Every feature

No pre-ticked boxes, no consent by scrolling.

Light, dark or automatic theme, a discreet box or a bar, rounded or square corners, in your colours.

When a visitor’s browser sends the GPC signal, marketing stays refused, as several US states require. The signal also cancels an earlier yes to marketing, the cookie button says “Opt-out request honored”, and a signed-in visitor’s refusal follows their account to their other browsers. The “Do Not Sell or Share” link opens a one-click opt-out. With a browser opt-out signal, Cookie Rocks stops advertising. Statistics can keep running: a measurement tool bound by a service contract is not a sale or sharing. If your analytics tool shares data for advertising, turn that sharing off.

Pro copies the Google Fonts it finds in your pages and stylesheets, and shows the state of each font.

Example: a site that targets France and California keeps consent for 6 months at most, and a refusal for 12 months at least. In Colorado, a visitor who refused is not asked again.

Where your countries allow it, audience measurement set up for it can run until the visitor objects.

With Polylang or WPML, the banner follows the language of each page. One option shows it in the visitor’s browser language instead, even when your site has no version in that language. The dashboard comes in 28 languages, the law sheets in 28.

Necessary cookies are always on; the others wait for consent. Only the categories your site really uses are shown: no empty marketing switch on a site without marketing.

Or hide it and put a “Manage cookies” link in your footer instead.

• For whom: every visitor who refuses, on every site. Visitors from the United States read “Opt-out request honored”, the others “Refusal applied”.
• When: after “Reject all”, “Do Not Sell or Share” or a category turned off in the details, and from the first page when the browser sends Global Privacy Control. A category hidden from the details never lights it.
• What: a ring around the button in the colour you choose, or none if you turn it off, and a message that stays 5 seconds.

How it works · See the big ring

Cookie names and durations are kept, shown on request. Made to look right on any theme, with two settings in Pro: a title and a width. See ours, live.

What a cookie policy must contain

Paste this in a page: [cookie_rocks_policy]

Each visitor gets the rules of their own country, read from its law sheet; texts, colours and services stay shared. The rules of your own country apply to every visitor, on top of theirs, except for a site in the United States. In the EU, the UK or Brazil, that means prior consent for everyone. Try the simulator.

Only one source is trusted, after a check. The visitor’s IP address is never kept or sent.

Consent is never assumed. A yes ends at the shortest limit of both countries; a no lasts at least what the visitor’s law asks.

Choose your target countries one by one, or by region of the world.

The country is asked once, on the first visit, and never again once the visitor has chosen. Sites that leave the option off load nothing more.

Nothing is loaded from our servers. The banner uses your site’s own font: no font file to download, no font service contacted.

Measured on a blank WordPress. And the engine is built for your site: it only carries the options you use. The measured figures.

The cookie button shows your logo or ours.

The accent colour is picked from your theme, Divi or Elementor palette, and the text colour adapts to stay readable.

Each warning says what to do, often in one click.

Each language pack is signed too.

Basic or advanced mode, with a recommendation for your site.

• Google
• Google Tag Manager

Matomo loads as usual and writes no cookie before consent. WooCommerce and WP Statistics load as usual and read the choice through the WP Consent API plugin.

• Microsoft Clarity
• Microsoft Advertising
• Matomo

The tools it loads go into your cookie policy by themselves, paused tags are left out, and the dashboard tells you which tags to make wait for consent.

• Google Tag Manager

The scan finds the ones it does not know yet too. See the list.

• Meta Pixel
• LinkedIn
• TikTok
• Pinterest
• Hotjar
• AdSense

Allowing only Google reCAPTCHA or hCaptcha from a form reloads the page once, and what the visitor typed stays in the form. After consent, held scripts download together, then run in the order of the page.

• YouTube
• Vimeo
• Google Maps
• Spotify
• Instagram
• Tiktok
• Typeform

• reCAPTCHA

Each tool waits for its own consent: allowing the Meta Pixel does not start Google or Microsoft. When consent is withdrawn, their cookies are removed, from the first visit.

Cookie Rocks reads the code of your theme and plugins to find their names, and in Cookie Rocks Pro, Record a visit notes the cookies and keys your site writes while you use it.

Hold it from the Cookies screen in a few clicks, or give it a category in your theme (type="text/plain" data-cr-category="statistics") and it waits for the visitor’s yes. The categories you use show up in the panel, even before the first scan.

The cache is cleared when you save, for WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, SiteGround Optimizer, WP-Optimize and Jetpack Boost, and the consent script is kept out of Autoptimize, Jetpack Boost, WP-Optimize, FlyingPress, Perfmatters, NitroPack and the others. Scripts that WP Rocket, Perfmatters or LiteSpeed delay until the first interaction stay held until consent too. Caching plugins · The weight.

Then it is deleted automatically. An optional daily or weekly copy goes to your own storage: Dropbox, a WebDAV server, a signed webhook or an e-mail address. It goes straight from your site, never through ours.

For sites that address the United States, it also explains how the site answers browser privacy signals (Global Privacy Control, Do Not Track).

Country by country, too: proof of consent (248 jurisdictions), storing data in the country (218), hosting abroad (246), the local representative where one is needed, AI chatbots (50) and accessibility (99). The law sheets also give the language the banner must speak, the age of digital consent, the rule on cookie walls, the highest fine and recent decisions of the authorities.

Checking it needs nothing from your site.

Opt-out records are kept for at least 24 months, as California and Colorado require.