The banner

Cookie Consent → The banner. Six shapes, four placements, three colours.

What you cannot change is the balance of the buttons. Accept and Reject are the same size, in the same row, one click each, in every design, whatever words you give them: the two are always as wide as each other and as tall as each other, so a short Accept beside a long Reject makes both as wide as the longer one needs, and on a phone they sit one above the other at full width. Nearly every enforcement action taken over a cookie banner anywhere has been about making Reject harder to reach than Accept, so it is not offered as an option.

Nothing is pre-ticked either. A banner whose boxes start ticked has not asked anything.

The page behind the banner can still be used, by mouse and by keyboard, in every design, including Middle of the screen. Only Dim the page behind it stops clicks reaching the page until the visitor answers.

In current browsers, a link that someone tabs to is scrolled out from under a banner along the bottom, in a corner or in the middle of the screen, rather than left hidden behind it, as long as the window has room to show it clear of the banner. A banner along the bottom or in a corner also leaves room at the end of the page, so the last lines of your footer can be scrolled clear of it. On a phone the Side panel becomes a sheet along the bottom and does the same, and floating buttons in the bottom corners, such as a prize-wheel tab, move up above it. On a wider screen the side panel runs down one side of the window: the floating buttons stay where they are, and a link behind the panel is not moved out from under it. A banner along the top still covers the first lines of the page, as it does for everyone, until it is answered.

On a small phone, a phone held sideways, or a page zoomed in, the banner is never taller than the window. Its words and choices scroll inside it, and Accept all, Reject all and Save my choices stay in view along its foot, in every design, so every answer can always be given. A choice reached with the Tab key is scrolled into view above them, so it is never ticked unseen under the answers.

For a keyboard or screen-reader visitor, Choose moves on to the first choice, and answering choices reopened from a Cookie choices button puts them back on that button. An answer given by scrolling on leaves them where they scrolled to.

Your own wording, in every language#

Every word on the banner and in its choices can be your own. The banner → Words has a box for each:

• Heading and What it says;
• Privacy policy link text, the words of the link to the page you chose under Link to your privacy policy (the box is greyed out until you choose a page);
• Buttons: Accept all, Reject all, Choose, Save my choices, and the Cookie choices button, whose words the [cookie_choices] shortcode uses too unless you give it its own ([cookie_choices text="…"]);
• Kinds of cookie: the name and the one-line description of Necessary, Preferences, Measurement and Advertising, as the choices show them and as [cookie_list] heads its sections, and the two small tags beside a kind in the choices: always on beside Necessary, and New beside a kind the banner asks a returning visitor about for the first time;
• Held-back embeds: the Load this content button, and the sentence under it, one for an embed with a title (type %s where the title goes) and one for an embed without;
• Line for a browser's privacy signal: what the choices say to a visitor whose browser's refusal was taken as their answer (see Browsers that have already refused).

The rest of [cookie_list], its table headings and the rows about the plugin's own cookies, has no box: it is in the plugin's own words, in the languages the plugin comes in.

Every box starts empty, and an empty box is the plugin's own words, shown in grey in the box in your site's language. They come translated into Spanish and French. On a site in any other language the plugin's words are English: there the Dashboard says, under Worth doing next, that your site is in that language and the banner's buttons are in English, and the note goes once you have typed your own words for the buttons the banner shows (Accept all and Reject all, and Choose and Save my choices when people can choose kind by kind). Words are kept as plain text: any HTML you type is taken out, a label is kept to 60 characters and a sentence to 240.

Each label must say what its button does. Accept all and Reject all cannot be saved with the same words, whatever their capitals, in any language your banner is read in: the plugin compares them in your screen's language, your site's, and each language WPML or Polylang shows, counting the plugin's own words in that language for a box left empty. So Accept all typed as Rechazar todo on a site with Spanish pages is refused. The banner is saved without them, the two buttons keep the words they had, and the screen says why. If a translation made afterwards in WPML or Polylang gives the two buttons the same words, visitors reading that language see the plugin's own words on both buttons instead.

On a site translated with WPML or Polylang, whatever you type in these boxes can be translated like any other text on the site: they appear under WPML's String Translation (admin texts) or Polylang's string translations, and each visitor reads the banner in their own language. What you type is in your main language, and a box you have filled shows those words in every language until it is translated, in place of the plugin's own words there, Spanish and French included. A box you leave empty is the plugin's own words in the visitor's language where the plugin has them. Your own settings screen goes on showing the words exactly as you typed them, so translating them never writes a translation back over the wording your legal team gave you. With either plugin, the Dashboard names each of your languages the plugin has no words for while a button there is still the plugin's English, and, under Translate the words you typed for the banner, each of your other languages whose pages show words you typed without a translation, with a link to where WPML or Polylang translates them.

Link to your privacy policy is a page rather than a sentence, so both plugins already send a reader to their own language's copy of it.

Letting people change their mind#

The Cookie choices button. The banner → Cookie choices button. A small button with a cookie drawing and the words Cookie choices sits in a bottom corner of every page, once a visitor has answered. Pressing it opens the choices with their current answer ticked; they save or change it, and the button comes back. Escape puts the choices away again with the answer as it was. It is there for anybody whose answer is in force: one they gave, or the refusal their browser gave for them, including somewhere you do not ask (see Asking only where the law asks), since that answer still decides what runs. It is not there for somebody who has never answered, so not for a visitor you have never asked, and not while the banner or the choices are open. Choose the bottom left or the bottom right corner; pages in a language written the other way round show it in the opposite corner. On a narrow phone it shows the drawing alone, and the words appear beside it while it is hovered or reached with the keyboard. It is drawn in the banner's background colour, with its words in your text colour, or in black or white when your text colour would be hard to read on that background. A theme's own button styles, such as Hello Elementor's or an Elementor kit's, do not repaint it.

It shares the corner with our other plugins' floating buttons rather than covering them: it stands above a Lucky Wheel launcher, or its Your prize button, and a Table of Contents button in the same corner, and a Dark Mode switch there stands above it once Dark Mode is up to date too. Buttons from other makers' plugins, such as a chat bubble, know nothing of it; if one sits in the same corner, choose the other corner.

It is on for sites that install this version or a later one. A site that had the plugin before keeps it off, and the Dashboard offers it once under Worth doing next (Show the button): until you switch it on, or save The banner, where the switch is, which stores it as you left it. Saving another screen, switching on another Dashboard offer, or importing a settings file that has it off does not end the offer. It is not offered where a reading of your site finds a way back of your own on one of the pages it reads: the [cookie_choices] shortcode, the cookie list's button, or anything with the class trcc-open (not one inside a comment). The monthly reading notes one it finds, too.

A link of your own. Put [cookie_choices] in a footer. A menu cannot hold a shortcode, because WordPress prints a menu item's label as it is written, so in a menu use the class instead: anything on the page with the class trcc-open opens the choices, so a theme's own link works with no shortcode. Add a Custom Link with # as its address and give it the class trcc-open. Under Appearance → Menus, switch on CSS Classes in Screen Options first; in the Site Editor's Navigation block, the class goes in Advanced → Additional CSS class(es).

A visitor who switches off something they had agreed to also has its cookies removed from your site, and the page reloads once (see Taking an agreement back).

Taking an agreement back#

Settings → What it does → Remove cookies when somebody takes an agreement back. On for every site. When a visitor opens the choices again (the Cookie choices button, [cookie_choices] or anything with the class trcc-open) and switches off a kind of cookie they had agreed to, or presses Reject all there, the cookies that kind's services leave on your site are removed from their browser, and the page reloads once, so that the tags already running on it stop: a script that has started cannot be stopped any other way. While it reloads, one line takes the place of the buttons: Saved. The page reloads to switch off what you turned off. Type your own under The banner → Words → Line while the page reloads. The Record has the new answer, and Google's Consent Mode, Microsoft's tags, WP Consent API and Google Tag Manager are told it, as with any answer. The page the reload opens looks once more, in case a tag wrote one of those cookies again as the page closed.

Nothing is removed and nothing reloads after a first answer, or after an answer that only adds kinds. Where nothing of the kind switched off was running on that page, for example a visitor asked again after Ask everybody again, its cookies are removed and the page does not reload. Somewhere you do not ask (see Asking only where the law asks) everything runs as if it were agreed, so a kind switched off from a Cookie choices link is taken back the same way. With the switch off, an answer taken back is kept and told as before, and nothing is removed.

Which cookies: those of the services the last reading of your site found, or before the first reading every service held back, and only while a service is held back (one you leave loading runs whatever the visitor says, and would write its cookies again on the next page). Each counts under the kind it is held back as on your site. The names come from each maker's own documentation; a name ending in … stands for every name that starts so. Entries of the same names in the browser's storage go too, since some tags keep a copy there. A cookie named by a kind the visitor still agrees to stays: _gcl_… belongs to Google Ads as well as to the tags Google Tag Manager loads, so taking Measurement back leaves it while Advertising stands. The visitor's answer, the sign-in cookies, the basket's and WP Consent API's are never removed, and no cookie that records a refusal is on the list (Google's __gpi_optout, Klaviyo's __kla_off, HubSpot's __hs_opt_out, Matomo's mtm_consent_removed).

What no website can remove, and so this does not:

• cookies a company keeps on its own address, such as Google's on doubleclick.net and google.com, or Microsoft's MUID. Only the visitor's browser settings can remove those, and the cookie list tells visitors so;
• a cookie your server writes as HttpOnly, which a script in the page cannot see, as a server-side tagging setup can;
• a cookie written for a folder of your site the page is not in.

Rules of your own name a script, not its cookies, so nothing is removed for them. On a network set up with sub-directories the sites share one address, and so share these cookies: taken back on one site, they go for every site, and a site the visitor still agrees to writes its own again. Read your site again after adding a service, so its cookies are on the list.

A cookie list for your policy page#

Put [cookie_list] on your cookie or privacy policy page. It prints, for each kind of cookie the banner asks about, what it is for and the services behind it: who runs each one, with a link to that company's own privacy policy. Under Necessary it lists the site's own cookies: the one that remembers the visitor's answer (and for how long, from your setting), the WordPress sign-in cookies, and the basket cookies when WooCommerce is installed.

With the WP Consent API plugin installed (see Other plugins on your site), a second row under Necessary lists the five cookies it keeps each visitor's answer in for other plugins (wp_consent_functional to wp_consent_marketing), for as long as WP Consent API keeps them: 30 days unless something on your site changes that. Without it there is no such row. On a network set up with sub-directories, both rows name the cookies of the site the page is on (see Multisite).

Each section is headed with the name and the line of that kind of cookie as the banner's choices show them, your own words included (see Your own wording, in every language). The rest of the list is the plugin's own words, translated by its language files.

Each service's row names the cookies it leaves on your site, the ones taking its kind back removes (see Taking an agreement back); a name ending in … stands for every name that starts so, and a service that keeps its cookies on its own address, or a rule you added by hand, has a dash. While Remove cookies when somebody takes an agreement back is on, a line under the list tells visitors that taking an agreement back removes the cookies listed for it from your site, and that cookies a service keeps on its own website only their browser's settings can remove.

It is built from exactly what the banner uses, so the two cannot disagree: the services the last reading of your site found, or everything held back before the first reading, plus any rule you added by hand. Read your site again after adding a plugin that loads something new, and the list follows. It says the date it was last checked, and ends with a button to change your cookie choices.

[cookie_list heading="h2"] sets the heading level (h3 unless you say), and [cookie_list choices="no"] leaves the button out. On a phone each row is shown as a short block with its own labels rather than a squeezed table.

Asking only where the law asks#

Cookie Consent → How it asks → Who is asked. Everyone, by default. Or only where a banner is the law — the EU, the EEA, the UK, Switzerland and Brazil — or only in the countries you list, as two-letter codes.

Where a visitor is comes from Cloudflare, if your site is behind it, or from WooCommerce's own geolocation if that is installed; the setting's hint says which of the two this site has. Anyone who cannot be placed is asked — the safe mistake is a banner somebody did not need, never a tag somebody did not agree to. A site with neither asks everyone whatever the setting says, and the hint says so.

Because your pages are cached, the page itself cannot know who is reading it. The banner asks a tiny question of your own site before it shows — never cached, nothing stored — and remembers the answer for the visit. Where the answer is "not here", the held-back scripts run and no consent is written, because none was asked for.