Practical guide

How to add a cookie banner to a website: install it, verify it and test the reject choice

How to add a cookie banner to a website: choose regions, install the code before other scripts, verify it, test the reject choice and check the signals.

Last materially reviewed 2026-10-30

Quick answerTo add a cookie banner, pick a consent tool, choose the regions you serve, build the banner, paste its code into your site header before other scripts, verify it, then test the reject choice. On WordPress and Shopify the vendor's help center gives exact steps. Ask a lawyer which rules apply to your visitors.

How to add a cookie banner to a website: the steps in order

  • Step 1, decide which rules apply: California, the EU and the UK ask different things of a banner, as the best cookie consent banner guide shows.
  • Step 2, choose a tool and a plan that fit your pageviews or pages and your number of domains.
  • Step 3, set the regions you serve and the template for each: opt-in for GDPR visitors, opt-out for US state laws.
  • Step 4, build the banner so the accept and reject choices are equally easy to use.
  • Step 5, install the code in your site header, before any other scripts.
  • Step 6, verify the install in the tool's dashboard and run a cookie scan.
  • Step 7, test accept, reject and change-your-mind, then re-scan whenever you add a script.

On WordPress with CookieYes

The vendor's help center describes two ways to place the code. In the theme editor, open Appearance and then Theme File Editor, open the theme header, paste the code between the head tags before any other scripts, and update the file. With a header and footer plugin, paste the code into the plugin's header section instead. The help article says code placed after other custom scripts may stop auto-blocking from working as intended, and that after a theme change you may need to add the code again if you used the theme editor. After either route, return to the CookieYes screen and click Verify. The vendor also offers its own WordPress plugin as a separate route.

On Shopify with CookieYes

  • Install the CookieYes app from the Shopify App Store. It opens a three-step setup.
  • Regions: pick worldwide, United States only, or Europe and other non-US regions. The help article says worldwide uses geo-targeting, a US-only choice uses an opt-out banner and a non-US choice uses an opt-in banner. The pricing table lists geo-targeting from Pro, so confirm what your plan allows.
  • Customize and activate: choose a banner, box or centered layout, then turn on the CookieYes app embed in the Shopify theme editor and save.
  • Shopify settings: under Customer privacy, remove Shopify's default cookie banner so only one banner shows, and set the regions. The article says Shopify collects marketing and analytics data only after a visitor consents in the regions you select.

Make the choice fair and the signals work

In California, the agency's regulations call a banner with only Accept All and Preferences unequal, and say an equal choice could be Accept All and Decline All. In the EU, Article 7 of the GDPR says withdrawing consent must be as easy as giving it. If your site also runs Google tags, Google's consent mode guide says to set a default consent state before the visitor chooses and to update it afterward, and it notes that consent mode was updated in November 2023 with two added parameters. The guide has a separate section for sites that use a consent management platform, so follow your tool's help article for the exact settings.

Test before and after you publish

  • Open the site in a private browser window and confirm the banner appears before any non-essential script runs.
  • Click Reject or Decline and check that analytics and advertising tags stay off. A browser developer tool shows which requests fire.
  • Click Accept, then reopen the preferences and change your choice. Withdrawal should take about as many clicks as consent.
  • Turn on a browser or extension that sends Global Privacy Control and check that your site treats it as an opt-out if you sell or share personal information. The Global Privacy Control site lists browsers and a reference server for testing.
  • Re-scan after you add a script, plugin or embed, because new cookies need categories.

When to ask for legal help

A banner is a tool. It does not tell you which laws apply, which cookies are essential or whether your policy text is accurate, and the vendor's own terms say its information is not legal advice. For a business with many client sites, ask a lawyer to approve one standard setup. Then compare tools in the best cookie consent banner guide and plan costs with the CookieYes pricing guide.

Continue when useful

Next: What is CookieYes

What CookieYes is: a cookie consent platform you install with one line of code, a plugin or an app, how it works and what it leaves to you and a lawyer.

Open What is CookieYes →

Sources used for this page

These records support the facts and comparisons above. Merchant-controlled records are labelled so you can separate product claims from independent evidence.

  1. CookieYes help center, How to add a cookie banner to WordPress — Merchant documentation · cookieyes.com · Merchant-controlled · checked 2026-10-30
  2. CookieYes help center, Install and set up CookieYes in a Shopify store — Merchant documentation · cookieyes.com · Merchant-controlled · checked 2026-10-30
  3. CookieYes terms and conditions — Merchant documentation · cookieyes.com · Merchant-controlled · checked 2026-10-30
  4. California Privacy Protection Agency, CCPA regulations effective January 1, 2026 (PDF) — Regulatory guidance · cppa.ca.gov · Publisher independence not verified · checked 2026-10-30
  5. GDPR text, Article 7: conditions for consent (gdpr-info.eu) — Regulatory guidance · gdpr-info.eu · Publisher independence not verified · checked 2026-10-30
  6. Global Privacy Control specification site — Standards and certification reference · globalprivacycontrol.org · Publisher independence not verified · checked 2026-10-30
  7. Google for Developers, Set up consent mode on websites — Platform documentation · developers.google.com · Merchant-controlled · checked 2026-10-30
  8. ICO, Cookies and similar technologies (PECR guide) — Regulatory guidance · ico.org.uk · Publisher independence not verified · checked 2026-10-30