Works with your stack
Cookie consent for share buttons and social icons
a link waits for the click
A share button can be a plain link or a script from another server. A plain link loads nothing until the visitor clicks. A script from a sharing tool or a social network calls out as soon as the page opens.
Social sharing, one by one
What each sharing plugin puts on your pages
- AddToAny Share Buttons
- A script and a hidden frame from AddToAny on every page, even with its local copy. Share counts are requested by the visitor’s browser.
- Shared Counts
- Plain links, script from your site. Counts fetched by your server.
- Simple Social Icons
- Plain profile links and icons from your site. No script.
- Social Warfare
- Plain links, own script and icons. Counts fetched by your server.
- Ultimate Social Media Icons
- Local icons and links, except the YouTube Subscribe button, which prints Google’s platform script, and the LinkedIn buttons, which print LinkedIn’s script.
What matters for consent with Social sharing
A link is not a tracker
Before the click, a share link is only text on your page. The visitor decides to open the network.
Counts can come from your server
Shared Counts and Social Warfare fetch share counts on your server. The visitor’s browser does not contact the networks. With AddToAny’s counts, it does.
Some buttons bring a script
A button built by a network’s script, or a sharing menu from another server, calls out when the page opens. Cookie Rocks holds known trackers until the visitor agrees.
Click tracking follows analytics
Several plugins send share clicks to Google Analytics only if it is already on the page. Analytics follows the visitor’s choice like any other tracker.
What our tests found on Social sharing
Set before the choice · AddToAny Share ButtonsCookie Rocks also holds AddToAny's local copy of page.js
setting “Cache AddToAny locally”
With AddToAny's local cache on, Cookie Rocks also holds the copy of page.js served from the site (wp-content/uploads/addtoany/page.js), so nothing reaches static.addtoany.com before consent. The buttons appear after Accept, without a reload.
Seen in our tests, 18 October 2026, AddToAny Share Buttons 1.8.18.
Set before the choice · AddToAny Share ButtonsAddToAny local cache still loads files from static.addtoany.com on page open
setting “Cache AddToAny locally” · by default: Off
page.js comes from the site, but the menu frame, a module and the icons still load from static.addtoany.com before any click. No cookie is set before a click.
Seen in our tests, 18 October 2026, AddToAny Share Buttons 1.8.18.
Full detail
With its local cache option on, AddToAny serves page.js from the site (wp-content/uploads/addtoany/page.js) and sets a2a_config.static_server to that folder. The script still loads its menu frame, a module and the button icons from static.addtoany.com as soon as the page opens, before any click. No cookie is set before a click.
Depends on a setting · AddToAny Share ButtonsAddToAny's local cache option still loads one file from AddToAny
setting “Cache AddToAny locally (addtoany_options['cache'])” · by default: off
With this option (off by default), page.js is served from the site, but the utility frame still loads from static.addtoany.com. The plugin turns the option off if files are old or fail to download.
Read in its code, 16 October 2026, AddToAny Share Buttons 1.8.18.
Full detail
With the local cache option (off by default), AddToAny serves page.js from uploads/addtoany/page.js and sets a2a_config.static_server to that folder; the utility iframe sm.25.html stays hard-coded to static.addtoany.com. The files are fetched by the server from addtoany.com; if page.js is missing the tag still points to the local address (404), and if the file is older than 2 days, or a download fails, the plugin turns the option back off.
Set before the choice · AddToAny Share ButtonsAddToAny loads its script on every page, even without share buttons
page.js opens a hidden frame from static.addtoany.com that reads the visitor's preferred networks from addtoany.com cookies. It writes no cookie or storage on the site itself.
Read in its code, 16 October 2026, AddToAny Share Buttons 1.8.18.
Full detail
AddToAny enqueues static.addtoany.com/menu/page.js (defer) on every public page, even without buttons, after an inline window.a2a_config script. page.js creates a hidden iframe, static.addtoany.com/menu/sm.25.html (AddToAny Utility Frame), which reads the visitor's preferred sharing networks from cookies on addtoany.com (page_services, feed_services) and passes them back by postMessage, then loads its core module and icons from static.addtoany.com. page.js and the core module write no cookie or browser storage on the site. The PHP filter addtoany_script_disabled removes the script.
Good to know · AddToAny Share ButtonsAddToAny sends stats on use and can fetch share counts on page load
setting “Show count”
- Sends a POST to stats.addtoany.com/menu when the full menu opens, a link is copied or the visitor returns from a share.
- With Show count on, the browser asks Pinterest, Reddit, Tumblr or Facebook for share counts on page load.
- Official-style buttons are copies linking to addtoany.com, without the networks' own code.
Read in its code, 16 October 2026, AddToAny Share Buttons 1.8.18.
Full detail
AddToAny's core module sends a POST to stats.addtoany.com/menu (view, copy or post, the site's domain, flags for ad tags found on the page) when the full menu opens, a link is copied or the visitor returns from a share. With Show count on, the visitor's browser requests share counts directly from Pinterest, Reddit, Tumblr or Facebook (Like replica) when the page loads. Official-style buttons are replicas linking to addtoany.com/add_to/, without the networks' SDKs.
Good to know · AddToAny Share ButtonsAddToAny uses WP Consent API only to switch off its official-style buttons
Its script, utility frame and share counters do not wait for consent, and it sends no Consent Mode signal. With page caching, the cached buttons are served to everyone.
Read in its code, 16 October 2026, AddToAny Share Buttons 1.8.18.
Full detail
AddToAny registers with WP Consent API and reads wp_has_consent('marketing') on the server at init, but only to switch off its official-style buttons (Like, Tweet, Pin, LinkedIn replicas). page.js, the utility frame and share counters do not wait for consent, and it sets no Consent Mode signal; it only pushes AddToAnyShare events into gtag or dataLayer when they exist. With page caching, the cached version of those buttons is served to everyone.
See the 5 other findings
Good to know · Simple Social IconsSimple Social Icons loads nothing from other sites and sets no cookie
Simple Social Icons 4.1.0 prints plain profile links with SVG icons from a symbol-defs.svg file and a stylesheet served by the site. On visitor pages it loads no script, sets no cookie, stores nothing in the browser and contacts no other host.
Read in its code, 16 October 2026, Simple Social Icons 4.1.0.
Good to know · Social WarfareSocial Warfare (free) sets no cookie and loads no third-party script
Share buttons are plain links, and the site's server fetches share counts. With click tracking on, events go to ga() or dataLayer only if they already exist on the page.
Read in its code, 16 October 2026, Social Warfare 4.5.6.
Full detail
The free Social Warfare 4.5.6 renders share buttons as plain links with its own script and icons; on visitor pages it sets no cookie, uses no browser storage and loads no third-party script. Share counts are fetched by the site's server when a post's cached counts expire. With click tracking on, share events go to ga() or dataLayer only if they already exist on the page.
Good to know · Ultimate Social Media IconsUltimate Social Media Icons' pop-up cookie is never written, so it keeps showing
A code error stops the 30-day sfsi_popup cookie. The subscription form sends the typed e-mail address to follow.it. Follower counts are fetched by the server only when turned on.
Read in its code, 16 October 2026, Ultimate Social Media Icons 3.0.2.
Full detail
Ultimate Social Media Icons 3.0.2 tries to set a 30-day sfsi_popup cookie so its share pop-up shows only once, but the call throws a TypeError that the code swallows, so the cookie is never written and the pop-up comes back on each page. Its e-mail subscription form sends the address typed to follow.it, the vendor's newsletter service, when submitted; follower counts are fetched by the server (Facebook, Pinterest, Instagram, follow.it) only when counts are turned on. It has no consent setting and does not use WP Consent API.
Set before the choice · Ultimate Social Media IconsUltimate Social Media Icons loads YouTube and LinkedIn scripts on every page
setting “YouTube icon: Subscribe button (sfsi_youtube_follow)” · by default: off
The YouTube Subscribe button adds apis.google.com/js/platform.js, even on pages without icons; LinkedIn Follow or Recommend adds platform.linkedin.com. Other icons are local images and links.
Read in its code, 16 October 2026, Ultimate Social Media Icons 3.0.2.
Full detail
Ultimate Social Media Icons prints a plain <script src="https://apis.google.com/js/platform.js"> in the footer of every front page once the YouTube icon has the Subscribe button with a channel ID, even on pages without icons; where the icons show, platform.js builds the YouTube subscribe iframe. LinkedIn Follow or Recommend prints platform.linkedin.com/in.js the same way, with its configuration (lang) inside the tag. The other icons (Facebook, X, Pinterest, RSS, e-mail) are local images and plain links, and all its front files are served by the site.
Social sharing
Other plugins of the same kind.
Questions
Which kind should I pick?
For consent, plain links served by your site are the simplest: nothing waits, and the buttons show for every visitor.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with share buttons
Sharing for everyone, scripts after consent.
links never wait
Every feature of the complete plugin for 30 days, no card. Plain share links keep working as they do today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.