3. DSAR webhook<\/strong> \u2014 When auto-execute DSAR is enabled, CookieKita sends signed data-subject requests (containing the requester\u2019s email) to the plugin so they can be fulfilled on your site.<\/p>\n\nBy using this plugin you agree to the CookieKita Terms of Service (https:\/\/cookiekita.com\/terms) and Privacy Policy (https:\/\/cookiekita.com\/privacy).<\/p>\n\n
Optional third-party tags (only loaded if you enable them)<\/h4>\n\n
CookieKita does not load any of the third-party services below by default. The consent-aware tag installer loads a provider's official script only when you, the site administrator, enter that provider's ID \/ enable it<\/strong>, and even then the script is held back until the visitor gives the matching consent (analytics or marketing). When a tag fires, the visitor's browser loads the provider's script directly and that provider receives standard analytics\/advertising data (e.g. page views, events, IP address, cookie\/device identifiers) \u2014 what is sent and when is determined by that provider. Review each provider's terms and privacy policy before enabling it:<\/p>\n\n\n- Google (Tag Manager, gtag, GA4) \u2014 googletagmanager.com \u2014 terms: https:\/\/policies.google.com\/terms \u2014 privacy: https:\/\/policies.google.com\/privacy<\/li>\n
- Meta Pixel (Facebook) \u2014 connect.facebook.net \u2014 terms: https:\/\/www.facebook.com\/legal\/terms\/ \u2014 privacy: https:\/\/www.facebook.com\/privacy\/policy\/<\/li>\n
- Microsoft Clarity \/ UET \u2014 clarity.ms \u2014 terms: https:\/\/www.microsoft.com\/legal\/terms-of-use \u2014 privacy: https:\/\/privacy.microsoft.com\/privacystatement<\/li>\n
- TikTok \u2014 analytics.tiktok.com \u2014 terms: https:\/\/www.tiktok.com\/legal\/terms-of-service \u2014 privacy: https:\/\/www.tiktok.com\/legal\/privacy-policy<\/li>\n
- LinkedIn Insight \u2014 snap.licdn.com \u2014 terms: https:\/\/www.linkedin.com\/legal\/user-agreement \u2014 privacy: https:\/\/www.linkedin.com\/legal\/privacy-policy<\/li>\n
- X (Twitter) Ads \u2014 static.ads-twitter.com \u2014 terms: https:\/\/legal.twitter.com\/ads-terms.html \u2014 privacy: https:\/\/twitter.com\/en\/privacy<\/li>\n
- Pinterest Tag \u2014 s.pinimg.com \u2014 terms: https:\/\/policy.pinterest.com\/terms-of-service \u2014 privacy: https:\/\/policy.pinterest.com\/privacy-policy<\/li>\n
- Snap Pixel \u2014 sc-static.net \u2014 terms: https:\/\/snap.com\/terms \u2014 privacy: https:\/\/snap.com\/privacy\/privacy-policy<\/li>\n
- Reddit Pixel \u2014 redditstatic.com \u2014 terms: https:\/\/www.redditinc.com\/policies\/user-agreement \u2014 privacy: https:\/\/www.reddit.com\/policies\/privacy-policy<\/li>\n
- Amazon Ads \u2014 c.amazon-adsystem.com \u2014 terms: https:\/\/www.amazon.com\/gp\/help\/customer\/display.html?nodeId=508088 \u2014 privacy: https:\/\/www.amazon.com\/gp\/help\/customer\/display.html?nodeId=468496<\/li>\n
- Criteo \u2014 static.criteo.net \u2014 terms: https:\/\/www.criteo.com\/terms-and-conditions\/ \u2014 privacy: https:\/\/www.criteo.com\/privacy\/<\/li>\n
- Outbrain \u2014 amplify.outbrain.com \u2014 terms: https:\/\/www.outbrain.com\/onyx\/term-of-use\/ \u2014 privacy: https:\/\/www.outbrain.com\/privacy\/<\/li>\n
- Taboola \u2014 cdn.taboola.com \u2014 terms: https:\/\/policies.taboola.com\/terms-of-service\/ \u2014 privacy: https:\/\/policies.taboola.com\/privacy-policy\/<\/li>\n
- Hotjar \u2014 static.hotjar.com \u2014 terms: https:\/\/www.hotjar.com\/legal\/policies\/terms-of-service\/ \u2014 privacy: https:\/\/www.hotjar.com\/legal\/policies\/privacy\/<\/li>\n
- Segment (Twilio) \u2014 cdn.segment.com \u2014 terms: https:\/\/www.twilio.com\/en-us\/legal\/tos \u2014 privacy: https:\/\/www.twilio.com\/en-us\/legal\/privacy<\/li>\n
- Heap \u2014 cdn.heapanalytics.com \u2014 terms: https:\/\/www.heap.io\/terms \u2014 privacy: https:\/\/www.heap.io\/privacy<\/li>\n
- Amplitude \u2014 cdn.amplitude.com \u2014 terms: https:\/\/amplitude.com\/terms \u2014 privacy: https:\/\/amplitude.com\/privacy<\/li>\n
- Mixpanel \u2014 cdn.mxpnl.com \u2014 terms: https:\/\/mixpanel.com\/legal\/terms-of-use\/ \u2014 privacy: https:\/\/mixpanel.com\/legal\/privacy-policy\/<\/li>\n
- FullStory \u2014 fullstory.com \u2014 terms: https:\/\/www.fullstory.com\/legal\/terms-and-conditions\/ \u2014 privacy: https:\/\/www.fullstory.com\/legal\/privacy-policy\/<\/li>\n
- Crazy Egg \u2014 script.crazyegg.com \u2014 terms: https:\/\/www.crazyegg.com\/terms \u2014 privacy: https:\/\/www.crazyegg.com\/privacy<\/li>\n
- Mouseflow \u2014 cdn.mouseflow.com \u2014 terms: https:\/\/mouseflow.com\/legal\/terms\/ \u2014 privacy: https:\/\/mouseflow.com\/legal\/privacy-policy\/<\/li>\n
- Inspectlet \u2014 cdn.inspectlet.com \u2014 terms: https:\/\/www.inspectlet.com\/terms-of-service \u2014 privacy: https:\/\/www.inspectlet.com\/terms-of-service<\/li>\n
- Plausible Analytics \u2014 plausible.io \u2014 terms: https:\/\/plausible.io\/terms \u2014 privacy: https:\/\/plausible.io\/privacy<\/li>\n
- PostHog \u2014 posthog.com \u2014 terms: https:\/\/posthog.com\/terms \u2014 privacy: https:\/\/posthog.com\/privacy<\/li>\n
- Simple Analytics \u2014 simpleanalyticscdn.com \u2014 terms: https:\/\/www.simpleanalytics.com\/terms \u2014 privacy: https:\/\/www.simpleanalytics.com\/privacy-policy<\/li>\n
- HubSpot \u2014 js.hs-scripts.com \u2014 terms: https:\/\/legal.hubspot.com\/terms-of-service \u2014 privacy: https:\/\/legal.hubspot.com\/privacy-policy<\/li>\n
- Intercom \u2014 widget.intercom.io \u2014 terms: https:\/\/www.intercom.com\/legal\/terms-and-policies \u2014 privacy: https:\/\/www.intercom.com\/legal\/privacy<\/li>\n
- Drift \u2014 js.driftt.com \u2014 terms: https:\/\/www.drift.com\/terms-of-service\/ \u2014 privacy: https:\/\/www.drift.com\/privacy-policy\/<\/li>\n
- Crisp \u2014 client.crisp.chat \u2014 terms: https:\/\/crisp.chat\/en\/terms\/ \u2014 privacy: https:\/\/crisp.chat\/en\/privacy\/<\/li>\n
- Tawk.to \u2014 embed.tawk.to \u2014 terms: https:\/\/www.tawk.to\/terms-of-service\/ \u2014 privacy: https:\/\/www.tawk.to\/privacy-policy\/<\/li>\n
- LiveChat \u2014 cdn.livechatinc.com \u2014 terms: https:\/\/www.livechat.com\/legal\/terms\/ \u2014 privacy: https:\/\/www.livechat.com\/legal\/privacy-policy\/<\/li>\n
- Zendesk \u2014 static.zdassets.com \u2014 terms: https:\/\/www.zendesk.com\/company\/agreements-and-terms\/master-subscription-agreement\/ \u2014 privacy: https:\/\/www.zendesk.com\/company\/agreements-and-terms\/privacy-notice\/<\/li>\n<\/ul>\n\n\n
\n- Install through Plugins \u2192 Add New<\/strong>, or upload the
cookiekita<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n- Activate the plugin through the Plugins<\/strong> menu.<\/li>\n
- Open the CookieKita<\/strong> menu and paste your Site Key (skipped automatically if you downloaded a pre-configured copy from your dashboard).<\/li>\n
- (Optional) Activate integrations and paste your tag IDs under CookieKita \u2192 Integrations<\/strong>.<\/li>\n
- (Optional) Add
[cookiekita_cookies]<\/code> to your Privacy Policy page and [cookiekita_dsar]<\/code> to your Data Requests page.<\/li>\n<\/ol>\n\n\n\nDoes this require a CookieKita account?<\/h3><\/dt>\nYes. CookieKita is a companion plugin for the cookiekita.com platform and needs a Site Key from your account. Core banner, blocking, scanner and DSAR form work on the free plan.<\/p><\/dd>\n
Will it slow down my site?<\/h3><\/dt>\nThe banner script is small, async-loaded and CDN-served. The tracker blocker runs a single fast pass per page render.<\/p><\/dd>\n
Does it actually block trackers, or just show a banner?<\/h3><\/dt>\nIt blocks. Recognised tracking scripts and embeds are held back (rendered as inert, consent-gated scripts) and only execute after the visitor consents to the matching category.<\/p><\/dd>\n
How does the consent-aware tag installer work?<\/h3><\/dt>\nYou paste a service ID (e.g. a GA4 Measurement ID or Meta Pixel ID). The plugin emits the vendor\u2019s official loader as a blocked inline script tied to a consent category, so it fires only after the visitor accepts that category.<\/p><\/dd>\n
Is DSAR auto-execution safe?<\/h3><\/dt>\nIt is opt-in (off by default), refuses to delete administrator accounts, and records every action to an audit log. Take a backup before enabling.<\/p><\/dd>\n
Does it work with WooCommerce?<\/h3><\/dt>\nYes. It adds consent-gated eCommerce event tracking (view_item, add_to_cart, begin_checkout, purchase) and uses WooCommerce\u2019s privacy hooks for DSAR.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.1.1<\/h4>\n\n\n- Fix: the banner script (banner.js) was requested with the plugin version as a
?ver<\/code> cache-buster. Because banner.js is a remote script that updates independently of the plugin, this could keep browsers on an older cached copy after a banner update until the plugin version changed. The plugin no longer pins a version to it and lets the script's own cache headers govern freshness, so improvements reach visitors right away.<\/li>\n<\/ul>\n\n1.1.0<\/h4>\n\n\n- Improved: the accessibility toolbar (Settings \u2192 Accessibility toolbar) is now fully customizable from your CookieKita dashboard \u2014 the floating button's colours and corner, which controls the panel shows and the order they appear in. Existing sites keep the full default set until you change it.<\/li>\n
- Improved: refreshed toolbar design \u2014 clearer controls with a level indicator on the steppers, proper switches, and a tidy header\/footer.<\/li>\n
- New: the Accessibility toolbar settings screen now links straight to the dashboard where you customize its appearance.<\/li>\n<\/ul>\n\n
1.0.15<\/h4>\n\n\n- New: optional accessibility toolbar (Settings \u2192 Accessibility toolbar). A floating button visitors can open to adjust text size, line height, letter spacing, contrast (dark\/light\/high), a readable font, stop animations, a big cursor, link\/heading highlighting, a reading guide and hide images \u2014 choices are remembered on their device (localStorage), independent of cookie consent since no data leaves the browser. This is a comfort\/customization toolkit, not an ADA\/WCAG compliance claim \u2014 it complements real accessibility work rather than replacing it. Off by default.<\/li>\n<\/ul>\n\n
1.0.14<\/h4>\n\n\n- Fix: HubSpot's actual analytics beacon (js.hs-analytics.net) was accidentally bundled into the \"HubSpot Forms\" integration's domain list, which silently downgraded it from the correct \"analytics\" consent category to \"preferences\" \u2014 the least strict category. It now stays correctly gated behind analytics consent.<\/li>\n
- Fix: the Matomo and PostHog custom-URL fields rejected otherwise-valid addresses that included a port number (e.g. a self-hosted Matomo on
https:\/\/host:8080\/<\/code>), showing \"does not look right\" for valid input.<\/li>\n- Fix: Google Ads \/ Amazon Ads \u2014 the Amazon integration hardcoded the advertiser region to \"EU\", silently breaking attribution for any non-EU Amazon Ads account. A new optional \"Account region (NA \/ EU \/ FE)\" field lets you set the correct one; existing configs keep working unchanged (defaults to EU).<\/li>\n
- Fix: Criteo was hardcoded to report every single page load as the homepage (\"viewHome\"), making its analytics\/retargeting data wrong on every page except the actual front page. Criteo now gets real, page-aware WooCommerce events \u2014 viewItem on product pages, viewBasket on add-to-cart and checkout, trackTransaction on purchase (de-duplicated per order) \u2014 and \"viewHome\" only fires on the real front page.<\/li>\n<\/ul>\n\n
1.0.13<\/h4>\n\n\n- The Integrations tab now shows an \"Extensions\" section with a WooCommerce card, so the WooCommerce eCommerce tracking is discoverable there (it was previously only in Settings). The card shows whether WooCommerce is detected and links straight to its settings.<\/li>\n<\/ul>\n\n
1.0.12<\/h4>\n\n\n- New: shared Google tag settings (Settings \u2192 Google tag settings), applied to both the Google Analytics and Google Ads integrations.<\/li>\n
- New: Google Tag Gateway measurement path \u2014 serve the Google tag first-party from your own domain to reduce ad-blocker loss. Requires a reverse proxy (currently Cloudflare's Tag Gateway); leave blank to load from Google directly.<\/li>\n
- New: optional url_passthrough (link decoration) toggle, off by default. It stays consent-gated, so it only fires after the visitor consents.<\/li>\n<\/ul>\n\n
1.0.11<\/h4>\n\n\n- New: Google Ads conversion tracking for WooCommerce. Add your Purchase \/ Begin-checkout \/ Add-to-cart conversion labels on the Google Ads integration and CookieKita fires the matching
gtag('event','conversion', \u2026)<\/code> with value, currency and (for purchases) the order id \u2014 marketing-consent-gated, and de-duplicated per order in the browser. Previously the plugin installed the Google Ads tag but never reported WooCommerce conversions to it.<\/li>\n- Diagnostics now recognises Google Ads conversions as a valid destination for eCommerce events.<\/li>\n<\/ul>\n\n
1.0.10<\/h4>\n\n\n- Fixed WooCommerce eCommerce values serializing as long floats (e.g.
19.899999999999999<\/code>) on hosts with serialize_precision = 17<\/code>; monetary values now emit as clean two-decimal numbers (19.9<\/code>) to GA4 \/ Tag Manager and the ad pixels.<\/li>\n- Purchase events are now de-duplicated in the browser by order id (localStorage) instead of by an order meta flag written at page-render time. The previous approach could permanently suppress a purchase hit when the buyer reached the thank-you page before granting analytics consent; the event now fires exactly once, but only once it is actually allowed to run.<\/li>\n
- Richer GA4 items:
item_category<\/code>, item_brand<\/code> (WooCommerce product_brand<\/code>) and item_variant<\/code> are now included when available, across view_item, add_to_cart, begin_checkout and purchase.<\/li>\n- Diagnostics now flags when WooCommerce eCommerce tracking is enabled but no Google Analytics \/ Tag Manager integration is active \u2014 i.e. events are emitted but nothing collects them.<\/li>\n<\/ul>\n\n
1.0.9<\/h4>\n\n\n- New (opt-in): \"Also block hand-pasted inline snippets\" under Tracker blocking. The blocker previously only held back external tracker script files (
<script src><\/code>); inline snippets pasted directly into a theme or header (Google Analytics\/GTM config, Meta Pixel fbq<\/code>, and others) ran before consent. When enabled, these inline snippets are rewritten to inert type=\"text\/plain\"<\/code> with the correct consent category (analytics vs. marketing) and only execute after the visitor consents. Benign inline scripts and non-JS blocks (e.g. JSON-LD) are never touched. Off by default \u2014 enable and test your site, as it can affect custom inline scripts.<\/li>\n- Connection status is now verified, not just \"a key is stored\". The header badge and Diagnostics reflect three states \u2014 Connected, Key not recognized, and Not connected \u2014 based on the real handshake with CookieKita. A mistyped or wrong-domain Site Key now surfaces as \"Key not recognized\" instead of a misleading \"Connected\". The check reuses the existing hourly heartbeat, so there is no extra request on page load.<\/li>\n
- Performance: the tracker-blocking output filter now skips the regex entirely on responses with no
<script><\/code> tag.<\/li>\n<\/ul>\n\n1.0.8<\/h4>\n\n\n- Admin UI no longer gates any panel behind the account connection. The Settings, Integrations and Shortcodes tabs are now always fully accessible and every option is editable and saved locally at all times \u2014 nothing is hidden or disabled while unconnected. A small, non-blocking hint simply notes that the consent banner goes live on the front-end once the site is connected (the banner script needs the Site Key to load its configuration). This addresses the review concern that locally-implemented features (tracker blocking, tag installer, shortcodes) appeared to be locked behind the service connection.<\/li>\n
- Removed the last padlock icon from the Integrations activation modal (replaced with a shield), so no \"lock\" iconography remains anywhere in the admin.<\/li>\n
- Full audit of every third-party terms\/privacy URL in the External services section; refreshed the ones that had moved or now return an error: Criteo (privacy \u2192 \/privacy\/, terms \u2192 \/terms-and-conditions\/), Meta\/Facebook (added trailing slashes so the pages return 200), Taboola (\u2192 policies.taboola.com), Outbrain terms (\u2192 \/onyx\/term-of-use\/), Mouseflow (\u2192 \/legal\/\u2026), Inspectlet (\u2192 \/terms-of-service) and Segment (\u2192 Twilio legal, since Segment's terms\/privacy are now governed by Twilio). All remaining links were verified reachable.<\/li>\n<\/ul>\n\n
1.0.7<\/h4>\n\n\n- Removed the custom update checker (
update_check_enabled<\/code> \/ ajax_check_update<\/code> \/ fetch_latest_version<\/code>) \u2014 updates are handled exclusively through the standard WordPress.org update flow.<\/li>\n- Renamed
render_lock_gate()<\/code> to render_service_connection_notice()<\/code> and replaced lock-icon UI with a neutral \"connect your account\" prompt. The tabs show a connection prompt because they are managed through the CookieKita external service (Guideline 6), not because features are locked behind a payment or licence.<\/li>\n- Removed lock-icon decorations from Integrations \/ Settings \/ Shortcodes tab buttons.<\/li>\n
- Fixed dead readme URLs: Criteo terms updated; Mouseflow terms\/privacy updated.<\/li>\n<\/ul>\n\n
1.0.6<\/h4>\n\n\n- No functional changes. Submitted in response to review R-29Jun26: confirmed that HubSpot (js.hs-scripts.com) and LiveChat (cdn.livechatinc.com) are fully documented in the External services section, including terms and privacy links. The privacy link for HubSpot (legal.hubspot.com\/privacy-policy) is their official URL; the timeout reported by the automated checker is caused by HubSpot's CDN anti-bot protection on their legal subdomain, not an invalid URL.<\/li>\n<\/ul>\n\n
1.0.5<\/h4>\n\n\n- Branded the \"Connect to CookieKita\" button to match the CookieKita visual style.<\/li>\n<\/ul>\n\n
1.0.4<\/h4>\n\n\n- Fixed \"Connection could not be completed\" \u2014 the connect state token is now shared across all Connect buttons on the page instead of being regenerated per button.<\/li>\n<\/ul>\n\n
1.0.3<\/h4>\n\n\n- The admin now lands on the Connection tab first when the site is not yet connected (all tabs remain accessible).<\/li>\n
- Updated the brand logo in the admin header.<\/li>\n<\/ul>\n\n
1.0.2<\/h4>\n\n\n- Text domain now matches the plugin slug (
cookiekita-gdpr-consent-cookie-banner<\/code>) so the plugin is translatable via the directory.<\/li>\n- Admin notice-hiding CSS is enqueued via
wp_add_inline_style<\/code> instead of an inline <style><\/code> echo.<\/li>\n- Public
\/ping<\/code> endpoint no longer exposes configuration state, feature flags or secret status \u2014 it returns only a minimal reachability response.<\/li>\n- The tracker-blocking output buffer is now explicitly closed (paired
ob_start<\/code>\/ob_end_flush<\/code>).<\/li>\n- Removed an unnecessary
require<\/code> of a WordPress core admin file in the DSAR exporter path.<\/li>\n- Documented all optional third-party tag services (with terms\/privacy links) in the External services section.<\/li>\n<\/ul>\n\n
1.0.1<\/h4>\n\n\n- Security hardening: proof-of-possession required to disconnect, stronger DSAR deletion guard (super-admins), reduced anonymous info in the health endpoint, and a hardcoded update link.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial public release.<\/li>\n
- Cookie consent banner with real tracker blocking (37+ services) until consent.<\/li>\n
- Integrations directory + consent-aware tag installer (GA4, GTM, Meta Pixel, and more).<\/li>\n
- WooCommerce eCommerce events (view_item, add_to_cart, begin_checkout, purchase), fully consent-gated.<\/li>\n
- Google Consent Mode v2 + Microsoft UET Consent Mode, GPC\/DNT signals.<\/li>\n
- Cookie declaration and DSAR shortcodes, with optional auto-execution of verified requests.<\/li>\n
- One-click \"Connect to CookieKita\" onboarding, with manual Site Key entry as a fallback.<\/li>\n<\/ul>","raw_excerpt":"GDPR cookie consent banner with real tracker blocking, Google Consent Mode v2, consent-aware tag installer, DSAR handling and WooCommerce tracking.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/333142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=333142"}],"author":[{"embeddable":true,"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/gdimitrov"}],"wp:attachment":[{"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=333142"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=333142"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=333142"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=333142"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=333142"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/he.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=333142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}