Works with your stack

Cookie consent for PixelYourSite

the pixel is not the only thing

PixelYourSite adds the Meta pixel, Google Analytics and Google Tag Manager to your pages, and sends events from your server too. Its own script also sets cookies of its own: where the visitor came from, the page they landed on, and an ID sent to Meta. Holding the pixels is not enough: that script has to wait too.

By PixelYourSite · pixelyoursite.com · WordPress.org

Is this your product? Tell us if anything here is out of date. Write to us

Start your free trial

Get the free audit

PixelYourSite

WordPress plugin

Tested

Tested version: 11.4.5
How: Tested automatically around each Cookie Rocks version
Last test: 7 November 2026
Latest version: 11.4.5 tested
Active installs: 400,000+

See it on WordPress.org

What PixelYourSite adds to your visitors’ browser

Trackers it loads

Google Tag Manager →Statistics, MarketingNo cookie of its own1 browser storage key
Google Analytics / Google Ads (gtag.js) →Statistics, Marketing_ga 2 years _ga_* 2 years _gcl_au 90 days FPID 2 years FPLC 20 hours FPAU 90 days FPGSID 90 days1 browser storage key
Meta Pixel →Marketing_fbp 90 days _fbc 90 days _fbleid 7 days wc_facebook_signals_state Until the browser closes _gtmeec 90 days3 browser storage keys
PixelYourSite →Marketingpys_cd 1 year pys_session_limit 1 hour pys_start_session Until the browser closes pys_first_visit 7 days pysTrafficSource 7 days pys_landing_page 7 days last_pysTrafficSource 7 days last_pys_landing_page 7 days pbid 180 days _ga 2 years _ga_* 2 years _gcl_au 90 days _fbp 90 days _fbc 90 days _fbleid 7 days _uetsid 1 day _uetvid 13 months _pin_unauth 1 year _epik 1 year _rdt_uuid 90 days __oppref 30 days __obref 1 year __oaiq_consent 30 days pys_event_referrer Until the browser closes

Cookies seen in our test

PHPSESSIDpys_cdpys_session_limitpys_start_sessionpys_first_visitpysTrafficSourcepys_landing_pagelast_pysTrafficSourcelast_pys_landing_pagepbid_fbp_ga_<ID>_gafr

One script for all PixelYourSite loads all of them through one script of its own. Holding that script holds them all, so it waits for the strictest category among them: Marketing. A visitor who accepts statistics only gets none of them. PixelYourSite can switch each tracker on or off in its own settings.

Also from your server Meta Conversions API and an OpenAI pixel, both off by default; on only once an access token is saved. A banner holds what runs in the visitor’s browser. What PixelYourSite sends from your server is set in PixelYourSite itself.

What PixelYourSite puts on your pages

Its own script: Runs on every page. It writes PixelYourSite’s first-party cookies: the first visit, the session, the traffic source, the landing page, and the pbid ID. It also writes the Meta _fbp cookie itself.
Meta pixel: Loads Meta Pixel and sends your events to Meta. Advertising: it waits for marketing consent.
Google Analytics and Tag Manager: Adds the Google tag or your Tag Manager container. Statistics or marketing, depending on the tags.
A PHP session: Opens a session on the server for each visitor, to remember the traffic source. It sets a PHPSESSID cookie on the first page, before any banner can act.
Server events: With an access token, events also go to Meta from your server (Conversions API). Off until you save a token.

What matters for consent with PixelYourSite

The pixel and the script are two things

Consent integrations usually hold the pixels and leave PixelYourSite’s own script running. That script still writes its cookies before the visitor chooses. A banner has to hold the script itself, not only the pixels.

An ID for Meta

The pbid cookie is a stable ID per browser, sent to Meta to match visits and conversions. It is advertising data, so it needs consent. Without the cookie, PixelYourSite can derive the same ID from the visitor’s address and browser.

A session no banner can hold

The PHP session is opened by the server, so the PHPSESSID cookie is set with the page itself. No banner can hold it. Switch it off in PixelYourSite: “Disable PHP sessions”. It also lets your page cache work.

Form data in a cookie

At login or checkout, PixelYourSite can keep the visitor’s name, e-mail and phone in a cookie on your domain, to match later events to the same person. That is personal data written by the site itself. Its setting is “Store detected user data in a cookie”: switch it off unless you need it.

Cookie Rocks with PixelYourSite

Holds the scripts it adds to your pages, such as tags, pixels or a chat, until the visitor consents. In advanced Consent Mode, Google’s tags load with consent denied instead.

All the features

What our tests found on PixelYourSite

Good to know · PixelYourSitePixelYourSite keys the Audit still shows as unknown

PixelYourSite: pys_consent (1 year), pys_fb_event_id (session), pys_* and last_pys_* (UTM and click parameters).

Name	Kept in	Category	What it is for
`pys_consent`	cookie	Necessary	Keeps the consent PixelYourSite received from the consent banner
`pys_fb_event_id`	cookie	Marketing	Shares event ids between the Meta pixel and the Conversions API
`pys_*`	cookie	Marketing	Keeps the UTM and click parameters of the visitor's landing page
`last_pys_*`	cookie	Marketing	Keeps the UTM and click parameters of the visitor's last visit

Read in its code, 4 November 2026, PixelYourSite.

Full detail

Next to the cookies already known (pys_cd, pys_session_limit, pys_start_session, pys_first_visit, pysTrafficSource, pys_landing_page and last_ copies), PixelYourSite public.js sets pys_consent (1 year, base64 of the consent its GDPR integration received), pys_fb_event_id (session, ids shared by the pixel and the Conversions API to avoid counting an event twice) and pys_<parameter> for each UTM or click parameter of the landing URL (life set in its options), with last_pys_<parameter> copies. The Audit 2.9.11 lists pys_consent, pys_fb_event_id, pys_* and last_pys_* as unknown.

Good to know · PixelYourSiteWhat PixelYourSite stores in visitors' browsers

PixelYourSite: 3 cookie(s) or browser key(s) for visitors, recognised by Cookie Rocks from 2.9.8.

Name	Kept in	Category	What it is for
`__oppref`	cookie	Statistics	Records that the visitor came from an AI assistant such as ChatGPT
`pys_advanced_form_data`	cookie	Marketing	Keeps details sent to advertising platforms to match conversions
`pys_woo_orders`	cookie	Marketing	Keeps details sent to advertising platforms to match conversions

Read in its code, 2 November 2026, PixelYourSite.

Full detail

PixelYourSite can store these in a visitor's browser: __oppref (cookie, statistics: Records that the visitor came from an AI assistant such as ChatGPT); pys_advanced_form_data (cookie, marketing: Keeps details sent to advertising platforms to match conversions); pys_woo_orders (cookie, marketing: Keeps details sent to advertising platforms to match conversions). Cookie Rocks recognises them from 2.9.8, with this category and purpose, and lists them in the cookie policy when it sees them.

Good to know · Cookie RocksPixelYourSite's consent values follow the visitor's choice
Cookie Rocks 2.8.2 passes the visitor's choice to PixelYourSite's own Consent Mode values: refused means denied.
Seen in our tests, 24 October 2026, Cookie Rocks.
Full detail
With PixelYourSite and its Google Consent Mode on, Cookie Rocks 2.8.2 writes the visitor's choice into PixelYourSite's own consent values (analytics_storage, ad_storage) before its script runs. Statistics only: analytics granted, ads denied, and PixelYourSite's script stays held. Accept all: the script loads and its consent layer starts granted. Withdrawing marketing: ads denied again after the reload.
Set before the choice · PixelYourSiteWithdrawing marketing erases PixelYourSite's Meta and OpenAI cookies
With PixelYourSite running Meta and OpenAI, withdrawing marketing reloaded the page and removed the pys_* cookies, pbid, __obref, __oaiq_consent, _fbp and _fbc, even on the very first page view of a new site.
Seen in our tests, 18 October 2026, PixelYourSite 11.4.3.
Set before the choice · PixelYourSitePixelYourSite free starts the OpenAI pixel before any choice
Once a pixel ID is set, it loads the OpenAI pixel and gives it consent on page load, with no consent tool integration. It sets __obref, __oaiq_consent and browser storage keys.
Seen in our tests, 18 October 2026, PixelYourSite 11.4.3.
Full detail
PixelYourSite free has an OpenAI pixel module (option pys_openai, enabled by default, needs only a pixel ID). Once a pixel ID is set, dist/scripts/public.js injects bzrcdn.openai.com/sdk/oaiq.min.js and calls oaiq('init') then oaiq('consent', true) on page load, with no consent tool integration: the pixel config and an event to bzr.openai.com/v1/sdk/events leave before any choice, with cookies __obref and __oaiq_consent, localStorage oaiq_consent and sessionStorage oaiq_cs:<pixel ID>, next to the pys_* cookies.
Good to know · PixelYourSitePixelYourSite sets the cookie pbid, an external visitor ID
PixelYourSite sets a first-party cookie named pbid, an external visitor ID that it also reads on the server and sends with its events. In the test it appeared once marketing was accepted, together with the pys_* cookies.
Seen in our tests, 18 October 2026, PixelYourSite 11.4.3.

See the 8 other findings

Sent from your server · PixelYourSitePixelYourSite stores visitor name, e-mail and phone in a cookie by default
setting “Store detected user data in a cookie (enable_advanced_form_data_cookie)” · by default: on
At login or checkout, PixelYourSite writes pys_advanced_form_data with first name, last name, e-mail and phone for 30 days, without checking consent.
What to do: Turn off "Store detected user data in a cookie" in PixelYourSite.
Read in its code, 16 October 2026, PixelYourSite 11.4.2.1.
Full detail
With "Store detected user data in a cookie" on (the default), PixelYourSite writes the cookie pys_advanced_form_data with the visitor's first name, last name, e-mail and phone for 30 days, at login or checkout, without checking consent.
Depends on a setting · PixelYourSitePixelYourSite sends Meta a visitor ID that does not depend on consent
setting “Send external ID (send_external_id)” · by default: on
PixelYourSite sends an external ID to Meta. Without its cookie it computes the ID from the visitor's IP address, browser and language, and the code states that this ID does not depend on consent.
Read in its code, 16 October 2026, PixelYourSite 11.4.2.1.
Depends on a setting · PixelYourSitePixelYourSite sends no Consent Mode command with its default settings
setting “google_consent_mode” · by default: on
It does not set consent to granted, but without a banner GA4 sets _ga before the choice. With Cookie Rocks 2.5.0, gtag.js is held and only Cookie Rocks' denied command is sent.
Seen in our tests, 16 October 2026, PixelYourSite 11.4.2.1.
Full detail
PixelYourSite with a GA4 tag and its default settings (Google Consent Mode on) sends no Consent Mode command at all, neither default nor update: it does not set consent to granted, but without a banner GA4 sets _ga before the choice. With Cookie Rocks 2.5.0, gtag.js is held and only Cookie Rocks' denied command is sent.
Sent from your server · PixelYourSitePixelYourSite can set a PHP session cookie that no banner can hold
setting “Disable PHP sessions (session_disable)” · by default: off
PixelYourSite can open a PHP session on public pages, which sets the PHPSESSID cookie from the server; no banner can hold it. In our test with default settings and no pixel set, it was not set.
What to do: Tick "Disable PHP sessions" in PixelYourSite.
Read in its code, 16 October 2026, PixelYourSite 11.4.2.1. Source
Depends on a setting · PixelYourSitePixelYourSite's prior consent options let pixels fire before the choice
setting “gdpr_<pixel>_prior_consent_enabled” · by default: on
- Per-pixel prior consent options are on by default.
- With its integrations for some consent plugins, pixels fire before the visitor chooses.
- With no consent plugin detected, every pixel is treated as consented.
- Consent values are written into the page, so a cached page keeps them unless AJAX update is on.
Read in its code, 16 October 2026, PixelYourSite 11.4.2.1.
Full detail
PixelYourSite's per-pixel "prior consent" options (gdpr_<pixel>_prior_consent_enabled) are on by default: with its built-in integrations for some consent plugins, they let the pixels fire while the visitor has not chosen yet. With no consent plugin detected, every pixel is treated as consented. Its consent filter values are written into the inline pysOptions when the page is rendered, so a cached page keeps them for every visitor unless the AJAX update (pys_gdpr_ajax_enabled) is on.
Set before the choice · PixelYourSitePixelYourSite sets up to 8 cookies before the choice, even with no pixel
- Its public.js runs on every page, even with no pixel set.
- pys_cd, pys_session_limit, pys_start_session, pys_first_visit, pysTrafficSource, pys_landing_page and last_ copies
- Its consent integrations hold the pixels, not this script.
- Cookie Rocks holds public.js: the cookies appear only after consent, without a reload.
Seen in our tests, 16 October 2026, PixelYourSite 11.4.2.1.
Full detail
PixelYourSite runs its public.js on every page and sets up to 8 first-party cookies before any choice (pys_cd, pys_session_limit, pys_start_session, pys_first_visit, pysTrafficSource, pys_landing_page and their last_ copies), even with no pixel set. Its integrations with other consent plugins hold the pixels, not this script. Cookie Rocks recognises public.js and holds it: the cookies appear only after consent, without a reload.
Sent from your server · PixelYourSitePixelYourSite sends server events without the WP Consent API
Meta Conversions API and OpenAI events leave from the site's server; the only consent gate is a filter. The OpenAI cookie __oppref is set by the server, with no end date, only with OpenAI consent.
Read in its code, 16 October 2026, PixelYourSite 11.4.2.1.
Full detail
PixelYourSite does not call the WP Consent API (no wp_has_consent or wp_set_consent in its code). Its server events (Meta Conversions API, OpenAI) leave from the site's server, where the only consent gate is the pys_check_consent_by_gdpr filter. The OpenAI click cookie __oppref is set by the server, with no end date, only when OpenAI consent is true.
Set before the choice · PixelYourSiteCookie Rocks holds PixelYourSite's script, and GA with it, until consent
The Meta pixel, Google Analytics and Tag Manager load from one PixelYourSite file, held in the marketing category: accepting statistics only does not load GA. Before 2.1.0 the pixel loaded before the choice.
Seen in our tests, 14 October 2026, PixelYourSite.
Full detail
PixelYourSite loads the Meta pixel, Google Analytics and Google Tag Manager from its own script (pixelyoursite/dist/scripts/public.js). Cookie Rocks recognises this script as the Meta pixel and holds it until consent; the pixel loads after Accept all. Google Analytics and Tag Manager loaded through the same file wait with it, in the marketing category, so a visitor who accepts statistics only does not get them either. Before 2.1.0 the pixel loaded before the choice.

How we test it

Around each version, with its latest release

Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.

PixelYourSite 11.4.5, tested on 7 November 2026.
The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
Its own tags, set with a test ID, do not load before the choice and load after “Accept all”.
Settings of the test: Meta Pixel ID, Google Analytics 4 ID and Google Tag Manager container ID (test values).
Last run: PixelYourSite 11.4.5 on 7 November 2026, with WordPress 7.1.3.

Analytics and ad pixels

Other plugins of the same kind.

Meta Pixel for WordPressThe Meta pixel, plus Meta cookies sent from your server.tested 5.2.2Adds: Meta Pixel Meta for WooCommercePixel and server events, with a hold switch for consent.tested 3.7.8 Pixel CaffeineThe Meta pixel on every page, with no consent setting.tested 2.3.3Adds: Meta Pixel TikTok for BusinessThe TikTok pixel held, server events to decide.tested 1.4.3Adds: TikTok Pixel Microsoft ClarityClarity on every page, with no consent signal.tested 0.10.37 HotjarHotjar held until the visitor agrees.tested 1.0.16 HubSpotHubSpot’s loader on every page, consent only in HubSpot.tested 11.3.75 JetpackStats, comments, videos and images from WordPress.com.tested 16.4 Ad pixel pluginsMeta and TikTok pixels, and what your server sends.MatomoStatistics from your own site, consent through Matomo’s API.tested 5.13.1 Koko AnalyticsStatistics on your own site, with a cookie by default.tested 2.5.3 Independent AnalyticsNo cookie, but returning visitors are still recognised.tested 2.16.2 Burst StatisticsWaits for statistics consent when WP Consent API is there.tested 3.7.4 SlimStat AnalyticsNo consent check by default; one setting changes that.tested 6.0.0Adds: Slimstat Analytics Statistics on your own siteStatistics plugins that count on your own server.Pixel ManagerUp to ten shop pixels from one script, held until the visitor agrees.tested 1.72.0 Plausible AnalyticsStatistics with no cookie, from plausible.io or your own site.tested 2.6.4 Fathom AnalyticsStatistics with no cookie, from cdn.usefathom.com.WP StatisticsVisitor counts on your own server, without cookies.tested 14.16.18

Every plugin and theme we test →

Questions

Which PixelYourSite settings should I check?

Three. “Disable PHP sessions”: on, so no PHPSESSID before consent. The external ID: it sends the pbid ID to Meta, so it must wait for consent like the pixel. And “Store detected user data in a cookie”: off unless you need it, since it keeps a visitor’s name, e-mail and phone.

Does Cookie Rocks hold PixelYourSite?

Yes. Cookie Rocks recognises PixelYourSite’s own script and holds it with the Meta pixel until the visitor agrees, so its first-party cookies and the pbid ID wait too. After a yes, everything starts on the same page, without a reload. The PHP session is the only cookie left: switch it off in PixelYourSite.

Do I lose data when visitors refuse?

Meta and Google do not receive their visit, and PixelYourSite’s cookies are not written. That is what refusing means. Visitors who accept are measured as before.

What happens after the 30-day trial?

The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.

For PixelYourSite users

The pixel, the script and its cookies, all held.

pixelyoursite stays on

Every feature of the complete plugin for 30 days, no card. PixelYourSite keeps working as it does today.

During the trial: everything, including the full settings and the scans
After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
What waits for a key: most settings, updates and support

How the trial works, in detail

Get your trial key

Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.