Cookie consent for WordPress, set up in minutes.

Yes — that’s the Pro scanner. It loads your site the way a browser does and lists every tracker it detects, where it came from, and whether it’s covered by consent. Recognized trackers are intercepted and gated automatically, and scheduled scans email you when something new appears.

No — and for most sites it doesn’t need to be. CoreConsent isn’t a certified consent management platform or a registered IAB TCF vendor. It handles consent and sends Google Consent Mode v2 signals directly, rather than through the IAB Transparency & Consent Framework. If your advertising setup specifically requires a TCF-registered CMP — some programmatic and ad-exchange integrations do — check that before relying on CoreConsent for it. As with compliance generally, what your situation requires is your call.

Add it the supported way so CoreConsent controls it: configure it as a service in Settings → CoreConsent (there’s a one-click template), or tag the script with type="text/plain" and a data-cc-name attribute. CoreConsent then loads it only after the visitor consents. Avoid pasting a gtag snippet high in your theme’s head, where it can run before the consent default is set.

Yes, in all versions, including free. CoreConsent sets all v2 consent signals to denied by default and updates them when the visitor makes a choice. Your Google tags load only after consent.

CoreConsent’s region rules let you decide where and how the banner appears — for example for the EU/EEA, the UK, or specific US states — and it honors the Global Privacy Control signal: visitors sending GPC have marketing services declined automatically until they choose otherwise, in line with US opt-out-of-sale laws. It gives you the controls to match your approach to your audience, but it doesn’t decide your legal obligations for you. If you’re unsure which rules apply to you, check with someone qualified in privacy law.

On your own site. Consent choices are kept in the visitor’s browser and, with the Pro consent log, in your own WordPress database — nothing about your visitors is sent to a third-party consent platform. CoreConsent does use the Freemius service for licensing and an optional, skippable sign-up, but that only ever involves your site and admin details, never visitor data.

Yes. Consent is applied in the visitor’s browser and the page HTML is the same for everyone, so your pages cache normally. After changing which services are blocked, clear your page cache so the change takes effect right away.

It’s designed not to. The banner is lightweight vanilla JavaScript, and because it’s caching-friendly it doesn’t force your pages to load uncached.

No lock-in. Deactivating CoreConsent stops the banner and lets your scripts load normally again, so make sure that’s what you intend before turning it off on a live site. Uninstalling also removes its settings and, on Pro, its consent-log table, leaving your site clean.

Yes — Pro and Agency include a 14-day free trial with no credit card required, so you can try the paid features before committing. The free version stays free with no time limit. For refund terms, see the details at checkout.

Network-wide scanning and pushing settings across subsites is part of CoreConsent Agency.