Applies to: WordPress Plugin v3.1.0+ WP Admin: Compliance > Cookie Consent tab > Technical Settings > WP Consent API

Overview

From v3.1.0 onward, Cookie Compliance for WordPress registers as a Consent Management Platform (CMP) for the WP Consent API. This means cooperative WordPress plugins (WooCommerce, Google Site Kit, Burst Statistics, and others) can read the visitor’s banner choice directly from a standard WordPress API, without you having to write any custom “trust the banner” snippets.

The integration is on by default. For most sites, you do not need to change anything — cooperative plugins start respecting consent automatically as soon as the WP Consent API plugin is active.

How It Works

1. You install the WP Consent API plugin (free, from WordPress.org). This plugin provides a shared vocabulary — functions like wp_has_consent('marketing') and constants like WP_CONSENT_API_CONSENT_TYPE — that every cooperative plugin agrees to use.
2. Cookie Compliance registers itself as the active CMP. While the WP Consent API toggle is on, Cookie Compliance v3.1.0+ tells the WP Consent API plugin: “I am handling consent on this site.” The banner then sets all five WP Consent API categories (functional, preferences, statistics, statistics-anonymous, marketing).
3. The visitor sees the banner and makes a choice. The Cookie Compliance banner passes the choice to the WP Consent API (wp_set_consent), which stores it in its standard cookie (wp_consent_…), keyed by category. Before the visitor’s first choice nothing is sent, so the WP Consent API’s own default applies (except in a browser that sends Global Privacy Control on a site with GPC Support on, where the banner records an opt-out straight away and every category except functional is set to deny). If the stored choice expires or is reset, any category still set to allow is set back to deny.
4. Cooperative plugins read the cookie. WooCommerce checks wp_has_consent('marketing') before enabling Stripe’s analytics features; Site Kit checks wp_has_consent('statistics') before sending pageviews to GA4; Burst reads it before recording anonymous stats. Each plugin self-gates.
5. Global Privacy Control (GPC) is honoured. When the visitor’s browser reports Global Privacy Control, the banner sets the marketing category to deny whenever it passes consent state. On a site with GPC Support on, marketing is allowed again only if the visitor then explicitly chooses Personalized. The check runs in the browser; the plugin does not read the Sec-GPC request header.

Currently Registered Consumer Plugins

These plugins read consent from the WP Consent API and self-gate when Cookie Compliance is the active CMP:

Plugin	Gates
WooCommerce	Stripe analytics, PayPal analytics, marketing add-ons
Google Site Kit	GA4, AdSense, Tag Manager, Search Console
Burst Statistics	Anonymous and cookie-based statistics
WP Statistics	First-party visitor tracking
Pixel Manager for WooCommerce	Meta, Google Ads, TikTok, Pinterest pixels
AddToAny Share Buttons	Social-share network calls
AFL UTM Tracker	UTM attribution cookies

The list grows as the WP Consent API ecosystem expands. For any plugin not on this list, autoblocking and category-based script gating still apply.

Configuration

In the WordPress admin, go to Compliance → Cookie Consent tab → Technical Settings (classic settings screen: Cookie Consent Settings) and locate the WP Consent API toggle.

• On (default) — Cookie Compliance registers as the CMP and writes consent into the WP Consent API cookie. Recommended.
• Off — Cookie Compliance does not register, and the WP Consent API reports no consent type, so cooperative plugins that rely on wp_has_consent() treat every category as allowed. Use this only if those plugins gate themselves another way.
• Greyed out (classic settings screen only) — The WP Consent API plugin is not installed or not active. In the current settings screen the toggle stays clickable but has no effect until that plugin is active. Install it from WordPress.org.

Category Mapping

The WP Consent API defines five standard categories. Cookie Compliance maps its own purpose categories to them as follows:

WP Consent API Category	Cookie Compliance Purpose
functional	Always granted (essential / strictly necessary)
statistics-anonymous	Allowed when the visitor’s choice includes Site Optimization (Balanced or Personalized)
statistics	Allowed when the visitor’s choice includes Site Optimization (Balanced or Personalized)
preferences	Allowed when the visitor’s choice includes Content Personalization (Balanced or Personalized)
marketing	Allowed when the visitor’s choice includes Ad Personalization (Personalized); denied under GPC unless the visitor explicitly chooses Personalized on a site with GPC Support on

Verifying the Integration

1. Open the site in a fresh incognito session.
2. Open the browser console (F12) and run:
   • consent_api.consent_type — holds one value for the whole site, based on the laws you selected: 'optin' if GDPR, UK PECR, LGPD or POPIA is selected, 'optout' if only CCPA, Other US State Laws or PIPEDA are selected, and an empty value if no laws are selected or the integration is off. It does not change with the visitor’s location.
   • wp_has_consent('functional') — returns true once the visitor has made a choice (on an opt-in site it is false before that, like every category).
   • wp_has_consent('marketing') — on a site with an opt-in law selected, should return false before the visitor chooses, and update when they make a choice.
3. Choose Personalized in the banner and re-run wp_has_consent('marketing'). It should now return true (it stays false in a browser that sends Global Privacy Control, unless the site has GPC Support on).
4. If you have a cooperative plugin installed (Site Kit, WooCommerce, etc.), confirm its dashboard reflects the visitor’s state — for example, Site Kit’s GA4 module should report “consent: granted” events.

Relationship to Google Consent Mode

Google Consent Mode v2 (GCM) and the WP Consent API are independent and complementary paths. Cookie Compliance fires both:

• GCM v2 gates Google-side tag execution — analytics_storage, ad_storage, ad_user_data, ad_personalization. This works for any GA4, Google Ads, or Floodlight tag, regardless of how it was added.
• WP Consent API gates server-side and plugin-level behaviour for cooperative consumer plugins.

If you use Site Kit as the source of your GA4 tag, both paths run: GCM tells the Google tag what consent state to operate under, and the WP Consent API tells Site Kit itself whether to even send the request. Both must be configured correctly. See the GTM / Tag Trigger Timing Troubleshooting article for the Site Kit-specific scenario.

Troubleshooting

The WP Consent API toggle is greyed out

The WP Consent API plugin is not installed or not active (the classic settings screen greys the toggle out; the current screen leaves it clickable but it has no effect). Install it from WordPress.org and activate it.

Cooperative plugin still fires before consent

Check the toggle is on, then check the plugin’s own settings. Some plugins (Site Kit, Burst) have their own “Consent Management” section that may need to be set to “Use a CMP” rather than “Always allow”. See the per-plugin troubleshooting in Autoblocking Not Working — Troubleshooting.

I had a manual “push consent into [plugin]” snippet from an older version

Remove it. With v3.1.0+ and the WP Consent API plugin active, manual bridges are redundant and can cause double-fires.

I want to opt out of the integration entirely

Turn the WP Consent API toggle off. Cookie Compliance will continue to operate normally; cooperative plugins will fall back to their own defaults.

Related Articles

• Autoblocking Not Working — Troubleshooting
• GTM / Tag Trigger Timing Troubleshooting
• Smash Balloon Compatibility
• WooCommerce and Cookie Compliance