Would you like your cookie banner to follow the privacy law that applies where each visitor actually lives?
In this guide, we’ll walk you through setting up geolocation rules in WPConsent so each region sees the consent experience its local regulation calls for. It takes a few minutes in your WordPress dashboard.
Requirements: Geolocation rules require a Plus license level or higher.
Table of contents
- How Do Location-Based Rules Work?
- Adding a Pre-Configured Compliance Template
- Creating a Custom Location Rule
- Reviewing Your Location Rules
- Why Doesn’t a Rule Change Show Up Straight Away?
- Frequently Asked Questions
Before you get started, make sure WPConsent is installed and activated on your WordPress site.
How Do Location-Based Rules Work?
Your main settings, at WPConsent » Settings, define one default consent behavior for every visitor. A location rule overrides that default for the regions you pick.
That means a visitor in Europe can be asked for clear opt-in consent, while a visitor in California gets an opt-out experience instead.
Rules only change behavior for the locations you attach to them. Every visitor outside those locations continues to get whatever your main settings specify.
Note: If you want the banner hidden by default and shown only in specific regions, disable it in your main WPConsent settings first. Then override it on the Geolocation page for the locations that need it.
Adding a Pre-Configured Compliance Template
To get started, we’ll add one of WPConsent’s ready-made compliance templates.
From your WordPress admin sidebar, go to WPConsent » Geolocation.
The Geolocation page opens on the Location-based Rules panel. The cards across the top are your starting points, and any rules you already have appear in the table underneath them.
WPConsent ships with 3 templates built around major privacy regulations, so you don’t have to assemble the settings yourself.
- GDPR Compliance requires clear opt-in before cookies are set. It applies to every country in Europe, so add this one if your visitors include people in the European Union or elsewhere on the continent.
- CCPA allows users to opt out of data collection. It applies to California, so add this one if your visitors include people in that state.
- LGPD seeks user consent before processing personal data. It applies to Brazil, so add this one if your visitors include people there.
On the card for the regulation you need, click the add link, such as Add GDPR Location Template.
WPConsent creates the rule with the locations and consent settings that regulation expects. Every template arrives with script blocking switched on, the banner and the settings button showing, and the consent mode its regulation is built around. You can adjust any of that later. Once a template has been added, its card shows Added instead of an add link.
If you plan to build custom rules as well, add the templates you need first. A location can belong to only one rule, so a template can be added while the region it covers is still free.
Creating a Custom Location Rule
When you need a combination the templates don’t cover, build the rule yourself.
On the Custom Rule card, click Add Custom Rule.
The Add New Location Group panel opens. Start by giving the rule a descriptive name in the Group Name field. Next, choose where it applies under Select Locations.
The name you enter appears in the Name column of your rules table. A name that says who the rule covers keeps it easy to recognize later.
Locations are grouped by continent, so you can switch on a whole continent, expand one to pick individual countries, or search by name.
The United States and Canada expand one level further, down to individual states and provinces. This is how a rule can target California for CCPA without covering the rest of the country.
Anything you choose is listed under Selected Locations, so you can check your work before saving. Each location belongs to one rule at a time, so anything already claimed by another rule is marked Used in the picker.
Choosing the Consent Settings
Below the location picker, 4 toggles control what visitors from these locations experience. Switch on the ones that apply to this group.
- Block Scripts Before Consent holds tracking scripts back until the visitor gives consent.
- Content Blocking stops embedded third-party content, such as videos and maps, from loading until the visitor gives consent.
- Show Consent Banner decides whether visitors from these locations see the banner at all.
- Show Settings Button gives visitors an ongoing way to reopen their consent preferences.
New rules start with Show Consent Banner and Show Settings Button switched on. That way, visitors covered by the rule always see the banner and keep a way back to their choices. Block Scripts Before Consent and Content Blocking start switched off, so your site keeps behaving as it does today until you turn them on.
Underneath them, choose a Consent Mode to set how consent is treated for this group. Opt-in means the visitor must actively consent, which is what regulations like GDPR expect. Opt-out means consent is assumed unless the visitor rejects it, which suits regulations built around an opt-out right. New rules start on Opt-in, the stricter of the two, so a new group is never less protective than you intended.
If you leave this group on Opt-in, switch on Block Scripts Before Consent and Content Blocking as well. Opt-in consent only takes effect if scripts and embedded content wait for it. That’s why WPConsent’s own GDPR and LGPD templates arrive with both switched on.
The last 2 options let you tailor the banner itself for this group. Both start switched off, so these locations see the same banner buttons and wording as the rest of your site. Customize Banner Buttons lets you set up a different set of buttons for these locations. Customize Banner Message lets you write wording that fits the regulation these visitors fall under.
Once you’ve chosen your locations and settings, click Save Location Group at the bottom of the panel.
Your rule is saved and joins the rest of your rules on the Geolocation page.
Reviewing Your Location Rules
Every rule you add appears in the table at the bottom of the Geolocation page, so you can see your whole setup at a glance.
Each row shows the rule’s name, the locations it covers, its type of consent, and its consent mode. Type of Consent tells you where a rule came from. A rule added from a template shows GDPR, CCPA, or LGPD, while one you built yourself shows Custom. The Consent Settings column marks each of the 4 toggles with a check or a cross. This lets you confirm a rule’s behavior without opening it.
The Action column holds the edit and delete controls, so you can adjust a rule’s locations or settings later, or remove it altogether.
Why Doesn’t a Rule Change Show Up Straight Away?
After editing a rule, it is normal to reload your site and see exactly what you saw before. Nothing has gone wrong, and the rule is live for new visitors. What you are looking at is your own browser reusing an answer it already has.
WPConsent works out a visitor’s location once, on their first visit, and then stores the result in their browser in a cookie named wpconsent_geolocation. Every later page load reads that stored result instead of looking the location up again, which is what keeps the feature fast and keeps it working behind a page cache.
That cookie lasts as long as your Consent Duration setting, so on a site set to 30 days it holds the old result for up to 30 days. Your own browser carries on applying the result it saved before you made the change.
While that cookie is present, WPConsent makes no location request at all. A returning visitor is served entirely from the stored result, which is what makes a rule change look as though it did nothing.
To see a rule change on your own machine, clear the wpconsent_geolocation cookie for your site and load the page again. WPConsent then looks the location up fresh and stores the new result. A private or incognito window does the same thing, because it starts without the cookie.
Note: The stored result lives in each visitor’s own browser rather than on your server, so clearing your site’s page cache or purging a CDN does not reach it. That is also why a returning visitor keeps their existing experience while a first-time visitor gets the new rule straight away.
The stored location is listed in your cookie list as an essential cookie called Geolocation Config, with its duration matching your Consent Duration setting. Our guide on managing cookies covers that list.
That’s it! Your cookie banner now adapts to each visitor’s location instead of showing everyone the same thing. Next, take a look at our guide on opening the WPConsent preferences panel with a custom link. It gives visitors another way to revisit their choices.
Frequently Asked Questions
Below, we’ve answered some of the most common questions about geolocation rules in WPConsent.
How does WPConsent know where a visitor is?
It checks the visitor’s IP address against WPConsent’s own location service. The address is anonymized before it’s sent, so the lookup resolves a country and state without passing along a full IP. There is nothing to set up and no third-party account to connect. If a visitor’s location can’t be determined, they get the default behavior from your main settings.
How can I see what visitors in another region get?
Rules are matched on the visitor’s IP address. Your own visits show whichever rule covers the place you’re browsing from, or your main settings if no rule covers it. To preview another region’s experience, visit your site through a VPN set to a location that rule covers.
What happens to visitors from locations my rules don’t cover?
They get the default behavior from your main WPConsent settings. Location rules only override that default for the locations attached to them.
Can I cover several regions with a single rule?
Yes. A location group accepts as many locations as you need, and you can mix whole continents with individual countries. For example, a single group can cover Europe, Canada, and California.
How do I move a location to a different rule?
Remove it from the rule that currently has it, and it becomes available again in the location picker. While a continent, country, or state belongs to a rule, it appears there as Used.
Can I add more than one template?
Yes. The GDPR, CCPA, and LGPD templates are independent, and each one becomes its own row in the rules table. Once a template has been added, its card shows Added in place of the add link.
Do location rules work with a caching plugin or CDN?
Yes. WPConsent works out each visitor’s location in the browser once the page has loaded, through a request that is excluded from caching. The right rule still applies even when the page itself is served from a cache. The result is then stored in that visitor’s browser, which is why a rule you change later can take a while to reach people who have already visited. See the Why Doesn’t a Rule Change Show Up Straight Away? section above.
Why is my banner still hidden after I set up a rule?
Start with your main settings at WPConsent » Settings. Rules override the default only for their own locations. If the banner is disabled by default, turn on Show Consent Banner inside the rule that covers those visitors. If the rule looks right and the banner still has not changed, your own browser is most likely reusing a stored result. See the Why Doesn’t a Rule Change Show Up Straight Away? section above.