What Cookies Does WordPress Set, and Do I Need a Banner?
What Core Actually Sets
WordPress's own cookies are functional in nature — authentication cookies keeping a logged-in user's session active, and an optional comment cookie remembering a commenter's details for convenience on their next visit. These are commonly categorized as "strictly necessary" under regulations like GDPR, which generally don't require explicit consent for cookies essential to the site's basic functioning.
Where Consent Requirements Actually Come From
- Analytics tools (Google Analytics and similar) typically set tracking cookies that most interpretations of GDPR and similar regulations do require consent for, since they're not strictly necessary for the site's basic function.
- Advertising and marketing pixels (Facebook Pixel, retargeting tools) almost universally require consent, being explicitly designed for tracking rather than site functionality.
- Jurisdiction matters significantly — GDPR (EU/UK) has specific, relatively strict consent requirements, while other regions have their own, sometimes less prescriptive rules; a blanket answer doesn't fit every site's actual legal situation.
- A proper cookie consent plugin can detect and categorize cookies in use, then manage the appropriate consent flow, rather than needing this built manually from scratch.
Assessing and Implementing This
- Audit what cookies are actually set across the site, including from every plugin and any third-party embed, not just WordPress core.
- Confirm the legal requirement for the store's specific jurisdiction and audience, ideally with proper legal advice given the real consequences of non-compliance.
- Implement a proper cookie consent solution if required, covering all non-essential cookies in use, not just the most obvious ones.
Need help auditing cookies and implementing proper consent? See WordPress bug fix.