Works with your stack
Cookie consent for booking and event plugins
the form brings guests
Booking calendars and event plugins often bring other companies with them: payment scripts, Google Maps, captchas and analytics tags. Several also look up the visitor’s country from the IP address to fill in the phone field.
Bookings and events, one by one
What each plugin adds
- Amelia
- Payment scripts, Google Maps and reCAPTCHA with the form; in paid versions Google and Meta tags. A server lookup of the visitor’s country.
- Bookly
- No cookie by default. reCAPTCHA, Google Maps or Stripe added while the form runs, and a country lookup.
- Simply Schedule Appointments
- A booking iframe built by your site’s REST API, a country lookup and Google Fonts inside.
- Eventin
- One booking timer setting in local storage, no cookie.
- The Events Calendar
- No cookie. A Google map on every event with an address, on by default.
What matters for consent with Bookings and events
Look at the form in use
Many booking plugins add outside scripts only when the form starts or reaches a step. The page source does not show them.
Pick a phone country
Amelia, Bookly and Simply Schedule Appointments guess the visitor’s country from outside sites when left on auto. A fixed country stops it.
Maps and payments
Google Maps, Stripe and PayPal come from other companies. Cookie Rocks holds known trackers until consent.
Tags belong to the site
Analytics or pixel IDs set inside a booking plugin can load before any choice. Put them in your site’s own tag, which a consent plugin can hold.
What our tests found on Bookings and events
Set before the choice · ameliabookingAmelia 2.4.14 and Google Fonts
Amelia 2.4.14 loads Roboto font files from fonts.gstatic.com before any choice on a page with its shortcode. In our test on Cookie Rocks 2.11.2 the Pro copy did not catch them: the call to Google stayed after the daily check.
Seen in our tests, 7 November 2026, ameliabooking 2.4.14.
Set before the choice · Cookie RocksTags created inside a form script are not held
Cookie Rocks 2.11.0 does not hold Google tags or a Meta pixel created in JavaScript from a script of the site, the way Amelia's form script creates them: gtag.js and fbevents.js load before the choice. Tested with a script of the same form, because Amelia's own option is paid.
Seen in our tests, 6 November 2026, Cookie Rocks.
Sent from your server · AmeliaAmelia sends the visitor's IP address to iplocate.io from the server
setting “Default phone country code” · by default: auto
With the phone country on auto, each page with a booking form triggers this lookup. With page caching, the first visitor's country is served to everyone.
What to do: Choose a fixed default phone country.
Read in its code, 5 November 2026, Amelia 2.4.14.
Full detail
With the default phone country set to auto, Amelia's server sends the visitor's IP address to www.iplocate.io/api/lookup/ each time a page with a booking form is built, and writes the country found into the page settings (wpAmeliaSettings). With page caching, the first visitor's country is served to everyone and the call happens only when the cache is filled. A fixed default phone country avoids the call: the setting is auto by default, and the site owner can change it.
Good to know · EventinWhat Eventin stores in visitors' browsers
Eventin: 9 cookie(s) or browser key(s) for visitors, recognised by Cookie Rocks from 2.9.8.
Name Kept in Category What it is for EVENTIN_PAYPAL_ORDER_IDlocalStorage Necessary Keeps an event booking and its payment going bookingTimerSettingsEnabledlocalStorage Necessary Keeps an event booking and its payment going etn_cart_infolocalStorage Necessary Keeps an event booking and its payment going etn_event_datalocalStorage Necessary Keeps an event booking and its payment going etn_is_waiting_listlocalStorage Necessary Keeps an event booking and its payment going etn_order_idlocalStorage Necessary Keeps an event booking and its payment going etn_order_tokenlocalStorage Necessary Keeps an event booking and its payment going etn_preferred_payment_methodlocalStorage Necessary Keeps an event booking and its payment going etn_is_payment_linklocalStorage Necessary Keeps an event booking and its payment going Read in its code, 2 November 2026, Eventin.
Full detail
Eventin can store 9 cookies or browser keys for visitors: EVENTIN_PAYPAL_ORDER_ID, bookingTimerSettingsEnabled, etn_cart_info, etn_event_data, etn_is_waiting_list, etn_order_id, etn_order_token, etn_preferred_payment_method, etn_is_payment_link. Cookie Rocks recognises them from 2.9.8 and lists them in the cookie policy, each with its category and purpose, when it sees them.
Good to know · EventinEventin keeps one key in local storage on the home page
With default settings, Eventin keeps the key bookingTimerSettingsEnabled in the browser's local storage on the home page (seen after Accept all; no cookie).
Seen in our tests, 17 October 2026, Eventin 4.1.27. Source
Good to know · AmeliaAmelia's booking form sets a colour mode cookie for visitors
- maz-resolved-color-mode (light or dark, 1 year) when the form loads in automatic colour mode, the default.
- ameliaToken and ameliaUserEmail only after a panel login, 30 days by default.
- ameliaCacheData in sessionStorage keeps the booking during a redirect payment.
- Fonts are served from the site.
Read in its code, 16 October 2026, Amelia 2.4.11.
Full detail
The Amelia booking form sets a first-party cookie, maz-resolved-color-mode (light or dark, 1 year, path /, SameSite=Lax), when it mounts with the automatic colour mode (default). ameliaToken and ameliaUserEmail exist only after a customer or employee logs in to the panel and last 30 days by default. sessionStorage ameliaCacheData keeps the booking during a redirect payment. Fonts are served from the site.
See the 8 other findings
Set before the choice · AmeliaAmelia loads payment scripts on every page with a form
- PayPal (www.paypal.com/sdk/js) and Stripe (js.stripe.com/v3/).
- Square (web.squarecdn.com, with a stylesheet from developers.google.com), also in the free version.
- Razorpay (checkout.razorpay.com).
- Google Maps with Places, when a Maps key is set and an address field exists.
Read in its code, 16 October 2026, Amelia 2.4.11.
Full detail
On every page with an Amelia form, the server enqueues the scripts of the enabled payment methods before the payment step: www.paypal.com/sdk/js, js.stripe.com/v3/, web.squarecdn.com/v1/square.js with a stylesheet from developers.google.com (Square, available in the free version) and checkout.razorpay.com. maps.googleapis.com/maps/api/js with Places loads when a Google Maps key is set and an address custom field exists.
Set before the choice · AmeliaAmelia loads Google and Meta tags with no consent check
When configured, its form script loads Google's tag and the Meta Pixel as soon as a form shows. Its reCAPTCHA adds Google's script too. These are paid features.
What to do: Do not enable Meta Pixel or Google Analytics inside Amelia; load them through the site's own tag, which a consent plugin can hold.
Read in its code, 16 October 2026, Amelia 2.4.11.
Full detail
Amelia's form script public.js, served by the site, loads googletagmanager.com/gtag/js (vue-gtag) when Google Analytics or Google Tag is configured, and connect.facebook.net/en_US/fbevents.js then fbq('init') when a Meta Pixel ID is set, as soon as a form mounts, with no consent check and no gtag('consent') call. Its reCAPTCHA component adds google.com/recaptcha/api.js itself. These integrations are reserved to paid licences. Amelia does not use WP Consent API.
Depends on a setting · BooklyBookly can store customer details in plain-text cookies for a year
setting “Remember personal information in cookies” · by default: off
Off by default. With 'Remember personal information in cookies' on, bookly-customer-* cookies keep name, e-mail, phone, birthday and address after a booking.
Read in its code, 16 October 2026, Bookly 28.6.
Full detail
By default Bookly sets no cookie of its own: form progress is kept in the database under a token for 30 minutes. With 'Remember personal information in cookies' on (off by default), the server sets bookly-customer-* cookies (name, email, phone, birthday, address) and bookly-customer-info-fields after a booking, for 1 year, in plain text, without HttpOnly. 'Prevent caching of pages with booking form' (on by default) sends DONOTCACHEPAGE.
Set before the choice · BooklyBookly asks ipinfo.io for the visitor's country at the Details step
setting “Phone field default country” · by default: auto
With the phone field default country left on auto (the default), Bookly's script bookly.js asks ipinfo.io for the visitor's country by JSONP when the Details step opens, before anything is sent.
What to do: Choose a default country.
Read in its code, 16 October 2026, Bookly 28.6.
Set before the choice · BooklyBookly adds reCAPTCHA, Google Maps and Stripe while the form runs
Its own script adds them when their modules are active, so they are not in the page markup. Bookly has no WP Consent API or Consent Mode code.
Read in its code, 16 October 2026, Bookly 28.6.
Full detail
Bookly's own script, served by the site, adds third-party scripts at run time: google.com/recaptcha/api.js (v2 when the Details step shows, v3 on Next), and maps.googleapis.com with Places or js.stripe.com/v3/ when the form starts, if those modules are active. They are not in the page markup. Bookly has no WP Consent API or Consent Mode code.
Set before the choice · Simply Schedule AppointmentsSimply Schedule Appointments sends the visitor's IP to country lookup sites
setting “Default Country for Telephone Number Fields (country_code)” · by default: empty
Until a default phone country is set, the booking form asks ip2c.org, then api.country.is, before any choice. Google Fonts and Stripe (paid) can also load in the form. No cookie or storage.
Read in its code, 16 October 2026, Simply Schedule Appointments 1.6.12.37.
Full detail
Until a default phone country is set, the Simply Schedule Appointments booking app asks ip2c.org for the visitor's country each time the form is shown, before any choice, and api.country.is if that fails, so the visitor's IP address reaches those two sites. A Google font chosen in the form style loads from fonts.googleapis.com inside the form, and Stripe (paid edition) loads js.stripe.com there. The booking app itself sets no cookie and uses no browser storage.
Good to know · Simply Schedule AppointmentsSimply Schedule Appointments' booking form is out of a consent plugin's reach
The form is an iframe built by the site's REST API, so a consent plugin that rewrites pages never reads it. The paid Tracking feature sends a hashed e-mail address to dataLayer on a booking.
Read in its code, 16 October 2026, Simply Schedule Appointments 1.6.12.37.
Full detail
The [ssa_booking] form is an iframe whose page is written by the site's REST API (/wp-json/ssa/v1/embed-inner) without wp_head or template_redirect, marked skip-lazy and loading=eager. A consent plugin that rewrites pages from template_redirect never reads that page, so what loads inside cannot be held there. The paid Tracking feature only calls ga, dataLayer, fbq or analytics if already present, and pushes a SHA-256 hashed e-mail address to dataLayer on a completed booking.
Set before the choice · The Events CalendarThe Events Calendar shows a Google map on events with an address by default
setting “Enable Maps” · by default: on
With the built-in key the map is a Google iframe; with the site's own key, Google's map script loads. The plugin sets no cookie or storage. Its suggested policy text says no data leaves the site.
Read in its code, 16 October 2026, The Events Calendar 6.18.2.
Full detail
The Events Calendar shows a Google map on events with an address by default (maps enabled, Show Google Map ticked for new events). With the key built into the plugin, the map is an iframe to www.google.com/maps/embed/v1/place in the HTML; with the site's own key, it loads maps.googleapis.com/maps/api/js and embedded-map.js draws the map on page load. The plugin sets no cookie and uses no browser storage on visitor pages, and its calendar export links load nothing until clicked. Its suggested privacy policy text says no data leaves the site by default.
Bookings, events and courses
Other plugins of the same kind.
Questions
Do bookings need cookies?
Most booking plugins set few or none of their own. The question is what they load from others.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with bookings or events
Bookings open to everyone.
pick a phone country
Every feature of the complete plugin for 30 days, no card. Your booking form keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.