CookieKita — GDPR Consent & Cookie Banner
GDPR cookie consent banner with real tracker blocking, Google Consent Mode v2, consent-aware tag installer, DSAR handling and WooCommerce tracking.
Use with caution
CookieKita works, but test it on a staging site before relying on it in 2026. Was last updated 2 months ago, and scores 55/100 on our health check.
- Small user base (<10 active installs)
- Very few reviews so far
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where CookieKita stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| consent mode | >100 |
| cookie banner | >100 |
| cookie consent | >100 |
| DSAR | #9 |
| GDPR | >100 |
About CookieKita
From the official readme · v1.1.2Description
CookieKita is the WordPress companion plugin to cookiekita.com, a GDPR/ePrivacy consent management platform. It does the on-site work — blocking trackers before consent, installing your tags consent-aware, and executing data requests — while the dashboard handles the consent log, cookie scanner and compliance reporting.
What it does
- 🍪 Cookie consent banner — auto-injects the CookieKita banner, localized to the WordPress site language.
- 🛡 Real tracker blocking — holds back Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Clarity, LinkedIn, TikTok and 30+ other services until the visitor consents. A banner that only shows without blocking is not compliant — CookieKita actually blocks.
- 🔌 Integrations directory — a catalogue of 37 recognised services, each auto-blocked and mapped to the right consent category.
- ⚡ Consent-aware tag installer — paste your GA4 / Meta Pixel / GTM (and many more) ID and CookieKita installs the official tag for you as a blocked script that only fires after the matching consent. You become the bridge, not just the blocker.
- 🛒 WooCommerce eCommerce tracking — automatically sends
view_item,add_to_cart,begin_checkoutandpurchaseto GA4 / Google Tag Manager, your ad pixels (Meta, TikTok, Pinterest, Snap, Reddit) and — with a conversion label — Google Ads conversions. Analytics events fire on analytics consent; ad events and Google Ads conversions on marketing consent — fully consent-gated. - 🟢 Google Consent Mode v2 & Microsoft UET Consent Mode — consent signals are forwarded automatically.
- 🌐 GPC / DNT signals — honours Global Privacy Control and Do Not Track.
- 📊 Cookie declaration shortcode —
[cookiekita_cookies]renders a live table of the cookies discovered by the CookieKita scanner. - 📨 DSAR form shortcode —
[cookiekita_dsar]adds a GDPR data-subject-request form to any page. - 🤖 Auto-execute DSAR (opt-in) — verified deletion/export requests are executed via the WordPress Personal Data API and WooCommerce privacy hooks, with an audit log.
- ♿ Accessibility toolbar (opt-in) — a floating comfort/customization widget (text size, contrast, readable font, big cursor, reading guide and more). Not an ADA/WCAG compliance claim — it complements real accessibility work.
Requirements
- A free or paid account at cookiekita.com.
- Your Site Key (32 hex characters) from the CookieKita dashboard. If you download the plugin from your dashboard, the key is pre-configured for you.
External services
This plugin connects to the CookieKita service (cookiekita.com) — it is a companion plugin for that platform and requires a CookieKita account to function. The connection is used for the features below.
1. Banner script & configuration — On every front-end page the plugin loads the consent banner script from https://cookiekita.com/banner.js and fetches your banner configuration and cookie list from https://cookiekita.com/functions/v1/. Your public Site Key is sent so the correct configuration is returned. No personal data is sent for this.
2. Connection / heartbeat — When you save your Site Key (and roughly once a day afterwards) the plugin sends your site URL, plugin version, WordPress version and PHP version to https://cookiekita.com/functions/v1/verify-wp-site so the dashboard can show connection status and register the DSAR webhook. It also checks whether the site was disconnected from the dashboard.
3. DSAR webhook — When auto-execute DSAR is enabled, CookieKita sends signed data-subject requests (containing the requester’s email) to the plugin so they can be fulfilled on your site.
By using this plugin you agree to the CookieKita Terms of Service (https://cookiekita.com/terms) and Privacy Policy (https://cookiekita.com/privacy).
Optional third-party tags (only loaded if you enable them)
CookieKita does not load any of the third-party services below by default. The consent-aware tag installer loads a provider’s official script only when you, the site administrator, enter that provider’s ID / enable it, and even then the script is held back until the visitor gives the matching consent (analytics or marketing). When a tag fires, the visitor’s browser loads the provider’s script directly and that provider receives standard analytics/advertising data (e.g. page views, events, IP address, cookie/device identifiers) — what is sent and when is determined by that provider. Review each provider’s terms and privacy policy before enabling it:
- Google (Tag Manager, gtag, GA4) — googletagmanager.com — terms: https://policies.google.com/terms — privacy: https://policies.google.com/privacy
- Meta Pixel (Facebook) — connect.facebook.net — terms: https://www.facebook.com/legal/terms/ — privacy: https://www.facebook.com/privacy/policy/
- Microsoft Clarity / UET — clarity.ms — terms: https://www.microsoft.com/legal/terms-of-use — privacy: https://privacy.microsoft.com/privacystatement
- TikTok — analytics.tiktok.com — terms: https://www.tiktok.com/legal/terms-of-service — privacy: https://www.tiktok.com/legal/privacy-policy
- LinkedIn Insight — snap.licdn.com — terms: https://www.linkedin.com/legal/user-agreement — privacy: https://www.linkedin.com/legal/privacy-policy
- X (Twitter) Ads — static.ads-twitter.com — terms: https://legal.twitter.com/ads-terms.html — privacy: https://twitter.com/en/privacy
- Pinterest Tag — s.pinimg.com — terms: https://policy.pinterest.com/terms-of-service — privacy: https://policy.pinterest.com/privacy-policy
- Snap Pixel — sc-static.net — terms: https://snap.com/terms — privacy: https://snap.com/privacy/privacy-policy
- Reddit Pixel — redditstatic.com — terms: https://www.redditinc.com/policies/user-agreement — privacy: https://www.reddit.com/policies/privacy-policy
- Amazon Ads — c.amazon-adsystem.com — terms: https://www.amazon.com/gp/help/customer/display.html?nodeId=508088 — privacy: https://www.amazon.com/gp/help/customer/display.html?nodeId=468496
- Criteo — static.criteo.net — terms: https://www.criteo.com/terms-and-conditions/ — privacy: https://www.criteo.com/privacy/
- Outbrain — amplify.outbrain.com — terms: https://www.outbrain.com/onyx/term-of-use/ — privacy: https://www.outbrain.com/privacy/
- Taboola — cdn.taboola.com — terms: https://policies.taboola.com/terms-of-service/ — privacy: https://policies.taboola.com/privacy-policy/
- Hotjar — static.hotjar.com — terms: https://www.hotjar.com/legal/policies/terms-of-service/ — privacy: https://www.hotjar.com/legal/policies/privacy/
- Segment (Twilio) — cdn.segment.com — terms: https://www.twilio.com/en-us/legal/tos — privacy: https://www.twilio.com/en-us/legal/privacy
- Heap — cdn.heapanalytics.com — terms: https://www.heap.io/terms — privacy: https://www.heap.io/privacy
- Amplitude — cdn.amplitude.com — terms: https://amplitude.com/terms — privacy: https://amplitude.com/privacy
- Mixpanel — cdn.mxpnl.com — terms: https://mixpanel.com/legal/terms-of-use/ — privacy: https://mixpanel.com/legal/privacy-policy/
- FullStory — fullstory.com — terms: https://www.fullstory.com/legal/terms-and-conditions/ — privacy: https://www.fullstory.com/legal/privacy-policy/
- Crazy Egg — script.crazyegg.com — terms: https://www.crazyegg.com/terms — privacy: https://www.crazyegg.com/privacy
- Mouseflow — cdn.mouseflow.com — terms: https://mouseflow.com/legal/terms/ — privacy: https://mouseflow.com/legal/privacy-policy/
- Inspectlet — cdn.inspectlet.com — terms: https://www.inspectlet.com/terms-of-service — privacy: https://www.inspectlet.com/terms-of-service
- Plausible Analytics — plausible.io — terms: https://plausible.io/terms — privacy: https://plausible.io/privacy
- PostHog — posthog.com — terms: https://posthog.com/terms — privacy: https://posthog.com/privacy
- Simple Analytics — simpleanalyticscdn.com — terms: https://www.simpleanalytics.com/terms — privacy: https://www.simpleanalytics.com/privacy-policy
- HubSpot — js.hs-scripts.com — terms: https://legal.hubspot.com/terms-of-service — privacy: https://legal.hubspot.com/privacy-policy
- Intercom — widget.intercom.io — terms: https://www.intercom.com/legal/terms-and-policies — privacy: https://www.intercom.com/legal/privacy
- Drift — js.driftt.com — terms: https://www.drift.com/terms-of-service/ — privacy: https://www.drift.com/privacy-policy/
- Crisp — client.crisp.chat — terms: https://crisp.chat/en/terms/ — privacy: https://crisp.chat/en/privacy/
- Tawk.to — embed.tawk.to — terms: https://www.tawk.to/terms-of-service/ — privacy: https://www.tawk.to/privacy-policy/
- LiveChat — cdn.livechatinc.com — terms: https://www.livechat.com/legal/terms/ — privacy: https://www.livechat.com/legal/privacy-policy/
- Zendesk — static.zdassets.com — terms: https://www.zendesk.com/company/agreements-and-terms/master-subscription-agreement/ — privacy: https://www.zendesk.com/company/agreements-and-terms/privacy-notice/
Installation
- Install through Plugins → Add New, or upload the
cookiekitafolder to/wp-content/plugins/. - Activate the plugin through the Plugins menu.
- Open the CookieKita menu and paste your Site Key (skipped automatically if you downloaded a pre-configured copy from your dashboard).
- (Optional) Activate integrations and paste your tag IDs under CookieKita → Integrations.
- (Optional) Add
[cookiekita_cookies]to your Privacy Policy page and[cookiekita_dsar]to your Data Requests page.
Frequently asked questions
Does this require a CookieKita account?
Yes. CookieKita is a companion plugin for the cookiekita.com platform and needs a Site Key from your account. Core banner, blocking, scanner and DSAR form work on the free plan.
Will it slow down my site?
The banner script is small, async-loaded and CDN-served. The tracker blocker runs a single fast pass per page render.
Does it actually block trackers, or just show a banner?
It blocks. Recognised tracking scripts and embeds are held back (rendered as inert, consent-gated scripts) and only execute after the visitor consents to the matching category.
How does the consent-aware tag installer work?
You paste a service ID (e.g. a GA4 Measurement ID or Meta Pixel ID). The plugin emits the vendor’s official loader as a blocked inline script tied to a consent category, so it fires only after the visitor accepts that category.
Is DSAR auto-execution safe?
It is opt-in (off by default), refuses to delete administrator accounts, and records every action to an audit log. Take a backup before enabling.
Does it work with WooCommerce?
Yes. It adds consent-gated eCommerce event tracking (view_item, add_to_cart, begin_checkout, purchase) and uses WooCommerce’s privacy hooks for DSAR.
Changelog
Connection problems now show the exact reason (domain mismatch, unknown key, or disconnect) and how to fix it.
1.1.2
- Improvement: when CookieKita rejects the connection, the status now names the exact reason instead of a vague “Key not recognized”. The header badge, the Connection tab and Diagnostics distinguish a domain mismatch (the Site Key belongs to a different domain), an unknown key (no such site), and a dashboard disconnect — each with a one-line fix. The Connection tab shows the explanation inline so there is nothing to guess.
1.1.1
- Fix: the banner script (banner.js) was requested with the plugin version as a
?vercache-buster. Because banner.js is a remote script that updates independently of the plugin, this could keep browsers on an older cached copy after a banner update until the plugin version changed. The plugin no longer pins a version to it and lets the script’s own cache headers govern freshness, so improvements reach visitors right away.
1.1.0
- Improved: the accessibility toolbar (Settings → Accessibility toolbar) is now fully customizable from your CookieKita dashboard — the floating button’s colours and corner, which controls the panel shows and the order they appear in. Existing sites keep the full default set until you change it.
- Improved: refreshed toolbar design — clearer controls with a level indicator on the steppers, proper switches, and a tidy header/footer.
- New: the Accessibility toolbar settings screen now links straight to the dashboard where you customize its appearance.
1.0.15
- New: optional accessibility toolbar (Settings → Accessibility toolbar). A floating button visitors can open to adjust text size, line height, letter spacing, contrast (dark/light/high), a readable font, stop animations, a big cursor, link/heading highlighting, a reading guide and hide images — choices are remembered on their device (localStorage), independent of cookie consent since no data leaves the browser. This is a comfort/customization toolkit, not an ADA/WCAG compliance claim — it complements real accessibility work rather than replacing it. Off by default.
1.0.14
- Fix: HubSpot’s actual analytics beacon (js.hs-analytics.net) was accidentally bundled into the “HubSpot Forms” integration’s domain list, which silently downgraded it from the correct “analytics” consent category to “preferences” — the least strict category. It now stays correctly gated behind analytics consent.
- Fix: the Matomo and PostHog custom-URL fields rejected otherwise-valid addresses that included a port number (e.g. a self-hosted Matomo on
https://host:8080/), showing “does not look right” for valid input. - Fix: Google Ads / Amazon Ads — the Amazon integration hardcoded the advertiser region to “EU”, silently breaking attribution for any non-EU Amazon Ads account. A new optional “Account region (NA / EU / FE)” field lets you set the correct one; existing configs keep working unchanged (defaults to EU).
- Fix: Criteo was hardcoded to report every single page load as the homepage (“viewHome”), making its analytics/retargeting data wrong on every page except the actual front page. Criteo now gets real, page-aware WooCommerce events — viewItem on product pages, viewBasket on add-to-cart and checkout, trackTransaction on purchase (de-duplicated per order) — and “viewHome” only fires on the real front page.
1.0.13
- The Integrations tab now shows an “Extensions” section with a WooCommerce card, so the WooCommerce eCommerce tracking is discoverable there (it was previously only in Settings). The card shows whether WooCommerce is detected and links straight to its settings.
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best CookieKita alternatives
All consent mode plugins →
FAQ
CookieKita: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 19, 2026
Is CookieKita free?
Yes. CookieKita is free to download and use from the official WordPress.org plugin directory.
Is CookieKita safe to use in 2026?
CookieKita works, but test it on a staging site before relying on it in 2026. Was last updated 2 months ago, and scores 55/100 on our health check.
How many websites use CookieKita?
CookieKita is active on <10 WordPress websites and has been downloaded 502 times since it launched in July 2026. It was downloaded 71 times in the last 30 days.
Does CookieKita work with WordPress 7.1?
CookieKita is officially tested up to WordPress 7.0.7, while the latest release is 7.1.3. It may still work, but try it on a staging site first.
What PHP version does CookieKita need?
CookieKita requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was CookieKita last updated?
The latest version, 1.1.2, was released on August 25, 2026 (2 months ago).
Who makes CookieKita?
CookieKita is developed and maintained by gdimitrov.
What are the best alternatives to CookieKita?
The most popular alternatives to CookieKita are tarteaucitron.io (10K+ installs), WP Global Site Tag (7K+ installs) and Tracking and Consent Manager (3K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
