Umay Çerez Yöneticisi

Description

Umay Çerez Yöneticisi (Umay Cookie Manager) is a cookie consent manager for websites that follow Turkey’s Personal Data Protection Law (KVKK) and the Turkish Data Protection Authority’s Cookie Guidelines (July 2025). It shows visitors the cookies used on the site by category and only lets tracking code run after the visitor allows the matching category.

This plugin is developed by Umay Ajans. It is not affiliated with or endorsed by the Turkish Personal Data Protection Authority (KVKK).

The admin screens and the texts shown to visitors are in Turkish, because the plugin is built for websites that serve visitors in Turkey. Every string is translatable.

Consent banner

• Accept, Reject and Settings buttons are presented with equal weight, and optional categories start unticked.
• Four categories: necessary, functional, analytics and marketing. Category names, descriptions and all banner texts can be edited.
• Bar, card or modal layout with a live preview in the settings screen.
• A floating icon, a shortcode or a menu link lets visitors change their choice at any time.
• A “request consent again” button raises the policy version so that earlier choices expire.

Blocking before consent

• Scripts, iframes and tracking pixels that need consent are neutralised in the page HTML on the server and only activated in the browser after consent.
• Scripts that other code adds later (for example a video player API or a tag loaded through Google Tag Manager) are held back as well.
• Embedded videos and maps are replaced by a placeholder with an “allow and load” button.
• The page output is the same for every visitor, so the plugin works with page caching.

Integrations

• Google Consent Mode v2: every signal starts as denied and is updated when the visitor makes a choice.
• WP Consent API: the plugin registers as the consent provider.
• PixelYourSite: pixels and server side events follow the visitor’s marketing and analytics choices.
• LiteSpeed Cache and WP Rocket: banner files are excluded from deferring and combining.

Cookie inventory and site scan

The scanner requests pages of your own site from your server, as an anonymous visitor, and matches scripts, iframes, pixels and Set-Cookie headers against a built-in list of common services (Google Tag Manager, Google Analytics, Google Ads, Meta Pixel, YouTube, Vimeo, Google Maps, reCAPTCHA, Microsoft Clarity, Hotjar, Yandex Metrica, TikTok, LinkedIn and more). Found services are added to the inventory, which you can edit.

The [kvkk_cerez_tablosu] shortcode prints the inventory as a cookie table (name, provider, type, purpose, duration) together with the providers located outside Turkey, for use on your cookie policy page.

Consent records

Each choice is stored in a table in your WordPress database so that you can show when and how consent was given. Records are searchable by consent ID and can be exported as CSV. They are deleted automatically after the retention period you choose (24 months by default).

Data stored by the plugin

The plugin does not send any data to external services. A consent record contains:

• a random consent ID generated by the server,
• the date and time (UTC), the action and the allowed categories,
• the policy version and the path of the page where the choice was made,
• optionally, a keyed hash (HMAC) of the visitor’s shortened IP address (IPv4 /24, IPv6 /48).

It does not store the raw IP address, browser or device details, query strings or the logged in user. The visitor’s choice is also saved in a first party cookie named kvkkc_consent so that it can be applied on the next page.

Legal notice

This plugin is a technical tool. It helps you apply the recommendations of the KVKK Cookie Guidelines on your site, but it is not legal advice and it does not guarantee legal compliance. The checklist in the settings screen only compares your settings with the guidelines.

Shortcodes and developer notes

• [kvkk_cerez_tablosu] prints the cookie table. Use kategori="analitik" for a single category and aktarim="hayir" to hide the list of providers abroad.
• [kvkk_cerez_ayarlari text="..."] prints a link that opens the preferences window. A menu link with the address #kvkkc-ayarlar does the same.
• The kvkkc:consent event on document carries the allowed categories in detail.categories.
• A kvkkc_consent event is pushed to dataLayer with the kvkkc_islevsel, kvkkc_analitik and kvkkc_pazarlama variables, so tags in Google Tag Manager can use it as a trigger.
• Add the data-kvkkc-skip attribute to a script tag to exclude it from blocking.
• Manual blocking rules can be added in the advanced settings as address or code fragment|category lines.

Development

The source code is developed in public on GitHub. Bug reports and pull requests are welcome.

External services

This plugin does not connect to any external service and does not send any data to third parties.

It contains a list of domains used by common third party services (for example googletagmanager.com or connect.facebook.net). The list is only used to recognise the code of those services on your own pages and to hold it back until the visitor gives consent. The site scan only requests pages of your own site from your server.

define( 'KVKKC_TRUSTED_PROXY_HEADER', 'HTTP_CF_CONNECTING_IP' );