Why a Cookie Banner Won't Fix Your Practice's WordPress Website (and What It Really Costs)
Bolting a consent management platform onto WordPress leaves hardcoded tags, plugins and caching outside its control. Here is where the leaks come from and how the costs compare with a rebuild.
When a practice learns that its website may be sharing visitor data with advertising and analytics companies, the usual first fix is a cookie banner run by a consent management platform (CMP): software that shows the banner, records each visitor’s choice, and is supposed to hold back tracking scripts until the visitor agrees. Install a CMP plugin on the existing WordPress site and move on. It looks inexpensive and it looks finished. On a healthcare website it is often neither, because the banner sits on top of the code that actually sends the data instead of removing it.
The fact most practices miss
HHS Office for Civil Rights guidance on online tracking technologies states that a banner asking visitors to accept or reject cookies is not a valid HIPAA authorization. A 2024 federal court decision (American Hospital Association v. Becerra) set aside part of that guidance for certain public, unauthenticated pages, but the rest of it, including patient portals and other pages where protected health information is involved, still stands. A consent banner records a preference. It does not, by itself, make a disclosure to a tracking vendor lawful.
Why a Bolt-On Banner Leaks on WordPress
A CMP works by holding back scripts until the visitor agrees. That only works for scripts the CMP knows about and loads before. A typical practice site built on WordPress has many places where code runs outside the banner’s control:
- Hardcoded tags in the theme or page builder. Analytics, Meta Pixel or call-tracking snippets pasted into the theme header, a page-builder widget or a “header scripts” plugin load whether or not the CMP blocks them.
- Plugins that add their own trackers. Booking widgets, chat tools, review badges, form plugins, embedded maps and videos, reCAPTCHA and hosted fonts each connect to a third party. A plugin update can add a new one without anyone noticing.
- Caching and optimization plugins. Tools that combine, defer or “delay” JavaScript change the script tags that a CMP relies on to block code. A misconfigured cache can also serve one visitor’s consent state to the next.
- Load order. If a tag manager or tracking script starts before the CMP, it has already sent its first request by the time the banner appears.
- “Consent mode” is not the same as blocking. In Google’s advanced consent mode, tags still send cookieless requests to Google before the visitor chooses. That may be fine for a retailer. On a page about a medical service, that request still carries the page address and the visitor’s IP address. Since the 2024 ruling, that combination on a public page is not automatically HIPAA-protected information, but the FTC and state health-privacy laws, such as Washington’s My Health My Data Act, can still treat it as sensitive health data.
- Browser privacy signals. Many banner setups ignore Global Privacy Control (GPC), the browser signal that several state privacy laws treat as a valid opt-out.
The banner adds its own accessibility risk
The consent banner appears on every page, often as the first thing a screen-reader or keyboard user meets. If it traps focus, can’t be closed with a keyboard or fails contrast, it creates a WCAG failure on the entire site. Under the HHS Section 504 rule, practices that receive federal financial assistance must meet WCAG 2.1 AA by May 11, 2027 (15 or more employees) or May 10, 2028 (fewer than 15), after HHS extended the original dates in May 2026.
What the Bolt-On Approach Really Costs
The banner subscription is the smallest line item. Published pricing for popular CMPs starts free or around $10 per month per domain for small sites, rises with page count and traffic, and enterprise platforms are typically quoted at five figures per year. The larger costs come from everything around it:
Keep WordPress + add a CMP
- CMP subscription, per domain (free to $100+/month; enterprise far more)
- Developer time to find every hardcoded tag, map scripts to consent categories and re-test with the cache on
- Re-testing after every theme, plugin and WordPress update
- Separate accessibility remediation of the theme, forms and the banner itself
- Existing hosting, security and plugin maintenance
- Leftover risk from any script the CMP doesn’t control
Clinic Security rebuild
- $499 one-time setup + $99/month
- We copy your content, provider bios and services and rebuild the site on our platform, keeping your scheduling and patient-portal links or embeds (custom extras are quoted separately)
- Third-party trackers are left out at the source, so there is nothing for a banner to hold back
- Accessible, semantic templates built to WCAG 2.1 AA
- Managed hosting with Cloudflare edge security and SSL included
- You review the rebuilt site on a private staging address before your domain moves
Over a first year that is $1,687, and $1,188 a year after that, with hosting included. For many practices, a few hours of developer time on the bolt-on path costs as much as the entire setup fee, before any accessibility work begins.
Remove the Leak Instead of Asking Permission for It
A banner asks visitors to approve tracking that a medical practice usually doesn’t need. A rebuild removes it:
- Measure first. We load your site in independent browser sessions, decline, accept and send a GPC signal, and record every request that leaves the page.
- Rebuild without the leaks. Maps become click-to-load images, fonts are hosted on your own site, and only tools you choose, under agreements you have, are added back.
- Verify before launch. The rebuilt site is scanned with the same engine, so you see the before-and-after evidence, not a promise.
See what your homepage sends today
Run our free homepage preview scan at clinic-security.com. It loads your homepage, declines tracking and checks what still goes out. A full multi-page audit is available on request.
This article is general information, not legal advice. Sources: HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; American Hospital Association v. Becerra, N.D. Tex., June 20, 2024 (HHS withdrew its appeal in August 2024); HHS interim final rule extending Section 504 web accessibility compliance dates, May 2026; published CMP pricing pages, October 2026.
Protect Your Clinic from Federal Non-Compliance Penalties
Internet Security Consultants (operated by Call Center Options, LLC) delivers end-to-end Section 504 website migrations, HIPAA security risk assessments, and CMS workflow audits. Our engineers, supported by automated scanning tools, handle the entire process without disrupting patient appointments.