Works with your stack
Cookie consent for newsletter plugins: Mailchimp, MailPoet, Klaviyo
the form is not the tracker
A sign-up form is rarely the problem: the visitor sends an address on purpose. The trackers come next to it: a marketing script on every page, cookies set by your server, checkout fields sent before an order. Each plugin does it differently.
Newsletter plugins, one by one
What each newsletter plugin adds
- MC4WP: Mailchimp for WordPress
- Forms with no cookie. Optional site tracking adds Mailchimp’s script to every page.
- MailPoet
- Light forms. Its default engagement tracking sets server cookies for known subscribers.
- Klaviyo
- Klaviyo’s script on every page, and checkout files that send details by themselves.
- Mailchimp for WooCommerce
- Mailchimp’s script on every page by default, server cookies, and cart tracking that sends the e-mail typed at checkout.
What matters for consent with Newsletter plugins
The form is not a tracker
Sending an address to subscribe is the visitor’s own action. A form that stores nothing in the browser needs no consent question.
Marketing scripts wait
Mailchimp’s and Klaviyo’s site scripts follow visitors on every page. They are marketing, so they should wait for consent. Cookie Rocks holds known trackers until consent.
Server cookies cannot be held
MailPoet and Mailchimp for WooCommerce set some cookies from PHP, with the page itself. No banner can hold them; only the plugin’s own settings can.
The checkout talks early
Klaviyo and Mailchimp for WooCommerce can send an e-mail typed at checkout before any order. Check what your checkout sends.
What our tests found on Newsletter plugins
Good to know · TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, MatomoTranslatePress, Weglot, MailPoet and others set nothing by default
by default: Default settings
With default settings and nothing set up, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, use no storage and load no known third-party tool.
Seen in our tests, 17 October 2026, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, Matomo 3.3.8, 6.4.3, 6.14.0, 10.1.10, 5.42.0, 5.13.1. Source
Full detail
On a fresh WordPress home page with default settings (no account, key or content set up), TranslatePress, Weglot, Smash Balloon Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, keep nothing in the browser's storage and load no known third-party tool, after Accept all.
Good to know · MC4WP: Mailchimp for WordPressMC4WP Mailchimp forms set no cookie and store nothing in the browser
The forms work on cached pages. Form data is sent to Mailchimp by the server when the form is submitted.
Read in its code, 16 October 2026, MC4WP: Mailchimp for WordPress 4.14.1.
Full detail
MC4WP: Mailchimp for WordPress 4.14.1 contains no setcookie, document.cookie, localStorage, sessionStorage, IndexedDB, WP Consent API or gtag('consent') code (outside minified and vendor files). Forms use a timestamp field accepted for 90 days instead of a nonce, so they work on cached pages. Form data is sent to Mailchimp by the server on submission.
Depends on a setting · MC4WP: Mailchimp for WordPressMC4WP's tracking pixel loads on every page with no wait for consent
setting “Enable Site Tracking” · by default: off
Off by default. After a sign-up, the email is sent to Mailchimp only if the pixel is already loaded, so it is lost if the pixel is held and accepted later on that page.
Read in its code, 16 October 2026, MC4WP: Mailchimp for WordPress 4.14.1.
Full detail
MC4WP's Site Tracking Pixel (off by default) enqueues Mailchimp's script chimpstatic.com/mcjs-connected/js/users/<id>.js (handle mc4wp-mailchimp-site-tracking-pixel, defer) on every public page, with no setting to wait for consent. After a sign-up, an inline footer script calls $mcSite.pixel.api.identify with the subscriber's email only if the pixel is already loaded, so it is lost if the pixel is held and accepted later on the same page.
Good to know · MailPoetMailPoet's tracking consent covers emails, not the cookie banner
setting “tracking.consent.subscriber_choice” · by default: track_all
It covers email opens and clicks only, and MailPoet has no WP Consent API code. For visitors, its forms set only popup_form_dismissed_<id> (182 days) after closing a pop-up or subscribing.
Read in its code, 16 October 2026, MailPoet 5.42.0.
Full detail
MailPoet's subscriber tracking consent (track_all by default, ask_new, ask_all) covers email opens and clicks only; it does not read a cookie banner and does not cover cookies set at login or order. MailPoet has no WP Consent API code. For anonymous visitors, its forms set only popup_form_dismissed_<id>, by JavaScript, after closing a pop-up form or subscribing (182 days).
Depends on a setting · MailPoetMailPoet forms load Google or Cloudflare captcha only when it is chosen
setting “Load 3rd-party libraries” · by default: off
The built-in captcha sets no cookie. Google Fonts load only with Load 3rd-party libraries on (off by default). If the captcha script is held, the form cannot be sent before consent.
Read in its code, 16 October 2026, MailPoet 5.42.0.
Full detail
MailPoet forms load www.google.com/recaptcha/api.js or challenges.cloudflare.com/turnstile only when that captcha is chosen; the built-in captcha uses a hidden field and no cookie. Google Fonts in forms load from fonts.googleapis.com only when Load 3rd-party libraries is on (off by default). If the captcha script is held, public.js retries 20 times every 400 ms then gives up, so the form cannot be sent before consent.
Sent from your server · MailPoetMailPoet sets long-lived tracking cookies from the server, out of banners' reach
setting “Engagement analytics tracking” · by default: full
- With the default level (Full), mailpoet_subscriber (10 years) is set when a known subscriber logs in or orders.
- mailpoet_page_view (10 years) is then set on public pages.
- A newsletter click sets mailpoet_revenue_tracking (14 days) and mailpoet_subscriber.
- The Partial or Basic level, or the mailpoet_is_cookie_tracking_enabled filter, stops them.
Read in its code, 16 October 2026, MailPoet 5.42.0.
Full detail
With the default Engagement analytics tracking level (Full), MailPoet sets from PHP mailpoet_subscriber (10 years) when a known subscriber logs in, confirms, registers or places a WooCommerce order, then mailpoet_page_view (10 years) on public pages at most once a minute; a click in a newsletter sets mailpoet_revenue_tracking (14 days) and mailpoet_subscriber before redirecting. A consent plugin cannot hold them. Partial or Basic, or the mailpoet_is_cookie_tracking_enabled filter, stops them.
See the 6 other findings
Set before the choice · KlaviyoKlaviyo sends checkout details to Klaviyo even when its addresses are held
On the WooCommerce checkout, scripts served by the site set __kla_id (email and name, 2 years) and send profile data when the email or name is typed, or on load for logged-in customers.
Read in its code, 16 October 2026, Klaviyo 3.8.3.
Full detail
On the WooCommerce checkout, wck-started-checkout.js (classic) and includes/blocks/build/events.js (block checkout), both served by the site, set the __kla_id cookie (base64 of email, first and last name, 2 years) and POST profile and Started Checkout data to a.klaviyo.com/client/profiles/ and client/events/ without klaviyo.js: on load for a logged-in customer, otherwise when the email or name is typed. Holding Klaviyo's own addresses does not stop them.
Set before the choice · KlaviyoKlaviyo loads klaviyo.js on every page with no wait for consent
It loads on every public page except checkout, with no consent setting or WP Consent API code. Its other scripts only queue calls, so they need not be held.
Read in its code, 16 October 2026, Klaviyo 3.8.3.
Full detail
Once the public API key is set, the Klaviyo plugin prints static.klaviyo.com/onsite/js/<key>/klaviyo.js on every public page except checkout, rewritten as <script async src='...'> with single quotes and no id. There is no setting to wait for consent and no WP Consent API code. kl-identify-browser.js and wck-viewed-product.js only queue calls in window.klaviyo, sent when klaviyo.js loads, so they need not be held.
Sent from your server · KlaviyoKlaviyo's server sends Added to Cart events while __kla_id exists
Without the cookie nothing is sent, so removing __kla_id on withdrawal stops it.
Read in its code, 16 October 2026, Klaviyo 3.8.3.
Full detail
When a product is added to the cart and the __kla_id cookie is present, the Klaviyo plugin's server sends an Added to Cart event to a.klaviyo.com/client/events/ (wp_remote_post). Without the cookie nothing is sent, so removing __kla_id on withdrawal stops it.
Sent from your server · Mailchimp for WooCommerceMailchimp for WooCommerce sends the typed email to the site before any order
setting “Cart tracking” · by default: all
With cart tracking on (the default), leaving the email field sets mailchimp.cart.current_email and sends the address to the site. The server then passes cart data to Mailchimp.
Read in its code, 16 October 2026, Mailchimp for WooCommerce 6.3.
Full detail
With cart tracking on (all, by default), Mailchimp for WooCommerce's site script sets the session cookie mailchimp.cart.current_email when the visitor leaves the email field at checkout, login or registration, then sends the address to admin-ajax.php?action=mailchimp_set_user_by_email, before any order. The server then passes cart data to Mailchimp's API.
Sent from your server · Mailchimp for WooCommerceMailchimp for WooCommerce sets 28-day cookies that banners cannot hold
- mailchimp_campaign_id and mailchimp_email_id when the visitor arrives with ?mc_cid= or ?mc_eid=.
- mailchimp_user_email, mailchimp_user_previous_email and mailchimp_cart_token for cart recovery.
- mailchimp_landing_site on the first page, only if landing page tracking is on (off by default).
- All go through the mailchimp_allowed_to_use_cookie filter.
Read in its code, 16 October 2026, Mailchimp for WooCommerce 6.3.
Full detail
Mailchimp for WooCommerce sets its cookies from PHP for 28 days (2 419 200 s, Secure, SameSite=Strict): mailchimp_campaign_id and mailchimp_email_id when a visitor arrives with ?mc_cid= or ?mc_eid=, mailchimp_user_email, mailchimp_user_previous_email and mailchimp_cart_token (HttpOnly) for cart recovery, and mailchimp_landing_site on the first page only if landing page tracking is on (off by default). A consent plugin cannot hold them; all go through the mailchimp_allowed_to_use_cookie filter.
Set before the choice · Mailchimp for WooCommerceMailchimp for WooCommerce loads Mailchimp scripts on every page by default
setting “Mailchimp script” · by default: on
Mailchimp's site snippet and pixel load on every page, and a logged-in customer's email is written into the page for identification. No WP Consent API or Google consent code.
Read in its code, 16 October 2026, Mailchimp for WooCommerce 6.3.
Full detail
Mailchimp for WooCommerce prints Mailchimp's connected-site snippet (chimpstatic.com/mcjs-connected) inline in wp_footer on every page by default (option mailchimp-woocommerce-code-snippet, filter mailchimp_add_inline_footer_script). The Mailchimp pixel scripts are enqueued on every page unless MAILCHIMP_PIXEL_ENABLED is false, and the logged-in customer's email is written into window.mcPixel for identification. No WP Consent API or Consent Mode code.
Newsletters and popups
Other plugins of the same kind.
Questions
Which plugin is simplest for consent?
A plain sign-up form with no site tracking, like MC4WP with tracking off, adds nothing that waits.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with a newsletter
Sign-ups stay open, trackers wait.
forms are fine
Every feature of the complete plugin for 30 days, no card. Your sign-up forms keep working as they do today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.