Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager vs FAZ Cookie Manager

🍪 What Cookie Consent Does Scans your site for cookies. Cookie Consent detects cookies by loading your pages in a full headless browser (Chromium), the same way a real visitor experiences your site. This catches cookies set by JavaScript execution, third-party embeds, analytics snippets, and dynamically loaded content that simpler HTTP-based scanners often miss. Detected cookies are automatically categorized into Necessary, Analytics, Marketing, Functional, or Uncategorized. You can scan your homepage, crawl your full site, or specify custom URLs. Results merge into your cookie manager without overwriting any manual edits. Blocks scripts until consent is given. In GDPR (opt-in) mode, non-essential scripts don’t execute until the visitor consents to the relevant category. This applies to analytics scripts, advertising pixels, tracking tags, and any other third-party script that sets non-essential cookies. Cookie Consent intercepts both WordPress-enqueued scripts and inline scripts, modifying them to wait for consent before firing. Essential cookies, like those used for login sessions, shopping carts, and basic site functionality, are never blocked. In CCPA (opt-out) mode, scripts load by default and visitors can choose to opt out of specific categories. Displays a customizable consent banner. Visitors see a cookie banner with clear options to accept, reject, or manage preferences by category. The banner, preferences dialog, and revisit button are all customizable including layout, position, colors, text, button styles, and border radius. A live preview shows you what visitors will see as you make changes. Logs every consent decision. Each time a visitor makes a choice, Cookie Consent records the decision type (accept all, reject all, or custom), the specific category preferences, and a timestamp. These records create an audit trail you can reference if compliance questions arise. Keeps everything in one place. Cookie list, scan results, script rules, consent logs, banner design, and compliance settings, all in one admin area. No separate platform to sign up for, no external app to connect, no additional accounts to manage. ⚙️ Setup A guided wizard gets your banner live in three steps: 1. Choose your compliance model – Select GDPR (opt-in) or CCPA (opt-out) based on your audience and the regulations that apply to your site. 2. Configure your banner – Pick a layout, adjust colors and text, and preview what visitors will see. 3. Scan your site – Cookie Consent visits your pages with a real browser, finds active cookies, and categorizes them. Your banner goes live with accurate cookie data from the start. After setup, you can re-scan anytime, refine your design, recategorize cookies, and adjust script rules, all from the same dashboard. 🎨 Banner Design & Customization Banner Templates: Start with a pre-configured template during setup, then customize to fit your site. Templates are tailored to your selected compliance model (GDPR or CCPA) so the default structure, buttons, and consent flow match your requirements from the start. Layouts: Footer bar, slide-in, or center popup. Positioning: Control where and how the banner appears on the page. Styling: Background colors, text colors, button primary and secondary colors, border radius, and button sizing, enough control to match any brand or design. Content: Editable title, description, and button labels for the banner, preferences dialog, and revisit button. Write in your own voice. Preferences Dialog: When a visitor clicks Manage Preferences, they see a breakdown of each cookie category with descriptions and toggles. Necessary cookies are marked as always active. Visitors choose exactly which categories they\’re comfortable with. Revisit Consent Button: A persistent button visitors can click anytime to reopen the preferences dialog and change their choices. Responsive: Automatically adapts to desktop and mobile. Live Preview: Desktop and mobile preview with a device toggle. Updates in real time as you edit — no publishing and refreshing the front end. Elementor Editor Integration [Requires Elementor Pro]: Open the banner and preferences dialog in the Elementor visual editor. Drag-and-drop widgets, styling panels, and your full design system, the same workflow you use for the rest of your site. Cloud Templates [Requires Elementor Pro]: Save a finished banner design to your cloud library and deploy it across other sites in one click. Useful for agencies and freelancers managing multiple client sites with consistent branding. 📋 Cookie & Script Management Cookie Manager: A central dashboard showing every cookie on your site, organized by consent category. Each entry shows the cookie name, domain, category, duration, and a description field. Add cookies manually, edit any field, or delete entries you no longer need. Drag-and-drop cookies to reorder them within a category, the order you set here is the order visitors see in the preferences dialog. Category View: Categories display as expandable accordion sections: Necessary, Analytics, Marketing, Functional, and Uncategorized. Each shows a status badge: \”Always Active\” for Necessary, or an Active/Inactive toggle for other categories. Expand any section to see the individual cookies it contains. Scanning: Run a scan anytime with homepage only, full-site crawl, or custom URLs you specify. Include and exclude lists let you control exactly which pages get scanned. Only one scan runs at a time. New cookies are added automatically; existing manual edits are never overwritten. A progress indicator shows scan status in real time. Script Manager: Control how individual scripts behave, independent of their category\’s default rule. Three options per script: – Do Not Block – Script always loads, bypassing the consent engine. Use for scripts you\’ve verified as essential but that aren\’t automatically detected as Necessary. – Block Until Consent – Script waits until the visitor consents to its assigned category. This is the default for non-essential scripts in GDPR mode. – Always Block – Script never loads under any circumstances. Use for scripts you want permanently disabled. Script Input: Add scripts by URL or paste inline code directly. Cookie Consent matches scripts using URL comparison or normalized snippet hashing. Inline Script Blocking: An optional output buffering method catches inline and hardcoded scripts that aren\’t loaded through the standard enqueue system. Toggle it off from Advanced Settings if you want to manage inline scripts manually or minimize server-side processing. Developer Hooks: Advanced users and agencies can hook into the blocking engine via an MU-plugin snippet to delay dynamically injected scripts, including those created by page builders or loaded after DOM ready. Scan History: A table of past scans showing date (UTC), status (success/failed), URLs scanned, categories found, and total cookies detected. = 🔒 Compliance Settings= GDPR (Opt-in): Non-essential scripts are blocked by default. The banner presents three options: Accept All, Reject All, and Manage Preferences. Visitors who open the preferences dialog see each cookie category with a description and a toggle. Necessary cookies are labeled \”Always Active\” with no toggle, they can\’t be disabled. Consent must be given before Analytics, Marketing, or Functional scripts execute. CCPA (Opt-out): All scripts load by default. The banner includes a Do Not Sell My Data option. Visitors who opt out trigger blocking of Marketing category scripts. Global Privacy Control (GPC) signals sent by the visitor\’s browser are detected and respected automatically. Consent Expiration: Set how many days a visitor\’s choice is remembered (1–365 days, default 180). When the period expires, the banner reappears and the visitor is prompted to choose again. Until expiration, the previous choice is respected and the banner stays hidden. Banner Activation: A global toggle to enable or disable the cookie banner. 🎁 Free Features Everything you need for working cookie consent. – Guided 3-step setup wizard – GDPR (opt-in) and CCPA (opt-out) compliance models – Google Consent Mode v2 – Automatically send consent signals to Google so analytics and ad measurement continue working after consent is deployed – Cookie scanning with headless browser (Chromium) detection – Automatic categorization into Necessary, Analytics, Marketing, Functional, and Uncategorized – Automatic script blocking for non-essential cookies – Blocks both enqueued scripts and inline scripts – Global Privacy Control (GPC) and Do Not Sell support – Customizable consent banner with Accept All, Reject All, and Manage Preferences – Preferences dialog with per-category toggles and descriptions – Revisit consent button for visitors to update choices anytime – Banner templates tailored to GDPR and CCPA compliance models – Footer bar, slide-in, and center popup layouts – Full styling controls: colors, buttons, borders, sizing – Editable banner text, button labels, and dialog content – Responsive desktop and mobile design – Live banner preview with device toggle – Cookie manager with manual add/edit/delete and sorting – Script manager with per-script overrides (always load, block until consent, always block) – Consent logging with timestamped audit trail – Configurable consent expiration (1–365 days) – Scan history with status and results tracking – Output buffering toggle for inline script blocking – No external dashboards – No CDN dependencies 🔥 Premium Cookie Consent features available with Elementor One White-Label: Remove Cookie Consent branding from the consent banner entirely. Multilingual Translations: Translate the banner and preferences dialog into additional languages for international visitors. Consent Log Export: Download consent records in CSV format for audits, legal reviews, or internal documentation. Advanced Scan Rule Exclusions: Exclude specific paths or URLs from cookie scans. Useful for staging environments, admin areas, or sections that don\’t need scanning. Disable Banner on Specific Pages: Prevent the banner from loading on pages you select (e.g., internal dashboards, login screens). Elementor Editor Design [Requires Elementor Pro]: Open the cookie banner and preferences dialog in the full Elementor visual editor. Drag-and-drop layout, widget-level control, and live editing. Cloud Templates [Requires Elementor Pro]: Save banner designs to your cloud library and deploy them across multiple sites instantly. Google Tag Manager Integration [Premium] – Pass consent signals to your GTM container for tag-level consent control. Geo-Targeting [Premium] – Automatically display the correct banner based on visitor location. GDPR opt-in for EU visitors, CCPA opt-out for US visitors without manual configuration. Multi-Region Banner Management [Premium] – Configure and manage separate banner designs and compliance rules for different geographic regions from one dashboard. 🔜 Coming Soon Cookie Policy Generator – Auto-generate a cookie policy page based on the cookies detected on your site. Automatic and Scheduled Scans [Premium] – Set scans to run on a recurring schedule so your cookie list stays current without manual intervention. ♿ Accessibility The Cookie Consent consent banner is built following accessibility best practices. For full website accessibility compliance, Cookie Consent works alongside Ally, Elementor\’s accessibility plugin that scans for and remediates accessibility issues across your site. Installation Install using the WordPress built-in Plugin installer, or Extract the zip file and drop the contents in the wp-content/plugins/ directory of your WordPress installation. Activate the plugin through the ‘Plugins’ menu in WordPress. External Services Cookie Consent requires a connection to an active Elementor account in order to: * Identify the user and provide the user with the purchased service. * Log website visitors consents for “proof of consent” * Preform an external scan of cookies generated by and on the website. * Collect manually submitted feedback, to improve the product. This connection is initiated manually by the user via the plugin’s settings panel. Learn more about our terms and conditionsand Privacy Policy. This plugin uses a 3rd party service operated by Elementor. Cookie Consent uses a 3rd party service operated by Mixpanel to collect interactions with the plugin but only for consenting users, meaning if the user has Not consented to “sharing data” (default) this is disabled and no collection is made.

Tired of cookie consent plugins that lock essential features behind paywalls, require cloud accounts, or send your visitors’ data to third-party servers? FAZ Cookie Manager is a WordPress plugin that helps you implement cookie consent and privacy workflows for international regulations — completely free, with no strings attached. No account to create. The plugin requires no cloud service connection. Basic features like consent logging and geo-targeting are included — no premium plan needed. Core consent features run on your own server, and you own all your data. Why FAZ Cookie Manager? Most cookie consent plugins follow the same pattern: a free version with crippled features, and a paid tier starting at $10-50/month that unlocks what you actually need (cookie scanning, consent logs, Google Consent Mode, IAB TCF). FAZ Cookie Manager breaks that model: Cookie scanner — scans your site directly from your browser. No external service, no API limits, no waiting. Finds the cookies a JavaScript scanner cannot see — cookies set by PHP before the page renders, including HttpOnly ones your browser hides from scripts, are captured from the server response itself: from pages, AJAX, REST calls and sub-resources, then replayed across the URLs the crawl actually visited. Those are exactly the cookies that get set before consent, so a declaration built without them is incomplete. Cookie Policy generator — a jurisdiction-aware policy page (GDPR / CCPA / LGPD / POPIA) built from your own company details and the scanner’s live cookie inventory, published with [faz_cookie_policy_complete]. Ships in en, it, fr, de, es, pt-BR, bg and cs, and every section can be rewritten per jurisdiction and language. Consent logging with CSV export — every consent is recorded locally in your database. Export anytime for audits. Google Consent Mode v2 — all 7 consent signals sent to Google tags. No premium required. IAB TCF v2.3 — full Transparency and Consent Framework API and UI. Operating as a recognised CMP needs your own registered IAB Europe CMP ID; without one the TCF interface stays inactive and no TC string is produced, so invalid signals are never broadcast to vendors. Script blocking — tag any script with data-faz-tag to hold it until its category is accepted. Geo-targeting and 180+ languages — serve the right banner per region and translate every string, or use a built-in translation. Guided setup wizard — a first-run wizard detects your environment (multilingual plugin, page cache, WooCommerce, existing consent data) and configures jurisdiction-appropriate defaults, explaining each choice in plain language. Existing sites are treated as already set up and are never nagged. A/B test your consent banner — run two or more existing banners with a persistent random split and read the accept rate per variant. Only active, independently compliant banners take part, so improving your wording can never quietly become a dark pattern. Off by default. Schrems II transfer disclosure — flag per cookie that a service sends personal data to a country without an EU adequacy decision, with the safeguard you rely on. Worded neutrally: it states the fact and your described safeguard, and never claims that safeguard is legally sufficient. Off by default. Age-appropriate consent (GDPR Art. 8) — an optional age-confirmation checkbox above the buttons. It gates only Accept, never Reject or withdraw, so the two keep equal weight. This is a self-declared affirmation and is not a substitute for the parental-consent verification Art. 8(2) requires. Off by default. Ad-blocker resilience — keeps the legally required notice visible when a cosmetic filter list hides elements whose class contains “cookie” or “consent”. A single deferred re-assert: no loop, no cookie wall. It protects a mandatory notice; it does not circumvent a privacy tool. Off by default. Editable “Do Not Sell” opt-out text — customise the title, description and toggle label of the CCPA / US State Laws opt-out popup, per language. E-commerce & payment friendly — a per-gateway opt-in (PayPal, Stripe, Square, Braintree, Klarna, Mollie, Amazon Pay) lets payment SDKs load before consent when you enable that gateway, so pre-consent blocking never breaks a payment button. Off by default; a real WooCommerce checkout/cart is exempt automatically. Cache & object-cache compatible — purges and bypasses FlyingPress, LiteSpeed, WP Rocket, W3 Total Cache and more on save, epoch-invalidates Redis / Memcached object caches, and keeps WPML, Polylang, TranslatePress and Weglot banners in the right language behind a full-page cache. Details in the FAQ. Microsoft UET/Clarity, revisit widget, accessibility — consent integration for Microsoft tags, a floating button so visitors can change their mind, and keyboard/screen-reader support throughout. Helps with these frameworks This plugin assists consent and privacy workflows. It does not itself create, provide, or guarantee legal compliance, and you remain responsible for the final configuration for your site and jurisdiction. GDPR (EU General Data Protection Regulation) — Opt-in consent, granular categories, right to withdraw CCPA / CPRA (California Consumer Privacy Act) — “Do Not Sell or Share” opt-out link ePrivacy Directive (EU Cookie Law) — Consent-based script blocking support Italian Garante Privacy — 6-month consent expiry setting and consent logging controls EDPB Guidelines — No scroll-as-consent, no pre-checked categories, equal button prominence options LGPD (Brazil General Data Protection Law) — Consent-based model POPIA (South Africa Protection of Personal Information Act) — Conservative consent-based preset under s.11(1)(a); other s.11(1)(b)-(f) justifications require separate assessment Try it Live Try FAZ Cookie Manager in WordPress Playground — no account, no install, runs entirely in your browser. How it works Install and activate — the cookie banner appears immediately with sensible defaults Scan your site to detect cookies automatically Customize the banner design, text, and colors to match your brand Enable Google Consent Mode or IAB TCF if you use advertising tools Monitor consent analytics on the dashboard Core banner functionality runs on your WordPress site. Optional update/download features may contact GitHub, IAB Europe, MaxMind, ipinfo.io (opt-in VPN detection), or the AMP CDN depending on which features you enable and use. Cookie Policy generator A dedicated Cookie Policy admin tab and the [faz_cookie_policy_complete] shortcode build a policy page from the cookies your site actually sets. Jurisdiction-aware — GDPR (EU/EEA/UK), CCPA/CPRA, LGPD or POPIA, each with the legal references and sections that framework requires. Auto-populated — the inventory renders live from the scanner, so a newly discovered cookie appears with its category, duration and description. Multilingual — en, it, fr, de, es, pt-BR, bg, cs; override per render with lang="it" or let the browser decide. Editable per jurisdiction and language — replace any section with your own Markdown, placeholders included; leave one empty and it keeps receiving reviewed updates. Your company data — name, address, DPO email, retention period. Never seeded from admin_email or blogname. Honest by default — a localised disclaimer states the templates are a starting point, not legal advice. The older [faz_cookie_policy] and [faz_cookie_table] shortcodes and the faz/cookie-table block are unchanged. Multi-banner geo-routing and multilingual content Two orthogonal features that combine freely: the visitor’s country decides which banner is served, the visitor’s browser language decides the translation shown inside it. Geo-routing picks a banner per country — typically a strict GDPR banner for the EU/EEA/UK and a CCPA opt-out banner for California — resolving the country from Cloudflare’s CF-IPCountry header (opt-in), then a server GeoIP module or extension, then the self-hosted MaxMind GeoLite2 database. All four are local to your server or your CDN edge; no visitor IP is sent to a third party for country resolution. When none of them is available the most-protective GDPR ruleset is applied to every visitor. Translations live inside each banner and are resolved client-side from navigator.languages, so a country-targeted banner still works behind a full-page cache. In practice that means two banner rows rather than eight: one EU banner holding English, Italian, German, French and Polish, one US banner holding English and Spanish. External Services Summary. This plugin is cloud-free: consent is stored on your own site and there is no vendor account, dashboard or telemetry. Below is the full outbound picture, one heading per item — the optional features that contact an external host (none run unless you enable them), the public REST endpoints this plugin exposes on your own domain, and a note on third-party domain strings that appear in the code as matching patterns and are never contacted. Each entry states its trigger, what leaves your server, and the provider’s terms. GitHub / Raw GitHubusercontent (Open Cookie Database) Used to refresh the built-in cookie definitions snapshot for the optional auto-categorize feature. Triggered when: you click the definitions update action in the Cookies screen. Data sent: your server IP address and standard HTTP request headers. Service URLs: * https://raw.githubusercontent.com/fabiodalez-dev/Open-Cookie-Database/master/open-cookie-database.json Terms of Service / Privacy Policy: * https://docs.github.com/en/site-policy/github-terms/github-terms-of-service * https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement IAB Europe / vendor-list.consensu.org Used to download the Global Vendor List and purpose translations for the optional IAB TCF feature. Triggered when: you manually update the vendor list, and weekly while IAB TCF is enabled. Data sent: your server IP address and standard HTTP request headers. Service URLs: * https://vendor-list.consensu.org/v3/vendor-list.json * https://vendor-list.consensu.org/v3/purposes-en.json Privacy Policy: * https://iabeurope.eu/privacy-policy/ MaxMind Used to download a GeoLite2 database for optional geo-targeting. You choose the edition in Settings → GeoIP Database: the smaller Country edition (default, country-level only) or the larger City edition (adds region/subdivision data for sub-national province/state routing such as Quebec Law 25). City is a much larger download; pick it only if you rely on region-level routing. Triggered when: you enter a MaxMind license key in Settings and start the database download. Data sent: your server IP address, the license key you provide, and standard HTTP request headers. Service URL: * https://download.maxmind.com/app/geoip_download Terms of Service / Privacy Policy: * https://www.maxmind.com/en/terms-of-use * https://www.maxmind.com/en/privacy-policy ipinfo.io (optional live VPN detection and admin preview) The live geo-ruleset runtime applies jurisdiction-specific consent defaults and mandatory controls. If an administrator explicitly enables ipinfo.io, the jurisdiction pipeline may use it to classify a visitor as VPN/proxy/Tor and apply the most-protective fallback; the Geo-routing admin preview uses the same detector. Leave this integration disabled to keep visitor geolocation entirely on trusted headers and the local GeoLite2 database. Triggered when: an administrator has configured an ipinfo API key, confirmed the transfer terms, and enabled the integration, then either a visitor-facing jurisdiction lookup or an admin preview runs the geo detector. Without that explicit opt-in, ipinfo is never called. Data sent: the visitor IP address or the IP entered/resolved for an admin preview, the configured API key, and standard HTTP request headers. The result is cached locally for 24 hours hash-keyed by IP. Service URL: * https://ipinfo.io/{ip}/privacy Terms of Service / Privacy Policy: * https://ipinfo.io/terms-of-service * https://ipinfo.io/privacy-policy * DPA (Data Processing Agreement) available on request: https://ipinfo.io/contact Plugin REST endpoint /faz/v1/banner (public) Serves the banner configuration to the visitor’s browser under Cache Compatibility Mode, so a full-page cache can store one visitor-invariant HTML document while the banner still resolves per request. Hosted by this WordPress install; no third-party host is involved. Triggered when: Cache Compatibility Mode is enabled and a visitor loads a page with no stored consent. Data sent: nothing about the visitor. The response carries banner text, categories and styling only. Service URL: * https://{your-site}/wp-json/faz/v1/banner Plugin REST endpoints /faz/v1/amp-consent/check and /update (public) Used by the plugin’s AMP banner to reconcile the AMP consent cache with the first-party FAZ consent cookie. Both are hosted by the same WordPress install. Requests must pass AMP CORS provenance checks — the publisher origin, or that publisher’s exact HTTPS Google AMP Cache origin with the matching __amp_source_origin. Arbitrary origins, another publisher’s cache subdomain, and requests without AMP provenance are rejected before consent can change. Sites on another registered AMP cache can add their own verified exact origin with the faz_amp_consent_allowed_cache_origin filter. Triggered when: an AMP page checks an existing decision, or the visitor saves AMP cookie preferences. Data sent: banner scope, consent state, per-category purpose choices, and the AMP-generated user ID that amp-consent includes. FAZ neither stores nor logs that ID, and does not derive its consent identifier from it. The update endpoint tries to synchronise the first-party cookie with SameSite=None; Secure; a browser that blocks third-party cookies may refuse it behind an AMP Cache, and the bridge then fails closed and asks again rather than claiming cross-origin parity it cannot guarantee. Service URLs: * https://{your-site}/wp-json/faz/v1/amp-consent/check * https://{your-site}/wp-json/faz/v1/amp-consent/update AMP Project CDN Used only on AMP pages when the AMP consent integration is active, to load the official amp-consent component required by AMP. Triggered when: an AMP page renders the AMP consent banner. Data sent: the visitor IP address and standard browser request data to the AMP CDN. Service URL: * https://cdn.ampproject.org/v0/amp-consent-0.1.js Documentation / Privacy: * https://amp.dev/documentation/components/amp-consent * https://policies.google.com/privacy Note on third-party domain strings inside the plugin codebase The source contains third-party domain names (js.stripe.com, connect.facebook.net, googletagmanager.com and others) purely as string patterns, for two purposes: Blocking detection — to recognise analytics, advertising and tracking scripts injected by the site’s other plugins, so they can be held until consent. This plugin loads none of them itself. Explicit exceptions — no whole third-party plugin is whitelisted and no profiling resource is: Google Fonts, Google Maps, OAuth endpoints and generic CDNs stay blocked until consent. The only defaults are four anti-abuse challenge endpoints (reCAPTCHA, its gstatic assets, Cloudflare Turnstile, hCaptcha), which gate a form the visitor is actively submitting and are therefore strictly necessary. An administrator can add a narrow audited exception in Settings, and can remove the CAPTCHA defaults too. Every outbound request documented above happens only when its feature is used. /faz/v1/banner is hosted by this plugin on the same site: no third-party call leaves the visitor’s browser. Cache Plugin Compatibility When multi-banner geo-routing is active, the rendered HTML can legitimately vary by visitor country. This plugin asks the page-cache layer to bypass caching on those requests by emitting: Cache-Control: no-store, no-cache, must-revalidate, max-age=0 Pragma: no-cache X-LiteSpeed-Cache-Control: no-cache CDN-Cache-Control: no-store and Cloudflare-CDN-Cache-Control: no-store (banner REST endpoint only, so an edge that overrides the browser directive still refuses to store the country-dependent payload) Vary: CF-IPCountry (when the trust filter faz_trust_cf_ipcountry_header is enabled). It is emitted for symmetry but is inert on these responses: nothing is stored, so there is no cache key to vary. Vary only does work on the storable responses — the banner REST endpoint’s non-country-dependent answers, which are served public, max-age=300 and carry the same header. DONOTCACHEPAGE, …