Mortar Consent

FAQ

Does it find and block trackers automatically?

No. You tell it which scripts need consent. Scripts added through WordPress (with wp_enqueue_script) are blocked by handle; in your page source their tag has an id of handle-js. Scripts pasted into your theme need type="text/plain" and a data-mortar-consent attribute. Trackers that another script inserts later need that script to be blocked.

Does it make my site GDPR compliant?

No plugin can do that on its own. Mortar Consent gives visitors a fair choice and keeps a record of it, but compliance depends on your configuration, your content and the services you use. Test the cookies and requests your site actually makes.

Does it work with page caching?

Yes. The banner markup is the same for every visitor, and the visitor’s browser decides what to show and load. Plugins that combine or rewrite script tags can undo the blocking, so exclude blocked scripts from them.

How do visitors change their mind?

From the floating “Cookie settings” button (which you can turn off), the Cookie settings button block, the [mortar_consent_settings] shortcode, or any link to #cookie-settings, such as a menu item.

How does it work with Google Analytics and Google Ads?

Turn on Google Consent Mode v2 under Integrations. To load nothing until consent (basic mode), also add the Google tag’s script handle under Scripts. To let Google send cookieless pings before consent (advanced mode), leave the tag unblocked.

What data does it store?

The mortar_consent cookie on the visitor’s device holds a random consent ID, the policy version, the time of the choice and the allowed categories. When the consent log is on, the same details and how the choice was made are stored on your server. No IP address, browser details or WordPress user ID are stored. To limit abuse, the log endpoint briefly counts requests under a keyed hash of the IP address, which expires within about ten minutes. The plugin sends nothing to any outside service.

How long is data kept?

Consent lasts 365 days by default, and log records 1095 days (three years). You can change both in the settings. Older records are deleted daily.

Can visitors export or erase their consent record?

Consent records cannot be linked to a person, email address or user account, so WordPress’s personal data export and erase tools have nothing to find. A visitor can quote the consent ID shown in their cookie preferences, and you can look it up in the Consent log tab.

What happens when I delete the plugin?

Its scheduled clean-up task is removed. Your settings and the consent log are kept, because you may need the log as evidence. To delete them as well, add define('MORTAR_CONSENT_DELETE_DATA_ON_UNINSTALL', true); to wp-config.php before deleting the plugin. On multisite this applies to every site.

Does it support multisite?

Yes. Each site has its own settings and consent log.

Can I change how it looks?

Yes. Set the --mortar-consent-* CSS custom properties in your theme, for example --mortar-consent-button-bg, or turn off the built-in styles with the mortar_consent_load_styles filter. Keep the three choice buttons equally prominent.