Add a GDPR cookie banner to WordPress
PrivacyPill isn't another heavy plugin. It's one script that loads first in your <head>, shows a fair consent banner, blocks trackers until visitors agree and sets Google Consent Mode v2. It works the same on classic and block themes.
Updated 28 October 2026
Set it up in 5 steps
- 1Install a header-code pluginIn WordPress admin go to Plugins → Add New Plugin, search for WPCode, then Install Now → Activate. Its global header field works with classic and block themes.
- 2Paste the embed at the top of the headerGo to Code Snippets → Header & Footer and paste the PrivacyPill snippet at the very beginning of the Header field, above any analytics or ads code. Save.
- 3Or use your child themePrefer code? Add the PHP below to your child theme's functions.php. Priority 1 prints it before most plugins hook into wp_head.
- 4Check the order and clear cachesView the page source and make sure the PrivacyPill script comes before Google tags added by other plugins. Purge WP Rocket, LiteSpeed, Cloudflare or other caches, and exclude the script from 'delay JavaScript' features.
- 5Test like a visitorOpen the site logged out in a private window. Check that no analytics cookies appear before you choose, then try 'Reject non-essential' and 'Accept all'.
<?php
// functions.php (child theme)
add_action('wp_head', function () {
?>
<!-- PrivacyPill: keep this first in <head>, before Google Tag Manager or analytics -->
<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag('consent','default',{ad_storage:'denied',ad_user_data:'denied',ad_personalization:'denied',analytics_storage:'denied',functionality_storage:'denied',personalization_storage:'denied',security_storage:'granted',wait_for_update:500});</script>
<script src="https://privacy-pill-consent-studio.lovable.app/api/public/v1/pp.js?site=pp_your_site_key"></script>
<?php
}, 1);Replace pp_your_site_key with your site key — you'll get it when you save your banner.
Block themes: don't use the Site Editor header
In block themes, Appearance → Editor → Header is a part of the page body, not the document <head>. A Custom HTML block there loads too late to protect your visitors. Use WPCode's global header (or functions.php) instead.
Plugins that add trackers
WordPress itself doesn't add analytics or ads, but plugins do — Site Kit, Jetpack, Pixel plugins, YouTube embeds. Google tags respect PrivacyPill's Consent Mode signals automatically. For other scripts you control, change type to text/plain and add data-pp-category so they wait for consent.
The WP Consent API lets supporting plugins share consent state. It isn't a banner or a blocker by itself; PrivacyPill doesn't hook into it yet, so gate non-Google trackers with data-pp-category.
Keep optimisation plugins away from the script
Features that defer, delay, combine or move JavaScript can push the consent script after your trackers. Exclude privacypill / pp.js in WP Rocket, Autoptimize, LiteSpeed or Perfmatters, and don't add async or defer to the tag.
Frequently asked questions
Set up PrivacyPill on other platforms
See all- Shopify cookie bannertheme.liquid install + Customer Privacy API.
- Webflow cookie bannerPaste one line into Head code and publish.
- Wix cookie bannerSettings → Custom Code → Head, all pages.
- Squarespace cookie bannerCode Injection → Header on Core plans and up.
- Framer cookie bannerProject Settings → Custom Code, start of head.
- Lovable cookie bannerOne prompt to the Lovable agent, or one tag.
- Bolt cookie bannerOne prompt to the Bolt agent, then publish.
- v0 cookie bannernext/script in the root layout, publish to Vercel.
- Next.js cookie bannernext/script beforeInteractive in the root layout.
- Ghost cookie bannerSettings → Code Injection → Site header.
- HubSpot cookie bannerSite header HTML + setHubSpotConsent sync.
Try it on your own site
Design your banner, preview it live, and paste one line. Free for one domain.