Website Cookie Compliance for Joomla & WordPress

Under the UK GDPR, PECR, and the newly active Data (Use and Access) Act 2025, you must meet strict rules before placing non-essential tracking cookies on a user's device:

• Tell people the cookies are there: You must provide clear, specific information about what data is being collected and why.
• Explain what the cookies are doing: This should be detailed in an easily accessible Cookie Policy.
• Get explicit consent: You must obtain active, opt-in consent before these cookies are loaded. Pre-ticked boxes or "implied consent" are strictly illegal.
• Symmetry of Choice: The ICO mandates that it must be just as easy for a user to click ‘Reject All’ as it is to ‘Accept All.’

Note: The recent DUAA changes do allow for purely "statistical" (analytics) cookies to be loaded without prior consent in the UK, but only under very strict conditions where the data is aggregated, not used for ad targeting, and the user is provided with a clear, one-click opt-out.

Practically speaking, they are very similar. Because the UK's privacy laws were originally derived from European law, the core rules regarding opt-in consent for advertising trackers remain the same. However, the recent UK DUAA has created some divergence (such as the UK's new statistical exemption mentioned above).

Crucially, if your UK website has European visitors, you cannot rely solely on the new, relaxed UK rules for those users; you must still comply with the stricter EU GDPR. Fortunately, the premium Consent Management Platforms (CMPs) we implement use geo-targeting to automatically serve the correct, compliant banner based on the visitor's location.

US data privacy law is entirely different from the UK and EU. The United States does not have a single federal privacy law; instead, it has a patchwork of state-level regulations (like California's CCPA).

The biggest difference is that US laws generally operate on an opt-out model. This means non-essential cookies can usually load immediately, but you must give users a clear way to opt-out (typically via a prominent ‘Do Not Sell My Personal Information’ link). Our CMP software handles this automatically via geo-targeting, ensuring US visitors get the correct opt-out experience while UK/EU visitors get the strict opt-in experience.

Essential cookies (also known as "strictly necessary" cookies) are vital for the basic functioning of a website. Examples include cookies that keep items in a shopping basket, remember user authentication to keep you logged in, or manage site security. You do not need user consent to load essential cookies.

Non-essential cookies are anything used outside of core website functionality. This includes:

• Advertising & Marketing: Meta/Facebook Pixels or Google Ads trackers used for remarketing are examples of these cookies, and where consent is strictly required.
• Social Media: Embedded YouTube videos or Facebook ‘Like’ buttons that track users across sites. Again, consent is strictly required for these cookies.
• Analytics: Google Analytics tracking user behaviour. (Under new UK DUAA rules, this may not require prior consent if strictly aggregated, but still requires a clear opt-out).

There are a few ways to check what cookies are currently active on your site. The most common manual method is to use your web browser's Developer Tools (in Chrome, right-click > Inspect > Application > Cookies).

The most reliable method is to let us handle it! We offer a comprehensive diagnostic scan as part of our compliance service to identify every hidden tracker across your entire WordPress or Joomla website.

A modern, legally sound CMP needs to do much more than just display a banner. When we select a CMP for your website, we ensure it includes these vital features:

• Automatic Cookie Scanning to detect new trackers.
• Prior Blocking (Script Management) to stop scripts firing before consent.
• Google Consent Mode v2 Integration (mandatory for Google Ads).
• Granular Consent (allowing users to accept Analytics but reject Marketing).
• Geo-targeting to serve different rules to UK, EU, and US visitors.
• Consent Audit Trails to prove compliance to the ICO if investigated.

If your website uses any non-essential cookies, especially advertising trackers, social media embeds, or cross-site marketing tools - yes, it is a strict legal requirement under PECR and UK GDPR.

The risks are two-fold:

• Legal Risk: The ICO actively scans UK websites for compliance. The new DUAA has raised the ceiling on PECR penalties to UK GDPR levels - up to £17.5m or 4% of worldwide turnover for serious infringements.
• Marketing Risk: Without a compliant banner integrated with Google Consent Mode v2, Google will block your ability to build remarketing audiences and accurately track conversions.

Google Consent Mode v2 is an API that acts as a bridge between your cookie banner and your Google tags (Analytics and Ads). If a user clicks ‘Accept’, data flows normally. If a user clicks ‘Reject’, Consent Mode ensures no cookies are set, but sends ‘cookieless pings’ to Google so their machine learning can model your conversions. It is now mandatory for UK and EEA businesses using Google Ads.

Implementing true WordPress or Joomla cookie compliance requires technical configuration of your website's code and tag manager, not just installing a basic plugin.

While there are thousands of free plugins in the CMS directories (and we even used to sell our own basic Joomla plugin years ago when laws were simpler), they are no longer fit for purpose. The vast majority are purely ’cosmetic’ - they display a banner, but they do not actually block the underlying scripts from firing in your theme or via Google Tag Manager. Furthermore, basic plugins lack the geo-targeting and Google Consent Mode v2 API integrations required by modern regulations.

Note: If you have previously used our legacy Channel Digital cookie plugin and need assistance upgrading to a modern CMP, please just Contact Us and our support team will help you transition.

Absolutely. UK GDPR and PECR protect the personal data of individuals, regardless of whether they are browsing your website for personal reasons or on behalf of their employer. B2B websites are subject to the exact same cookie compliance rules as B2C e-commerce stores.