kaatai

<p>KaaTai Consent Manager is a <strong>privacy-first cookie consent plugin for GDPR-compliant websites</strong>. It gives your visitors full control over cookies and tracking scripts — while keeping you compliant with the GDPR, ePrivacy, and (in Germany) DSGVO and TDDDG. The admin interface is <strong>fully available in English and German</strong>.</p>
<p>Instead of spreading thin across 100+ jurisdictions, KaaTai does one thing exceptionally well: <strong>clean, no-nonsense GDPR consent</strong> — backed by unusually deep coverage of German/DACH law (DSGVO, TDDDG, ePrivacy), among the strictest in Europe. That depth benefits every GDPR site: a curated cookie database, ready-made legal-text templates, vendor presets, and built-in compliance checks. Works on international sites today, with more localized presets on the way.</p>
<h4>Cookie Consent Banner</h4>
<ul>
<li>Customizable consent banner with 3 layouts: Bottom Bar, Centered Popup, Corner Box</li>
<li>All design settings free for all plans: colors, overlay, border radius, spacing, box shadow</li>
<li>Responsive design — works on desktop, tablet, and mobile</li>
<li>WCAG 2.1 compliant: ARIA roles, focus trap, keyboard navigation, semantic HTML</li>
<li>No jQuery dependency — lightweight vanilla JavaScript</li>
<li>Cache-safe: works correctly with all popular caching plugins</li>
</ul>
<h4>Content Blocking</h4>
<ul>
<li>Automatically blocks YouTube, Vimeo, Facebook, Instagram, and Spotify embeds until consent</li>
<li>Blocks Google Maps and OpenStreetMap iframes</li>
<li>Shows privacy-friendly placeholders with click-to-load buttons</li>
<li>MutationObserver detects and blocks dynamically injected content</li>
<li>Auto Script Blocker detects and blocks tracking scripts from third-party plugins (67 known services)</li>
</ul>
<h4>Consent Management</h4>
<ul>
<li>Google Consent Mode v2 — always enabled, sends proper signals to GTM, GA4, and Google Ads</li>
<li>Granular consent — visitors can accept/reject individual vendors, not just categories</li>
<li>5 cookie categories: Essential, Functional, Statistics, Marketing, Performance</li>
<li>Consent choices persist across sessions and can be withdrawn at any time</li>
<li>Consent logging with unique record IDs for GDPR Art. 7(1) compliance (36-month retention)</li>
<li>Global Privacy Control (GPC) — automatically honors browser-level privacy signals</li>
</ul>
<h4>Legal Text Generator</h4>
<ul>
<li>Impressum generator — all mandatory fields per German law (TMG/DDG)</li>
<li>Privacy policy generator — covers all 14 items required by GDPR Art. 13</li>
<li>Shortcodes: [kccm_impressum] and [kccm_datenschutz] for easy page integration</li>
<li>Language-specific shortcodes for multilingual sites (WPML/Polylang): [kccm_datenschutz_en], [kccm_datenschutz_de], [kccm_impressum_en], [kccm_impressum_de] — or the lang=”en|de” attribute</li>
<li>Data for responsible person (Verantwortlicher) stored locally — no external service needed</li>
</ul>
<h4>Vendor Registry</h4>
<ul>
<li>Pre-configured database of 66+ common services with accurate cookie descriptions</li>
<li>Google Analytics, Meta Pixel, Microsoft Clarity, YouTube, Google Maps, and many more</li>
<li>1-click install from the service catalog</li>
<li>Custom vendor support — add your own services with cookie details</li>
</ul>
<h4>Setup Wizard</h4>
<ul>
<li>4-step guided setup: General Settings, Responsible Person, Select Services, Banner Design</li>
<li>Live banner preview during setup</li>
<li>Works without an API key — no account required for basic features</li>
</ul>
<h4>Deep GDPR & DACH Expertise</h4>
<p>The cookie database, legal-text templates, and compliance checks are built around the GDPR and the especially strict German rules (DSGVO, TDDDG, ePrivacy) — so you get compliance depth that also covers the rest of the EU. The plugin is fully translatable and locale-aware: the admin UI ships in <strong>English and German</strong>, legal texts can be rendered per language, and more localized presets are being added.</p>
<h4>Integrations</h4>
<p>KaaTai Consent Manager works with the most popular WordPress plugins and services:</p>
<ul>
<li><strong>Analytics:</strong> Google Analytics, Google Tag Manager, Matomo, Piwik PRO, Microsoft Clarity, Plausible, Fathom</li>
<li><strong>Marketing:</strong> Meta Pixel (Facebook), Google Ads, Taboola, Outbrain, Awin, Tradedoubler</li>
<li><strong>Embeds:</strong> YouTube, Vimeo, Google Maps, OpenStreetMap, Facebook, Instagram, Spotify</li>
<li><strong>E-Commerce:</strong> WooCommerce (Checkout Banner mode, one-click setup)</li>
<li><strong>Chat & Support:</strong> Tidio, Crisp, Zendesk, Drift, LiveChat</li>
<li><strong>Security:</strong> Google reCAPTCHA, Cloudflare, hCaptcha</li>
<li><strong>Payments:</strong> PayPal, Klarna</li>
<li><strong>Other:</strong> HubSpot, Twitter/X Pixel, Snap Pixel, Gravatar, Site Kit by Google</li>
</ul>
<h4>Premium Features (optional SaaS)</h4>
<p>Connect to the <strong>KaaTai Consent Manager</strong> dashboard to unlock additional features. The SaaS integration is entirely optional — the plugin works fully standalone.</p>
<p>Pricing per domain, incl. 19% VAT:</p>
<p><strong>Free (0 EUR):</strong></p>
<ul>
<li>Cookie banner with all designs and layouts</li>
<li>Local consent logging</li>
<li>Vendor registry (4 vendors)</li>
<li>Content blocking (YouTube, Maps, etc.)</li>
<li>Google Consent Mode v2</li>
<li>Local cookie scanner — scan any single page, unlimited scans (dashboard sync once per day)</li>
<li>Privacy policy (DSE) generator (local)</li>
</ul>
<p><strong>Starter (1,90 EUR/month):</strong></p>
<ul>
<li>66+ vendor presets</li>
<li>Banner logo upload</li>
<li>Cookie scanner — automatic scan of your most important pages (up to 20, from your navigation menus)</li>
<li>Impressum generator (via SaaS)</li>
<li>Auto script blocker</li>
<li>White-label (remove branding)</li>
<li>Ticket support</li>
</ul>
<p><strong>Business (2,49 EUR/month):</strong></p>
<ul>
<li>SaaS legal texts: dashboard archive, version history, DE/EN sync</li>
<li>Playwright deep scan</li>
<li>Audit scanner with compliance score</li>
<li>WooCommerce presets</li>
<li>Central consent logging</li>
<li>Multi-domain support</li>
</ul>
<p><strong>Pro (2,90 EUR/month):</strong></p>
<ul>
<li>Analytics dashboard (consent trends, geo data)</li>
<li>Conversion impact calculator</li>
</ul>
<h4>Useful Links</h4>
<ul>
<li><a href="https://consent-management.kaatai.de" rel="nofollow ugc">Plugin Homepage</a></li>
<li><a href="https://consent-management.kaatai.de/docs" rel="nofollow ugc">Documentation</a></li>
<li><a href="https://wordpress.org/support/plugin/kaatai-consent-manager/" rel="ugc">Support</a></li>
<li><a href="https://github.com/kahramanatalay/consent-by-kaatai" rel="nofollow ugc">GitHub</a></li>
<li><a href="https://translate.wordpress.org/projects/wp-plugins/kaatai-consent-manager" rel="nofollow ugc">Translate KaaTai Consent Manager</a></li>
</ul>
<h4>About KaaTai</h4>
<p>KaaTai Consent Manager is developed by <strong>KaaTai</strong> in Germany. We believe that GDPR compliance should be simple, affordable, and accessible to every website owner — not just enterprises with legal departments. Our goal is to be the best cookie consent solution for the German-speaking market.</p>
<h3>External Services</h3>
<h4>Third-party service references (detection patterns, NOT dependencies)</h4>
<p>This plugin is a <strong>Consent Management Tool</strong>. Its purpose is to detect, categorize, and block third-party tracking scripts until the visitor gives consent. The plugin contains a database of known tracking services with their hostnames and script patterns.</p>
<p>These references are <strong>identification patterns only</strong>. The plugin does <strong>not</strong> load, connect to, or transmit any data to these services. It uses the patterns to recognize scripts already present on your site and block them until consent is granted.</p>
<p>The following services are referenced as detection patterns:</p>
<ul>
<li><strong>Google Analytics</strong> — detected and blocked until “statistics” consent. <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Google Tag Manager</strong> — detected and blocked until “marketing” consent. <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Meta Pixel (Facebook)</strong> — detected and blocked until “marketing” consent. <a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.facebook.com/legal/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Cloudflare</strong> — detected and categorized as “essential”. <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.cloudflare.com/website-terms/" rel="nofollow ugc">Terms</a></li>
<li><strong>Google reCAPTCHA</strong> — detected and categorized as “functional”. <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Piwik PRO / Matomo</strong> — detected and blocked until “statistics” consent. <a href="https://piwik.pro/privacy-policy/" rel="nofollow ugc">Privacy Policy</a></li>
<li><strong>Microsoft Clarity</strong> — detected and blocked until “statistics” consent. <a href="https://privacy.microsoft.com/privacystatement" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.microsoft.com/licensing/terms" rel="nofollow ugc">Terms</a></li>
</ul>
<p>No data is sent to any of these services by this plugin.</p>
<h4>KaaTai Consent Manager SaaS (optional, requires API key)</h4>
<p>This plugin optionally connects to servers operated by <strong>KaaTai</strong> (<code>consent-management.kaatai.de</code>). These connections are <strong>only made when the site administrator has entered an API key</strong>. Without an API key, no external connections occur.</p>
<p><strong>Service:</strong> KaaTai Consent Manager SaaS<br />
<strong>Service URL:</strong> <a href="https://consent-management.kaatai.de" rel="nofollow ugc">https://consent-management.kaatai.de</a><br />
<strong>What it does:</strong> License validation, consent analytics, cookie scanner, service library, legal text generation.<br />
<strong>What data is sent:</strong> API key, domain, consent configuration, anonymized consent events (no PII), scan results.<br />
<strong>Privacy Policy:</strong> <a href="https://consent-management.kaatai.de/datenschutz" rel="nofollow ugc">https://consent-management.kaatai.de/datenschutz</a><br />
<strong>Terms of Service:</strong> <a href="https://consent-management.kaatai.de/agb" rel="nofollow ugc">https://consent-management.kaatai.de/agb</a></p>
<h4>Data transmitted when an API key is configured</h4>
<ol>
<li><strong>License Validation</strong> (<code>/api/license/validate</code>) — API key sent to verify license status and features. Cached for 24 hours.</li>
<li><strong>Config Sync</strong> (<code>/api/consent/config</code>) — Consent configuration sent when settings are saved. No personal visitor data.</li>
<li><strong>Consent Events</strong> (<code>/api/consent/event</code>) — Anonymized consent events via sendBeacon(). Contains: action, categories, hashed session ID, policy hash. No PII.</li>
<li><strong>Legal Texts</strong> (<code>/api/legal/impressum</code>, <code>/api/legal/privacy-policy</code>) — Legal text content fetched from SaaS. Cached for 24 hours.</li>
<li><strong>Newsletter</strong> (<code>/api/newsletter/subscribe-by-key</code>) — Only when administrator clicks “Subscribe”.</li>
<li><strong>Scanner</strong> (<code>/api/scan/results</code>) — Scan results synced to SaaS dashboard (Business plan+).</li>
<li><strong>Cookie Definitions</strong> (<code>/api/cookies/definitions</code>) — Cookie descriptions fetched for Service Library.</li>
</ol>
<h4>Data stored on the external server</h4>
<ul>
<li>License/API key association and plan details</li>
<li>Aggregated consent statistics (no personal data)</li>
<li>Consent configuration snapshots</li>
<li>Scan results (URLs and detected services)</li>
</ul>
<h4>User consent</h4>
<p>The site administrator gives explicit consent by entering and saving an API key. The API key can be removed at any time to stop all external communication.</p>


KaaTai Consent Manager

GDPR cookie consent made simple. Consent Mode v2, cookie scanner & legal-text generator. Deep DSGVO expertise, admin UI in English & German.

Hugo Carvalho

<p>Attribution usually breaks somewhere between the ad click and the conversion. ClickTrail makes it survive: cached pages, dynamic forms, multi-page journeys, repeat visits, and consent requirements.</p>
<p>ClickTrail keeps the source of the visit, not a profile of the visitor. Capture is first-party and consent-aware: the plugin does not call external services to identify or enrich visitors, and data only leaves your site through integrations you enable yourself (GTM, webhooks, server-side delivery).</p>
<p>ClickTrail stores first-touch and last-touch attribution from the landing page and keeps it available until the conversion point, where it becomes usable inside WordPress:</p>
<ul>
<li>WooCommerce orders</li>
<li>supported forms</li>
<li>browser events</li>
<li>optional server-side delivery</li>
</ul>
<p>In WooCommerce, ClickTrail stores attribution on the order, pushes enriched purchase events on the thank-you page, and can optionally emit GA4-style storefront events for <code>view_item</code>, <code>view_item_list</code>, <code>view_cart</code>, <code>add_to_cart</code>, <code>remove_from_cart</code>, and <code>begin_checkout</code>, plus post-purchase milestones, through the same ClickTrail pipeline.</p>
<h4>Pick a starting path</h4>
<ul>
<li><strong>WooCommerce store</strong>: enable Capture and WooCommerce. Orders carry campaign context from day one; add storefront events later if you want funnel signals.</li>
<li><strong>Lead-gen forms</strong>: enable Capture and Forms. Contact Form 7 and Fluent Forms get hidden fields automatically; Gravity Forms and WPForms fill the <code>ct_*</code> fields you add.</li>
<li><strong>GTM / sGTM stack</strong>: enable Capture, Events, and Delivery. Browser events push to the <code>dataLayer</code>, and the server-side adapters feed sGTM or platform APIs directly.</li>
</ul>
<h4>What problems it solves</h4>
<ul>
<li><strong>No paid order reports as “direct”</strong>: Paid traffic often ends up looking like direct traffic by the time an order is placed. ClickTrail stores attribution on the order and keeps purchase reporting tied to campaign context.</li>
<li><strong>No checkout journey goes dark</strong>: WooCommerce storefront journeys can emit opt-in <code>view_item</code>, <code>view_item_list</code>, <code>view_cart</code>, <code>add_to_cart</code>, <code>remove_from_cart</code>, and <code>begin_checkout</code> signals through the same ClickTrail event layer used elsewhere in the plugin.</li>
<li><strong>No cached or AJAX-rendered form drops attribution</strong>: Hidden fields often break on cached pages or dynamically rendered forms. ClickTrail includes client-side fallback and dynamic-content support.</li>
<li><strong>No cross-domain hop breaks continuity</strong>: Approved link decoration and attribution tokens keep continuity between domains or subdomains.</li>
<li><strong>No consent signal is ignored</strong>: Consent controls, browser events, webhook intake, and server-side transport live in the same plugin and respect the same consent state.</li>
</ul>
<h4>Core capabilities</h4>
<ul>
<li><strong>Capture</strong>: first-touch and last-touch UTMs, major ad click IDs, and referrers with automatic organic/social/referral fallback when UTMs are absent.</li>
<li><strong>WooCommerce</strong>: checkout attribution persistence, thank-you purchase event push, enriched commerce payloads, optional storefront commerce events, and optional order-status milestones.</li>
<li><strong>Forms</strong>: automatic hidden-field enrichment for Contact Form 7 and Fluent Forms, compatible hidden-field population for Gravity Forms and WPForms, client-side fallback, dynamic form support, and WhatsApp attribution continuity.</li>
<li><strong>Events</strong>: browser event collection with <code>dataLayer</code> pushes, canonical REST intake, webhook ingestion, lifecycle updates, one-time WordPress follow-up events such as <code>login</code>, <code>sign_up</code>, and <code>comment_submit</code>, and optional WooCommerce storefront events.</li>
<li><strong>Delivery</strong>: optional server-side transport, retry queue, diagnostics, consent-aware dispatch, and failure telemetry.</li>
</ul>
<h4>Recent additions</h4>
<p>Recent releases extended the Gravity Forms integration with channel classification, merge tags, and per-form controls:</p>
<ul>
<li><strong>Channel classification</strong>: every GF entry now receives a <code>ct_ft_channel</code> value — a human-readable label such as Google Ads, ChatGPT, or Mailchimp — derived from click IDs, UTM parameters, or referrer context. A server-side fallback covers sessions where JS attribution was unavailable.</li>
<li><strong>Expanded click ID capture</strong>: six additional click IDs (Reddit <code>rdt_cid</code>, Pinterest <code>pin_cid</code>, Snapchat <code>snap_cid</code>, Mailchimp <code>mc_cid</code> / <code>mc_eid</code>, and Display & Video 360 <code>dclid</code>) are now captured and stored.</li>
<li><strong>Merge tags</strong>: nine <code>{clicutcl_*}</code> merge tags are available in GF notifications and confirmations, including <code>{clicutcl_channel}</code>, <code>{clicutcl_click_id}</code>, and seven UTM-based tags.</li>
<li><strong>Per-form toggle</strong>: attribution tracking can be enabled or disabled per form via a dedicated ClickTrail section in Gravity Forms form settings.</li>
<li><strong>Admin QA mode</strong>: attribution data is stored in <code>sessionStorage</code> only when a <code>manage_options</code> user is logged in, preventing admin browsing from appearing in attribution reports.</li>
<li><strong>sessionStorage fallback</strong>: attribution capture now falls back to <code>sessionStorage</code> when the browser blocks cookies.</li>
<li><strong>Minification protection</strong>: ClickTrail script tags carry exclusion attributes recognised by Autoptimize, Cloudflare Rocket Loader, WP Rocket, and LiteSpeed Cache (corrected attribute set in 1.7.0).</li>
</ul>
<h4>Current admin structure</h4>
<p>The main settings experience is organized by capability:</p>
<ul>
<li>Capture</li>
<li>Forms</li>
<li>Events</li>
<li>Delivery</li>
</ul>
<p>Operational screens stay separate:</p>
<ul>
<li>Logs</li>
<li>Diagnostics</li>
</ul>
<h4>Supported integrations</h4>
<ul>
<li><strong>Forms</strong>: Contact Form 7, Elementor Forms (Pro), Fluent Forms, Gravity Forms, Ninja Forms, WPForms</li>
<li><strong>Commerce</strong>: WooCommerce</li>
<li><strong>CMP sources</strong>: ClickTrail banner, Cookiebot, OneTrust, Complianz, GTM, custom</li>
<li><strong>Webhook providers</strong>: Calendly, HubSpot, Typeform</li>
<li><strong>Server-side adapters</strong>: Generic collector, sGTM, Meta CAPI, Google Ads / GA4, LinkedIn CAPI, Pinterest Conversions API, TikTok Events API</li>
</ul>
<h4>Forms behavior by plugin</h4>
<ul>
<li><strong>Contact Form 7 and Fluent Forms</strong>: ClickTrail can add hidden attribution fields automatically.</li>
<li><strong>Gravity Forms and WPForms</strong>: ClickTrail can populate matching hidden fields you add to the form.</li>
<li><strong>Recommended for Gravity Forms and WPForms</strong>: add the hidden fields you want stored or exported, and ClickTrail will fill them.</li>
<li><strong>Elementor Forms (Pro)</strong>: ClickTrail uses the available submission hooks and attribution fallback, not automatic hidden-field injection.</li>
<li><strong>Ninja Forms</strong>: ClickTrail stores attribution with the submission and surfaces it in the submission record, not as automatic hidden-field injection.</li>
</ul>
<h4>Supported click IDs</h4>
<ul>
<li>Google: <code>gclid</code>, <code>wbraid</code>, <code>gbraid</code></li>
<li>Meta: <code>fbclid</code></li>
<li>TikTok: <code>ttclid</code></li>
<li>Microsoft: <code>msclkid</code></li>
<li>X / Twitter: <code>twclid</code></li>
<li>LinkedIn: <code>li_fat_id</code></li>
<li>Snapchat: <code>sccid</code></li>
<li>Pinterest: <code>epik</code></li>
</ul>
<h4>Additional capture fields</h4>
<ul>
<li>Extended UTMs: <code>utm_id</code>, <code>utm_source_platform</code>, <code>utm_creative_format</code>, <code>utm_marketing_tactic</code></li>
<li>Browser/platform identifiers: <code>fbc</code>, <code>fbp</code>, <code>_ttp</code>, <code>li_gc</code>, <code>ga_client_id</code>, <code>ga_session_id</code></li>
</ul>


ClickTrail – UTM, Click ID & Ad Tracking (with Consent)

Consent-aware attribution for WooCommerce, WordPress forms, and event flows. Capture UTMs and click IDs across conversion paths.

KaaTai Consent Manager vs ClickTrail – UTM, Click ID & Ad Tracking (with Consent)