CookieFlame

CookieFlame is a cookie consent plugin that finds your site’s cookies for you, runs on your own server, and shows each visitor the banner their region requires. Full details are at cookieflame.com.

Finds cookies for you

• Watch for new cookies: your visitors’ browsers report cookies as they browse, so a new plugin’s or tag’s cookies appear in the Cookie Manager without you scanning. Get an email about changes weekly, daily, or not at all.
• Cookie Discovery: for a full list now, browse your own site with every cookie allowed for your browser only. It uses your own browser.

The right banner for each region

• UK, EU/EEA, Switzerland, Brazil and South Africa: an opt-in banner with Accept All and Manage preferences. You can also show Decline All on the first screen (off by default).
• United States: a short notice with a “Do Not Sell or Share My Personal Information” link that opens a real opt-out choice.
• Everywhere else: no banner.

Country comes from CDN headers such as Cloudflare’s, or a free MaxMind database you upload, with the time zone as a fallback. If none works, the opt-in banner is shown.

Global Privacy Control

A browser that sends Global Privacy Control (GPC) is opted out of selling and sharing straight away: marketing cookies stay off and Google’s ad signals are denied. US visitors see that the signal was honoured, and OK only closes the notice. The opt-out is saved, so a later visit without GPC keeps it. A visitor can opt back in only through a separate, clear choice.

Blocks trackers before consent

Tracking scripts are rewritten on your server before the page is sent, so blocking works with WP Rocket, LiteSpeed, Cloudflare APO and other caches. Built-in patterns cover Google Analytics, Google Ads, Google Tag Manager, Microsoft Ads, Meta, X (Twitter), LinkedIn, Pinterest, Reddit and TikTok. Cookies you classify get matching rules automatically.

YouTube, Vimeo, Google Maps, Spotify, SoundCloud, Dailymotion and Elementor videos show a click-to-load placeholder until the visitor consents.

Google Consent Mode v2

All Google consent signals start as denied before any tag runs and update the moment a visitor chooses. Returning visitors’ choices are restored before Google Tag Manager loads.

For developers

• Events: cc:ready, cc:update, cc:accept-all, cc:decline-all, cc:save and cc:banner-rendered.
• JavaScript API: CookieConsent.getState(), show(), showSettings() and more.
• [cookieflame_settings_link] shortcode, or the class cc-open-settings on any link, to reopen a visitor’s choices.
• CSS custom properties (–cc-accent, –cc-bg, –cc-radius, –cc-font and others) to restyle the banner.
• Filters cookieflame_frontend_config, cookieflame_digest_email and cookieflame_unsafe_block_hosts, and the action cookieflame_settings_sections.
• An optional consent log endpoint for your own audit trail.

CookieFlame Pro

Pro identifies and classifies cookies automatically, creates the blocking rules, and adds instant emails. See cookieflame.com.

Compliance note

CookieFlame helps with GDPR, CCPA, LGPD, POPIA and similar laws; how you set it up is your responsibility. For legal advice, ask a qualified professional.

External services

CookieFlame does not phone home. These requests happen only in the cases described.

Google Tag Manager (optional). If you enter a container ID on the Tag Managers tab, Google’s script (https://www.googletagmanager.com/gtm.js) loads on every page, except for visitors you exclude from tracking. Tags inside it follow the visitor’s Consent Mode choices. Sent: the container ID and the browser’s standard request data (IP address, user agent, page URL). Terms, privacy policy.

Microsoft UET (optional). If you enter a UET tag ID, Microsoft’s loader (https://bat.bing.com/bat.js) loads on every page, except for visitors you exclude from tracking. It records nothing until the visitor allows Marketing. Sent: the tag ID and the browser’s standard request data. Microsoft Advertising agreement, privacy statement.

YouTube thumbnails. When a page has a YouTube embed that is waiting for consent, its placeholder shows the video’s thumbnail from img.youtube.com. Sent: the video ID and the browser’s standard request data. YouTube terms, Google privacy policy.

Consent log endpoint (optional). If you enter a URL in the Consent Log Endpoint setting, each consent choice is sent there from the visitor’s browser as JSON: an anonymous ID, time, action, the choice per category, region, country code, page URL, user agent, the GPC flag, consent version and plugin version. No cookie values or IP address are in it. You choose the destination and are responsible for it.

Third-party domain names in the code (such as connect.facebook.net) are only used to recognise and block scripts; they are never contacted.