Title: Consentfold
Author: DevStine
Published: October 28, 2026
Last modified: October 28, 2026
---
Search plugins
# Consentfold
By [DevStine](https://profiles.wordpress.org/devstine/)
[Download](https://downloads.wordpress.org/plugin/consentfold.1.0.0.zip)
* [Details](https://wordpress.org/plugins/consentfold/#description)
* [Reviews](https://wordpress.org/plugins/consentfold/#reviews)
* [Installation](https://wordpress.org/plugins/consentfold/#installation)
* [Development](https://wordpress.org/plugins/consentfold/#developers)
[Support](https://wordpress.org/support/plugin/consentfold/)
## Description
Consentfold is a consent management plugin that keeps visitor data on your own site.
It shows a cookie banner, blocks scripts and embeds until the visitor agrees, tells
Google about the choice with Consent Mode v2, and keeps a consent log you can prove
it with. Nothing is metered and your visitors’ data is never sent to a third party;
the only request a visitor’s browser can make to one is an optional video preview
they ask for with a click (see “External services”).
#### Banner designer
* Three layouts: Bar, Popup and Side panel, with placement, entrance and exit animations,
optional animated interactions, and a live preview.
* Palettes checked for contrast (WCAG AA) in light and dark, input styles, fonts,
sizes, spacing and radius.
* A Google Fonts finder over the full list. The font you choose is downloaded once
to your site and served from there, so visitors never contact Google.
* Banner regime: Automatic, Opt-in (EU / EEA), Opt-in (Brazil), Opt-out (United
States) or No banner.
* An optional small “Powered by Consentfold” link at the foot of the banner. It
is off unless you switch it on in the Banner designer or say yes in the setup
wizard; nothing is shown by default.
#### Setup wizard and Overview
The Overview shows what needs attention (health checks, the last scan, the consent
log). A fresh site gets a “Run setup” card that goes through who sees a banner,
the design, Google Consent Mode, the policy page and a first scan, in a few minutes.
#### Script blocking and Scanner
* Known trackers, embeds and iframes (including srcdoc iframes) are held back until
the matching category is accepted, with a placeholder the visitor can click.
* The Scanner finds the cookies and scripts your site really sets and sorts them
into categories. It builds the cookie policy table.
* Works behind page caches and optimisers: WP Super Cache, Cache Enabler and Autoptimize
are covered by end-to-end tests, as are Polylang, WooCommerce, Wordfence, GTM4WP
and Site Kit.
#### Google Consent Mode v2
Defaults are sent before any Google tag runs, and updated when the visitor decides.
Works with gtag.js, Google Tag Manager, GTM4WP and Site Kit, and with the WP Consent
API.
#### Consent log
One record per decision on your own site, with the retention you set. WordPress’s
personal data export and erase tools include it. A WP-CLI command (`wp consentfold
log`) counts and prunes it.
#### Import from another plugin
The Import tab reads the saved settings of CookieYes and Complianz from the database,
even when that plugin is not active, and shows a preview of what will change, what
is kept and what is not supported. Apply it, and Undo import restores the settings
from before your first import, even if you imported from both plugins. Consentfold
never deactivates the other plugin on its own; a “Deactivate now” button does it
when you say so.
#### Accessible and light
The banner is keyboard operable, announced to screen readers and checked with axe-
core. It loads in under 15 KB of JavaScript and 4 KB of CSS, gzipped, and no jQuery.
The admin uses icons from Phosphor Icons (https://phosphoricons.com), copyright (
c) 2023 Phosphor Icons, MIT License. The licence text is in `licenses/phosphor-icons.
txt`. The icons are part of the plugin; nothing is loaded from a CDN.
### Privacy
Consentfold stores the consent cookie in the visitor’s browser and, when the consent
log is on, one record per decision on your own site: a random consent ID, the accepted
categories, the method, the banner and policy versions, the region, the language
and a coarse browser class. It never stores an IP address or a user agent; a one-
way hash of both, salted and changing daily, is used only to limit the rate of the
consent endpoint. Consent records are never sent to a third party. Records are deleted
after the retention you set (365 days by default).
* Logged-in users: their consent IDs are kept in their user meta, so WordPress’s
Export Personal Data and Erase Personal Data tools (by email address) include
and delete their records.
* Visitors: they can find their consent ID in the cookie settings panel; delete
the records of an ID in the Consent log tab.
* Command line: `wp consentfold log count|prune`.
### External services
Consentfold contacts three external services. Two are contacted only from your admin:
Google Fonts, when an administrator uses the font finder in the Banner designer
or previews a Google font there (a font you choose is downloaded once to your own
site and served from there), and Freemius, which handles the upgrade, checkout and
license flow. The third, YouTube/Google or Vimeo, is contacted from a visitor’s
browser only when the visitor clicks **Show preview** on a blocked video embed.
**Google Fonts (fonts.googleapis.com and fonts.gstatic.com), operated by Google
LLC**
* What it is used for: letting you search the Google Fonts list, see a sample of
each font, preview the font you choose in the banner preview before it is on
your site, and download it to your site. The list of fonts itself ships with
the plugin.
* When: (1) while the finder is open in your admin, your browser asks fonts.googleapis.
com for a small stylesheet with a sample of the fonts shown, and Google serves
the matching font data; and while a chosen font is not saved yet, the banner
preview in your admin loads that font from Google the same way. The preview loads
fonts from Google in the admin only, never on your site’s pages; (2) when you
save the design with a Google font you chose, your server asks fonts.googleapis.
com for the font’s stylesheet and fonts.gstatic.com for its files. Nothing is
requested when the finder is not used, on any visitor page, or by a cron job.
* What is sent: the name of the font and the weights you chose, the sample text
you type (letters only, as a list of characters), and the technical data every
web request carries: the IP address of your browser (samples) or of your server(
download) and a browser user agent. No visitor data and no data about your site
is sent.
* The fonts are open-source licensed (SIL Open Font License or Apache License 2.0),
which allows hosting them yourself.
* Google’s terms of service: https://policies.google.com/terms and privacy policy:
https://policies.google.com/privacy (Google Fonts FAQ: https://developers.google.
com/fonts/faq/privacy).
**Freemius (freemius.com), operated by Freemius, Inc.**
Consentfold bundles the [Freemius](https://freemius.com/) WordPress SDK, which handles
the upgrade, checkout and license flow.
* What it is used for: the connect screen shown after activation, the **Upgrade**
page, starting a purchase, license activation and plugin updates for the paid
version.
* When: nothing is sent, and the SDK does not run its usage tracking, until you
explicitly opt in on the connect screen shown after activation (or enter a license
key). Choosing **Skip** there leaves the plugin fully functional and shares no
usage data, user details or plugin list. Three things you do yourself still contact
Freemius after a Skip: opening **Consentfold > Upgrade** loads pricing from the
Freemius API, and every such request carries your site’s address in its user
agent; starting a checkout from there puts your WordPress user’s first and last
name, email address and your site’s address in the checkout link; and submitting
the feedback form shown when you deactivate the plugin sends Freemius an anonymous
uninstall event with the reason you gave.
* What is sent if you opt in: your WordPress user’s first and last name and email
address; your site’s homepage URL and title, WordPress and PHP versions and site
language; the plugin and SDK versions and whether the plugin is active or uninstalled;
and the names, slugs, versions and active state of your installed plugins and
themes. A license activation shares your WordPress user’s first and last name
and email address (unless the license already has a known owner), the homepage
URL, plugin and SDK versions and plugin state, plus the diagnostic details (WordPress
and PHP versions, site language and title), which are ticked by default and can
be unticked, and the plugin and theme list, which is unticked by default.
* Visitor data: none. Consent records and visitor information never go to Freemius.
* To stop sharing, open the **Plugins** screen and click **Opt Out** under Consentfold;
this stops future sharing and does not recall what was already sent. If you chose
Skip, the same place offers **Opt In** should you change your mind.
* Freemius terms of service: https://freemius.com/terms/ and privacy policy: https://
freemius.com/privacy/
**YouTube video previews (i.ytimg.com), operated by Google LLC, and Vimeo video
previews (vimeo.com and the i.vimeocdn.com image host), operated by Vimeo.com, Inc.**
* What it is used for: showing the thumbnail of a blocked YouTube or Vimeo embed
in its placeholder, so the visitor can see which video it is before deciding
to load it.
* When: only when a visitor clicks **Show preview** on the placeholder of a blocked
YouTube or Vimeo embed, before they have agreed to the video’s category. Nothing
is requested when the page loads, when the visitor does not click, for any other
embed, or from your server. Loading the video itself, or accepting the category,
loads the embed from the provider as usual and is not part of this preview.
* What is sent: for YouTube, a request for the thumbnail image `https://i.ytimg.
com/vi/