Works with your stack
Cookie consent for Divi
the builder stays yours
Divi builds your pages with modules: contact forms, videos, maps, code. Several of them load outside tools that need consent, its fonts come from Google unless you change it, and a contact form protected by reCAPTCHA cannot send until reCAPTCHA is allowed.
By Elegant Themes · elegantthemes.com
Is this your product? Tell us if anything here is out of date. Write to us
Divi
WordPress theme
- Tested version
- 5.15.0
- How
- Tested on a live site
- Last test
- 10 October 2026
What Divi modules can put on your pages
- Map
- Shows Google Maps with your API key. The map loads Google’s scripts when the page opens.
- Contact Form
- Can use Google reCAPTCHA or a simple maths question. Only reCAPTCHA needs consent.
- Code and Text
- Run whatever you paste, embeds and tracking codes included.
- Social Media Follow
- Plain links to your profiles. They load nothing from the social networks.
- Fonts
- Divi’s fonts come from Google’s servers unless you host them yourself, for example with OMGF.
What matters for consent with Divi
Forms that depend on reCAPTCHA
The Divi contact form can use Google reCAPTCHA. reCAPTCHA needs consent, and the form needs reCAPTCHA to send. Held without a word, the form cannot send and the visitor does not know why.
Videos and maps in modules
Video and map modules embed YouTube, Vimeo or Google Maps. Each one sets cookies as soon as it loads, before any click.
Fonts from Google
Divi loads its fonts from Google’s servers by default. Each visit then sends the visitor’s address to Google before any choice. Hosting the fonts on your own site removes that request.
Code in the theme options
Divi has a place for code in the head and the body of every page. Tracking codes pasted there run on every page, outside any plugin, so they are easy to forget.
Divi 5 stores layouts as data
Divi 5 keeps modules as structured data instead of shortcodes. A cookie policy left by a previous cookie plugin sits inside that data, where a plain search of your pages does not find it.
A builder that must stay usable
While you design in the visual builder, a banner or a held script gets in the way. A consent plugin should stay out of the builder and act on published pages only.
Cookie Rocks with Divi
- Stays out of its visual editor: no banner and no blocking while you design.
- When reCAPTCHA or hCaptcha waits for consent, shows an “Allow” request at the top of its forms.
- Holds sending until reCAPTCHA is allowed, and puts back what the visitor typed after the page reloads.
- Offers its colours for your banner on the Appearance page.
- Recognises the cookie policy of your previous cookie plugin stored in its modules.
- Replaces that policy with the Cookie Rocks policy in one click.
What our tests found on Divi
Good to knowHeld maps wait behind a « Load the map » box
A « Load the map » box until the click or the consent; the map then loads without a reload.
Read in its code, 4 November 2026.
Full detail
Before the choice, Cookie Rocks Pro replaces an embedded Google map with a « Load the map » box. Nothing is requested from Google until the visitor clicks the box or accepts the category; a click allows this one tool and the map loads without a reload.
Good to knowHeld videos show their thumbnail, copied by the site
A « Load the video » box with the video's thumbnail, served by the site; one click starts the video without a reload.
Read in its code, 4 November 2026.
Full detail
Before the choice, Cookie Rocks Pro replaces a YouTube, Vimeo or Dailymotion video in the page with a « Load the video » box that shows the video's thumbnail. The site's own server copies the thumbnail once and refreshes it every 30 days, so the visitor's browser never contacts the video platform. A click on the box allows this one tool, and the video starts at once, without a reload.
Good to know · DiviDivi split testing sets a cookie before the visitor chooses
Divi split testing: et_pb_ab_view_page_* set by the server before the choice (statistics).
Name Kept in Category What it is for et_pb_ab_view_page_*cookie Statistics Counts a view of a page under a Divi split test Read in its code, 4 November 2026, Divi.
Full detail
On a live site with a Divi split test running, the server sets et_pb_ab_view_page_<page id> (session) in the page response, before the visitor chooses. The Audit 2.9.11 sees it and classes it Statistics; a banner can only delete it afterwards. Divi Leads goal cookies (et_pb_ab_*) follow for 1 year after a read or click.
Good to know · Divi Supreme ProWhat Divi Supreme Pro popups store in visitors' browsers
Divi Supreme Pro: dsm-*-popup-cookie-<id> (preferences, life set per popup), on load, scroll or exit.
Name Kept in Category What it is for dsm-load-popup-cookie-*cookie Preferences Remembers that a popup opened on page load was shown dsm-scroll-popup-cookie-*cookie Preferences Remembers that a popup opened on scroll was shown dsm-exit-popup-cookie-*cookie Preferences Remembers that a popup opened on exit was shown Read in its code, 4 November 2026, Divi Supreme Pro.
Full detail
Divi Supreme Pro popups set dsm-load-popup-cookie-<popup id>, dsm-scroll-popup-cookie-<popup id> or dsm-exit-popup-cookie-<popup id> (value dsm-<trigger>, SameSite Lax) when the popup opens, with a life in days set per popup (data-dsm-popup-cookie-expiry). An « on load » popup sets its cookie as soon as the page loads. They stop the popup from showing again.
Good to know · DiviDivi's onboarding keys stay with the site team
Divi's onboarding keys are for the site team only; visitors never get them.
What to do: Nothing to do. Cookie Rocks 2.9.7 listed them under « Found only in the code » to classify; from 2.9.8 it recognises them as site-team keys and leaves them out of the cookie policy and of the points to fix.
Read in its code, 2 November 2026, Divi 5.8.1.
Full detail
remainingSteps, siteCustomizationInfo and unprocessedPagesDetails are browser storage keys of Divi's onboarding and AI website builder. Divi loads that code only on its own admin page, so the keys are stored only in the browsers of people who build the site, never in visitors' browsers. They hold the steps left in the setup, the chosen starter pack and the pages still to create.
Good to know · Cookie RocksCookie Rocks classes Divi's visitor cookies itself
Cookie Rocks 2.9.5 classes two Divi cookies as preferences: divi_module_views (how many times a section was seen) and divi_post_visit (pages already visited), set for one year only when the site uses these display conditions. ACF's acf local storage key is also preferences. Names that only Divi's builder and WordPress editors use (et-*-post-* cookies, et_pb_templates_* keys, DiviCloud and others) are left out of scans and never to classify.
Read in its code, 1 November 2026, Cookie Rocks.
See the 6 other findings
Depends on a setting · Cookie Rocks ProCookie Rocks Pro serves Google Fonts from the site
setting “Serve Google Fonts from this site (local_fonts)” · by default: on
- Copies only fonts.googleapis.com and fonts.gstatic.com.
- At most 120 files, 2 MB each; a failed copy waits 7 days.
- Nothing to do on pages without a Google font.
Seen in our tests, 1 November 2026, Cookie Rocks Pro.
Full detail
Cookie Rocks Pro 2.9.5 serves Google Fonts from the site, on by default (« Serve Google Fonts from this site », Consent page). The first page that still loads a Google font starts a background task. It copies each stylesheet and font file into wp-content/uploads/cookie-rocks/fonts/, then pages use the copies: links to fonts.googleapis.com and font files written in the page, as Divi's inline fonts. Once all is copied, preconnect and preload links to Google are removed and page caches are cleared. Google Fonts then leaves the cookie policy.
Depends on a setting · DiviDivi's Improve Google Fonts Loading does not host fonts
setting “Improve Google Fonts Loading (divi_google_fonts_inline)”
Divi's « Improve Google Fonts Loading » copies Google's stylesheet into the page, but the font files still come from fonts.gstatic.com, so the visitor's IP address still goes to Google. On eight live Divi 4.27 sites, the inline style (id et-builder-googlefonts-cached-inline) pointed to Google in every case. With the setting off, Divi links fonts.googleapis.com instead. Divi 4 and Divi 5.15.1 have no option that hosts Google Fonts on the site.
What to do: Host the fonts with an extension such as OMGF, upload them in Divi, or turn off « Use Google Fonts ».
Seen in our tests, 1 November 2026, Divi 4.27.9.
Good to know · DiviFonts uploaded in Divi are served by the site
Fonts uploaded in Divi are served from the site itself (/wp-content/uploads/et-fonts/, declared in a style with id et-divi-userfonts): no request to Google for them. On a live site, uploaded fonts sat next to a Google font loaded from fonts.gstatic.com by the same theme: whether a page sends data to Google depends on each font, not on the theme.
Seen in our tests, 1 November 2026, Divi 4.27.9.
Good to know · DiviDivi 5 links variable Google Fonts, and OMGF still serves them
Divi 5.15.1 links its Google fonts as variable fonts, in a stylesheet with id et-builder-googlefonts-cached-variable-css (et-builder-googlefonts-variable-css on the first page built without cache). On a live Divi 5 site with OMGF, both were served from /wp-content/uploads/omgf/, with no request to Google. Turning « Improve Google Fonts Loading » on did not change that: Divi 5 kept the link and OMGF kept serving it.
Seen in our tests, 1 November 2026, Divi 5.15.1.
Set before the choice · DiviDivi loads Google Fonts before the choice and after a refusal
This sends the visitor's IP address to Google. On a real Divi 5 site, these fonts were the only request to Google before the choice.
What to do: Host the fonts with an extension such as OMGF, or upload them in Divi: Divi has no option that hosts Google Fonts on the site.
Seen in our tests, 8 October 2026, Divi 5.15.0.
Full detail
Divi loads its fonts from Google Fonts on every page, before any choice and after a refusal, which sends the visitor's IP address to Google. On a real Divi 5 site with Google Tag Manager, YouTube videos and Cookie Rocks in basic mode, these fonts were the only request to Google before the choice and after Reject all. The Divi contact form sends normally after Reject all.
Good to know · DiviCookie Rocks replaces an old cookie policy stored in a Divi 5 module
Divi 5 stores shortcodes in a form that plugins searching the page content may miss. The Cookie Rocks dashboard finds the previous plugin's policy there and replaces it in one click.
Seen in our tests, 8 October 2026, Divi 5.15.0.
Full detail
Divi 5 stores a shortcode placed in its modules inside JSON, with encoded quotes, so a plugin that looks for a shortcode in the page content may miss it. The Cookie Rocks dashboard finds a previous cookie plugin's policy stored this way in a Divi 5 module and replaces it with the Cookie Rocks policy in one click (checked on a real Divi 5 site).
How we test it
On a live site
We installed Cookie Rocks on a real WordPress site built with it, kept as its owners set it up, and watched what loads before the choice and after it. Its own features had to keep working, such as forms, videos or a checkout.
- Divi 5.15.0, tested on 10 October 2026.
Page builders and themes
Other plugins of the same kind.
Questions
Can I avoid the reCAPTCHA question on Divi forms?
Yes. The Divi contact form also offers a simple maths question, which needs no consent. A honeypot plugin is another way to stop spam without a captcha: see WP Armour.
How do I stop Divi from loading fonts from Google?
Host the fonts on your own site. A plugin such as OMGF does it for the fonts Divi uses, and the request to Google disappears.
Where does the cookie policy go on a Divi site?
In a Text or Code module, with the [cookie_rocks_policy] shortcode. It works with the free Audit alone.
What about embeds added by a script after the page has loaded?
No consent plugin sees those reliably. Prefer the standard Divi video and map modules, which put the embed in the page itself.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For Divi sites
Keep Divi, add consent that respects it.
forms still send
Every feature of the complete plugin on your Divi site for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.