What Happens to Your WooCommerce Store When Scripts Run Without Consent
When a visitor lands on your WooCommerce store, dozens of scripts can fire before the cookie banner even appears on screen — sending data to Google, Meta, ad networks and analytics platforms without that person’s knowledge or agreement. Under GDPR and the ePrivacy Directive, that is not a grey area: non-essential scripts must wait until the visitor gives explicit consent, or they must not run at all. The practical damage is also real: your conversion data becomes unreliable, your remarketing audiences collect unconsented profiles, and your checkout flow may load scripts that GDPR treats as incompatible with the transaction itself.
Which Scripts Typically Fire Before Consent on a WooCommerce Store
Most WooCommerce stores load scripts in a category their owners have never audited. The most common offenders fall into a few groups.
- Analytics scripts — Google Analytics 4, Universal Analytics remnants, Matomo in cloud mode. These set cookies and send page-view events the moment the page loads.
- Ad and remarketing pixels — Meta Pixel, Google Ads conversion tracking, TikTok Pixel, Pinterest Tag. Each one creates or reads an identifier tied to the visitor before any consent is given.
- Live chat and support widgets — Tidio, Intercom, Crisp and similar tools set their own storage and report session data to external servers.
- Payment partner scripts — Stripe.js and PayPal’s SDK are sometimes loaded site-wide rather than only on checkout pages, meaning they fire on product pages where no transaction is happening and no consent has been asked.
- Theme and plugin extras — Google Fonts loaded via a remote call, embedded YouTube videos, font-icon libraries that ping a CDN. These look harmless but create a cross-origin request that can expose an IP address to a third party.
The problem is not that these tools are forbidden. The problem is timing. GDPR requires that non-essential scripts are blocked until the visitor makes an active choice.
Why a Banner That Only Shows a Notice Is Not Enough
Many stores display a cookie banner that informs the visitor, but the scripts behind it fire immediately regardless of what the visitor clicks. This pattern — sometimes called a cosmetic banner — does not satisfy GDPR. Consent must be freely given, specific, informed and unambiguous. If the script has already run, consent collected afterwards is meaningless for that session.
Regulators across the EU have specifically targeted pre-ticked boxes, banners with no reject option, and situations where “close” or “continue” is treated as acceptance. The standard required is an affirmative action: a visitor who clicks nothing or who clicks “reject all” must have all non-essential scripts blocked for their entire session.
Google Consent Mode v2 adds another layer. If your store sends signals to Google Ads or GA4 without the correct consent state flags, your conversion modelling becomes unreliable and, in some configurations, non-compliant. The mode requires that your consent platform actively passes ad_storage, analytics_storage and related parameters before any Google tag fires in measurement mode.
What Real Script Blocking Looks Like in Practice
Genuine script blocking means the JavaScript tag for a tracker is never inserted into the DOM until consent is confirmed. This is different from simply hiding a banner after a click. It requires either a tag manager that respects consent signals, or a consent plugin that physically holds back script injection.
The correct sequence for a WooCommerce store looks like this:
- Visitor arrives. Only strictly necessary scripts load: the page renders, the cart works, the checkout processes. No analytics, no pixels, no chat widgets.
- The consent banner appears with clear accept and reject options. No pre-selected choices.
- If the visitor accepts analytics, the GA4 script is injected and begins firing. The consent state is recorded with a pseudonymous ID, timestamp and the categories accepted.
- If the visitor rejects all, no non-essential script loads during that session. On return visits, the stored preference is read and respected without showing the banner again.
- Google Consent Mode v2 signals are passed correctly so that Google’s own systems know the consent state before any measurement occurs.
The consent record itself matters. Regulators can ask a store to prove that a specific visitor consented, when, and to which categories. A log that holds only a cookie with no readable record is not sufficient evidence.
The WooCommerce Checkout Problem
Checkout deserves its own note. WooCommerce’s payment step is a strictly necessary function: a visitor who has rejected analytics still has a legal right to complete a purchase. If your consent setup blocks Stripe.js or the PayPal SDK on checkout because they were categorised as tracking scripts, you break your own store for non-consenting visitors.
The correct approach is to categorise payment scripts as strictly necessary — because they are — while still blocking their site-wide equivalents on non-transactional pages. This requires a consent plugin that understands WooCommerce’s page structure and treats the checkout differently from a product listing or blog post.
For more on how GDPR obligations interact with the WooCommerce checkout flow specifically, see the earlier article on how GDPR cookie consent banners must work in a WooCommerce store.
The EU AI Act Transparency Requirement
Starting with the EU AI Act’s transparency obligations, stores using AI-powered tools — personalisation engines, AI chat assistants, AI-generated product recommendations — now have an additional disclosure requirement. Visitors must be informed when they are interacting with an AI system, and in some configurations a dedicated AI Transparency page is required. This sits alongside, not instead of, the existing GDPR cookie obligations.
Bulgaro GDPR handles both: it includes a cookie consent banner with real script blocking in 14 languages, a pseudonymous consent register, Google Consent Mode v2 integration, a WooCommerce-safe checkout configuration, and a built-in Cookie Policy and AI Transparency page that covers the EU AI Act requirement. The plugin has a free version and a PRO version, and it passes the WordPress.org Plugin Check.
How We Run This in Our Own Projects
At Supreme Commerce, every store and site we build ships with real script blocking configured from day one. On GiantParts.eu, our WooCommerce store for tested used OEM car electronics selling in 10 languages, we separate strictly necessary scripts — including the payment layer — from analytics and marketing pixels, so a visitor who rejects all non-essential cookies can still find a part, add it to the cart and pay, while their session generates no analytics events and fires no remarketing pixels. The consent register records each decision with a pseudonymous ID and timestamp, which means we can answer a regulatory question about consent without exposing personal data.
The supremecommerce.eu site itself, which runs in six languages, follows the same setup. When we scan either site, every non-essential script shows a blocked state until the visitor makes a choice. That is the standard we apply to every project we build for clients.
FAQ
Does GDPR apply to my WooCommerce store if I am outside the EU?
GDPR applies based on where your visitors are, not where your business is registered. If you sell to or collect data from people in the EU or EEA, GDPR applies to those interactions. A store based anywhere in the world that ships to European customers must comply for those visitors.
Can I use Google Analytics without consent if I anonymise IP addresses?
IP anonymisation reduces one risk but does not remove the consent requirement. GA4 still sets cookies, creates persistent identifiers and sends data to Google’s servers. Under GDPR, any non-essential script that processes personal data — including pseudonymous identifiers — requires prior consent. A lawyer familiar with your jurisdiction should confirm your specific setup.
What is Google Consent Mode v2 and does my store need it?
Google Consent Mode v2 is a protocol that lets your store pass consent signals to Google tags so they adjust their behaviour based on what the visitor accepted. If you run Google Ads or use GA4 for conversion tracking, Google now requires Consent Mode v2 to maintain full measurement functionality and to comply with its own data policies in the EEA. Without it, your conversion data may be incomplete or modelled incorrectly.
How do I know which scripts are actually firing before consent on my store?
Open your browser’s developer tools, go to the Network tab, clear it, then load your store page without accepting the banner. Every request that appears before you interact with the banner is firing without consent. Look for requests to google-analytics.com, connect.facebook.net, analytics.tiktok.com and similar domains. A website scanner built into a consent plugin can automate this check across all pages.
Where to Go Next
If you want a WooCommerce store where scripts are genuinely blocked until consent is given — including correct Google Consent Mode v2 signals, a pseudonymous consent register and a WooCommerce-safe checkout — start with Bulgaro GDPR, which is built specifically for this. For a full review of your store’s compliance setup or to have the configuration built into a new project, request a project quote — the studio replies within 24–48 hours.
