By Daniel de Almeida Afonso · Last updated: October 7, 2026
Yes, your Wix site uses cookies, and some of them are probably not the ones Wix set. Wix places its own essential cookies on every site. Anything you add on top, such as Google Analytics, a Meta Pixel, a chat widget, or a pasted tracking snippet, adds cookies that need visitor consent in the EU, the UK, and Brazil.
Wix gives you a cookie banner and privacy tools, but it does not make your site compliant for you. Wix says so itself in its GDPR guidance: GDPR compliance is the responsibility of each site owner. This guide covers what Wix's banner does and does not do, which cookies need consent, and what you must put in place for GDPR, CCPA/CPRA, and LGPD.
Does my Wix site use cookies?
It does. Wix sets essential cookies such as svSession, wixSession, XSRF-TOKEN, and bSession for security, stability, and core site function. Their durations range from a single session to 12 months.
Your site may also set cookies that Wix does not list. Wix's own help center warns that your site may use cookies not on its list if you use business solutions, third-party apps, or integrations like Google Analytics. Wix also says it is your responsibility to make sure Wix services are permitted under your local laws.
The fastest way to see what your site really sets is to scan it. You can use Wix's built-in scan, a browser's developer tools, or a dedicated cookie scanner. Do this before you decide anything else, because you cannot disclose or block cookies you do not know about.
Essential, functional, analytics, and marketing cookies
Wix sorts cookies and code into four categories. The category decides whether a visitor must be asked first.
| Category | What it does | Consent needed in the EU/UK? |
|---|---|---|
| Essential | Security, identity verification, network management | No |
| Functional | Remembers visitor choices for a personalized experience | Yes, unless strictly necessary for a service the visitor requested |
| Analytics | Shows how visitors use the site and where errors occur | Yes |
| Marketing | Tracks ad performance and targets ads | Yes |
The legal source for this split is Article 5(3) of the ePrivacy Directive. It requires consent to store or access information on a visitor's device, except where the storage is strictly necessary to deliver a service the visitor asked for. The Court of Justice of the EU confirmed in the Planet49 ruling that this applies to cookies whether or not they hold personal data, and that pre-ticked boxes are not valid consent.
The practical rule is simple. Essential cookies need no permission. Everything else needs a clear yes before it loads.
Is Wix compliant with the cookie laws?
Wix is a platform, and you are the site owner. Those are two different legal roles. In its GDPR guidance, Wix describes itself as a processor that handles visitor data on your instructions. It describes you as the controller who decides what to collect and why.
So Wix's own compliance does not cover you. Wix supplies tools, templates, and a Data Processing Agreement. You are still responsible for the cookies you add, the policy you publish, and the consent you collect.
What Wix's built-in cookie banner does
Wix's current banner is built with Usercentrics, through a partnership. According to the Wix help center, it works like this:
- Only essential cookies and scripts load when a visitor first arrives.
- Visitors can accept all categories or switch individual categories off.
- You can scan your site for components that may need consent, and the scan shows both Wix and third-party components.
- Consent decisions are kept in a Consent Log you can open from your dashboard.
- Wix states that the banner supports Google Consent Mode v2.
- Visitors can reopen the banner through a privacy trigger and change their choices.
There are two tiers. The free version has basic functionality and limited customization, with layout and theme only. Premium features, such as translations in up to 60 languages, customizable text, and legal-document linking, require a paid Usercentrics plan.
What the Wix banner does not cover
Wix lists the limits itself. It says the banner cannot control some elements and apps, and it names third-party apps from the Wix App Market and custom code.
The custom code limit catches many site owners. By default, every piece of custom code you add is tagged as essential. That means it loads before consent and cannot be switched off by the visitor. If you paste a Google Analytics or Meta Pixel snippet into Settings, Custom Code and leave the default, the banner will not block it.
Fix this by assigning each snippet its correct category. Wix explains the steps in its guide to categorizing custom code.
Other practical limits from Wix's documentation:
- The banner is not visible in the editor or Preview mode, so you must test on the live site.
- If your domain is not properly connected, the banner will not appear.
- The banner does not write your privacy policy.
I could not confirm from Wix's public documentation how the banner handles US opt-out rules, such as Global Privacy Control signals, or whether it varies by visitor location. Test your own site rather than assuming.
What the EU cookie laws require from your Wix site
The EU rules come from two laws working together. The ePrivacy Directive governs storing and accessing information on a device. The GDPR sets the standard for what counts as valid consent and what you must disclose.
At minimum, a Wix site serving EU visitors needs a privacy policy and a consent banner that blocks non-essential cookies until the visitor agrees. Our guide to GDPR cookie consent and what your banner needs to do goes deeper on banner design.
What a valid consent looks like
Under GDPR, consent must be:
- Freely given
- Informed
- Specific
- Unambiguous
- Easy to withdraw
In practice, the banner has to explain the cookies before they are set. It has to let visitors accept or reject by purpose, and it has to make rejecting as easy as accepting. You also need a record of each decision. The European Data Protection Board's Guidelines 05/2020 on consent set out these conditions in detail.
What your privacy policy must contain
Under GDPR transparency rules, your policy should cover:
- The categories of personal data you collect
- Why you collect it and your legal basis
- How you collect it
- Who you share it with, and why
- Data subject rights and how to exercise them
- International transfers and the safeguard you rely on, such as an adequacy decision or Standard Contractual Clauses
- How long you keep the data
- The Data Protection Officer's details, if you have one
- Information about children's data, if relevant
- How you announce changes to the policy
- Your contact details
One correction to older guidance, including earlier versions of this article: "Privacy Shield 2.0" is not a real framework. EU-US transfers can currently rely on the EU-US Data Privacy Framework. The General Court upheld it in September 2025, but an appeal is pending before the Court of Justice, so name the safeguard you actually use.
Fines are real. The GDPR allows penalties of up to EUR 20 million or 4% of worldwide annual turnover for the most serious infringements. Cookie rules under the ePrivacy Directive are enforced by national authorities, and the amounts vary.
The European Commission has proposed changes to the cookie rules in its Digital Omnibus package. As of this writing it is still a proposal under negotiation. The current rules apply.
What CCPA/CPRA and CalOPPA require
California has two separate laws that matter here.
CalOPPA applies to any website or online service that collects personal information from California residents. Your privacy policy must state:
- What you collect
- Who you share it with
- How visitors are told about policy changes
- The effective date
- How you respond to Do Not Track signals
- Whether third parties can collect information about visitors across the web
The CCPA, as amended by the CPRA, applies only if your business meets one of these thresholds, according to the California Privacy Protection Agency:
- Annual gross revenue of $26,625,000 or more (the figure effective January 1, 2025, and adjusted in odd-numbered years)
- Buying, selling, or sharing the personal information of 100,000 or more California residents or households
- Earning 50% or more of annual revenue from selling or sharing personal information
If the CCPA applies, your privacy policy needs the full set of consumer rights, the request methods, the categories collected in the past 12 months, and details of any selling or sharing. Businesses handling the data of 10 million or more consumers must also publish request metrics. Our CCPA requirements guide covers the full list.
Do cookies need consent in California?
California does not require opt-in consent before a cookie is set. That part of older guidance still holds. But it is incomplete. Cookies and pixels used for cross-context behavioral advertising can count as "sharing" personal information. When that happens, you must offer a way to opt out, and the California Attorney General states that a Global Privacy Control signal must be honored as a valid opt-out request.
What LGPD requires
Brazil's LGPD applies to businesses that process personal data of people in Brazil. Your privacy policy should identify the controller, explain the purposes of processing, say who receives the data, describe the rights of data subjects, and state the type and duration of the processing.
For cookies, Brazil's data protection authority (ANPD) published a cookie guide in October 2022. It treats non-essential cookies as requiring consent. It recommends banners that let users accept or reject by category, and it warns against making the accept button prominent while hiding the reject option. The guide is available on the ANPD website.
One correction: the LGPD (Article 8) says consent may be given "in writing or by other means" showing the person's will. A click on an accept button qualifies. Consent must also be specific, informed, and free, and you carry the burden of proving you obtained it. Our LGPD compliance guide covers the wider obligations.
Why you need to store consent records
Records are what turn a banner click into proof. There are two main reasons to keep them:
- A visitor can file a data subject request and ask how you obtained their consent. You will need to show when and how they agreed.
- A data protection authority can inspect your records. If you cannot produce them, you cannot demonstrate compliance.
Wix's Consent Log covers consent collected through its banner. If you use a different tool, check that it logs the decision, the time, and the version of the notice shown.
Do Wix and WordPress differ on cookie compliance?
No. The legal requirements attach to your business and your visitors' location, not to the platform. Neither Wix nor WordPress promises compliance on your behalf. The tools differ, but the duty to disclose, block, and record is the same.
How to make your Wix site compliant
Work through these steps in order:
- Scan the site and list every cookie and script, including those added by apps and custom code.
- Categorize each one as essential, functional, analytics, or marketing.
- Make sure non-essential code does not load before consent. Check custom code categories first.
- Show a banner that offers equal accept and reject choices and lets visitors change their mind later.
- Publish a privacy policy and a cookie policy that match what the scan found.
- Keep consent records, and rescan whenever you add a new tool.
When Wix's banner is enough and when it is not
The built-in banner can work for a small site that uses only Wix-native tools and a handful of categorized scripts. Look at a dedicated consent management platform if you run several third-party tools, serve visitors in many countries, or need detailed audit records.
Secure Privacy installs on Wix through a script added under Settings, Custom Code, in the Head section on all pages. Secure Privacy's setup guide says the code type must be set to Essential so the consent tool itself loads first. It requires a published Wix site with a connected custom domain. Once installed, it scans the site for cookies and trackers, classifies them, and blocks non-essential scripts until a visitor consents. See our walkthrough of the Secure Privacy and Wix integration for the details.
Secure Privacy also offers a privacy policy generator that builds a policy from a short questionnaire about your business. If you use Google Analytics or Google Ads, read our guide to Google Consent Mode v2 so your consent signals reach Google correctly.
If you also run sites on other builders, we have step-by-step guides for adding a GDPR-compliant cookie banner on Webflow and on BigCommerce.
Frequently asked questions
Does Wix automatically make my site cookie compliant?
No. Wix is a processor of your visitors' data, and you are the controller. Wix provides a banner and privacy tools, but you decide which cookies your site sets and you are responsible for compliance.
Does the Wix cookie banner block Google Analytics?
It can, if Google Analytics is added through a Wix-native integration or if you categorize the code correctly. Code pasted into Custom Code is tagged as essential by default, so it loads before consent unless you change its category.
Does Wix support Google Consent Mode?
Wix states that its Usercentrics-powered cookie banner supports Google Consent Mode v2. Check your own setup in a live test, because Wix's documentation does not describe every configuration.
Do I need a cookie banner if I only use essential cookies?
Under the ePrivacy Directive, strictly necessary cookies do not need consent. You still need to tell visitors about them in your privacy policy. A banner becomes necessary once you add analytics, marketing, or other non-essential cookies.
Does the CCPA require a cookie banner?
Not an opt-in banner. If the CCPA applies to you and your cookies share personal information for advertising, you must offer an opt-out and honor Global Privacy Control signals. Whether the CCPA applies depends on the revenue, consumer-count, and data-selling thresholds above.
Why should I store consent records?
You need proof of consent if a visitor makes a data subject request or a regulator asks. A banner click you cannot demonstrate is not much of a defense.
