WordPress.org

Viktor Szépe

Rogier Lankhorst

Aert

Mark

Mathieu Paapst

pepe

Konstantinos Xenos

Aurooba Ahmed

Johan Holst Nielsen

mujuonly

<p>WP Consent API is a plugin that standardizes the communication of accepted consent categories between plugins. It requires a cookie banner plugin and, at least, one other plugin that supports the WP Consent API.</p>
<p>With this plugin, all supporting plugins can use the same set of methods to read and register the current consent category, allowing consent management plugins and other plugins to work together, improving compliance with privacy laws.</p>
<p>WARNING: the plugin itself will not handle consent. It will show you how many plugins you have without Consent API support and will improve compliance on your site by ensuring smooth communication between cookie banner plugins and plugins that set cookies or track user data.</p>
<h4>What problem does this plugin solve?</h4>
<p>Currently, it is possible for a consent management plugin to block third-party services like Facebook, Google Maps, Twitter, etc. But if a WordPress plugin places a PHP cookie, a consent management plugin cannot prevent this.</p>
<p>Secondly, some plugins integrate the tracking code on the clientside in javascript files that, when blocked, break the site.</p>
<p>Or, if such a plugin’s javascript is minified, causing the URL to be unrecognizable and won’t get detected by an automatic blocking script.</p>
<p>Lastly, the blocking approach requires a list of all types of URL’s that tracks data. A generic API where plugins adhere to can greatly<br />
facilitate a webmaster in getting a site compliant.</p>
<h4>Does usage of this API prevent third-party services from tracking user data?</h4>
<p>Primary this API is aimed at compliant first-party cookies or tracking by WordPress plugins. If such a plugin triggers, for example, Facebook,<br />
usage of this API will be of help. If a user embeds a Facebook iframe, a blocking tool is needed that initially disables the iframe and or scripts.</p>
<p>Third-party scripts have to blocked by blocking functionality in a consent management plugin. To do this in core would be to intrusive, and is also not applicable to all users: only users with visitors from opt-in regions such as the European Union require such a feature. Such a feature also has a risk of breaking things. Additionally, blocking these and showing a nice placeholder requires even more sophisticated code, all of which should in my opinion not be part of WordPress core, for the same reasons.</p>
<h4>How does it work?</h4>
<p>There are two indicators that together tell if consent is given for a specific consent category, e.g., “marketing”:<br />
1) the region based consent_type, which<br />
can be opt-in, opt-out, or other possible consent_types;<br />
2) and the visitor’s choice: not set, allow, or deny.</p>
<p>The consent_type is a function that wraps a filter, “wp_get_consent_type”. If there’s no consent management plugin to set it, it will return false. This will cause all consent categories to return true, allowing cookies to be set on all categories.</p>
<p>If opt-in is set using this filter, a category will only return true if the value of the visitor’s choice is “allow”.</p>
<p>If the region based consent_type is opt-out, it will return true if the visitor’s choice is not set or is “allow”.</p>
<p>Clientside, a consent management plugin can dynamically manipulate the consent type and set several cookie categories.</p>
<p>A plugin can use a hook to listen for changes or check the value of a given category.</p>
<p>Categories and most other stuff can be extended with a filter.</p>
<h3>Existing integrations</h3>
<p>Categorized, and sorted alphabetically</p>
<h4>Example plugin</h4>
<ul>
<li><a href="https://github.com/rlankhorst/consent-api-example-plugin" rel="nofollow ugc">Example plugin</a>. The plugin basically consists of a shortcode, with a div that shows a tracking or not tracking message. No actual tracking is done 🙂</li>
</ul>
<h4>Consent Management Providers</h4>
<ul>
<li><a href="https://wordpress.org/plugins/sirdata-cmp/" rel="ugc">Abconsent Sirdata CMP</a>.</li>
<li><a href="https://wordpress.org/plugins/beautiful-and-responsive-cookie-consent/" rel="ugc">Beautiful Cookie Consent Banner</a>.</li>
<li><a href="https://wordpress.org/plugins/clickio-consent/" rel="ugc">Clickio Consent</a></li>
<li><a href="https://wordpress.org/plugins/complianz-gdpr/" rel="ugc">Complianz GDPR/CCPA</a>.</li>
<li><a href="https://consent.studio/" rel="nofollow ugc">Consent Studio</a>.</li>
<li><a href="https://wordpress.org/plugins/consent-manager/" rel="ugc">consentmanager</a>.</li>
<li><a href="https://conzent.net/" rel="nofollow ugc">Conzent</a>.</li>
<li><a href="https://wordpress.org/plugins/cookiebot/" rel="ugc">Cookiebot</a>.</li>
<li><a href="https://wordpress.org/plugins/cookiefirst-gdpr-cookie-consent-banner/" rel="ugc">CookieFirst</a>.</li>
<li><a href="https://wordpress.org/plugins/cookiehub/" rel="ugc">CookieHub</a>.</li>
<li><a href="https://wordpress.org/plugins/cookietractor/" rel="ugc">CookieTractor</a>.</li>
<li><a href="https://wordpress.org/plugins/cookie-law-info/" rel="ugc">CookieYes – Cookie Banner for Cookie Consent</a>.</li>
<li><a href="https://wordpress.org/plugins/gdpr-cookie-compliance/" rel="ugc">GDPR Cookie Compliance</a>.</li>
<li><a href="https://www.webtoffee.com/product/gdpr-cookie-consent/" rel="nofollow ugc">GDPR Cookie Consent Plugin – CCPA Ready</a>.</li>
<li><a href="https://getterms.io/consent-manager/" rel="nofollow ugc">GetTerms</a>.</li>
<li><a href="https://wordpress.org/plugins/iubenda-cookie-law-solution/" rel="ugc">iubenda | All-in-one Compliance</a>.</li>
<li><a href="https://wordpress.org/plugins/ibamu/" rel="ugc">Lawwwing</a>.</li>
<li><a href="https://wordpress.org/plugins/pressidium-cookie-consent/" rel="ugc">Pressidium Cookie Consent</a>.</li>
<li><a href="https://wordpress.org/plugins/trustarc-cookie-consent-manager/" rel="ugc">TrustArc Cookie Consent Manager</a></li>
</ul>
<h4>Consent Requiring Plugins</h4>
<ul>
<li><a href="https://wordpress.org/plugins/add-to-any/" rel="ugc">AddToAny</a>.</li>
<li><a href="https://www.appfromlab.com/product/woocommerce-utm-tracker-plugin/" rel="nofollow ugc">AFL UTM Tracker Plugin</a>.</li>
<li><a href="https://wordpress.org/plugins/burst-statistics/" rel="ugc">Burst Statistics</a>.</li>
<li><a href="https://wordpress.org/plugins/google-site-kit/" rel="ugc">Google Site Kit</a>.</li>
<li><a href="https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/" rel="ugc">Pixel Manager for WooCommerce</a>.</li>
<li><a href="https://wordpress.org/plugins/woocommerce/" rel="ugc">Woo</a>.</li>
<li><a href="https://wordpress.org/plugins/wp-statistics/" rel="ugc">WP Statistics</a>.</li>
</ul>
<h3>Demo site</h3>
<p><a href="https://wpconsentapi.org/" rel="nofollow ugc">wpconsentapi.org</a><br />
Below are the plugins used to set up the demo site:</p>
<ul>
<li>Complianz</li>
<li><a href="https://github.com/rlankhorst/consent-api-example-plugin" rel="nofollow ugc">The example plugin</a></li>
</ul>
<h4>javascript, consent management plugin</h4>
<pre><code>//set consent type
window.wp_consent_type = 'optin'

//dispatch event when consent type is defined. This is useful if the region is detected server side, so the consent type is defined later during the pageload
let event = new CustomEvent('wp_consent_type_defined');
document.dispatchEvent( event );


//consent management plugin sets cookie when consent category value changes
wp_set_consent('marketing', 'allow');
</code></pre>
<h4>javascript, tracking plugin</h4>
<pre><code>//listen to consent change event
document.addEventListener("wp_listen_for_consent_change", function (e) {
  var changedConsentCategory = e.detail;
  for (var key in changedConsentCategory) {
    if (changedConsentCategory.hasOwnProperty(key)) {
      if (key === 'marketing' && changedConsentCategory[key] === 'allow') {
        console.log("just given consent, track user")
      }
    }
  }
});

//basic implementation of consent check:
if (wp_has_consent('marketing')){
  activateMarketing();
  console.log("set marketing stuff now!");
} else {
  console.log("No marketing stuff please!");
}
</code></pre>
<h4>PHP</h4>
<pre><code>//declare compliance with consent level API
$plugin = plugin_basename( __FILE__ );
add_filter( "wp_consent_api_registered_{$plugin}", '__return_true' );

/**
* Example how a plugin can register cookies with the consent API
 * These cookies can then be shown on the front-end, to the user, with wp_get_cookie_info()
 */

function my_wordpress_register_cookies(){
    if ( function_exists( 'wp_add_cookie_info' ) ) {
        wp_add_cookie_info( 'AMP_token', 'AMP', 'marketing', __( 'Session' ), __( 'Store a unique User ID.' ) );
    }
}
add_action('plugins_loaded', 'my_wordpress_register_cookies');


if (wp_has_consent('marketing')){
//do marketing stuff
}
</code></pre>
<h4>Service-level consent</h4>
<p>In addition to category-based consent, the API supports service-level consent control. This allows consent management plugins to grant or deny consent for specific services (like ‘google-analytics’ or ‘facebook-pixel’) independently from their category. When checking service consent with wp_has_service_consent(), the API first checks if explicit consent exists for that service. If no explicit consent is set, it falls back to the consent status of the service’s category. This enables fine-grained control: a user might accept statistics cookies in general, but explicitly deny a specific analytics service.</p>
<p>Service consent can be checked and set both server-side (PHP) and client-side (JavaScript):</p>
<p>PHP:</p>
<pre><code>//check if a specific service has consent
if ( wp_has_service_consent( 'google-analytics' ) ) {
    //activate google analytics
}

//check if a service is explicitly denied
if ( wp_is_service_denied( 'facebook-pixel' ) ) {
    //service was explicitly denied by user
}

//set service consent
wp_set_service_consent( 'google-analytics', true ); //grant consent
wp_set_service_consent( 'facebook-pixel', false ); //deny consent

//listen for service consent changes
add_action( 'wp_consent_service_changed', function( $service, $consented ) {
    error_log( "Service {$service} consent changed to: " . ( $consented ? 'granted' : 'denied' ) );
}, 10, 2 );
</code></pre>
<p>JavaScript:</p>
<pre><code>//check service consent
if ( wp_has_service_consent( 'youtube' ) ) {
    //activate tracking
}

//check if explicitly denied
if ( wp_is_service_denied( 'facebook-pixel' ) ) {
    //service denied
}

//set service consent
wp_set_service_consent( 'youtube', true );

//listen for service consent changes
document.addEventListener( 'wp_consent_api_status_change_service', function( e ) {
    console.log( 'Service: ' + e.detail.service + ', consented: ' + e.detail.value );
});
</code></pre>
<p>Any code suggestions? We’re on <a href="https://github.com/WordPress/wp-consent-level-api" rel="nofollow ugc">GitHub</a> as well!</p>


WP Consent API


Louis was great helping me with an issue. Plugin works great and highly recommend!


Great Support Team


The wp‑consent‑api plugin provides a clean, standardized way to manage user consent across plugins and themes. It solves a core problem with a lightweight API. This is definitely a feature that should be integrated into WordPress core to ensure consistent and compliant consent handling by default.


Future of WP Consent Management

Simple Consent API to read and register the current consent category.

clym

<h3>Website Compliance Simplified</h3>
<p>With Clym, you can expect a software solution that covers all global data privacy regulations, including the GDPR, CCPA, LGPD, and more. Our platform allows you to manage consents, legal documents, and data subject requests all in one place.</p>
<h3>Installation guide</h3>
<p>Here is a <a href="https://knowledge.clym.io/how-to-install-clym-on-a-wordpress-website-with-plugin" rel="nofollow ugc">step-by-step guide for installing</a> Clym on your WordPress website using the Clym Plugin</p>
<h3>Solutions</h3>
<h3>Consent management</h3>
<ul>
<li><strong>Business friendly approach:</strong> Using Clym helps your attorneys sleep better at night,but what about your marketing team? We’ve got them covered too: the data is thelifeblood of your marketing team’s efforts to drive top-line revenues. That’s why at Clym we believe in striking the right balance between legal compliance and marketing optimization. Our platform allows the maximum amount of data to be collected in accordance with the regulation imposed by your website’s visitors.</li>
<li><strong>A user interface and experience customers expect:</strong> You put a lot of money into the look and feel of your website, and we’re not here to intrude. Our customizable platform provides you with the ability to have the look and feel you want: widget placement, color scheme and branding for your company can reduce the friction your website visitors experience when browsing your website.</li>
<li><strong>Global Coverage:</strong> New regulations are introduced into law on a regular basis and existing regulations are frequently amended. Clym’s platform configures the location-specific settings needed to ensure you are set up for success.</li>
<li><strong>Easy to implement:</strong>  We’re here to reduce your headaches associated with data privacy law compliance, so our cookie consent manager starts working on your website with a simple copy and paste of Javascript code. We have default settings for all major data privacy laws around the globe, and our clean, crisp user interface makes it easy to customize how you want your website to look and feel. And if you run into questions, our support team is available around the clock to assist.</li>
<li><strong>Audit trail:</strong> For every visit to your website a record of given consent is registered through our tool, which helps you have an audit-ready trail of data. This way you are always prepared to show when, where, why, what and how consent was obtained.</li>
</ul>
<h3>Data subjects’ requests</h3>
<ul>
<li><strong>Collect and store DSARs:</strong>  Clym’s Privacy Widget not only collects your website visitors’ consent, it also allows your visitors to submit DSARs</li>
<li><strong>Verify submitted requests:</strong> When a DSAR is submitted through Clym’s Privacy Widget, an email is sent to the individual that made the request in order for them to validate the request through the verification link within that email. This is a precaution against spam requests.</li>
<li><strong>Notifications:</strong> You can view all requests submitted by your customers in real time by logging into your account. In addition to viewing DSARs within your admin console, you can also assign one or more email addresses to receive a notification any time a new request has been verified by the user, keeping you up to date with everything.</li>
<li><strong>Efficient reply system:</strong>  Clym makes it easy for you to timely respond to DSARs through your admin console so that all responses and correspondence are time-stamped and tied directly to the request. Also, to save time for you and your team, Clym provides default reply templates for various types of requests, that can be customized as needed, based on your preferences and language.</li>
</ul>
<h3>Policies and other legal documents</h3>
<ul>
<li><strong>Manage Terms, Policies, Agreements, and Procedures:</strong> Clym helps you simplify and streamline policy management, adaptable by jurisdiction. Create, update, and communicate policies at any time, in a transparent way, letting users know what the latest version is and when it was updated. Manage public or private agreements and procedures.</li>
<li><strong>Embed and share policies:</strong>  All policies, agreements and procedures managed through Clym can be easily included in your domain or shared with partners by using embed codes and unique document URLs. Whenever a new document version is created, we automatically sync and update it everywhere.</li>
</ul>
<h3>Features:</h3>
<h3>Continuous website scanning</h3>
<ul>
<li>This feature gives you comfort in knowing you are up-to-date with the categorization and   classification   of   your   scripts   and   cookies.   It   scans   every   visited   page, <strong>automatically</strong> without affecting the <strong>website’s performance</strong>.</li>
</ul>
<h3>Privacy widget</h3>
<ul>
<li>The Clym widget is regulation and location specific covering <strong>35+ privacy regulations (including GDPR, CPRA, LGPD), 40+ languages</strong>, and it lets users interact with <strong>legal documents, terms, contracts, DSARs, and policies</strong>, relevant to their location.</li>
<li>The widget is customisable to ensure the user’s seamless navigation experience: you can add a logo and choose the colors to display in order for the design to <strong>follow your brand guidelines, select the privacy widget’s position</strong> that best suits the flow of your website visitor and <strong>make opt-in and opt-out</strong> easy by clearly presenting their options.</li>
</ul>
<h3>Geofencing</h3>
<ul>
<li>Clym uses IP addresses of your website visitors to determine where they are and automatically   show   them   the   legal   content   relevant   to   their   country   or   region: location-specific  scripts,   cookies,   and   legal   documents,   content   language   set <strong>automatically</strong>, and allow users to <strong>toggle between</strong> languages and jurisdictions.</li>
<li>Clym’s robust settings allow you to adhere to all location-specific privacy regulations by using Clym’s <strong>database of regions and countries</strong> with their corresponding data privacy laws, add and  <strong>customize jurisdictions</strong>  for less common locations, and <strong>adjust</strong> the widget, cookie settings, documents, and other features of each jurisdiction.</li>
</ul>
<h3>Insights</h3>
<ul>
<li>Get a 360° data overview of all your website consents and DSARs along with audit-ready data reports through <strong>round-the-clock</strong> updates on page views, cookies, scripts, and   consents,  <strong>user-friendly</strong>  statistics   dashboard,  <strong>transparent</strong>  consent   analytics broken down into categories.</li>
<li>Keep track of  <strong>open, in progress, overdue, or closed DSARs</strong>, analyze requests filtering them by  <strong>device type, browser, regulation, country, language</strong>, and use visual charts and graphs for clean <strong>reports showing DSAR changes over time</strong>.</li>
<li>Use predefined filters and views to obtain accurate data that will help you improve consent rates and brand perception. You have the ability to <strong>analyze pageviews</strong> by country, device, browser language and type,  <strong>check consent changes in time</strong>  by cookie/script purpose category and consent type, <strong>apply detailed filters</strong> to display all the information you need to acquire customer data fairly</li>
</ul>
<h3>Embedded content</h3>
<ul>
<li>Let users know what their consent is needed for, what data they disclose, and who will receive it. You can <strong>automatically</strong> block external resources collecting user data without prior consent, add iFrames from another site  <strong>directly to your website</strong>  to embed content in a compliant manner, and  <strong>display the consent message</strong>  layer before loading the iFrame to keep your visitors informed</li>
</ul>
<h3>Localization</h3>
<ul>
<li>If you only use simple privacy content, you don’t need to hire a translator. Clym offers turnkey translations for the most common consent purposes, such as labels or cookie classification available in <strong>30+ languages</strong> through <strong>legally-approved</strong> translations.</li>
<li>You can also upload your own translations of complex documents, such as terms of service or privacy policy through the <strong>customizable</strong> appearance and behavior of the privacy widget and an <strong>easy to use editor</strong> that doesn’t require technical skills to add translations.</li>
</ul>


WP Consent API vs One interface for Cookie Consent and DSAR Compliance. Covering GDPR, CPRA and more.