Set up consent for an online shop · Docs

Written for Cookie Rocks 2.9.14, checked on 5 November 2026. The current version is 2.11.2: some details may have changed.

This guide is for online shops, with WooCommerce or Easy Digital Downloads. Cart and payment cookies need no consent. Order attribution and advertising pixels do. EU law also asks that payment and anti-fraud scripts wait for consent outside the pages where the visitor pays.

You need: Cookie Rocks Audit (free) to see what your shop loads, and when. Cookie Rocks Pro to hold what must wait, page by page.

The Cookies page of Cookie Rocks Audit, with each tool found, its category and what it does before the visitor chooses — Cookie Rocks 2.11.2 · Click to enlarge

Check your shop

Open Cookie Rocks, then Obligations. Under What kind of site?, click Online shop, then Show what the law asks of my site. The point Online shop appears in the list.
Open Cookies and click Scan my pages. With WooCommerce, the scan also opens the shop, cart, checkout and account pages.
In the table, read the Category of each tool. Payment tools, such as Stripe or PayPal, are Necessary. WooCommerce order attribution (cookies whose names start with sbjs_) and advertising pixels are Marketing: they must wait for the visitor’s choice.
On the Overview, read the WP Consent API card. WooCommerce reads the visitor’s choice through this plugin. Missing means WooCommerce cannot know what the visitor accepted.

Set it up with Cookie Rocks Pro

With Cookie Rocks Pro

Open Consent. Under Before the visitor chooses, check that Known trackers is set to Hold them until consent (recommended). Advertising pixels, such as Meta, then wait for marketing consent.
Under Payments, tick Load payment and anti-fraud scripts without consent only on cart, checkout and account pages, then click Save Changes. This is what EU law asks. It is off by default: payment scripts then load on every page, as necessary cookies.
Open a product page in a private window, without choosing. Payment and anti-fraud scripts wait, like marketing. One-click buy buttons (Apple Pay, Google Pay, PayPal…) may not show to visitors who refuse cookies.
Open the cart, then the checkout. These pages are protected: payment and anti-fraud scripts load at once, without consent, so the visitor can pay. The protected pages are the cart, checkout and account pages of WooCommerce, and the checkout of Easy Digital Downloads.
Check order attribution. With WP Consent API, WooCommerce reads the choice that Cookie Rocks Pro passes to it. Without it, Cookie Rocks Pro turns order attribution off until the visitor accepts marketing.

Fingerprint, which recognises a device even after cookies are deleted, always follows the rule of protected pages, even when Payments is not ticked. Another page where visitors pay, such as a booking page, can be made protected by a developer: see cookie_rocks_protected_page in PHP filters, actions and REST API.

Tip. If your checkout or account forms use Google reCAPTCHA or hCaptcha, keep Ask visitors before they send a form (recommended) on the Consent screen. Each protected form shows a short request, and nothing the visitor typed is lost. Cloudflare Turnstile is never held.

More detail: Consent, Cookies and WP Consent API.

Next step: Set up Google Consent Mode

See also: Cookie Rocks for online shops, what changes for this kind of site.

Cookie Rocks helps you find your way through cookie and privacy rules. It does not replace a lawyer’s advice.