Cookie consent that actually blocks: what 90% of WordPress banners get wrong
Most consent banners are decoration: they show a dialog and load the trackers anyway. How real blocking works, and how to test your own site in five minutes.
d9
Published
1. The 5-minute test: is your banner blocking anything?
2. Why “banner-only” setups fail — technically and legally
3. The three failure patterns (and fixes)
4. FAQ
1. The 5-minute test: is your banner blocking anything?
Open your site in a private window with DevTools → Network. Before clicking anything in the banner, filter for google-analytics, facebook and doubleclick. If any of these load, your banner is decoration.
# quick check from the terminal — no consent, no trackers expected
curl -s https://example.com | grep -c "googletagmanager"In our test of 50 German WordPress sites in July 2026, 44 loaded at least one tracker before consent. That’s the “90%” in the headline — measured, not estimated.
2. Why “banner-only” setups fail
A consent banner has two jobs: record a choice, and gate every non-essential request behind it. Most plugins only do the first, because the second requires rewriting how scripts are enqueued — WordPress loads plugins in order, and by the time the banner runs, the tracker is already in the document.
Key takeaway — blocking must happen server-side or at enqueue time, never by JavaScript that races the trackers it’s supposed to stop.
3. The three failure patterns
The racing banner
Banner JS and tracker JS load in parallel. Fix: block at enqueue, not in the browser.
The forgotten embed
Scripts are gated but YouTube iframes still set cookies. Fix: placeholder + two-click load.
The cached consent
Page cache serves the “consented” HTML to everyone. Fix: cache-vary on the consent cookie.
4. FAQ
Does blocking hurt my analytics data?
Is a paid consent tool required?
[1] GDPR Art. 6 — Lawfulness of processing · eur-lex.europa.eu
[2] DSK Orientierungshilfe Telemedien, March 2025 · datenschutzkonferenz-online.de
[3] Own measurement: 50 German WordPress sites, July 2026 — methodology & raw data on request.
Cookie Banner & Content Blocker does all of this out of the box.
Blocking at enqueue, two-click embeds, cache-safe consent.
d9
About the author
desk9 is a one-developer WordPress shop. Every article here documents something built, measured or broken first-hand — maintaining a small catalog of plugins and themes across thousands of live sites.