Works with your stack
Cookie consent for Site Kit by Google
one default, not two
Site Kit connects your site to Google Analytics, Tag Manager and AdSense, then prints Google’s tag on every page. It can also set Google’s consent defaults on its own. On a site that already has a consent banner, that is one default too many.
By Google · sitekit.withgoogle.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Site Kit by Google
WordPress plugin
- Tested version
- 1.191.0
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 1.191.0 tested
- Active installs
- 5,000,000+
What Site Kit adds to your visitors’ browser
Trackers it loads
- Google Analytics / Google Ads (gtag.js) →Statistics, Marketing1 browser storage key
What each Site Kit module puts on your pages
- Analytics
- Prints the Google tag on every page to count visits and what visitors do: Google Analytics. Its cookies need consent under the GDPR.
- Ads
- Uses the same Google tag to measure conversions from your Google Ads campaigns. That is advertising, so it waits for marketing consent.
- Tag Manager
- Adds your Google Tag Manager container to every page. The container then loads its own tags, which you set up in Tag Manager, not in Site Kit.
- AdSense
- Places Google’s ad script on your pages, and Auto ads if you turn them on: Google AdSense.
- Search Console
- Reads your search data on Google’s side. It adds no tracker to your pages and needs no consent.
- PageSpeed Insights
- Shows speed reports in your dashboard. It adds no tracker to your pages either.
- Sign in with Google
- Adds a Google sign-in button to your login page. The button loads a script from Google when the page opens.
What matters for consent with Site Kit
Nothing until you connect it
Before Site Kit is connected to a Google account, it only adds a hint to look up Google’s servers: no request, no cookie. The Google tag appears once you connect Analytics, Ads or another Google tool.
Google’s tag on every page
Once connected, Site Kit prints the Google tag. It sets Google Analytics cookies, and Google Ads cookies when the Ads module is on. Under the GDPR and similar laws, both need consent.
Two defaults, one too many
Site Kit has a Consent Mode setting of its own. When your consent plugin already sets Google’s default consent, Google receives it twice, and Site Kit’s version only covers the regions chosen in Site Kit.
One tag, two jobs
Without the Ads module, Site Kit’s Google tag measures visits only. With it, the same tag also measures ad conversions and sets advertising cookies. A visitor may accept one and refuse the other.
AdSense in Europe
Google asks for a consent tool certified for its framework (IAB TCF) before it shows personalised AdSense ads in the EEA, the United Kingdom and Switzerland.
Consent Mode, basic or advanced
In basic mode, Google’s tags wait for consent. In advanced mode, they load at once with consent refused, and Google models part of the missing data from cookieless signals.
Cookie Rocks with Site Kit
- Reads its active modules: without the Ads module, Google’s tag counts as statistics only, in the banner, the details and the cookie policy.
- Holds the scripts it adds to your pages, such as tags, pixels or a chat, until the visitor consents. In advanced Consent Mode, Google’s tags load with consent denied instead.
- Sets Google’s default consent at the top of the page, before any of its tags.
- Counts it as a Google setup and recommends basic or advanced Consent Mode for your site.
- Warns when its own Consent Mode setting sets Google’s default consent a second time.
- A button turns off that one setting, after confirmation. The plugin itself stays active.
- Passes the visitor’s choice to WP Consent API on every page, where this plugin reads it.
What our tests found on Site Kit
Depends on a setting · Site Kit by GoogleSite Kit adds a cross-domain linker to its Google Analytics tag
Site Kit's Analytics tag adds a _gl parameter to links towards subdomains; the googlesitekit_gtag_opt filter removes it.
Read in its code, 3 November 2026, Site Kit by Google 1.191.0. Source
Full detail
Site Kit's Google Analytics tag sets a cross-domain linker on the site's own domain, which adds a _gl parameter to links towards its subdomains. The googlesitekit_gtag_opt filter can remove it. Site Kit support said in March 2026 that there are no plans to drop it.
Good to know · Site Kit by GoogleSite Kit restores a saved choice only if the banner declares its consent type
Site Kit reads a saved choice on the next page only when the banner sets wp_consent_type. Cookie Rocks sets it on every page.
Read in its code, 3 November 2026, Site Kit by Google 1.191.0. Source
Full detail
On each page load, Site Kit's consent script reads the visitor's saved choice from WP Consent API only when the banner has declared a consent type (window.wp_consent_type or wp_fallback_consent_type). Without it, Site Kit only reacts to a new choice, and Google consent stays denied on the next pages. Cookie Rocks declares the consent type on every page, so a saved choice is restored. Site Kit support gave other banners the wp_get_consent_type filter as a workaround (October 2026).
Good to know · Cookie RocksOnly visitors' pages say which tools the site uses
Cookie Rocks Pro records the tools a site uses only from pages viewed by visitors. Pages viewed by site staff (users who can edit posts) never add tools, so files loaded only for logged-in users, such as the Google Fonts of Site Kit's admin bar, stay out of the list of detected tools and the cookie policy. Blocking still applies to everyone.
Seen in our tests, 28 October 2026, Cookie Rocks.
Good to know · google-site-kitSite Kit's admin bar loads Google Fonts for logged-in users only
Site Kit loads Google Fonts (Google Sans, from fonts.googleapis.com) on public pages only for logged-in users who see the admin bar: its admin bar stylesheet depends on it. Visitors never receive it.
What to do: Scan the site while logged out. Do not list Google Fonts in the cookie policy because of Site Kit alone.
Read in its code, 27 October 2026, google-site-kit 1.190.0. Source
Sent from your server · Site Kit by GoogleSite Kit tag gateway serves the Google tag from the site itself
setting “Google tag gateway for advertisers” · by default: Off until Google turns the feature on for the site
The site forwards each request to Google with the visitor's IP address. The browser never contacts Google directly, so a banner that only knows Google's addresses misses the tag.
Seen in our tests, 18 October 2026, Site Kit by Google 1.189.0.
Full detail
With Site Kit's Google tag gateway on, the Google tag is served by the site itself: a script with the id google_gtagjs-<tag ID>-js loads /wp-content/plugins/google-site-kit/gtg/measurement.php?id=<tag ID>. That file forwards each request to <tag ID>.fps.goog with the visitor's IP address and request headers. The browser never contacts a Google address directly, so a banner that only knows Google's addresses does not see the tag.
Set before the choice · Site Kit by GoogleCookie Rocks holds the Google tag served through Site Kit's tag gateway
It is held until consent, like the tag served by Google. Site Kit's short script that only fills the data layer still runs, after the default consent set by Cookie Rocks.
Seen in our tests, 18 October 2026, Site Kit by Google 1.189.0.
Full detail
Cookie Rocks recognises the Google tag that Site Kit serves from the site through its tag gateway (gtg/measurement.php?id=G-, GT- or AW-) and holds it until consent, like the tag served by Google. Site Kit's short inline script that only fills the dataLayer still runs before the choice, after the default consent set by Cookie Rocks.
See the 12 other findings
Set before the choice · Site Kit by GoogleSite Kit's Sign in with Google is held until consent
setting “Sign in with Google module”
- Both Google's script and Site Kit's sign-in script are held: no g_state or googlesitekit_auth_nonce cookie.
- After Accept all, without a reload, the button and One Tap appear.
- On wp-login.php, where no banner is shown, the button works as usual.
- Before 2.5.2 both scripts ran before the choice.
Seen in our tests, 17 October 2026, Site Kit by Google 1.189.0.
Full detail
With Site Kit's Sign in with Google module, Cookie Rocks holds both Google's script (accounts.google.com/gsi/client) and Site Kit's own sign-in script until consent: before the choice there is no g_state or googlesitekit_auth_nonce cookie. After Accept all, without a reload, the button and One Tap appear. On wp-login.php, where no banner is shown, the button works as usual. If accounts.google.com does not answer, the button does not appear, as without Cookie Rocks. Before 2.5.2 both scripts ran before the choice.
Depends on a setting · Site Kit by GoogleSite Kit's WooCommerce conversions can send the buyer's email, phone and name
With the gtagUserData flag, the purchase event carries billing details for Google's enhanced conversions. The Reader Revenue Manager module loads a Google News script on its pages.
Read in its code, 16 October 2026, Site Kit by Google 1.189.0.
Full detail
With Site Kit's conversion tracking for WooCommerce and the gtagUserData flag (since 1.161.0), the purchase event carries user_data with the billing email, phone and name for Google's enhanced conversions. Its Reader Revenue Manager module loads news.google.com/swg/js/v1/swg-basic.js on the pages where its snippet is set.
Good to know · Cookie RocksCookie Rocks counts the Google tag as statistics only without Google Ads
- Statistics only, without _gcl_au and _gcl_ls, when nothing shows Google Ads and one sign says there is none.
- Signs: the answer No Google Ads, or Site Kit active without its Ads module.
- Otherwise a GT- tag stays in statistics and marketing.
- A Google Ads ID (AW-) in the tag counts as Google Ads.
Read in its code, 15 October 2026, Cookie Rocks.
Full detail
Cookie Rocks lists the Google tag as Google Analytics (gtag.js), statistics only, without the Google Ads cookie _gcl_au and storage key _gcl_ls, when nothing shows Google Ads (no Google Ads tag seen on the pages or declared in GTM, no Site Kit Ads module) and one sign says there is none (the answer No Google Ads, or Site Kit active without its Ads module). Otherwise a GT- tag stays in statistics and marketing. A Google Ads ID (AW-) in the gtag.js address or in gtag('config', 'AW-...') counts as Google Ads.
Good to know · Site Kit by GoogleWith Site Kit's Ads module, the Google tag counts as statistics and marketing
After Accept all, Google Ads sets _gcl_au. With statistics only, no Google Ads cookie is set, but the tag still sends Google a cookieless request with advertising denied.
Seen in our tests, 15 October 2026, Site Kit by Google 1.189.0.
Full detail
With Site Kit's Ads module (a test AW- conversion ID), the Google tag counts as statistics and marketing. After Accept all, Google Ads sets _gcl_au and calls doubleclick.net. With consent to statistics only, no Google Ads cookie is set, but the loaded tag still sends Google a cookieless request with advertising consent denied (pagead2.googlesyndication.com/ccm/collect).
Good to know · Site Kit by GoogleCookie Rocks holds Site Kit's Google tag in basic mode
- Before any choice, no request goes to Google.
- Accept all or statistics only: _ga and _ga_<ID> are set; with statistics only, advertising stays denied.
- Reject all: gtag.js never loads.
Seen in our tests, 15 October 2026, Site Kit by Google 1.189.0.
Full detail
Site Kit prints its Google tag (gtag.js) in the page head. Cookie Rocks holds it there in basic mode: before any choice, no request goes to Google. After Accept all, Google Analytics sets _ga and _ga_<ID>; with statistics only, the same happens and advertising stays denied; after Reject all, gtag.js is never loaded. With a GT- test ID Google returned no configuration and set no cookie; the cookies were seen with a G- test ID.
Depends on a setting · Site Kit by GoogleSite Kit's Consent Mode setting sends Google's default consent a second time
setting “Consent Mode” · by default: off
Google receives a second default consent, for a fixed list of 32 countries that ignores the regions saved in Site Kit, and functionality storage is granted as the page opens.
What to do: Keep Site Kit and WP Consent API, and turn off only the Consent Mode setting of Site Kit (Settings, Admin settings) when the banner already sends Google's consent signals. The Cookie Rocks dashboard flags it and turns it off in one click.
Seen in our tests, 15 October 2026, Site Kit by Google 1.189.0.
Full detail
With its Consent Mode setting on, Site Kit sets Google's default consent a second time, after the banner's, and only for a fixed list of 32 countries (EU, IS, LI, NO, GB, CH): the regions saved in Site Kit are not read. With WP Consent API present, it also sends its own consent updates after each choice; they grant functionality_storage as soon as the page opens (the functional category of WP Consent API), while statistics and advertising follow the visitor's choice.
Good to know · Site Kit by GoogleCookie Rocks gives Site Kit's tag the consent in the right order
The tag reads denied first, then granted on Accept all, so everything is sent as granted. After a refusal the tag never loads. In a browser test, nothing was sent before the choice.
Read in its code, 15 October 2026, Site Kit by Google 1.189.0.
Full detail
With Site Kit, Cookie Rocks pushes its 'denied' consent default first in the dataLayer and asks Google to wait 500 ms; on Accept all it records 'granted' before releasing Site Kit's tag, so the tag reads denied, Site Kit's settings and events, then granted, and everything is sent as granted. After a refusal the tag never loads. In a browser test: no request and no cookie before the choice, Analytics and its cookies after Accept all.
Good to know · Site Kit by GoogleSite Kit sends nothing to Google before it is connected
Before it is connected to a Google account, Site Kit only adds a DNS prefetch hint for googletagmanager.com to the pages: no request to Google and no cookie.
Seen in our tests, 15 October 2026, Site Kit by Google 1.189.0.
Set before the choice · Site Kit by GoogleTwo Site Kit scripts still run before the choice, but send nothing to Google
When the Google tag is held, Site Kit's tag settings and content events only fill the data layer. After consent, the tag processes events pushed before the choice.
Seen in our tests, 15 October 2026, Site Kit by Google 1.189.0.
Full detail
When a banner holds Site Kit's Google tag (gtag/js), two other Site Kit scripts still run before the choice: the inline tag settings (google_gtagjs-js-after: linker, js, developer_id, config) and its content events provider. They only fill the dataLayer and send nothing to Google. Site Kit also replaces window.gtag with an equivalent function writing to the same dataLayer. After consent, events pushed before the choice are processed by the tag.
Good to know · Site Kit by GoogleCookie Rocks holds Site Kit's Tag Manager and AdSense scripts
The Tag Manager container loads only after consent. Auto ads count as marketing: they load after Accept all, not with statistics only or after Reject all.
Seen in our tests, 15 October 2026, Site Kit by Google 1.189.0.
Full detail
With Site Kit's Tag Manager module, the container (gtm.js) is held in the page head and loads only after consent. With its AdSense module, the Auto ads script (adsbygoogle.js) is held as marketing: it loads after Accept all, not with statistics only or after Reject all.
Good to know · Site Kit by GoogleSite Kit reads WP Consent API only when its Consent Mode setting is on
setting “Consent Mode” · by default: off
With that setting off, Site Kit sends no consent signal at all, and the visitor's choice reaches Google only through the banner's own signals.
Read in its code, 15 October 2026, Site Kit by Google 1.189.0.
Full detail
Site Kit declares itself compatible with WP Consent API, but its code reads WP Consent API only when its own Consent Mode setting is on. With that setting off, Site Kit pushes no consent command at all, and the visitor's choice reaches Google only through the banner's own Consent Mode signals.
Good to know · WP Consent APICookie Rocks rewrites the WP Consent API cookies on every page
They last 30 days by default, so a banner that writes them only at the click leaves Site Kit with no consent later. In a test, deleted cookies were set again and Google read granted.
Seen in our tests, 8 October 2026, WP Consent API.
Full detail
WP Consent API keeps its wp_consent_* cookies for 30 days by default. A banner that writes them only at the click leaves Site Kit reading no consent after 30 days, while the banner's own choice is still valid. Cookie Rocks writes the visitor's choice to WP Consent API on every page: in a test, the wp_consent_* cookies were deleted and the page reloaded; they were set again to allow, and Site Kit and Google read granted.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Site Kit by Google 1.191.0, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Its own tags, set with a test ID, do not load before the choice and load after “Accept all”.
- Settings of the test: Configured with test IDs.
- Last run: Site Kit by Google 1.191.0 on 7 November 2026, with WordPress 7.1.4.
Other plugins of the same kind.
Questions
Can I show personalised AdSense ads with Cookie Rocks?
Not in the EEA, the United Kingdom and Switzerland: Google requires an IAB TCF certified tool there, and Cookie Rocks is not one. Elsewhere, and for non-personalised ads, it is not a problem.
Do I lose data when visitors refuse?
Google Analytics does not record their visit with cookies. In advanced Consent Mode, Google receives cookieless signals and estimates part of the missing data. In basic mode, nothing is sent.
Should I switch off Site Kit’s Consent Mode setting?
Only that setting, not Site Kit. Google’s default consent is then set once, for every visitor. Site Kit may still say that tracking could suffer: it cannot see signals set by another plugin.
Does Site Kit need WP Consent API?
It works without it. WP Consent API is a free plugin from WordPress.org that lets plugins read the visitor’s choice. When it is installed, Cookie Rocks keeps it up to date on every page.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For Site Kit users
One consent default, sent once.
site kit stays on
Every feature of the complete plugin for 30 days, no card. Site Kit keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.