How to add a cookie banner to a website: the steps in order
- Step 1, decide which rules apply: California, the EU and the UK ask different things of a banner, as the best cookie consent banner guide shows.
- Step 2, choose a tool and a plan that fit your pageviews or pages and your number of domains.
- Step 3, set the regions you serve and the template for each: opt-in for GDPR visitors, opt-out for US state laws.
- Step 4, build the banner so the accept and reject choices are equally easy to use.
- Step 5, install the code in your site header, before any other scripts.
- Step 6, verify the install in the tool's dashboard and run a cookie scan.
- Step 7, test accept, reject and change-your-mind, then re-scan whenever you add a script.
On WordPress with CookieYes
The vendor's help center describes two ways to place the code. In the theme editor, open Appearance and then Theme File Editor, open the theme header, paste the code between the head tags before any other scripts, and update the file. With a header and footer plugin, paste the code into the plugin's header section instead. The help article says code placed after other custom scripts may stop auto-blocking from working as intended, and that after a theme change you may need to add the code again if you used the theme editor. After either route, return to the CookieYes screen and click Verify. The vendor also offers its own WordPress plugin as a separate route.
On Shopify with CookieYes
- Install the CookieYes app from the Shopify App Store. It opens a three-step setup.
- Regions: pick worldwide, United States only, or Europe and other non-US regions. The help article says worldwide uses geo-targeting, a US-only choice uses an opt-out banner and a non-US choice uses an opt-in banner. The pricing table lists geo-targeting from Pro, so confirm what your plan allows.
- Customize and activate: choose a banner, box or centered layout, then turn on the CookieYes app embed in the Shopify theme editor and save.
- Shopify settings: under Customer privacy, remove Shopify's default cookie banner so only one banner shows, and set the regions. The article says Shopify collects marketing and analytics data only after a visitor consents in the regions you select.
Make the choice fair and the signals work
In California, the agency's regulations call a banner with only Accept All and Preferences unequal, and say an equal choice could be Accept All and Decline All. In the EU, Article 7 of the GDPR says withdrawing consent must be as easy as giving it. If your site also runs Google tags, Google's consent mode guide says to set a default consent state before the visitor chooses and to update it afterward, and it notes that consent mode was updated in November 2023 with two added parameters. The guide has a separate section for sites that use a consent management platform, so follow your tool's help article for the exact settings.
Test before and after you publish
- Open the site in a private browser window and confirm the banner appears before any non-essential script runs.
- Click Reject or Decline and check that analytics and advertising tags stay off. A browser developer tool shows which requests fire.
- Click Accept, then reopen the preferences and change your choice. Withdrawal should take about as many clicks as consent.
- Turn on a browser or extension that sends Global Privacy Control and check that your site treats it as an opt-out if you sell or share personal information. The Global Privacy Control site lists browsers and a reference server for testing.
- Re-scan after you add a script, plugin or embed, because new cookies need categories.
When to ask for legal help
A banner is a tool. It does not tell you which laws apply, which cookies are essential or whether your policy text is accurate, and the vendor's own terms say its information is not legal advice. For a business with many client sites, ask a lawyer to approve one standard setup. Then compare tools in the best cookie consent banner guide and plan costs with the CookieYes pricing guide.
Sources used for this page
These records support the facts and comparisons above. Merchant-controlled records are labelled so you can separate product claims from independent evidence.
- CookieYes help center, How to add a cookie banner to WordPress — Merchant documentation · cookieyes.com · Merchant-controlled · checked 2026-10-30
- CookieYes help center, Install and set up CookieYes in a Shopify store — Merchant documentation · cookieyes.com · Merchant-controlled · checked 2026-10-30
- CookieYes terms and conditions — Merchant documentation · cookieyes.com · Merchant-controlled · checked 2026-10-30
- California Privacy Protection Agency, CCPA regulations effective January 1, 2026 (PDF) — Regulatory guidance · cppa.ca.gov · Publisher independence not verified · checked 2026-10-30
- GDPR text, Article 7: conditions for consent (gdpr-info.eu) — Regulatory guidance · gdpr-info.eu · Publisher independence not verified · checked 2026-10-30
- Global Privacy Control specification site — Standards and certification reference · globalprivacycontrol.org · Publisher independence not verified · checked 2026-10-30
- Google for Developers, Set up consent mode on websites — Platform documentation · developers.google.com · Merchant-controlled · checked 2026-10-30
- ICO, Cookies and similar technologies (PECR guide) — Regulatory guidance · ico.org.uk · Publisher independence not verified · checked 2026-10-30