Does WooCommerce require consent?

Conditionally. WooCommerce's core cart and checkout cookies — woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* — are essential for store operations and exempt from consent. The analytics module and any integrated marketing extensions require separate consent before activation.

What cookies does WooCommerce set?

WooCommerce core sets woocommerce_cart_hash (cache invalidation), woocommerce_items_in_cart (cart indicator), and wp_woocommerce_session_* (48-hour server session). Additional analytics and marketing extensions — Google Analytics integration, Facebook Pixel — set their own tracking cookies and are not part of WooCommerce core.

How does ConsentStack handle WooCommerce?

ConsentStack excludes WooCommerce core cart cookies from consent requirements, treating them as strictly necessary. Analytics and marketing extensions — conversion tracking, product view pixels, retargeting tags — are gated behind the appropriate consent category and blocked until the visitor consents.

What tracker domains does WooCommerce use?

ConsentStack has catalogued tracker domains for WooCommerce including woocommerce.com. These are the network destinations WooCommerce's scripts contact, which a consent platform blocks until a visitor agrees.

WooCommerce - E-Commerce Platform & Cookie Consent

Back to Vendor Library

Overview

WooCommerce is the dominant open-source e-commerce plugin for WordPress, powering a significant share of online stores globally. The platform transforms WordPress installations into full-featured storefronts with product catalogs, shopping carts, and checkout flows. Because WooCommerce operates as a WordPress plugin rather than a standalone platform, its cookie and script behavior is heavily influenced by the specific extensions, payment gateways, and analytics integrations each merchant installs.

What This Script Does

WooCommerce's core scripts manage cart state, checkout form validation, product variation selectors, and AJAX-powered add-to-cart functionality. The platform sets several cookies for essential store operations: woocommerce_cart_hash stores a hash of cart contents for cache invalidation, woocommerce_items_in_cart indicates whether the cart contains products, and wp_woocommerce_session_* maintains the server-side session linking the visitor to their cart data (persists for 48 hours by default). These core cookies are essential for store functionality.

Analytics and Marketing Layer

Beyond core functionality, WooCommerce integrates with analytics and marketing tools through its extension ecosystem. The WooCommerce Analytics module tracks product views, add-to-cart events, and purchase funnels. Many stores also run WooCommerce-specific integrations for Google Analytics (via woocommerce-google-analytics-integration), Facebook Pixel, and other marketing platforms that set their own tracking cookies. These additional scripts are not part of WooCommerce core but are commonly bundled.

Consent & Compliance

WooCommerce scripts span functional and analytics categories. The core cart and checkout cookies are essential for e-commerce functionality — they enable the shopping experience that the visitor explicitly initiated. Under GDPR and the ePrivacy Directive, these functional cookies are exempt from consent requirements as they are strictly necessary for the service requested by the user. However, the analytics layer — conversion tracking, funnel analysis, and any integrated marketing pixels — requires consent. Under CCPA/CPRA, the purchase transaction data is generally covered under the transactional exemption, but analytics and marketing data collection must be disclosed and is subject to opt-out rights.

Should You Block This Without Consent?

Conditional. WooCommerce core cart and checkout scripts are essential for store operations and should not be blocked — doing so would break the shopping experience. However, the analytics tracking, conversion measurement, and any integrated marketing extensions should be blocked until consent is obtained. Site operators should separate WooCommerce's functional scripts from its analytics and marketing extensions in their consent configuration.

Is WooCommerce GDPR compliant?

WooCommerce typically loads functional and analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So WooCommerce can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads WooCommerce, not on WooCommerce itself.

Visit website

Consent Categories

Functional Analytics

Also Known As

WooCommerce WordPressWooCommerce storeWooCommerce checkoutWooCommerce cartWordPress e-commerce

Industries

Computers Electronics and TechnologyProgramming and Developer Software

Tracked Domains (1)

woocommerce.comFunctional

woocommerce.com is a functional domain operated by WooCommerce, used to run site features like chat, video, embeds, and preferences.

Cookies WooCommerce Sets (4)

wp_woocommerce_session_Essential

WooCommerce cart session identifier. Anchors the shopping cart and checkout state to the visitor. Required for the cart and checkout flow to function. Suffix encodes the site auth hash.

woocommerce_items_in_cartEssential

WooCommerce cache-bypass flag set when the cart is non-empty so the WordPress page cache serves the live cart fragment rather than a cached HTML copy.

woocommerce_cart_hashEssential

WooCommerce cart-content hash for cart-page rendering.

woocommerce_recently_viewed

WooCommerce recently-viewed products cookie. Stores the last few product IDs the shopper viewed so the shop can render a recently-viewed widget. Convenience feature, not required for checkout.