--- title: "WordPress cookie consent plugins compared: which one to choose?" description: "Complianz, CookieYes, Borlabs, Real Cookie Banner, tarteaucitron, Axeptio, iubenda: Consent Mode v2, TCF, proof of consent, prices and picks." language: "en" locale: "en-US" type: "article" canonical: "https://www.wp-masquerade.com/wordpress-cookie-consent-plugins-compared/" published: "2026-08-18T06:00:00+00:00" modified: "2026-11-05T20:54:53+00:00" translations: en-US: "https://www.wp-masquerade.com/wordpress-cookie-consent-plugins-compared/index.md" fr-FR: "https://www.wp-masquerade.com/fr/comparatif-plugins-cookies-rgpd-wordpress/index.md" es-ES: "https://www.wp-masquerade.com/es/comparativa-plugins-cookies-wordpress/index.md" de-DE: "https://www.wp-masquerade.com/de/cookie-consent-plugins-wordpress-vergleich/index.md" it-IT: "https://www.wp-masquerade.com/it/confronto-plugin-cookie-gdpr-wordpress/index.md" pt-BR: "https://www.wp-masquerade.com/pt/comparativo-plugins-cookies-wordpress/index.md" nl-NL: "https://www.wp-masquerade.com/nl/cookieplugins-wordpress-vergelijken/index.md" --- # WordPress cookie consent plugins compared: which one to choose? Cookie consent plugins and platforms for WordPress compared on what matters: blocking before the choice, refusal as easy as acceptance, Consent Mode v2, TCF 2.3, proof of consent, script hosting and price, with a pick for each type of site. A cookie banner is not there to display a message: it must stop trackers from loading until the visitor has chosen, make refusing as easy as accepting, and keep proof of that choice. WordPress plugins and consent management platforms (CMPs) do not all do this the same way. This comparison ranks the most widely used solutions on what really matters: where the script runs, Google Consent Mode, the IAB TCF framework for advertising, proof of consent and the real price. *Transparency: no affiliate links in this article. Prices come from the vendors’ websites, without promotions; they change often, so check them before buying. This article is not legal advice: for a high-stakes site, have your setup reviewed by your DPO or a lawyer.* **Our picks at a glance** - **Brochure site or blog without ads**: free Complianz, free Real Cookie Banner or free CookieYes, all set up in an hour. - **Google Ads or GA4 with Consent Mode v2**: the free versions of CookieYes, WPConsent and Cookie Notice include it; Complianz and Real Cookie Banner keep it for their paid version. - **Site that lives on advertising (AdSense, ad networks)**: an IAB TCF and Google certified CMP, such as Complianz Premium, Borlabs Cookie, Real Cookie Banner Pro, Axeptio or iubenda. - **Keep everything on your server**: tarteaucitron.js (open source edition), Borlabs Cookie, Real Cookie Banner, WPConsent. - **Large group, several brands**: Didomi or OneTrust, on quote. ## What a cookie banner must do in Europe The rules come from the ePrivacy directive and the GDPR, as interpreted by national authorities. We use the French regulator, the CNIL, as the reference here because its guidance is among the most detailed; the UK ICO and the other European authorities apply the same principles. The rules do not cover every cookie: those used for login, the shopping cart, security or to remember the visitor’s choice are exempt, as are some strictly configured audience measurement tools. Everything else (advertising, standard analytics, embedded videos and social networks, pixels) waits for consent. - **Nothing before the choice**: no tracker that requires consent loads when the page opens. This is where most sites fail, because a tag pasted into the theme bypasses the banner. - **Refusing as easy as accepting**: a “Reject all” button at the same level as “Accept all”, not a discreet link hidden in the settings. - **No pre-ticked boxes**: consent is a positive action; continuing to browse is not agreement. - **Withdrawal at any time**: a permanent link (footer) reopens the panel and must be as simple as the first choice. - **Proof of consent**: you must be able to show which banner was displayed and what the visitor chose. A timestamped log kept by the tool is the simplest answer. - **Durations**: the CNIL recommends keeping the choice (acceptance or refusal) for six months before asking again; exempt audience measurement trackers must not live longer than 13 months. These rules are enforced: in September 2025, the CNIL fined SHEIN 150 million euros for cookies placed without consent and faulty refusal mechanisms, on the same day as a 325 million euro fine against Google. The animation shows the journey a good tool must guarantee. *What a consent tool must guarantee, from first display to withdrawal.* ## Consent Mode v2 and IAB TCF: two different topics Vendors happily mix these two acronyms in their marketing. They do not answer the same need. **Google Consent Mode v2** passes the consent state to Google tags (GA4, Google Ads, Tag Manager) through four signals: `ad_storage`, `analytics_storage`, `ad_user_data` and `ad_personalization`. Without these signals, Google Ads limits audiences and conversion measurement for visitors from the European Economic Area. There are two variants: in basic mode, tags stay blocked until the choice; in advanced mode, they load on arrival and send cookieless signals even after a refusal, which improves conversion modelling. Basic mode is the legally safer choice; discuss advanced mode with your DPO. **The IAB TCF** (Transparency and Consent Framework) is the standard format that passes consent to ad networks and their hundreds of partners. It only matters for sites that show programmatic advertising. For AdSense, Ad Manager and AdMob in Europe, Google requires a Google-certified CMP integrated with the TCF. TCF version 2.3 has been mandatory for new consents since 28 February 2026: if you live on advertising, check that your tool supports it. For a brochure site without ads, the TCF adds a heavier banner with no benefit at all. ## The comparison table | Solution | Where the script runs | Consent Mode v2 | IAB TCF | Starting price | | --- | --- | --- | --- | --- | | tarteaucitron.js | Your server (open source) or hosted service (Pro) | Yes | No | Free; Pro €190 excl. VAT per year, unlimited sites | | Complianz | Plugin, your server | Premium | Premium | Free; Premium €59 per year (1 site) | | CookieYes | Plugin alone or web app | Yes, even free | Pro and Ultimate plans | Free; from $10 per month | | Cookie Notice and Compliance | Plugin, or Hu-manity platform (connected mode) | Yes | Not announced | Free; paid by traffic | | Borlabs Cookie | Plugin, your server | Yes | Yes | From €49 excl. VAT, no free version | | Real Cookie Banner | Plugin, your server | Pro | Pro | Free; Pro €59 incl. VAT per year (1 site) | | WPConsent | Plugin, your server | Yes, even free | Pro | Free; Pro from $99 (1 site) | | Axeptio | Hosted service | Yes | From Small | Free up to 200 visitors; from €7.50 per month | | iubenda | Hosted service | Yes, even free | Yes | Limited free plan; from €4.99 per month | | Didomi, OneTrust | Hosted service | Yes | Yes | On quote | *Vendors’ public features and prices, without promotions (excl. VAT unless stated). “Premium” or “Pro”: feature reserved for the paid version.* ## The solutions one by one ### tarteaucitron.js: the French open source option, for those happy to configure An open source script maintained in France, free with no time limit. In the open source edition you host it, declare each service by hand and update it yourself; it supports Google Consent Mode. The Pro edition (€25 excl. VAT per month or €190 per year, unlimited sites, client sites included) adds automatic service detection, a dashboard and consent statistics, and the official “tarteaucitron.io” WordPress plugin connects your site to that Pro account. **For**: developers and agencies who want a tool without commercial lock-in. **Limit**: no TCF, and in the open source edition proof of consent is yours to organise. ### Complianz: the most complete wizard on the legal side More than one million active installations. Its wizard asks the right questions (analytics, advertising, embedded content), blocks known scripts, generates the cookie policy and replaces YouTube videos with a placeholder until the visitor accepts. The free version is enough for a brochure site. Premium (€59 per year for one site, $179 for five, $399 for twenty-five) adds consent records, Google Consent Mode, the TCF and geolocation. **For**: small businesses and freelancers who want guidance. **Limit**: lots of options, and a setting to revisit with every new tracking tool. ### CookieYes: the most generous free plan More than one million installations. The plugin works on its own, with Consent Mode v2 and a consent log exportable as CSV, even for free. Connecting to the CookieYes web app is optional: it adds automatic cookie scanning and, on the Pro and Ultimate plans, the TCF. The web app’s free plan is capped at 5,000 page views per month; then come Basic ($10 per month, €9 in euros), Pro and Ultimate. **For**: small sites with GA4 or Google Ads. **Limit**: traffic-based pricing gets expensive on a busy site. ### Cookie Notice and Compliance (Hu-manity): simple, but proof goes through the platform Around 800,000 installations. In “banner only” mode the plugin shows a banner without an account, but records no proof. Connected mode links the site to Hu-manity’s platform, which keeps the consent log and handles Consent Mode v2 on every plan; the free tier is capped in visits and paid plans depend on traffic. **For**: a site that wants to start fast. **Limit**: without connected mode, you have no proof. ### Borlabs Cookie: the German reference, everything on your server Paid plugin only (from €49 excl. VAT), very common in Germany and Austria. Visitor data stays on your server; it supports Google Consent Mode (basic and advanced), is certified for the TCF and offers a library of ready-made services. **For**: sites that are strict about where data is stored, advertising sites. **Limit**: no free trial, and a dense interface. ### Real Cookie Banner: the best value self-hosted option More than 100,000 installations. All consents are processed and stored on your server, and the vendor (devowl.io) states that the free version already covers a compliant setup. Pro (€59 incl. VAT per year for one site, up to €299 for 25 sites) adds service templates, Google Consent Mode and the TCF; each licence covers as many staging sites as production sites. **For**: sites that want to keep everything in-house without paying much. **Limit**: most of the convenience is in Pro. ### WPConsent: the easiest to install More than 200,000 installations. The free version includes Consent Mode v2 and keeps data in your WordPress database. Pro ($99 for one site at list price, frequent launch offers, renewal at full price) adds the consent log, automatic scanning, geolocation and TCF 2.3. **For**: standard WordPress sites that want a quick setup. **Limit**: no consent log in the free version. ### Axeptio and iubenda: consent as a hosted service **Axeptio** (French) focuses on a polished, engaging banner. Free plan up to 200 visitors per month, then Extra Small at €7.50 per month (paid yearly), Small at €29 (TCF and cookie scanning included), Medium at €69, Large at €129. **iubenda** (Italian) sells the banner together with generated privacy policies and terms: a free plan with Consent Mode v2, then Essentials from €4.99 per month (25,000 page views), Advanced and Ultimate. **For**: sites that prefer a managed service with support. **Limit**: traffic-based prices, script loaded from a third-party domain. ### Didomi and OneTrust: for enterprise accounts Enterprise platforms on quote: several brands and domains, mobile apps, A/B testing of the banner, preference management beyond cookies, integrations with marketing tools. They make sense for a media group or a corporation; for a single WordPress site, they are oversized. ## Self-hosted or SaaS: performance and control The banner is shown on every page to every visitor: its weight and loading method affect Core Web Vitals. A self-hosted script is served by your server and your cache, with no extra connection. A hosted service adds a connection to a third-party domain, and your site depends on its availability. Either way, measure before and after with PageSpeed Insights: the banner must not become the main element of the page (LCP) nor shift the content (CLS). *Two architectures, two ways of sharing the work and the data.* On the security side, a third-party script has the same rights as your own code on every page. If you use a content security policy ([CSP](https://www.wp-masquerade.com/glossary/content-security-policy/)), you must allow the platform’s domain in `script-src` and `connect-src`; our guide to [HTTP security headers](https://www.wp-masquerade.com/http-security-headers-wordpress/) explains how to do it without opening everything. A self-hosted plugin avoids that extra domain, but it must be kept up to date like any plugin. ## How to choose for your site | Profile | Main need | Recommended choice | Yearly budget | | --- | --- | --- | --- | | Blog, brochure site without ads | Block analytics and videos, easy refusal | Free Complianz, Real Cookie Banner or CookieYes | €0 | | Small business with GA4 and Google Ads | Consent Mode v2 and proof | CookieYes, WPConsent Pro, Complianz Premium | €60 to €120 | | WooCommerce shop | Ad pixels, proof, performance | Complianz Premium, Real Cookie Banner Pro, Borlabs | €50 to €100 | | Ad-funded site | TCF 2.3 and Google-certified CMP | Borlabs, Real Cookie Banner Pro, Axeptio, iubenda | €50 to €1,500 | | Agency, many client sites | Multi-site licence, fast rollout | tarteaucitron Pro, Complianz Agency, Real Cookie Banner Agency | €190 to €400 | | Group, several brands | Governance, apps, support | Didomi, OneTrust | On quote | *Orders of magnitude based on public prices, without promotions.* Whatever the tool, test it yourself: open the site in a private window, accept nothing, then check in the browser’s developer tools (Application and Network tabs) that no advertising or analytics cookie is set and no request goes to Google, Meta or an ad network. Repeat this check after every new plugin or tag. ## Mistakes that make a banner useless - **Scripts added outside the banner**: tracking code pasted into the theme or a header plugin loads before the choice. Route every tag through the consent tool or through Tag Manager connected to it. - **Two banners**: a theme or analytics plugin that shows its own notice creates two contradictory consents. - **Page cache**: a cached page may serve an already closed banner or the wrong language. Serious plugins handle caching, but clear the cache after each banner change. - **Embedded videos and maps**: YouTube, Vimeo or Google Maps set trackers as soon as they display. Use your tool’s placeholder, or a player that only loads YouTube on click. - **A frozen cookie policy**: the list of services must follow the site. Run the scan again after each new tool. ## WP Masquerade and visitor privacy WP Masquerade is not a consent tool and does not replace any of the solutions above. It sets no cookie for visitors of your public pages. The Pro version only uses cookies for accounts that log in (recognised device, two-factor authentication): these are security cookies tied to authentication, the kind the CNIL exempts from consent. Pro’s bot traps keep a log with truncated IP addresses, kept for 30 days; our article on GDPR and security logs covers the legal basis for this kind of processing. There is one point of contact: a cookie banner leaves its own traces in your pages’ code (plugin folder names, stylesheets), which bots use to [identify WordPress and its plugins](https://www.wp-masquerade.com/wordpress-fingerprinting-detection/). WP Masquerade removes the comments and tags that give away WordPress and its plugins, and Pro can rename plugin file addresses. This reduces automated targeting; it does not fix any flaw in the consent tool, which must stay up to date. For security in general, see our [comparison of WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/). *“How to Integrate Consent Mode with CookieYes WordPress Plugin?”, by CookieYes (September 2024): a short walkthrough showing where Consent Mode v2 is switched on in a WordPress consent plugin and how to check it.* ## Frequently asked questions **Does a site without Google Analytics need a cookie banner?** Not necessarily. If the site only uses exempt cookies (login, cart, security, audience measurement configured under the regulator’s conditions) and embeds no video, map or social button that sets trackers, no consent is required. You still need to inform visitors in the privacy policy. **Is a free plugin enough to be compliant?** For a brochure site, often yes: free Complianz, Real Cookie Banner and CookieYes block scripts and offer refusal at the same level as acceptance. Just check how you will prove consent: CookieYes logs it for free, while Complianz and WPConsent keep the full log for their paid version. **Is Google’s advanced consent mode compliant in Europe?** It sends cookieless signals before the choice and even after a refusal. Its legal assessment depends on your setup: basic mode, which loads nothing before acceptance, is the safest. Have advanced mode approved by your DPO. **How long should the visitor’s choice be kept?** The CNIL recommends six months, for acceptance as well as refusal, before asking again. Exempt audience measurement trackers must not exceed 13 months. **Does the banner slow the site down?** A little, since it appears on every page. A self-hosted, cached script avoids a connection to a third-party domain. Measure with PageSpeed Insights before and after, and check that the banner does not shift the content. ### Key takeaways - A compliant banner blocks trackers before the choice, offers “Reject all” at the same level as “Accept all” and keeps proof. - Consent Mode v2 is for Google tags; TCF 2.3 only concerns sites that live on advertising. - For a brochure site, a free plugin is often enough; check how consent is proven. - Self-hosted: data control and no third-party domain; SaaS: convenience, but traffic-based pricing. - Test in a private window, without accepting, after every new tool. ## Fewer traces, no extra cookie The free version of WP Masquerade moves the login, blocks XML-RPC and removes WordPress traces, without setting any cookie for your visitors. Pro adds two-factor authentication, login limiting and alerts about vulnerable plugins. [Download the free version](https://www.wp-masquerade.com/download/) [See Pro pricing](https://www.wp-masquerade.com/pricing/) ## Sources - CNIL: cookies and other trackers, what does the law say? (in French) (https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/que-dit-la-loi) - CNIL: SHEIN fined 150 million euros (https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil) - Google: consent mode overview (https://developers.google.com/tag-platform/security/concepts/consent-mode) - IAB Europe: Transparency and Consent Framework (https://iabeurope.eu/transparency-consent-framework/)