GDPR Compliance & Cookie Consent

GDPR Compliance & Cookie Consent is a free WordPress plugin that helps you handle visitor consent and personal data requests on your website. It adds a customizable cookie consent banner, consent checkboxes for comments and popular form and e-commerce plugins, and a form where visitors can ask for a copy of their personal data or ask for it to be erased.

The plugin is a tool to help you work towards GDPR compliance. It does not give legal advice and does not make a site compliant on its own: you remain responsible for your privacy policy, your cookies and the way you process personal data.

Features

• Cookie consent banner with your own text, button label, colors, position and optional custom CSS, plus an optional Decline button
• Google Consent Mode v2: Google tags (Analytics, Ads, Tag Manager) wait for consent, and the visitor’s choice is passed on to them (see “Google Consent Mode v2” below)
• Works with page caching: the banner is shown or hidden in the browser from the consent cookie, so cached pages are correct for every visitor
• Adjustable consent expiry time (default six months)
• Optional cookie blocking until the visitor accepts the banner (see “What cookie blocking does” below)
• Link to your Privacy Policy page from the banner, with custom link text
• Consent checkboxes for WordPress comments, Contact Form 7, Gravity Forms, WooCommerce, BuddyPress and MailChimp forms, each with its own label and error message
• Data access and erasure form for visitors, using WordPress’ built-in personal data export and erasure requests with an email confirmation link
• Gutenberg block “Data Access & Erasure Request”, shortcode and widget to place the data request form anywhere
• Translation-ready
• Comment consent is recorded: the comments list shows when each commenter accepted

How to use

After activation open “GDPR” in the admin menu. It has tabs for General (banner, cookie blocking, expiry, colors and position), Privacy Policy, Integrated plugins and Data access & to be forgotten. Click “Save changes” on each tab.

To offer visitors the data access and erasure form, add the “Data Access & Erasure Request” block to a page, or use this shortcode (optional attributes title and description), or the “GDPR Compliance Widget”:

[stm-gpdr-data-access]

Google Consent Mode v2

The option “Google Consent Mode v2” (General tab, on by default, active while the consent banner is enabled) prints the Consent Mode default as early as possible in the page head: ad_storage, ad_user_data, ad_personalization and analytics_storage are denied, with wait_for_update set to 500 ms, together with the dataLayer/gtag stub. When the visitor accepts, declines, or a category is changed, the plugin calls gtag('consent', 'update', ...). Analytics maps to analytics_storage; marketing maps to ad_storage, ad_user_data and ad_personalization. “Accept” grants both, “Decline” denies both, and returning visitors get their stored choice applied as an update on every page load. This happens in the browser from the consent cookie, so it works with cached pages. Themes and other plugins can set categories separately with window.stmGdprSetConsent({analytics: true, marketing: false}), and listen to the stm_gdpr_consent event. Your Google tags must load after the plugin’s snippet (the plugin prints it with priority 1 in wp_head) and must respect Consent Mode, which Google Tag and Google Tag Manager templates do by default.

What cookie blocking does

When the “Block Cookies” option is on, until a visitor accepts the banner the plugin stops WordPress and other PHP plugins from setting cookies on the front end of your site, and a small script prevents cookies being written from JavaScript. It does not scan your site, categorize cookies, or stop third-party scripts (for example analytics or advertising tags) from loading, so check those separately.

What this plugin does not do

• It does not provide legal advice or a legal guarantee
• It does not write your privacy policy for you
• It does not automatically scan or classify the cookies used on your site