GDPR Cookie Consent by WebToffee
GDPR Cookie Consent by WebToffee is one of the most installed cookie consent plugins for WordPress. It adds a configurable banner, a preference centre, a cookie scanner and a consent log, and can automatically block analytics and advertising scripts until the visitor opts in. Because it runs inside your own WordPress site, the banner logic and the consent records stay on your server rather than on a third party platform, which simplifies the international transfer question for the consent data itself.
What does GDPR Cookie Consent by WebToffee do?
What the WebToffee GDPR Cookie Consent plugin is
GDPR Cookie Consent, published by WebToffee, is one of the most installed cookie consent plugins for WordPress, with millions of active installations. It runs entirely inside your WordPress site and adds a configurable cookie banner, a consent preference centre, a built in cookie scanner, and a consent log. Because it is self hosted, the banner logic and the consent records stay on your own server rather than on a vendor platform.
What data and cookies it processes
The plugin stores a visitor decision in first party cookies such as viewed_cookie_policy and CookieLawInfoConsent, plus one cookielawinfo-checkbox cookie per category covering necessary, functional, analytics, performance and advertisement. These cookies hold yes or no flags and the categories accepted, typically for one year. When consent logging is enabled, the plugin saves a record in your WordPress database with a pseudonymous identifier, the date, the banner version and the categories chosen, which you control entirely.
GDPR and ePrivacy implications
The consent cookies are strictly necessary to remember the visitor choice, so they benefit from the exemption in article 5(3) of the ePrivacy Directive and do not require consent themselves. The plugin helps you meet the GDPR requirement that analytics and advertising scripts must not run before consent, and the accountability duty of article 5(2) to keep proof of consent. Its value depends on enabling the script blocker so that tags such as Google Analytics or Meta Pixel are genuinely held back.
Consent, script blocking and data location
Use the auto blocking or the shortcode based blocking to ensure non essential scripts only load after the matching category is accepted, and verify this with the browser developer tools. Because GDPR Cookie Consent is self hosted, it does not by itself transfer personal data to a third country: the consent data lives in your WordPress database in your chosen hosting location. Remember that the trackers it controls, such as US analytics or advertising tags, may still create their own transfers once consent is given.
Practical compliance steps
Run the cookie scanner, map each discovered cookie to a category and a clear description, and keep that list in sync with your privacy and cookie policy. Make the reject option as visible as accept, expose a persistent link to reopen the preference centre, and set a sensible consent expiry. Enable the consent log and export it when a supervisory authority asks for evidence, and re test the banner after every plugin or theme change.
GDPR Cookie Consent by WebToffee and the GDPR
- Legal basis
- The consent cookies (viewed_cookie_policy, CookieLawInfoConsent, cookielawinfo-checkbox-*) are strictly necessary to record the visitor choice and are exempt under ePrivacy art. 5(3). Keeping the consent log relies on accountability and the consent conditions of GDPR art. 5(2) and 7. The trackers the plugin gates require consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3).
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive 2002/58/EC, TTDSG (Germany), LOPDGDD (Spain), LIL (France), CNIL cookie guidelines 2020, CCPA
Impact assessment (DPIA)
The plugin records consent rather than profiling visitors, so it does not by itself require a DPIA. Assess the trackers it governs instead: a DPIA may be needed for the analytics or advertising tools that fire after consent, especially when they involve profiling or transfers to the United States. Document the script blocker configuration, the consent retention period and where your WordPress database is hosted.
Sample text for your banner
This website uses the WebToffee GDPR Cookie Consent plugin to manage your cookie choices. It stores strictly necessary cookies such as viewed_cookie_policy and cookielawinfo-checkbox cookies that remember your preferences for up to one year, all kept on our own servers. No analytics or advertising cookie is set until you accept the corresponding category, and you can change or withdraw your consent at any time from the cookie settings link.
What GDPR Cookie Consent by WebToffee sets and contacts
- Tracking method
- WordPress plugin: first party JavaScript consent banner with cookie scanner, consent log and optional automatic script blocker
- Server location
- Runs entirely inside the website own WordPress hosting. The banner logic, the consent cookies and the consent log are stored in the publisher WordPress database wherever it is hosted. WebToffee receives no visitor data; only licence and update checks reach webtoffee.com for the paid edition.
Cookies set (5)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| viewed_cookie_policy | First party, persistent | 1 year | Records that the visitor has seen the banner and stores the overall consent decision. |
| CookieLawInfoConsent | First party, persistent | 1 year | Stores a summary of the categories the visitor accepted or rejected. |
| cookielawinfo-checkbox-necessary | First party, persistent | 1 year | Stores consent for the strictly necessary cookie category. |
| cookielawinfo-checkbox-analytics | First party, persistent | 1 year | Stores consent for the analytics cookie category. |
| cookielawinfo-checkbox-advertisement | First party, persistent | 1 year | Stores consent for the advertisement cookie category. |
Third-party domains contacted (2)
webtoffee.comstore.webtoffee.com
Frequently asked questions about GDPR Cookie Consent by WebToffee
Can't find your question? Write to us, we answer fast.
Which cookies does the WebToffee GDPR Cookie Consent plugin set?
It sets first party cookies that record your choice: viewed_cookie_policy and CookieLawInfoConsent store whether you consented and which categories you accepted, and a cookielawinfo-checkbox cookie is set per category such as necessary, analytics and advertisement. They typically last one year and contain preference flags, not your name.
Do I need consent to use this plugin?
No. The cookies the plugin uses to remember a choice are strictly necessary and exempt under article 5(3) of the ePrivacy Directive. The plugin is the mechanism that collects consent for other trackers, so enable its script blocker to keep analytics and advertising from running before the visitor accepts.
What is the legal basis?
The consent cookies rely on the ePrivacy exemption for strictly necessary cookies, while keeping the consent log relies on your accountability and consent obligations under GDPR articles 5(2) and 7. The analytics and advertising scripts that the plugin gates need consent under GDPR article 6(1)(a) and ePrivacy article 5(3).
Does the plugin transfer data to the United States?
Not on its own. Because it is self hosted, the consent data stays in your WordPress database at your hosting location. Transfers come from the third party scripts the plugin controls, for example a US analytics or advertising tag, once consent is given, so document those tools separately.
Do I need a DPIA?
The plugin itself does not require a DPIA because it logs consent rather than profiling people. Assess the trackers it governs: a DPIA may be needed for large scale analytics or advertising that profiles users or transfers data to the US, under GDPR article 35.
How do I implement it compliantly?
Enable the automatic or shortcode script blocker, run the cookie scanner and categorise every cookie, make reject as easy as accept, and add a persistent settings link so visitors can withdraw consent. Keep the cookie table aligned with your cookie policy and turn on the consent log.
What are the alternatives?
Other WordPress and SaaS options include CookieYes, Complianz, Cookiebot, Axeptio, Didomi and the open source Klaro. Self hosted plugins such as this one and Complianz keep consent data on your own server, while SaaS platforms add hosted scanning and IAB TCF support.
How do I keep my cookie policy up to date?
Re run the cookie scanner regularly, review the detected cookies, and publish the generated cookie table in your policy through the plugin shortcode. After adding any new tag, re scan, categorise the new cookie and confirm the blocker rule before publishing.
Cookie Control
Cookie Control is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Cookie Control manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Cookie Control ensures worldwide privacy compliance.
Moove GDPR Consent
Moove GDPR Consent is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Moove GDPR Consent manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Moove GDPR Consent ensures worldwide privacy compliance.
Consent Manager
Consent Manager is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Consent Manager manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Consent Manager ensures worldwide privacy compliance.
Quantcast Choice
Quantcast Choice is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Quantcast Choice supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Quantcast Choice ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Clym
Clym is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Clym integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Clym helps organizations maintain robust websites that meet user expectations and technical requirements.
Usercentrics
Usercentrics is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Usercentrics integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Usercentrics helps organizations maintain robust websites that meet user expectations and technical requirements.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.