kaatai

<p>KaaTai Consent Manager is a <strong>privacy-first cookie consent plugin for GDPR-compliant websites</strong>. It gives your visitors full control over cookies and tracking scripts — while keeping you compliant with the GDPR, ePrivacy, and (in Germany) DSGVO and TDDDG. The admin interface is <strong>fully available in English and German</strong>.</p>
<p>Instead of spreading thin across 100+ jurisdictions, KaaTai does one thing exceptionally well: <strong>clean, no-nonsense GDPR consent</strong> — backed by unusually deep coverage of German/DACH law (DSGVO, TDDDG, ePrivacy), among the strictest in Europe. That depth benefits every GDPR site: a curated cookie database, ready-made legal-text templates, vendor presets, and built-in compliance checks. Works on international sites today, with more localized presets on the way.</p>
<h4>Cookie Consent Banner</h4>
<ul>
<li>Customizable consent banner with 3 layouts: Bottom Bar, Centered Popup, Corner Box</li>
<li>All design settings free for all plans: colors, overlay, border radius, spacing, box shadow</li>
<li>Responsive design — works on desktop, tablet, and mobile</li>
<li>WCAG 2.1 compliant: ARIA roles, focus trap, keyboard navigation, semantic HTML</li>
<li>No jQuery dependency — lightweight vanilla JavaScript</li>
<li>Cache-safe: works correctly with all popular caching plugins</li>
</ul>
<h4>Content Blocking</h4>
<ul>
<li>Automatically blocks YouTube, Vimeo, Facebook, Instagram, and Spotify embeds until consent</li>
<li>Blocks Google Maps and OpenStreetMap iframes</li>
<li>Shows privacy-friendly placeholders with click-to-load buttons</li>
<li>MutationObserver detects and blocks dynamically injected content</li>
<li>Auto Script Blocker detects and blocks tracking scripts from third-party plugins (67 known services)</li>
</ul>
<h4>Consent Management</h4>
<ul>
<li>Google Consent Mode v2 — always enabled, sends proper signals to GTM, GA4, and Google Ads</li>
<li>Granular consent — visitors can accept/reject individual vendors, not just categories</li>
<li>5 cookie categories: Essential, Functional, Statistics, Marketing, Performance</li>
<li>Consent choices persist across sessions and can be withdrawn at any time</li>
<li>Consent logging with unique record IDs for GDPR Art. 7(1) compliance (36-month retention)</li>
<li>Global Privacy Control (GPC) — automatically honors browser-level privacy signals</li>
</ul>
<h4>Legal Text Generator</h4>
<ul>
<li>Impressum generator — all mandatory fields per German law (TMG/DDG)</li>
<li>Privacy policy generator — covers all 14 items required by GDPR Art. 13</li>
<li>Shortcodes: [kccm_impressum] and [kccm_datenschutz] for easy page integration</li>
<li>Language-specific shortcodes for multilingual sites (WPML/Polylang): [kccm_datenschutz_en], [kccm_datenschutz_de], [kccm_impressum_en], [kccm_impressum_de] — or the lang=”en|de” attribute</li>
<li>Data for responsible person (Verantwortlicher) stored locally — no external service needed</li>
</ul>
<h4>Vendor Registry</h4>
<ul>
<li>Pre-configured database of 66+ common services with accurate cookie descriptions</li>
<li>Google Analytics, Meta Pixel, Microsoft Clarity, YouTube, Google Maps, and many more</li>
<li>1-click install from the service catalog</li>
<li>Custom vendor support — add your own services with cookie details</li>
</ul>
<h4>Setup Wizard</h4>
<ul>
<li>4-step guided setup: General Settings, Responsible Person, Select Services, Banner Design</li>
<li>Live banner preview during setup</li>
<li>Works without an API key — no account required for basic features</li>
</ul>
<h4>Deep GDPR & DACH Expertise</h4>
<p>The cookie database, legal-text templates, and compliance checks are built around the GDPR and the especially strict German rules (DSGVO, TDDDG, ePrivacy) — so you get compliance depth that also covers the rest of the EU. The plugin is fully translatable and locale-aware: the admin UI ships in <strong>English and German</strong>, legal texts can be rendered per language, and more localized presets are being added.</p>
<h4>Integrations</h4>
<p>KaaTai Consent Manager works with the most popular WordPress plugins and services:</p>
<ul>
<li><strong>Analytics:</strong> Google Analytics, Google Tag Manager, Matomo, Piwik PRO, Microsoft Clarity, Plausible, Fathom</li>
<li><strong>Marketing:</strong> Meta Pixel (Facebook), Google Ads, Taboola, Outbrain, Awin, Tradedoubler</li>
<li><strong>Embeds:</strong> YouTube, Vimeo, Google Maps, OpenStreetMap, Facebook, Instagram, Spotify</li>
<li><strong>E-Commerce:</strong> WooCommerce (Checkout Banner mode, one-click setup)</li>
<li><strong>Chat & Support:</strong> Tidio, Crisp, Zendesk, Drift, LiveChat</li>
<li><strong>Security:</strong> Google reCAPTCHA, Cloudflare, hCaptcha</li>
<li><strong>Payments:</strong> PayPal, Klarna</li>
<li><strong>Other:</strong> HubSpot, Twitter/X Pixel, Snap Pixel, Gravatar, Site Kit by Google</li>
</ul>
<h4>Premium Features (optional SaaS)</h4>
<p>Connect to the <strong>KaaTai Consent Manager</strong> dashboard to unlock additional features. The SaaS integration is entirely optional — the plugin works fully standalone.</p>
<p>Pricing per domain, incl. 19% VAT:</p>
<p><strong>Free (0 EUR):</strong></p>
<ul>
<li>Cookie banner with all designs and layouts</li>
<li>Local consent logging</li>
<li>Vendor registry (4 vendors)</li>
<li>Content blocking (YouTube, Maps, etc.)</li>
<li>Google Consent Mode v2</li>
<li>Local cookie scanner — scan any single page, unlimited scans (dashboard sync once per day)</li>
<li>Privacy policy (DSE) generator (local)</li>
</ul>
<p><strong>Starter (1,90 EUR/month):</strong></p>
<ul>
<li>66+ vendor presets</li>
<li>Banner logo upload</li>
<li>Cookie scanner — automatic scan of your most important pages (up to 20, from your navigation menus)</li>
<li>Impressum generator (via SaaS)</li>
<li>Auto script blocker</li>
<li>White-label (remove branding)</li>
<li>Ticket support</li>
</ul>
<p><strong>Business (2,49 EUR/month):</strong></p>
<ul>
<li>SaaS legal texts: dashboard archive, version history, DE/EN sync</li>
<li>Playwright deep scan</li>
<li>Audit scanner with compliance score</li>
<li>WooCommerce presets</li>
<li>Central consent logging</li>
<li>Multi-domain support</li>
</ul>
<p><strong>Pro (2,90 EUR/month):</strong></p>
<ul>
<li>Analytics dashboard (consent trends, geo data)</li>
<li>Conversion impact calculator</li>
</ul>
<h4>Useful Links</h4>
<ul>
<li><a href="https://consent-management.kaatai.de" rel="nofollow ugc">Plugin Homepage</a></li>
<li><a href="https://consent-management.kaatai.de/docs" rel="nofollow ugc">Documentation</a></li>
<li><a href="https://wordpress.org/support/plugin/kaatai-consent-manager/" rel="ugc">Support</a></li>
<li><a href="https://github.com/kahramanatalay/consent-by-kaatai" rel="nofollow ugc">GitHub</a></li>
<li><a href="https://translate.wordpress.org/projects/wp-plugins/kaatai-consent-manager" rel="nofollow ugc">Translate KaaTai Consent Manager</a></li>
</ul>
<h4>About KaaTai</h4>
<p>KaaTai Consent Manager is developed by <strong>KaaTai</strong> in Germany. We believe that GDPR compliance should be simple, affordable, and accessible to every website owner — not just enterprises with legal departments. Our goal is to be the best cookie consent solution for the German-speaking market.</p>
<h3>External Services</h3>
<h4>Third-party service references (detection patterns, NOT dependencies)</h4>
<p>This plugin is a <strong>Consent Management Tool</strong>. Its purpose is to detect, categorize, and block third-party tracking scripts until the visitor gives consent. The plugin contains a database of known tracking services with their hostnames and script patterns.</p>
<p>These references are <strong>identification patterns only</strong>. The plugin does <strong>not</strong> load, connect to, or transmit any data to these services. It uses the patterns to recognize scripts already present on your site and block them until consent is granted.</p>
<p>The following services are referenced as detection patterns:</p>
<ul>
<li><strong>Google Analytics</strong> — detected and blocked until “statistics” consent. <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Google Tag Manager</strong> — detected and blocked until “marketing” consent. <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Meta Pixel (Facebook)</strong> — detected and blocked until “marketing” consent. <a href="https://www.facebook.com/privacy/policy/" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.facebook.com/legal/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Cloudflare</strong> — detected and categorized as “essential”. <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.cloudflare.com/website-terms/" rel="nofollow ugc">Terms</a></li>
<li><strong>Google reCAPTCHA</strong> — detected and categorized as “functional”. <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>, <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a></li>
<li><strong>Piwik PRO / Matomo</strong> — detected and blocked until “statistics” consent. <a href="https://piwik.pro/privacy-policy/" rel="nofollow ugc">Privacy Policy</a></li>
<li><strong>Microsoft Clarity</strong> — detected and blocked until “statistics” consent. <a href="https://privacy.microsoft.com/privacystatement" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.microsoft.com/licensing/terms" rel="nofollow ugc">Terms</a></li>
</ul>
<p>No data is sent to any of these services by this plugin.</p>
<h4>KaaTai Consent Manager SaaS (optional, requires API key)</h4>
<p>This plugin optionally connects to servers operated by <strong>KaaTai</strong> (<code>consent-management.kaatai.de</code>). These connections are <strong>only made when the site administrator has entered an API key</strong>. Without an API key, no external connections occur.</p>
<p><strong>Service:</strong> KaaTai Consent Manager SaaS<br />
<strong>Service URL:</strong> <a href="https://consent-management.kaatai.de" rel="nofollow ugc">https://consent-management.kaatai.de</a><br />
<strong>What it does:</strong> License validation, consent analytics, cookie scanner, service library, legal text generation.<br />
<strong>What data is sent:</strong> API key, domain, consent configuration, anonymized consent events (no PII), scan results.<br />
<strong>Privacy Policy:</strong> <a href="https://consent-management.kaatai.de/datenschutz" rel="nofollow ugc">https://consent-management.kaatai.de/datenschutz</a><br />
<strong>Terms of Service:</strong> <a href="https://consent-management.kaatai.de/agb" rel="nofollow ugc">https://consent-management.kaatai.de/agb</a></p>
<h4>Data transmitted when an API key is configured</h4>
<ol>
<li><strong>License Validation</strong> (<code>/api/license/validate</code>) — API key sent to verify license status and features. Cached for 24 hours.</li>
<li><strong>Config Sync</strong> (<code>/api/consent/config</code>) — Consent configuration sent when settings are saved. No personal visitor data.</li>
<li><strong>Consent Events</strong> (<code>/api/consent/event</code>) — Anonymized consent events via sendBeacon(). Contains: action, categories, hashed session ID, policy hash. No PII.</li>
<li><strong>Legal Texts</strong> (<code>/api/legal/impressum</code>, <code>/api/legal/privacy-policy</code>) — Legal text content fetched from SaaS. Cached for 24 hours.</li>
<li><strong>Newsletter</strong> (<code>/api/newsletter/subscribe-by-key</code>) — Only when administrator clicks “Subscribe”.</li>
<li><strong>Scanner</strong> (<code>/api/scan/results</code>) — Scan results synced to SaaS dashboard (Business plan+).</li>
<li><strong>Cookie Definitions</strong> (<code>/api/cookies/definitions</code>) — Cookie descriptions fetched for Service Library.</li>
</ol>
<h4>Data stored on the external server</h4>
<ul>
<li>License/API key association and plan details</li>
<li>Aggregated consent statistics (no personal data)</li>
<li>Consent configuration snapshots</li>
<li>Scan results (URLs and detected services)</li>
</ul>
<h4>User consent</h4>
<p>The site administrator gives explicit consent by entering and saving an API key. The API key can be removed at any time to stop all external communication.</p>


KaaTai Consent Manager

GDPR cookie consent made simple. Consent Mode v2, cookie scanner & legal-text generator. Deep DSGVO expertise, admin UI in English & German.

Ontario

<p>Plain Cookie Consent is a no-frills GDPR + ePrivacy consent banner for WordPress. It ships a single banner, Google Consent Mode v2 defaults, a server-side audit log with pseudonymised subject hashing, a DSAR lookup helper, and constant-gated Meta Pixel / Microsoft Clarity / LinkedIn Insight Tag helpers — all under GPL v2, with no upsells and no external telemetry.</p>
<p>The plugin is designed to support a GDPR/ePrivacy-compliant consent setup. Final compliance depends on the site owner’s configuration and linked privacy policy.</p>
<h4>Core compliance features</h4>
<ul>
<li>Google Consent Mode v2 defaults injected at <code>wp_head</code> priority 1, before any tag manager or gtag snippet.</li>
<li>Early inline consent replay with a revision gate — consent recorded before a policy revision bump is not replayed; the banner re-prompts instead.</li>
<li>Server-side audit log (<code>wp_plain_consent_log</code>) with a privacy-preserving SHA-256 subject hash over a daily-rotating salt, and a 730-day default retention purge (filterable via constant).</li>
<li>Consent revision system with a “Force re-consent for all users now” admin action and strict rollback if the audit insert fails.</li>
<li>Two-step choice pattern: the first layer offers Accept All and Show Options; the preferences screen (one click away) offers equal-weight Accept All, Reject All, and Save Preferences buttons.</li>
<li>Server-mirror consent cookie via a cache-safe <code>GET /mirror-nonce</code> endpoint (<code>Cache-Control: no-store</code>), so full-page caching does not break nonce validation.</li>
<li>Geo targeting: the consent-required region set is the EEA (EU-27 plus Iceland, Liechtenstein, Norway) plus the United Kingdom. Detection uses the Cloudflare <code>CF-IPCountry</code> header when present, with a fail-safe default: if the country cannot be determined, the visitor is treated as in-scope.</li>
<li>CSV/JSON streamed export of the consent log, plus a pre-uninstall evidence warning with one-click export.</li>
<li>DSAR lookup admin tool: recompute a visitor’s subject hash from IP + User-Agent and list matching consent-log entries (GDPR Art. 15 support).</li>
</ul>
<h4>Integrations</h4>
<ul>
<li>Meta Pixel: define <code>PLAIN_COOKIE_CONSENT_FACEBOOK_PIXEL_ID</code> in <code>wp-config.php</code>.</li>
<li>Microsoft Clarity: define <code>PLAIN_COOKIE_CONSENT_CLARITY_PROJECT_ID</code> in <code>wp-config.php</code>.</li>
<li>LinkedIn Insight Tag: define <code>PLAIN_COOKIE_CONSENT_LINKEDIN_PARTNER_ID</code> in <code>wp-config.php</code>.</li>
<li>Public <code>window.plainCookieConsent</code> JavaScript API (<code>getCategories</code>, <code>hasConsent</code>, <code>onChange</code>, <code>onGrant</code>, <code>onRevoke</code>) for site-specific vendors.</li>
<li>Cookie cleanup on revoke with curated defaults for LinkedIn, TikTok, Hotjar, Clarity, Yandex Metrica, and Snapchat (<code>plain_cookie_consent_autoclear_cookies</code> filter).</li>
<li><code>localStorage</code> / <code>sessionStorage</code> cleanup on a real granted-to-revoked transition (<code>plain_cookie_consent_clear_storage_keys</code> filter).</li>
</ul>
<h4>Accessibility</h4>
<ul>
<li>The banner and preferences modal are attested against WCAG 2.1 AA.</li>
<li>axe-core smoke tests (<code>wcag2a</code>, <code>wcag2aa</code>, <code>wcag21aa</code> tags) run on every push and pull request via GitHub Actions.</li>
<li>Site-level accessibility remains the operator’s responsibility.</li>
</ul>
<h4>Languages</h4>
<p>Translation catalogs ship for nine languages: English, German, Russian, Spanish, French, Italian, Dutch, Polish, and Portuguese. Banner language auto-resolution covers all nine shipped languages, including regional variants (for example de-AT or pt-BR), with any other locale falling back to English. Any shipped catalog can also be selected explicitly, and translators can override strings the standard WordPress gettext way.</p>
<h4>Not included</h4>
<ul>
<li>TCF v2.2 (programmatic publishers).</li>
<li>Consent analytics dashboards beyond the read-only Consent Health widget.</li>
<li>Multi-domain consent sync.</li>
<li>Banner A/B testing.</li>
<li>Script auto-blocking beyond Consent Mode and the documented vendor helpers.</li>
</ul>
<h3>External services</h3>
<p>This plugin has no telemetry and never sends data to its own or the author’s servers. Consent records stay in your own WordPress database.</p>
<p>The plugin can optionally load three well-known third-party marketing/analytics tags <strong>on your behalf</strong>. Each one is OFF by default and only ever loads when BOTH of the following are true:</p>
<ol>
<li>You explicitly enable it by defining the matching constant in <code>wp-config.php</code>, and</li>
<li>The visitor grants the relevant consent category in the banner.</li>
</ol>
<p>If you do not define these constants, the plugin makes no third-party requests at all. Once enabled, the tag still loads only after the visitor grants the relevant consent category in the banner.</p>
<h4>Meta (Facebook) Pixel</h4>
<p>Optional advertising measurement. Enabled by defining <code>PLAIN_COOKIE_CONSENT_FACEBOOK_PIXEL_ID</code>. When a visitor grants <strong>advertising</strong> consent, the plugin loads <code>https://connect.facebook.net/en_US/fbevents.js</code> and initialises the Pixel with your Pixel ID. From then on, on each page view, Meta receives standard Pixel data: your Pixel ID, the page URL and referrer, the visitor’s IP address and browser/user-agent, and a PageView event. Nothing is sent before advertising consent.<br />
Provider: Meta Platforms, Inc. Privacy Policy: https://www.facebook.com/privacy/policy/ — Business Tools Terms: https://www.facebook.com/legal/terms/businesstools</p>
<h4>Microsoft Clarity</h4>
<p>Optional session analytics (heatmaps and session insights). Enabled by defining <code>PLAIN_COOKIE_CONSENT_CLARITY_PROJECT_ID</code>. When a visitor grants <strong>analytics</strong> consent, the plugin loads <code>https://www.clarity.ms/tag/<your-project-id></code>. From then on, on each page view, Microsoft receives Clarity analytics data: your project ID, the page URL, the visitor’s IP address and browser/user-agent, and interaction events such as clicks and scrolls. Nothing is sent before analytics consent.<br />
Provider: Microsoft Corporation. Privacy Statement: https://www.microsoft.com/privacy/privacystatement — Clarity Terms of Service: https://clarity.microsoft.com/terms</p>
<h4>LinkedIn Insight Tag</h4>
<p>Optional advertising measurement on LinkedIn. Enabled by defining <code>PLAIN_COOKIE_CONSENT_LINKEDIN_PARTNER_ID</code>. When a visitor grants <strong>advertising</strong> consent, the plugin loads <code>https://snap.licdn.com/li.lms-analytics/insight.min.js</code> with your Partner ID. From then on, on each page view, LinkedIn receives Insight Tag data: your Partner ID, the page URL, and the visitor’s IP address and browser/user-agent. Nothing is sent before advertising consent.<br />
Provider: LinkedIn Corporation. Privacy Policy: https://www.linkedin.com/legal/privacy-policy — LinkedIn Ads Agreement: https://www.linkedin.com/legal/ads-agreement</p>
<h3>Disclaimer</h3>
<p>This plugin is provided “as is”, free of charge, for evaluation and use at<br />
the site operator’s own discretion and risk.</p>
<ul>
<li>The site operator alone chooses which plugins to install and run on their<br />
site, and bears full responsibility for that choice and its consequences.</li>
<li>The plugin is offered for informational and evaluation purposes. The<br />
authors make no guarantees and no promises of any kind — including<br />
correctness, completeness, fitness for a particular purpose, or<br />
uninterrupted operation.</li>
<li>Software may contain errors. Any errors, malfunctions, data loss, or<br />
legal consequences arising from the use of this plugin are the sole<br />
responsibility of the site operator.</li>
<li>Nothing in this plugin or its documentation constitutes legal advice.<br />
The plugin is designed to support a GDPR/ePrivacy-oriented consent setup,<br />
but it does not and cannot guarantee legal compliance of any specific<br />
site — final compliance always depends on the operator’s configuration,<br />
vendors, and policies.</li>
<li>The warranty disclaimer and limitation of liability are governed by<br />
sections 11 and 12 of the GNU GPL v2 license that ships with this plugin.</li>
</ul>


Plain Cookie Consent

Minimal clean-room GDPR/ePrivacy consent banner with Google Consent Mode v2, early inline replay, DSAR helper, and no upsells.

KaaTai Consent Manager vs Plain Cookie Consent