner

A YouTube video or a Google Maps map embedded in a page fetches its resources from Google’s servers and can set third-party cookies as soon as it’s displayed, without the banner ever being consulted. Complianz can replace these embeds with a thumbnail and a button, which only loads the video after consent. That’s switched on in its settings, under Integrations, by ticking the services to block. For a contact-page map, a static image with a link to directions sidesteps the problem entirely.

Google’s reCAPTCHA is another stowaway. It loads on every page where the form is present, and it talks to Google before the visitor has typed a single letter. On this site, my Contact Form 7 form uses a honeypot: a field invisible to humans, which bots fill in blindly. Zero third-party cookies, and spam stays under control. For a brochure site, that’s more than enough.

Some plugins, finally, add their own scripts without listening to anyone: a social sharing button, a chat widget, an advertising pixel. Before installing a plugin that talks to an external service, I check whether it declares compatibility with the Consent API or whether Complianz knows how to block it. If not, I look elsewhere.

Hosting and email matter too

The GDPR doesn’t stop at the browser. Whatever a visitor types into the contact form is stored somewhere and passes through a mail server. This site is hosted with Infomaniak in Switzerland, a country the European Union recognises as offering an adequate level of protection. The site’s emails go out through the same host’s sending server, which avoids handing contact messages to a third-party American service.

A site that’s spotless on cookies but open to intrusion exposes the same data through another door. I covered the basic security settings in an article on securing WordPress.

The list I check for every site

• The banner blocks non-essential scripts before the choice, and refusing is as visible as accepting.
• Google Analytics runs through Consent Mode v2 and sets nothing before statistics are accepted.
• YouTube videos, maps and social media embeds are replaced by a placeholder until consent.
• Forms don’t use reCAPTCHA, or only after marketing consent.
• The cookie policy and privacy policy are up to date and reachable from every page.
• Hosting and email delivery stay in Europe or in a country recognised as adequate.

On a site you know, all of this comes together quickly. On an existing client site, the longest part is the inventory: the plugins that have piled up, the videos forgotten in old pages, the form someone added one day with reCAPTCHA “just to see”. And the result isn’t only legal. A site that loads fewer third-party scripts is faster, and an honest banner inspires more trust than a wall of text designed to make people click “Accept”.

It all starts with that first test in a private window. If Google cookies turn up before a single click, the rest of the configuration doesn’t matter.