# How to add a cookie consent banner to a WooCommerce store

> WooCommerce runs on WordPress, so the snippet goes in the WordPress header, with WPCode's Header box or the wp_head hook at priority 0. What is specific to a store is the rest: WooCommerce's cart cookies need no consent, its order attribution cookies do or can be switched off, and Google Analytics for WooCommerce follows Cookiequiet's Consent Mode updates.

Source: https://cookiequiet.com/platforms/woocommerce
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **Copy your snippet** In the Cookiequiet dashboard, open your website and copy the install snippet: one script tag with your site key, data-consent-mode and data-auto-block set to 1, and defer.
2. **Paste it in the WordPress header** With WPCode, go to Code Snippets, then Header & Footer, paste the snippet at the top of the Header box and save. Or echo it from a child theme on the wp_head hook at priority 0.
3. **Decide on order attribution** WooCommerce's order attribution sets sbjs_ cookies on every visit. Pass consent to it through the WP Consent API bridge in this guide, or turn it off under WooCommerce, then Settings, then Advanced, then Features.
4. **Keep Google Analytics for WooCommerce** The official extension sets Google's default consent state itself. Cookiequiet sends the update when the visitor chooses, so analytics and conversions follow the banner without extra settings.
5. **Mark tags you pasted and remove other banners** Change pasted Meta Pixel or TikTok tags to type="text/plain" with a data-cq-category. Deactivate other consent plugins and exclude cq.js from script delay features such as WP Rocket's.
6. **Add the Cookie preferences link** In the footer menu (Appearance, then Menus, or the Site Editor's Navigation block), add a custom link with the URL #cq-preferences and the label Cookie preferences.
7. **Test on product, cart and checkout pages** In a private window, click Reject all, add a product to the cart and go to checkout: the cart must work and no _ga, _fbp or sbjs_ cookie should appear before consent.

## Where to paste the snippet on a WooCommerce store

The install is the same as on any WordPress site, covered in detail in the [WordPress guide](/platforms/wordpress). In short: install the free WPCode plugin, go to **Code Snippets**, then **Header & Footer**, paste the snippet at the top of the **Header** box and click **Save Changes**. If you prefer code, hook `wp_head` at priority 0 in a child theme so the snippet prints before the tags other plugins add:

```html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
```

The header prints on shop, product, cart, checkout and account pages alike, including the block-based Cart and Checkout. Purge your page cache afterwards and exclude `cq.js` from script delay or aggregation features (WP Rocket, LiteSpeed Cache, Autoptimize).

## Which WooCommerce cookies need consent?

WooCommerce documents its own cookies, and the core ones need no consent because the shop cannot work without them:

| Cookie | Lifetime | What it does |
| --- | --- | --- |
| `woocommerce_cart_hash`, `woocommerce_items_in_cart` | Session | Track changes to the cart |
| `wp_woocommerce_session_` | 2 days | Links the shopper to their cart |
| `woocommerce_recently_viewed` | Session | Powers the Recently Viewed Products widget |
| `store_notice[id]` | Session | Remembers a dismissed store notice |

**Order attribution** is different. Since WooCommerce added it, the store sets seven `sbjs_` cookies (`sbjs_session`, `sbjs_first`, `sbjs_current` and others, session-length) on every visit to record which campaign or referrer brought the customer, and saves that to the order. WooCommerce says the feature is compatible with the WP Consent API, which is how a consent tool tells WordPress plugins what the visitor allowed. You have two clean options:

1. **Turn it off** if you do not use the Origin column in your orders: **WooCommerce**, then **Settings**, then **Advanced**, then **Features**, untick **Order Attribution**.
2. **Keep it and pass consent.** Install the WP Consent API plugin and add this bridge in WPCode's **Footer** box. It tells WordPress the site is opt-in and translates every Cookiequiet choice into the API's categories:

```html
<script>
  window.wp_consent_type = 'optin';
  document.dispatchEvent(new Event('wp_consent_type_defined'));
  window.addEventListener('cq:consent', function (e) {
    if (typeof window.wp_set_consent !== 'function') return;
    var c = e.detail.categories;
    var v = function (on) { return on ? 'allow' : 'deny'; };
    wp_set_consent('statistics', v(c.indexOf('analytics') >= 0));
    wp_set_consent('statistics-anonymous', v(c.indexOf('analytics') >= 0));
    wp_set_consent('marketing', v(c.indexOf('marketing') >= 0));
    wp_set_consent('preferences', v(c.indexOf('functional') >= 0));
  });
</script>
```

The same bridge serves every other plugin that reads the WP Consent API.

## How do Google Analytics and the other store tags follow the choice?

- **Google Analytics for WooCommerce** (the official extension) has no banner of its own. It sends Google's default consent state when the tag initialises, and WooCommerce asks that your consent tool update it after the visitor chooses. Cookiequiet does that with `gtag('consent', 'update', ...)`, so purchases and page views are measured in full only after analytics or marketing is granted. The extension is also integrated with the WP Consent API, which the bridge above feeds.
- **Pixels you pasted.** Mark them: `<script type="text/plain" data-cq-category="marketing">` for the Meta Pixel or TikTok, `analytics` for Hotjar or Clarity.
- **Marketing plugins that inject their pixel with JavaScript.** With `data-auto-block="1"`, Cookiequiet holds the scripts and iframes of about 80 known trackers until consent.

Deactivate any other consent plugin (Complianz, CookieYes, Cookie Notice) so the store has one banner and one consent log.

## How to test

1. Open the store in a private window and click **Reject all**.
2. Add a product to the cart and open the checkout: the cart must keep its contents, because WooCommerce's own cookies are necessary.
3. In the developer tools, check that no `_ga`, `_fbp` or `sbjs_` cookie is set (if you kept order attribution, the bridge must be in place).
4. Clear the cookies, click **Accept all**, reload: the tags run. Check the consent log in the dashboard.

## What does it cost compared with WordPress plugins?

Yearly WordPress plugins can cost less once you run several shops: Borlabs Cookie lists €49 a year for one website, €79 for 3 and €109 for 5 (excluding VAT). See how they compare in [Cookiequiet vs Borlabs Cookie](/vs/borlabs-cookie) and [Cookiequiet vs Complianz](/vs/complianz). Cookiequiet is free for one store with geo-targeting included, and Starter, which removes the Cookiequiet link, is €3 per website per month or €29 a year. Three stores on Starter come to €87 a year and five to €145, against €79 and €109 for Borlabs Cookie, so the plugin costs less there. The Agency plan is €190 a year for 10 Pro websites and 5 team seats, €19 per website. No plan has a pageview limit, and Cookiequiet works on any platform, so the setup stays the same if a store moves off WordPress.

## Questions

### Do WooCommerce cart cookies need consent?

No. The cart and session cookies (woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_) are needed for a service the shopper asked for, so they are exempt. The scanner lists them under Necessary in your cookie table.

### What are the sbjs_ cookies on my store?

They come from WooCommerce's order attribution feature, which records the campaign or referrer behind each order. Either turn the feature off under WooCommerce, Settings, Advanced, Features, or pass the visitor's choice to it through the WP Consent API.

### Does Google Analytics for WooCommerce work with Cookiequiet?

Yes. The extension sets Google's default consent state, and Cookiequiet sends the Consent Mode update when the visitor accepts or rejects. Tags then run in full only with consent.

### Is a WordPress cookie plugin cheaper for a store?

Sometimes. Borlabs Cookie costs €49 a year for one website and €79 a year for three. Cookiequiet is free for one website and €3 per website per month or €29 a year on Starter, and it is not tied to WordPress.

## Sources

- [WooCommerce documentation: WooCommerce cookies](https://woocommerce.com/document/woocommerce-cookies/)
- [WooCommerce documentation: Order attribution tracking](https://woocommerce.com/document/order-attribution-tracking/)
- [WooCommerce documentation: Google Analytics for WooCommerce (consent mode)](https://woocommerce.com/document/google-analytics-integration/)
- [WordPress.org: WP Consent API plugin](https://wordpress.org/plugins/wp-consent-api/)
- [WPCode: Using the Global Header & Footer settings](https://wpcode.com/docs/using-the-global-header-footer-settings/)
- [Borlabs Cookie prices (checked 2026-10-21)](https://borlabs.io/borlabs-cookie/prices/)