Start with purpose, not the cookie name
A cookie name can be a clue, but it rarely tells the full story. The useful review starts with why the storage exists, when it is set, who receives the data, and whether the visitor can still use the requested service without it. EU consent guidance focuses on active, specific, informed choices, so a category label should make the actual purpose easier to inspect.
WordPress adds another reason to be careful. Core, themes, plugins, embeds, payment tools, analytics tags, and advertising pixels can all add storage at different moments. A category decision made on one page may be wrong for checkout, comments, logged-in areas, or a campaign landing page.
Use categories as operating rules
ACookies uses required, preferences, analytics, and marketing as the main visitor-facing categories. Scan findings can also remain unclassified until a reviewer confirms the right category and description. That pause is important: unknown cookies should not be quietly promoted into required storage just because they are present.
- Required: storage needed for core site behavior, security, session handling, consent preferences, cart, or checkout.
- Preferences: choices such as language, region, display, or similar settings that improve the visit without being the requested service itself.
- Analytics: measurement that helps the site owner understand usage, performance, funnels, campaigns, or content quality.
- Marketing: advertising measurement, audience building, personalization, retargeting, affiliate attribution, or campaign optimization.
Check WordPress behavior in context
WordPress documents cookies for areas such as login, comments, and test cookies. WooCommerce adds store behavior such as cart and session cookies when relevant. Those examples show why category work should be tied to real templates and workflows, not a generic spreadsheet copied from another site.
Google tags need a separate pass. If Google Consent Mode is present, optional analytics and
advertising choices should line up with consent signals such as analytics_storage,
ad_storage, ad_user_data, and ad_personalization. Tag
Assistant verification can help confirm the technical signals, but it does not replace category
review or legal review.
Turn categories into a repeatable review
A practical WordPress review starts by scanning representative pages, then checking the browser state before and after accept, reject, and custom choices. The goal is to connect each cookie or script to a purpose, category, provider, user-facing description, and blocking rule where needed.
- Scan the homepage plus templates that load different plugins or embeds.
- Keep required cookies narrow and explain why the site needs them.
- Test that rejecting optional categories does not load analytics or marketing scripts early.
- Review unclassified findings before publishing banner or policy copy.
- Repeat the check after changing GTM, cache, forms, embeds, WooCommerce, or theme code.
Frequently asked questions
Are required cookies always exempt from consent?
Not automatically. Start with cookies that are strictly needed for a service the visitor requested, then review the purpose, duration, and regional rules before publishing your wording.
Can analytics cookies be required?
Treat analytics as optional by default unless you have reviewed a specific legal basis and technical setup. ACookies keeps analytics separate from required cookies so the reject path can be tested.
Which categories does ACookies use?
ACookies works with required, analytics, marketing, and preferences categories, plus an unclassified state for scan findings that still need review.