Which WooCommerce Cookies Require Consent?
WooCommerce sets several types of cookies on visitor browsers. Some are strictly necessary, but others require explicit consent under GDPR:
The WooCommerce entry in our third-party services catalog summarises its documented cookies and consent requirements.
- woocommerce_cart_hash (session) - strictly necessary, no consent required
- woocommerce_items_in_cart (session) - strictly necessary, no consent required
- _wc_session_ (session) - strictly necessary, no consent required
- woocommerce_recently_viewed - functional/analytics, consent required
- _ga, _gid (Google Analytics) - analytics, consent required
- _fbp (Facebook Pixel) - marketing, consent required
- Affiliate tracking cookies - marketing, consent required
When Is Consent Required on WooCommerce?
Under GDPR Article 6 and the ePrivacy Directive, consent is required before setting any non-essential cookie. For WooCommerce stores, this means:
Since WooCommerce runs on WordPress, our WordPress cookie consent guide covers the rest of your site.
- Before loading Google Analytics or any tracking pixel
- Before storing behavioral or preference data beyond the shopping cart
- Before any third-party script that sets cookies on behalf of advertisers
- Before affiliate or referral tracking cookies are written
- Before any A/B testing or personalization cookies are activated
How to Make Your WooCommerce Store GDPR-Compliant
Follow these five steps to bring your WooCommerce store into full compliance:
- Audit all cookies: use a scanner tool to list every cookie set on your site before and after consent
- Implement a Consent Management Platform (CMP): integrate a CMP that supports Google Consent Mode v2 and blocks non-essential scripts until consent is given
- Configure Google Consent Mode v2: set the four consent parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) via your CMP before the gtag snippet fires
- Update your privacy policy and cookie notice: clearly list all cookies, their purpose, and retention period
- Test the consent flow: verify that declining consent actually prevents cookies from being set using browser developer tools
Common Mistakes on WooCommerce Stores
Pre-ticked consent boxes. GDPR Article 7(2) explicitly prohibits pre-ticked boxes. Consent must be an active, unambiguous affirmative action.
Our guide to GDPR consent validity explains the other conditions that consent must meet.
Bundled consent for all purposes. Visitors must be able to consent separately for analytics, marketing, and functional cookies. Bundling all into one checkbox violates the specificity requirement.
Consent banners that do not block scripts. Showing a banner without actually blocking the cookies underneath it provides no legal protection. The CMP must intercept script execution.
The WooCommerce installation guide shows how to add the FlowConsent snippet with WPCode and take control of extension pixels.
No renewal of consent. EDPB guidelines recommend renewing consent at least every 12 months, or sooner if the cookie policy changes.
Ignoring the reject-all path. The ICO (UK) requires that rejecting cookies be as easy as accepting them. A prominent 'Reject All' button must be present on the first layer.
For inspiration, browse our GDPR cookie banner examples and best practices.
WooCommerce GDPR Compliance Checklist
- Scan your store for all cookies (first-party and third-party)
- Identify which cookies are strictly necessary vs. non-essential
- Install and configure a GDPR-compliant CMP
- Implement Google Consent Mode v2 with all four parameters
- Verify scripts are actually blocked when consent is declined
- Add a visible 'Reject All' button on the first consent layer
- Update your privacy policy with a full cookie list
- Set consent renewal reminders (at least annually)
- Test consent flows on mobile and desktop browsers
- Document consent records to demonstrate compliance to regulators
Conclusion
GDPR compliance for WooCommerce is not optional. The ICO and EDPB have issued substantial fines for cookie consent violations. A properly configured CMP protects your business and builds customer trust.
Scan your WooCommerce store for free to identify which cookies need consent: Free WooCommerce Cookie Scan