Lately, I’ve been working on more WordPress websites that I didn’t originally build. And when you start looking under the hood of a website someone else created, you find things. Sometimes weird things. Sometimes expensive things. And recently, some potentially serious things.
A couple of new clients came to me after facing lawsuits related to their websites—one involving website accessibility and another involving CIPA (the California Invasion of Privacy Act).
What caught my attention was that they hadn’t simply ignored compliance. They had tools and systems in place that were supposed to help. They thought they had taken care of it.
But having a compliance solution installed on your WordPress website and knowing that it’s actually working are two different things.
Installing a compliance tool isn’t the end of the job
There are plenty of services that can add things like cookie consent, privacy notices and accessibility functionality to a WordPress website. You sign up. Install the plugin or add the code. Configure some settings. Done, right?
Not necessarily. There’s another question website owners need to ask: Is the thing actually doing what we think it’s doing?
Because a compliance tool doesn’t exist in isolation. It has to work inside your particular WordPress website, with your particular theme, plugins, code and configuration. And sometimes, it doesn’t.
I’ve seen compliance tools installed but not working as expected
Sometimes it’s something simple, like a setting that wasn’t turned on. Other times, the way the WordPress website was developed can interfere with how a compliance tool functions.
But what happens when someone actually clicks “opt out”? Does the tracking stop? Or, if consent is required, do we make sure tracking doesn’t start until a visitor explicitly opts in?
That’s something we can test. And that’s the part I think website owners need to pay more attention to. It’s not enough to know that a compliance solution is installed. You need to know what is actually happening on the website.
Website compliance isn’t something I can certify for you
Here’s an important distinction. I’m a WordPress designer & developer, not an attorney.
I can’t tell you that your business is legally compliant, certify that your website meets every legal requirement, or promise that having particular tools in place will protect you from a lawsuit. Those are legal questions, and they belong with someone qualified to answer them.
What I can do is look at the technical side. If your attorney or compliance provider says your website needs to do X, Y and Z, we can test whether X, Y and Z are actually happening.
- Is the tool installed correctly?
- Are the expected notices appearing?
- Are the settings configured properly?
- Does an opt-out actually opt someone out?
- Is something else on the WordPress site interfering with the functionality?
That’s the gap I’ve been seeing.
Don’t assume “installed” means “working”
You may have done the responsible thing. You researched a compliance solution, paid for it, installed it and followed the instructions. But WordPress websites change.
Plugins get updated. New functionality gets added. Developers come and go. Settings get changed. And WordPress websites can be built in approximately 47 billion different ways. (That’s my unofficial count.)
So if compliance matters to your organization, it’s worth checking that the technology you’ve put in place is actually behaving the way you expect it to. Because a badge, banner or plugin in your WordPress dashboard tells you that something is there. It doesn’t necessarily tell you that it’s working.
WordPress compliance tools I work with
There are compliance tools I use and recommend for WordPress websites. But—and this is the whole point of this post—installing one doesn’t automatically make your website compliant. The right solution depends on your website, what it does, and the legal requirements that apply to your organization. Whatever tool you use, it still needs to be configured correctly and tested to make sure it’s actually doing what you expect it to do.
- Iubenda: I’ve used iubenda on a number of WordPress websites, and they also partner with SiteGround. It offers tools for generating and managing Privacy and Cookie Policies, Terms and Conditions, and privacy and cookie consent controls. On the front end of the website, you’ll typically see a small “i” icon fixed to the bottom of the page that visitors can use to access or change their privacy preferences. I use iubenda on my own site, too. (That’s an affiliate link, by the way, which means I may earn a commission if you sign up through it. Will I retire on the proceeds? Unlikely.)
- Cookiebot: Cookiebot is one of the easier solutions I’ve worked with when it comes to implementation, and I like that its consent banner and controls have a clean, modern appearance. It provides cookie consent and scanning tools, with options for visitors to manage their consent preferences. There’s also a free plan available for smaller websites. On the front end, visitors can reopen their consent preferences using a small “Co” icon from the Cookiebot logo at the bottom of the site. I spent far too long wondering what that little thing was. You’re welcome.
- CookieYes: I’ve used CookieYes on a smaller number of WordPress websites. It’s straightforward to implement and offers a free version of its WordPress plugin. Visitors can access their cookie preferences through a small cookie icon 🍪 that remains at the bottom of the site.
Whichever tool you use, though, seeing that little icon at the bottom of your website isn’t proof that everything behind it is working correctly. That’s what needs to be tested.
This is something I’m looking at more closely now
Working with WordPress websites I didn’t build has changed the kinds of questions I’m asking when I first get into a site.
I’m looking at what’s there, how it was set up, what the website owner is relying on, and whether those things are actually doing their jobs. Compliance tools are becoming an important part of that conversation.
If you have a compliance solution installed on your WordPress website and you’re not sure whether it’s functioning the way it should, don’t just assume it is because you can see it on the site. Test it. And if you’re not sure how to test it, I can help.
