Works with your stack
Cookie consent for WhatsApp buttons and chat widgets
a link waits for the click
A WhatsApp button can be a plain link, a plugin that serves its button from your site, or a widget hosted by another company. A link and a button plugin load nothing from WhatsApp until the visitor clicks. A hosted widget calls its provider as soon as the page opens, so Cookie Rocks holds it until consent.
WhatsApp, one by one
What each kind of WhatsApp button puts on your pages
- Plain links
- Links to wa.me, api.whatsapp.com/send or chat.whatsapp.com: WhatsApp. Nothing loads and no cookie is set before the click. WhatsApp sets its own cookies on whatsapp.com after it.
- Click to Chat
- A button served by your site. It keeps its state in the browser’s local storage and contacts no one before the click.
- Joinchat
- A button, its styles and its QR code served by your site. It keeps a page-view counter in local storage to open the chat window by itself, and contacts no one before the click.
- WP WhatsApp
- A button served by your site. It sets a cookie only when the visitor ticks its own consent box.
- GetButton
- A widget hosted by GetButton. Its script loads from GetButton and sends your site’s address as soon as the page opens.
- WATI
- A widget hosted by WATI. It loads its script, an image and Google Fonts from outside servers as soon as the page opens.
What matters for consent with WhatsApp
A link is not a tracker
Before the click, a WhatsApp link is only text on your page. The visitor decides to open WhatsApp, so Cookie Rocks treats it as necessary and leaves it alone.
Hosted widgets wait
GetButton and WATI call their provider when the page loads, without a click. Cookie Rocks holds them, like other chat widgets, until the visitor accepts preferences, then starts them without a reload.
Button plugins stay at home
Click to Chat, Joinchat and WP WhatsApp serve their button from your site, and what they keep in the browser stays on your site. Cookie Rocks recognises the storage of Click to Chat and Joinchat and suggests a category for your cookie list.
Events after the click
After a click, Joinchat and GetButton send an event to the Google and Meta tags already on your page. Those tags follow the visitor’s choice like any other.
Clicks counted on your server
Joinchat counts clicks on your own server, on by default. It keeps a hash of the IP address and browser for a minute, to avoid counting a click twice.
What our tests found on WhatsApp
Good to knowCookie Rocks lists Wordfence, Forminator, WP WhatsApp and WPForms Pro cookies
- Each appears in its cookie list with its purpose.
- Wordfence: wfCBLBypass, wf_loginalerted_*, wfls-remembered-*.
- Forminator: poll-cookie-*, forminator_stripe_payment_owner.
- WP WhatsApp: nta-wa-gdpr. WPForms Pro: _wpfuuid.
Read in its code, 18 October 2026.
Full detail
Cookie Rocks lists the site cookies of Wordfence (wfCBLBypass, wf_loginalerted_*, wfls-remembered-*), Forminator (poll-cookie-*, forminator_stripe_payment_owner), WP WhatsApp (nta-wa-gdpr) and WPForms Pro (_wpfuuid) in the cookie list it writes, with their purpose.
Good to know · Click to Chat, Joinchat, WP WhatsAppWhatsApp button plugins keep their state on the site, not with Meta
- Click to Chat stores ht_ctc_storage.
- Joinchat stores joinchat_views (a page-view counter updated on every page) and joinchat_hashes.
- WP WhatsApp (NinjaTeam) sets nta-wa-gdpr for 30 days, only when the visitor ticks its consent box.
- None of them contacts Meta before the click.
Read in its code, 17 October 2026, Click to Chat, Joinchat, WP WhatsApp.
Full detail
WhatsApp button plugins keep their state on the site only: Click to Chat stores ht_ctc_storage, Joinchat stores joinchat_views (a page-view counter updated on every page) and joinchat_hashes, and WP WhatsApp (NinjaTeam) sets nta-wa-gdpr for 30 days only when the visitor ticks its consent box. None of them contacts Meta before the click.
Good to know · JoinchatJoinchat sends click events to Google and Meta tags when they exist
setting “Clicks Counter (tracking)” · by default: on
On click it sends events to the site's Google tags, a Google Ads conversion if set, and Meta if present. If those tags are held, nothing reaches Google or Meta.
Read in its code, 16 October 2026, Joinchat 6.4.2.
Full detail
On click, Joinchat sends a generate_lead event through gtag to each G- or GT- tag found, a Google Ads conversion if set, a dataLayer push and fbq('trackCustom') if fbq exists, then opens wa.me or web.whatsapp.com; if those tags are held, nothing reaches Google or Meta. Its click counter (on by default) posts to the site's /wp-json/joinchat/v1/track-click, and the server keeps a hash of IP, user agent, channel and number for 60 seconds. No WP Consent API or Consent Mode default; events joinchat:event and joinchat:track can be cancelled.
Depends on a setting · JoinchatJoinchat keeps a page-view count in the browser when it opens by itself
setting “message_delay” · by default: 10
joinchat_views goes to localStorage when automatic opening is on (default: after 10 seconds and 2 page views). A cookieless setting moves it to sessionStorage.
Read in its code, 16 October 2026, Joinchat 6.4.2.
Full detail
Joinchat writes joinchat_views to localStorage on page load when automatic opening is on (default: after 10 seconds and 2 page views). The cookieless setting (filter joinchat_get_settings) moves its keys to sessionStorage, and a negative automatic-opening delay removes all storage. The JavaScript event joinchat:starting can pause its start until joinchat_obj.resume().
Chat and messaging
Other plugins of the same kind.
Questions
Does a WhatsApp link need consent?
No. It loads nothing before the click, and the visitor chooses to open WhatsApp. What WhatsApp does after that happens on whatsapp.com or in its app.
Why does my GetButton or WATI widget appear only after consent?
Their scripts call the provider as soon as the page opens. Cookie Rocks holds them until the visitor accepts preferences. A plain link or a button plugin shows at once.
Which kind should I pick?
For consent, a plain link or a button plugin served by your site is the simplest: nothing waits, and the button is there for every visitor.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with a WhatsApp button
Visitors can message you, whatever they choose.
links never wait
Every feature of the complete plugin for 30 days, no card. Your WhatsApp button keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.