I Audited 50 Wordpress Sites For Gdpr Compliance And The Results Were Depressing

I work in digital marketing and part of my job involves auditing client websites. Over the past few months I've been specifically checking GDPR/cookie consent compliance on WordPress sites. Mostly small business clients in the EU and some in the US who serve EU customers.

The results:

• 38 out of 50 had a cookie banner but it didn't actually block cookies until consent was given. The banner was decorative. Cookies were already set before you even clicked anything.
• 12 had no cookie banner at all. Just raw analytics and marketing pixels firing on every page load.
• Only 6 were properly logging consent records (which GDPR actually requires — you need to prove someone consented).
• 0 had a working "withdraw consent" mechanism. Zero.

The problem is most cookie consent plugins are cloud-based services that charge per page view. CookieYes starts free then jumps to $149/year. Cookiebot is similar. For a small business running a WordPress site, that's a recurring cost that feels unnecessary.

What frustrates me is that the actual technical requirements aren't that complex:

1. Show a banner before setting non-essential cookies
2. Let users accept all, reject non-essential, or pick categories
3. Log the consent with a timestamp
4. Provide a way to change preferences later

That's it. You don't need a cloud service scanning your site monthly for $149/year. You need a plugin that puts a banner on your site, stores consent in a cookie, and logs it locally.

I actually built a free WordPress plugin for this called Cirv Comply. It does exactly the four things above without phoning home to any external server. But honestly I'm less interested in promoting my thing and more interested in why the existing solutions are so overpriced for what they do. A cookie banner is not a $149/year feature. It's a basic web requirement that should be free.

Anyone else find the GDPR compliance tooling market weirdly inflated?