Cookie banner for a course or membership website

Plugins that courses and memberships often use

Each one is tested with Cookie Rocks: what it loads in the browser, and what waits for the visitor’s choice. Open a card for the details.

What matters for consent with courses and memberships

What our tests found on courses and memberships

• Set before the choice · tutorTutor LMS 4.2.0 and Google Fonts

  Tutor LMS 4.2.0 loads Inter from Google Fonts before any choice on public pages. Cookie Rocks Pro 2.11.2 copies it to the site, after its copy task has run: no call to Google remained on the next pass.

  Seen in our tests, 7 November 2026, tutor 4.2.0.

• Good to know · TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, MatomoTranslatePress, Weglot, MailPoet and others set nothing by default

  by default: Default settings

  With default settings and nothing set up, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, use no storage and load no known third-party tool.

  Seen in our tests, 17 October 2026, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, Matomo 3.3.8, 6.4.3, 6.14.0, 10.1.10, 5.42.0, 5.13.1. Source

  Full detail

  On a fresh WordPress home page with default settings (no account, key or content set up), TranslatePress, Weglot, Smash Balloon Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, keep nothing in the browser's storage and load no known third-party tool, after Accept all.

• Set before the choice · Tutor LMSTutor LMS loads the Inter font from Google on its dashboard and login pages

  Also on registration pages and the learning area, not on course pages. No setting turns it off, and the request leaves even as a preload.

  Read in its code, 16 October 2026, Tutor LMS 4.1.3.

  Full detail

  Tutor LMS 4.1.3 loads the Inter font (Nunito in kids mode) from fonts.googleapis.com as a dependency of its core stylesheet on its dashboard page, including the login form shown to visitors, on its registration pages and in the learning area, but not on course pages or the course archive. No setting turns it off, and the link is rewritten as rel=preload, so the request leaves either way.

• Depends on a setting · Tutor LMSTutor Player loads YouTube or Vimeo scripts and a Plyr file from another site

  setting “Use Tutor Player for YouTube / Vimeo” · by default: off

  By default, YouTube and Vimeo videos are plain iframes. With Use Tutor Player on, Plyr loads their scripts, asks noembed.com for YouTube titles and loads icons from cdn.plyr.io.

  Read in its code, 16 October 2026, Tutor LMS 4.1.3.

  Full detail

  Tutor LMS lesson and course intro videos from YouTube or Vimeo are plain iframes in the HTML by default. With Use Tutor Player on, Plyr 3.8.4 takes them over, loads www.youtube.com/iframe_api or player.vimeo.com/api/player.js and asks noembed.com for the YouTube title. Plyr also loads its icon sprite from cdn.plyr.io for every Tutor player, even a media library video, and keeps preferences in localStorage key plyr. External URL videos are video tags pointing at the other host.

• Set before the choice · The Events CalendarThe Events Calendar shows a Google map on events with an address by default

  setting “Enable Maps” · by default: on

  With the built-in key the map is a Google iframe; with the site's own key, Google's map script loads. The plugin sets no cookie or storage. Its suggested policy text says no data leaves the site.

  Read in its code, 16 October 2026, The Events Calendar 6.18.2.

  Full detail

  The Events Calendar shows a Google map on events with an address by default (maps enabled, Show Google Map ticked for new events). With the key built into the plugin, the map is an iframe to www.google.com/maps/embed/v1/place in the HTML; with the site's own key, it loads maps.googleapis.com/maps/api/js and embedded-map.js draws the map on page load. The plugin sets no cookie and uses no browser storage on visitor pages, and its calendar export links load nothing until clicked. Its suggested privacy policy text says no data leaves the site by default.

• Good to know · MailPoetMailPoet's tracking consent covers emails, not the cookie banner

  setting “tracking.consent.subscriber_choice” · by default: track_all

  It covers email opens and clicks only, and MailPoet has no WP Consent API code. For visitors, its forms set only popup_form_dismissed_<id> (182 days) after closing a pop-up or subscribing.

  Read in its code, 16 October 2026, MailPoet 5.42.0.

  Full detail

  MailPoet's subscriber tracking consent (track_all by default, ask_new, ask_all) covers email opens and clicks only; it does not read a cookie banner and does not cover cookies set at login or order. MailPoet has no WP Consent API code. For anonymous visitors, its forms set only popup_form_dismissed_<id>, by JavaScript, after closing a pop-up form or subscribing (182 days).

• Depends on a setting · MailPoetMailPoet forms load Google or Cloudflare captcha only when it is chosen

  setting “Load 3rd-party libraries” · by default: off

  The built-in captcha sets no cookie. Google Fonts load only with Load 3rd-party libraries on (off by default). If the captcha script is held, the form cannot be sent before consent.

  Read in its code, 16 October 2026, MailPoet 5.42.0.

  Full detail

  MailPoet forms load www.google.com/recaptcha/api.js or challenges.cloudflare.com/turnstile only when that captcha is chosen; the built-in captcha uses a hidden field and no cookie. Google Fonts in forms load from fonts.googleapis.com only when Load 3rd-party libraries is on (off by default). If the captcha script is held, public.js retries 20 times every 400 ms then gives up, so the form cannot be sent before consent.

• Sent from your server · MailPoetMailPoet sets long-lived tracking cookies from the server, out of banners' reach

  setting “Engagement analytics tracking” · by default: full

  • With the default level (Full), mailpoet_subscriber (10 years) is set when a known subscriber logs in or orders.
  • mailpoet_page_view (10 years) is then set on public pages.
  • A newsletter click sets mailpoet_revenue_tracking (14 days) and mailpoet_subscriber.
  • The Partial or Basic level, or the mailpoet_is_cookie_tracking_enabled filter, stops them.

  Read in its code, 16 October 2026, MailPoet 5.42.0.

  Full detail

  With the default Engagement analytics tracking level (Full), MailPoet sets from PHP mailpoet_subscriber (10 years) when a known subscriber logs in, confirms, registers or places a WooCommerce order, then mailpoet_page_view (10 years) on public pages at most once a minute; a click in a newsletter sets mailpoet_revenue_tracking (14 days) and mailpoet_subscriber before redirecting. A consent plugin cannot hold them. Partial or Basic, or the mailpoet_is_cookie_tracking_enabled filter, stops them.

Kinds of sites

Other kinds of sites, each with its own page.

Every plugin and theme we test →