Kookiok – Free Cookie Consent Banner, No Limits (GDPR & CCPA)

FAQ

Where do I find my Domain Group ID?

In your Kookiok dashboard at https://app.kookiok.com. It is a 36-character ID.

Does it work with caching / optimization plugins?

Yes, but exclude consent.js / cdn.kookiok.com from any “defer / delay / combine JavaScript”
features so the consent script keeps loading first and synchronously.

Does Kookiok work with the WP Consent API?

Yes. Install the free WP Consent API plugin
alongside Kookiok and no further setup is needed. Kookiok registers as the site’s consent provider,
declares the opt-in consent model, and publishes every consent choice through wp_set_consent() –
at page load and again whenever the visitor changes their mind. Any plugin that supports the API
then gates itself automatically: Burst Statistics, for example, checks wp_has_consent('statistics')
and listens for consent changes on its own, so it stops sending beacons before consent without you
annotating a single script handle.

Kookiok’s categories map onto the Consent API’s like this:

• Kookiok “necessary” -> functional (always allowed – strictly necessary needs no consent).
• Kookiok “preferences” -> preferences.
• Kookiok “statistics” -> statistics, and also statistics-anonymous.

• Kookiok “marketing” -> marketing.

  statistics-anonymous has no separate Kookiok category, so it follows the visitor’s “statistics”
  choice: Kookiok never reports more consent than the visitor actually gave.

If the WP Consent API plugin is not installed, or you have not entered a Domain Group ID yet, no
bridge script is loaded and no consent type is declared, so nothing on your site changes. (Kookiok
still tells the Consent API that it is a consent provider, which is what its Site Health check
looks for.)

Kookiok declares the optin model, which is what GDPR requires. If you run Kookiok in a pure
opt-out configuration, switch it with the kookiok_consent_api_consent_type filter:

add_filter( 'kookiok_consent_api_consent_type', function () { return 'optout'; } );

Under optin, a plugin that speaks the Consent API waits for the visitor to agree. That is the
correct behaviour under GDPR, and it is worth knowing if your traffic is mostly outside its scope:
those plugins will stay quiet until the visitor accepts.

Does it block self-hosted analytics like Burst Statistics or a self-hosted Matomo?

The easiest route is the WP Consent API (see the previous question): Burst Statistics supports it,
so with the WP Consent API plugin installed Burst gates itself on Kookiok consent and there is
nothing to annotate.

For trackers that do not support the API, it is partly automatic with one required step on your
side. Known third-party trackers are blocked automatically, and so is a self-hosted Matomo/Piwik
that uses the standard matomo. / piwik.
file or host names. But a tracker served from your own site’s path – Burst Statistics under
wp-content/plugins/burst-statistics/, for example – cannot be told apart from your theme’s
JavaScript by URL, so Kookiok will not guess: you must annotate its script handles with the
data-ag-consent attribute (a small script_loader_tag filter in your child theme). Kookiok then
keeps those scripts blocked until the visitor consents to the category. The attribute is a
supported, stable API, and since August 2026 annotated scripts are handed back under every privacy
regulation, including CCPA’s opt-out model, so annotation is safe to rely on for US traffic too.
Full guide with a copy-paste WordPress filter, including which handles to gate:
https://api.kookiok.com/docs/consent-script/script-blocking/

Does the plugin store any personal data itself?

No. The plugin stores only your Domain Group ID and a couple of settings in your WordPress options.
Visitor consent is handled by the Kookiok service.

Where is the plugin’s source code?

The plugin ships its full, human-readable source. The only compiled asset is the block’s
build/index.js, minified from src/edit.js with @wordpress/scripts (npm run build); the
un-minified source is included in the plugin’s own src/ directory.