Works with your stack
Cookie consent for WooCommerce
the checkout never waits
WooCommerce records where each order comes from with small sbjs_ cookies. That is marketing, and it needs consent. The cart, the checkout and the payment have to keep working whatever the visitor chooses.
By WooCommerce, Inc. · woocommerce.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
WooCommerce
WordPress plugin
- Tested version
- 11.2.2
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 11.2.2 tested
- Active installs
- 7,000,000+
What WooCommerce adds to your visitors’ browser
Trackers it loads
- WooCommerce →Marketing
Cookies seen in our test
sbjs_migrationssbjs_current_addsbjs_first_addsbjs_currentsbjs_firstsbjs_udatasbjs_session
What a WooCommerce shop puts on your pages
- Order attribution
- Notes where each visit comes from in small cookies and attaches it to the order: WooCommerce order attribution. Marketing, so it needs consent.
- Cart and session
- Cookies that keep the cart and the order between pages. Necessary: no consent needed.
- Customer accounts
- WordPress login cookies when customers sign in. Necessary as well.
- Payment
- Stripe, PayPal or Mollie load their scripts at checkout. They are part of the purchase and are never held.
- Shop extensions
- Analytics and pixels for shops add their own tags, such as the Google tag, Meta Pixel or TikTok Pixel.
What matters for consent with WooCommerce
Order attribution
WooCommerce notes where each visit comes from, such as a search, an ad or a newsletter, and attaches it to the order. It counts as marketing.
Cart and session cookies
The cookies that keep the cart and the order are necessary. They need no consent, and nothing should hold them.
Payment at checkout
Stripe, PayPal and other payment providers load their own scripts at checkout. They are part of the purchase the customer asked for.
Analytics and pixels for shops
Shops often add Google Analytics, Meta or TikTok extensions on top of WooCommerce. Each one adds tags of its own, beyond order attribution.
Customer accounts
When customers can create accounts, WordPress sets login cookies. They are needed for the account to work and need no consent.
Cookie Rocks with WooCommerce
- Passes the visitor’s choice to WP Consent API on every page, where this plugin reads it.
- Holds order attribution, the sbjs_ cookies, until the visitor accepts marketing.
- Deletes the sbjs_ cookies when a visitor refuses or withdraws marketing.
- Never holds the cart, the checkout or the payment.
What our tests found on WooCommerce
Good to know · WooCommerceThe wc key of WooCommerce is a storage test
WooCommerce: wc is written then deleted at once (storage test), nothing stays.
Name Kept in Category What it is for wclocalStorage Necessary Checks that browser storage works, deleted at once wcsessionStorage Necessary Checks that browser storage works, deleted at once Read in its code, 4 November 2026, WooCommerce.
Full detail
WooCommerce cart fragments write wc = test in local and session storage and delete it in the same statement, to check that storage works. Nothing stays. The Audit 2.9.11 lists wc as an unknown key; a key written and deleted at once should not be listed.
Good to know · WooCommerceWhat WooCommerce stores in visitors' browsers
WooCommerce: 11 cookie(s) or browser key(s) for visitors, recognised by Cookie Rocks from 2.9.8.
Name Kept in Category What it is for WOOCOMMERCE_CHECKOUT_IS_CUSTOMER_DATA_DIRTYlocalStorage Necessary Keeps the shopping cart and the checkout working storeApiCartHashlocalStorage Necessary Keeps the shopping cart and the checkout working storeApiNoncelocalStorage Necessary Keeps the shopping cart and the checkout working wc_cart_createdsessionStorage Necessary Keeps the shopping cart and the checkout working woocommerce_geo_hashcookie Necessary Serves the cached page that matches the visitor's country (taxes, shipping) woo-sharecookie Necessary Lets a visitor with a share link see a store that is not launched yet tk_aicookie Statistics Anonymous identifier for WooCommerce usage statistics (Automattic Tracks) tk_lrcookie Statistics Automattic Tracks usage statistics (referrer) tk_orcookie Statistics Automattic Tracks usage statistics (original referrer) tk_r3dcookie Statistics Automattic Tracks usage statistics tk_tccookie Statistics Automattic Tracks usage statistics (session) Read in its code, 2 November 2026, WooCommerce.
Full detail
WooCommerce can store 11 cookies or browser keys for visitors: WOOCOMMERCE_CHECKOUT_IS_CUSTOMER_DATA_DIRTY, storeApiCartHash, storeApiNonce, wc_cart_created, woocommerce_geo_hash, woo-share, tk_ai, tk_lr, tk_or, tk_r3d, tk_tc. Cookie Rocks recognises them from 2.9.8 and lists them in the cookie policy, each with its category and purpose, when it sees them.
Good to know · Cookie RocksCookie Rocks 2.9.5 tested on PHP, WooCommerce and multisite
- No PHP error on PHP 7.4 and 8.3.
- WooCommerce cart and checkout work before and after the choice.
- Multisite: settings, choice cookie and tables per site.
- Uninstall removes options, tables, task and files.
Seen in our tests, 1 November 2026, Cookie Rocks.
Full detail
Cookie Rocks 2.9.5 with the Audit and Pro showed no PHP error on PHP 7.4 and 8.3. On WooCommerce, cart and checkout work before and after the choice, and strict payments keep Stripe out of other pages only. On a multisite network, settings, the choice cookie (cr_consent_2) and tables are per site, including sites created later. Uninstall removes options, tables, the scheduled task and files.
Depends on a setting · Microsoft ClarityClarity's Brand Agents loads a Microsoft script and sets a cookie on stores
setting “Brand Agents” · by default: not connected
With Brand Agents connected and front-end injection on, a script loads from an Azure address on every front page for visitors not logged in. On WooCommerce stores, brandagent_attrs is set for 2 hours.
Read in its code, 16 October 2026, Microsoft Clarity 0.10.35.
Full detail
With Brand Agents connected and front-end injection on, the Microsoft Clarity plugin loads a script module from adsagentclientafd-b7hqhjdrf3fpeqh2.b01.azurefd.net on every front page for visitors who are not logged in. On WooCommerce stores, a REST endpoint called by that script sets the brandagent_attrs cookie for 2 hours (session, customer and conversation IDs, Clarity data, language, currency, country).
Good to know · JetpackWooCommerce Analytics assumes consent when WP Consent API is missing
It checks for statistics consent before each event. Without WP Consent API, its requests to pixel.wp.com and stats.wp.com are sent for every visitor.
Read in its code, 16 October 2026, Jetpack 16.3.1.
Full detail
WooCommerce Analytics (Jetpack module, on with WooCommerce) checks wp_has_consent('statistics') before each event, on the server and in the browser. Without WP Consent API, consent is assumed and pixel.wp.com/t.gif and stats.wp.com/s-*.js are sent for every visitor.
Set before the choice · KlaviyoKlaviyo sends checkout details to Klaviyo even when its addresses are held
On the WooCommerce checkout, scripts served by the site set __kla_id (email and name, 2 years) and send profile data when the email or name is typed, or on load for logged-in customers.
Read in its code, 16 October 2026, Klaviyo 3.8.3.
Full detail
On the WooCommerce checkout, wck-started-checkout.js (classic) and includes/blocks/build/events.js (block checkout), both served by the site, set the __kla_id cookie (base64 of email, first and last name, 2 years) and POST profile and Started Checkout data to a.klaviyo.com/client/profiles/ and client/events/ without klaviyo.js: on load for a logged-in customer, otherwise when the email or name is typed. Holding Klaviyo's own addresses does not stop them.
See the 15 other findings
Sent from your server · KlaviyoKlaviyo's server sends Added to Cart events while __kla_id exists
Without the cookie nothing is sent, so removing __kla_id on withdrawal stops it.
Read in its code, 16 October 2026, Klaviyo 3.8.3.
Full detail
When a product is added to the cart and the __kla_id cookie is present, the Klaviyo plugin's server sends an Added to Cart event to a.klaviyo.com/client/events/ (wp_remote_post). Without the cookie nothing is sent, so removing __kla_id on withdrawal stops it.
Sent from your server · Matomo for WordPressMatomo for WordPress sends WooCommerce carts and orders from the server
setting “Track ecommerce” · by default: on
With Track ecommerce on (default), carts and orders are sent from PHP in some cases, with no consent check. A browser-side consent signal does not hold these hits. The server tracker sets no cookie.
Read in its code, 16 October 2026, Matomo for WordPress 5.13.1.
Full detail
With Track ecommerce on (default), Matomo for WordPress sends WooCommerce carts and orders from PHP during AJAX or REST requests, in Tag Manager mode, or with MATOMO_TRACK_ECOMMERCE_SERVER_SIDE, with no consent check in that code; the PHP tracker sets no cookie but reads _pk_id. A browser-side consent signal does not hold these hits. Use server generated Visitor ID (off by default) starts the WooCommerce session for visitors without _pk_id.
Sent from your server · Mailchimp for WooCommerceMailchimp for WooCommerce sends the typed email to the site before any order
setting “Cart tracking” · by default: all
With cart tracking on (the default), leaving the email field sets mailchimp.cart.current_email and sends the address to the site. The server then passes cart data to Mailchimp.
Read in its code, 16 October 2026, Mailchimp for WooCommerce 6.3.
Full detail
With cart tracking on (all, by default), Mailchimp for WooCommerce's site script sets the session cookie mailchimp.cart.current_email when the visitor leaves the email field at checkout, login or registration, then sends the address to admin-ajax.php?action=mailchimp_set_user_by_email, before any order. The server then passes cart data to Mailchimp's API.
Sent from your server · Mailchimp for WooCommerceMailchimp for WooCommerce sets 28-day cookies that banners cannot hold
- mailchimp_campaign_id and mailchimp_email_id when the visitor arrives with ?mc_cid= or ?mc_eid=.
- mailchimp_user_email, mailchimp_user_previous_email and mailchimp_cart_token for cart recovery.
- mailchimp_landing_site on the first page, only if landing page tracking is on (off by default).
- All go through the mailchimp_allowed_to_use_cookie filter.
Read in its code, 16 October 2026, Mailchimp for WooCommerce 6.3.
Full detail
Mailchimp for WooCommerce sets its cookies from PHP for 28 days (2 419 200 s, Secure, SameSite=Strict): mailchimp_campaign_id and mailchimp_email_id when a visitor arrives with ?mc_cid= or ?mc_eid=, mailchimp_user_email, mailchimp_user_previous_email and mailchimp_cart_token (HttpOnly) for cart recovery, and mailchimp_landing_site on the first page only if landing page tracking is on (off by default). A consent plugin cannot hold them; all go through the mailchimp_allowed_to_use_cookie filter.
Sent from your server · OptinMonsterOptinMonster sends order revenue from the server using the _omra cookie
setting “Revenue Attribution”
With Revenue Attribution on, OptinMonster's server reads the _omra cookie at a WooCommerce or EDD order and sends the revenue to the OptinMonster API (v2/revenue). If _omra survives a refusal, sending continues.
Read in its code, 16 October 2026, OptinMonster 2.17.1.
Good to know · WooCommerceWooCommerce writes one visitor's marketing consent into cached pages
With WP Consent API, the attribution consent value is in the page, so a cached page carries it for everyone until a footer script corrects it. Session and cart storage do not depend on consent.
Read in its code, 16 October 2026, WooCommerce 11.2.1.
Full detail
With WP Consent API, WooCommerce writes the result of wp_has_consent('marketing'), read from the request's cookies, into the page as the attribution allowTracking value, so a cached page carries the value of the visitor who generated it. Its footer script wp-consent-api-integration corrects it only at the wp_consent_type_defined event and on each consent change. Only order attribution reads consent; the session cookie wp_woocommerce_session_<hash> (HttpOnly, 2 days, 7 when logged in) and the cart fragments storage (wc_cart_hash_<md5> in localStorage, wc_fragments_<md5> in sessionStorage) do not depend on it.
Sent from your server · WooCommerceWooCommerce geolocation can send the visitor's IP to an outside lookup site
setting “Default customer location”
When it needs the country and no MaxMind key or CDN header gives it, the server asks ipinfo.io or api.country.is. With page caching support, woocommerce_geo_hash is set for 1 hour.
Read in its code, 16 October 2026, WooCommerce 11.2.1.
Full detail
When WooCommerce needs the visitor's country (default customer location set to Geolocate, or taxes by geolocation) and neither a MaxMind key nor a CDN country header gives it, its server looks the country up at ipinfo.io or api.country.is, sending the visitor's IP address. With Geolocate (with page caching support), it sets woocommerce_geo_hash for 1 hour from the first page and adds a v= parameter to addresses.
Good to know · WooCommerceWooCommerce attribution cookies are session cookies, except sbjs_session
sbjs_session lasts 30 minutes. The cookies are set on the domain without www., while WooCommerce's removal on withdrawal uses the full host name.
Read in its code, 16 October 2026, WooCommerce 11.2.1.
Full detail
WooCommerce passes a lifetime of 0.00001 month to its sourcebuster library, which converts and truncates it to 0 minutes: the sbjs_ attribution cookies are session cookies, except sbjs_session (30 minutes). sourcebuster sets them on the host name without www. (domain=.<domain>), while WooCommerce's own removal on withdrawal uses domain=.<hostname>.
Good to know · WooCommerceWooCommerce order attribution starts on the page where the visitor accepts
A visitor who lands from a campaign link and accepts on a later page is recorded as a direct visit.
Seen in our tests, 15 October 2026, WooCommerce 11.2.1.
Full detail
When order attribution waits for consent, it starts on the page where the visitor accepts. A visitor who lands from a campaign link and accepts on a later page is recorded as a direct visit. This respects the choice, but shops that follow their campaigns should know it.
Good to know · WooCommerceWooCommerce block cart and checkout use the browser's local storage
They keep storeApiNonce, storeApiCartData and storeApiCartHash, plus one more key on the checkout page. The classic checkout keeps nothing there.
Seen in our tests, 15 October 2026, WooCommerce 11.2.1.
Full detail
The WooCommerce block cart and block checkout keep storeApiNonce, storeApiCartData and storeApiCartHash in the browser's local storage, plus WOOCOMMERCE_CHECKOUT_IS_CUSTOMER_DATA_DIRTY on the checkout page. The classic checkout keeps nothing in local storage.
Set before the choice · WooCommerceWooCommerce cart cookies are necessary and never held
by default: Default settings
Browsing sets no cookie. Adding a product sets woocommerce_items_in_cart, woocommerce_cart_hash and wp_woocommerce_session_* before any choice; they keep the cart.
Seen in our tests, 15 October 2026, WooCommerce 11.2.1.
Full detail
Browsing a WooCommerce shop sets no cookie. Adding a product to the cart sets woocommerce_items_in_cart, woocommerce_cart_hash and wp_woocommerce_session_* before any choice. They keep the cart, so they are necessary cookies and Cookie Rocks never holds them.
Good to know · WooCommerceWooCommerce checkout works after Reject all or Accept all
With Cookie Rocks, orders go through with the WooCommerce block checkout and the classic checkout alike, after Reject all or Accept all, with no error and no request to another site.
Seen in our tests, 15 October 2026, WooCommerce 11.2.1.
Good to know · WooCommerceWith Cookie Rocks, WooCommerce order attribution waits for marketing consent
After Reject all, an order goes through with no origin data; after Accept all, it has it. Withdrawing marketing consent deletes the sbjs_ cookies at once.
Seen in our tests, 15 October 2026, WooCommerce 11.2.1.
Full detail
With Cookie Rocks, WooCommerce order attribution (the sbjs_ cookies) waits for consent to marketing, with or without WP Consent API. After Reject all, a cash on delivery order goes through and carries no origin data; after Accept all, it does. Withdrawing marketing consent deletes the sbjs_ cookies at once.
Good to know · WooCommerceCookie Rocks is not flagged as incompatible with WooCommerce order storage
setting “HPOS”
With WooCommerce's order storage (HPOS) on, WooCommerce only judges extensions that declare they target WooCommerce: Cookie Rocks, which declares nothing, is not listed as incompatible, and no declaration is needed.
Seen in our tests, 10 October 2026, WooCommerce.
Set before the choice · WooCommerceWooCommerce order attribution sets seven cookies on arrival, before any choice
setting “Order attribution” · by default: on
Without a consent integration, the sbjs_ cookies are set as soon as the visitor arrives and stay after a refusal.
Seen in our tests, 9 October 2026, WooCommerce 11.2.
Full detail
Without a consent integration, WooCommerce order attribution sets seven sbjs_ cookies (sbjs_migrations, sbjs_current_add, sbjs_first_add, sbjs_current, sbjs_first, sbjs_udata, sbjs_session) as soon as the visitor arrives, before any choice, and they stay after a refusal.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- WooCommerce 11.2.2, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: WooCommerce 11.2.2 on 7 November 2026, with WordPress 7.1.3.
Online shops
Other plugins of the same kind.
Questions
Does WooCommerce read the visitor’s choice itself?
Yes, through WP Consent API when it is installed. Without it, order attribution has to be switched on and off by your consent plugin.
And the pixels added by other shop extensions?
Meta, TikTok, Google and others add their own tags. See the plugins that add trackers.
Does refusing cookies stop a customer from buying?
No. The cart, the checkout and the payment work with necessary cookies only. A visitor who refuses everything can still place an order.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For WooCommerce shops
Consent that never stands between a customer and the checkout.
the checkout never waits
Every feature of the complete plugin on your shop for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.