Works with your stack
Cookie consent for WooCommerce payment plugins
payments come early
Payment plugins for WooCommerce do not wait for the checkout. Stripe and PayPal scripts load on product and cart pages too, for express buttons and pay-later messages, and fraud checks come with them. None of these plugins has a consent setting.
Payment plugins, one by one
What each payment plugin adds
- WooPayments
- Stripe’s script on product, cart and checkout pages, a device ID for fraud checks, some browser storage.
- WooCommerce Stripe Payment Gateway
- Stripe’s script on product, cart and checkout pages, even with express buttons off.
- WooCommerce PayPal Payments
- The PayPal script built by its own code where buttons show, and a fraud script always.
What matters for consent with Payment plugins
Checkout is part of paying
On the checkout page, the payment script is what lets the visitor pay. It has to load from the provider and run unchanged.
Product and cart pages
Express buttons and pay-later messages bring the payment script to product and cart pages, before any purchase. Keep only the locations you need.
Fraud checks
Payment plugins add fraud scripts or device IDs at checkout. Some create the script from their own code, so it is not in the page source.
What our tests found on Payment plugins
Good to know · WooPaymentsWhat WooPayments stores in visitors' browsers
WooPayments: 2 cookie(s) or browser key(s) for visitors, recognised by Cookie Rocks from 2.9.8.
Name Kept in Category What it is for wcpay_express_checkout_redirect_urlcookie Necessary Keeps an express payment going skip_woopaycookie Necessary Keeps an express payment going Read in its code, 2 November 2026, WooPayments.
Full detail
WooPayments can store these in a visitor's browser: wcpay_express_checkout_redirect_url (cookie, necessary: Keeps an express payment going); skip_woopay (cookie, necessary: Keeps an express payment going). Cookie Rocks recognises them from 2.9.8, with this category and purpose, and lists them in the cookie policy when it sees them.
Good to know · WooCommerce Stripe Payment GatewayWhat WooCommerce Stripe Payment Gateway stores in visitors' browsers
WooCommerce Stripe Payment Gateway: 1 cookie(s) or browser key(s) for visitors, recognised by Cookie Rocks from 2.9.8.
Name Kept in Category What it is for wc_stripe_express_checkout_redirect_urlcookie Necessary Keeps an express payment (Apple Pay, Google Pay) going Read in its code, 2 November 2026, WooCommerce Stripe Payment Gateway.
Full detail
WooCommerce Stripe Payment Gateway can store these in a visitor's browser: wc_stripe_express_checkout_redirect_url (cookie, necessary: Keeps an express payment (Apple Pay, Google Pay) going). Cookie Rocks recognises them from 2.9.8, with this category and purpose, and lists them in the cookie policy when it sees them.
Good to know · WooCommerce PayPal PaymentsWhat WooCommerce PayPal Payments stores in visitors' browsers
WooCommerce PayPal Payments: 2 cookie(s) or browser key(s) for visitors, recognised by Cookie Rocks from 2.9.8.
Name Kept in Category What it is for axoEnvlocalStorage Necessary Keeps the PayPal fast checkout (Fastlane) going axoOriginalCheckoutFieldslocalStorage Necessary Keeps the PayPal fast checkout (Fastlane) going Read in its code, 2 November 2026, WooCommerce PayPal Payments.
Full detail
WooCommerce PayPal Payments can store these in a visitor's browser: axoEnv (localStorage, necessary: Keeps the PayPal fast checkout (Fastlane) going); axoOriginalCheckoutFields (localStorage, necessary: Keeps the PayPal fast checkout (Fastlane) going). Cookie Rocks recognises them from 2.9.8, with this category and purpose, and lists them in the cookie policy when it sees them.
Good to know · WooPaymentsWooPayments checkout computes a device ID and uses cookies and browser storage
- A FingerprintJS device ID is sent with the payment for fraud checks.
- Sets skip_woopay (1 day) and keeps wcpay_appearance_<context> in local storage.
- With Sift in the fraud setup, it creates cdn.sift.com/s.js itself, outside the page HTML.
- Block checkout keeps woopay_preferred_card (card brand, last 4 digits) in local storage.
Read in its code, 16 October 2026, WooPayments 11.2.0.
Full detail
WooPayments' checkout bundle (served by the site) computes a FingerprintJS device ID sent with the payment for fraud checks, with monitoring off (no call to openfpcdn.io); it sets and deletes a cookietest cookie, keeps wcpay_appearance_<context> in localStorage and reads or sets skip_woopay (1 day). When the account's fraud configuration includes Sift, the same bundle creates <script src="https://cdn.sift.com/s.js"> itself, so it is not in the page HTML. The block checkout also stores woopay_preferred_card (card brand and last 4 digits) in localStorage; multi-currency keeps wcpay_mc_async_config in sessionStorage for 5 minutes. It does not read WP Consent API.
Sent from your server · WooPaymentsWooPayments sends shopper events from the server for US stores
setting “wcpay_shopper_tracking_enabled (filter) ; WooCommerce usage tracking” · by default: off
Only with WooCommerce usage tracking allowed, mostly when WooPay is on. The anonymous ID is a tk_ai session cookie set by the server. No banner can hold a server-side call.
Read in its code, 16 October 2026, WooPayments 11.2.0.
Full detail
WooPayments sends shopper Tracks events from the server to pixel.wp.com (wp_remote_get), only for stores in the United States with WooCommerce usage tracking allowed, mostly when WooPay is on; it respects a tk_opt-out cookie. The anonymous ID is a tk_ai session cookie set in PHP. No banner can hold a server-side call.
Set before the choice · WooPaymentsWooPayments loads Stripe.js on product, cart and checkout pages by default
setting “Express checkout locations” · by default: product, cart, checkout
Its default Apple Pay, Google Pay, WooPay and Amazon Pay buttons show on those pages, so Stripe.js runs there, but not on the home page or posts.
Read in its code, 16 October 2026, WooPayments 11.2.0.
Full detail
WooPayments loads Stripe.js (js.stripe.com/v3) at checkout and pay-for-order, and on product and cart pages when express buttons or pay-later messages (Affirm, Afterpay, Klarna) are shown there. Its defaults offer Apple Pay and Google Pay, WooPay and Amazon Pay buttons on product, cart and checkout pages, so Stripe.js runs on those pages; not on the home page or posts. It uses the same script handle as the Stripe extension to avoid loading it twice.
See the 4 other findings
Set before the choice · WooCommerce Stripe Payment GatewayWooCommerce Stripe loads Stripe.js on product, cart and checkout by default
- Not on the home page, posts or shop.
- On product and cart pages it loads even when express buttons are off there.
- With express buttons, it adds early connections to four Stripe hosts.
- An express redirect sets wc_stripe_express_checkout_redirect_url (10 minutes).
Read in its code, 16 October 2026, WooCommerce Stripe Payment Gateway 11.1.1.
Full detail
The Stripe extension for WooCommerce loads Stripe.js (js.stripe.com) on product, cart, checkout, pay-for-order and add-payment-method pages by default, not only at checkout, and never on the home page, posts or shop. On product and cart pages it still loads when express buttons are off there, because two filters (wc_stripe_load_scripts_on_product_page_when_prbs_disabled and the cart one) default to true. When express buttons show, it adds preconnect hints to js.stripe.com, m.stripe.network, q.stripe.com and b.stripecdn.com in the head, and sets wc_stripe_express_checkout_redirect_url (10 minutes) on an express redirect. Its shop bundles write no cookie or localStorage.
Good to know · WooCommerce Stripe Payment GatewayWooCommerce Stripe has no consent setting and needs Stripe.js at its address
It does not read WP Consent API or set Consent Mode. Its checkout checks that Stripe.js came from js.stripe.com, so the script must run normally for card payments to work.
Read in its code, 16 October 2026, WooCommerce Stripe Payment Gateway 11.1.1.
Full detail
The Stripe extension for WooCommerce has no consent setting, does not read WP Consent API and sets no Consent Mode. Before charging, its checkout code checks that Stripe.js was loaded from https://js.stripe.com, so the script must stay on Stripe's address and run normally for card payments to work.
Set before the choice · WooCommerce PayPal PaymentsPayPal Payments always loads PayPal's FraudNet script where its buttons are
In 4.1.3 a site script creates c.paypal.com/da/r/fb.js at checkout and on product, cart and pay pages with buttons. Optional reCAPTCHA (off by default) loads Google there. No consent setting.
Read in its code, 16 October 2026, WooCommerce PayPal Payments 4.1.3.
Full detail
PayPal Payments always loads FraudNet in version 4.1.3 (the enabled check returns true): fraudnet.js, served by the site, creates a JSON config tag and <script src="https://c.paypal.com/da/r/fb.js"> at the page load event, at checkout whenever a PayPal method is active and on product, cart and pay pages where buttons are; its session ID is kept in the WooCommerce session. Its optional reCAPTCHA protection (off by default) loads www.google.com/recaptcha/api.js where buttons are. It has no consent setting and does not read WP Consent API.
Set before the choice · WooCommerce PayPal PaymentsPayPal Payments loads the PayPal SDK by script on product, cart and checkout
setting “Button and Pay Later locations” · by default: product, cart, checkout
The SDK is not a tag in the HTML. Pay Later messages load it in 8 countries, and on home and shop pages only if turned on. Mini-cart buttons (off by default) load it on every page.
Read in its code, 16 October 2026, WooCommerce PayPal Payments 4.1.3.
Full detail
WooCommerce PayPal Payments does not print the PayPal SDK as a tag: its own button.js (served by the site) creates www.paypal.com/sdk/js from an address in its localized data. After setup, buttons are on product, cart and checkout pages, so the SDK loads there; Pay Later messages load it on product, cart and checkout pages in 8 countries (US, DE, GB, FR, AU, IT, ES, CA), and on home and shop pages only if turned on. Mini-cart buttons (off by default) load it on every page.
Online shops
Other plugins of the same kind.
Questions
Should payment scripts wait for consent?
Not at checkout, where they are needed to pay. On other pages, ask whether the express buttons there are worth the extra script.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For WooCommerce shops
Checkout first, consent everywhere else.
fewer button locations
Every feature of the complete plugin for 30 days, no card. Your payment plugins keep working as they do today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.