Cookie consent for popup plugins: Popup Maker and OptinMonster

Popup plugins, one by one

What matters for consent with Popup plugins

What our tests found on Popup plugins

• Set before the choice · popup-makerPopup Maker 1.25.0 and Google Fonts

  Popup Maker 1.25.0 loads Montserrat from Google Fonts before any choice, through a generated stylesheet (pum-site-styles.css). Cookie Rocks Pro 2.11.2 copies it to the site: no call to Google remained in our test.

  Seen in our tests, 7 November 2026, popup-maker 1.25.0.

• Depends on a setting · Popup MakerPopup Maker sets its cookie only when the popup event happens, never on arrival

  setting “Cookie duration” · by default: 1 month

  By default the cookie is set on close and lasts one month. No browser storage. Statistics go to the site itself, not to an outside service.

  Read in its code, 16 October 2026, Popup Maker 1.25.0.

  Full detail

  Popup Maker sets its cookie with JavaScript only when the event chosen for a popup happens (on close by default), never on arrival; the default lasts one month for the whole site. It uses no localStorage or sessionStorage. Open and conversion statistics go to the site's own REST API or admin-ajax.php (pum_analytics), not to an outside service.

• Set before the choice · Popup MakerPopup Maker loads hidden popup content and Google Fonts with every page

  setting “Don't Load Google Fonts (disable_google_font_loading)”

  • A video, map or form in a popup loads with the page, even unopened, unless a banner holds its iframe.
  • A Google font in a popup theme loads from Popup Maker's stylesheet, out of reach of a banner.
  • The Don't Load Google Fonts setting stops the font.

  Read in its code, 16 October 2026, Popup Maker 1.25.0.

  Full detail

  Popup Maker writes every popup into the page at load, hidden: a video, map or form placed in a popup loads with the page even if the popup never opens, unless a banner holds its iframe. A Google font chosen in a popup theme is loaded by an @import at the top of Popup Maker's generated stylesheet pum-site-styles.css, on every page that loads it, out of reach of a banner; the Don't Load Google Fonts setting stops it.

• Set before the choice · OptinMonsterOptinMonster creates its script by JavaScript on every public page

  Since 2.17.0, once a campaign is synced, a script in the page creates the a.omappapi.com tag. A banner that reads only script addresses misses it. All its cookies come from that OptinMonster script.

  Read in its code, 16 October 2026, OptinMonster 2.17.1.

  Full detail

  Since 2.17.0, once a campaign is synced, OptinMonster replaces its enqueued a.omappapi.com/app/js/api.min.js tag with an inline script that creates the tag by JavaScript (id omapi-script, appended to the head) on every public page; a custom domain (customApiUrl, apiCname) can replace the address. A banner reading only src misses it; the address stays in the inline script's content. The plugin's own code sets no cookie or storage and has no WP Consent API or Consent Mode code: all cookies come from api.min.js.

• Sent from your server · OptinMonsterOptinMonster sends order revenue from the server using the _omra cookie

  setting “Revenue Attribution”

  With Revenue Attribution on, OptinMonster's server reads the _omra cookie at a WooCommerce or EDD order and sends the revenue to the OptinMonster API (v2/revenue). If _omra survives a refusal, sending continues.

  Read in its code, 16 October 2026, OptinMonster 2.17.1.

Newsletters and popups

Other plugins of the same kind.

Every plugin and theme we test →