Harbor Privacy Guard for WooCommerce

FAQ

Does this replace my existing cookie banner?

It can, but it also works alongside one. If you already run another consent-management plugin, consider disabling its visitor-facing banner so your store does not show two banners; its other features (cookie scanning, privacy-policy pages) can remain active alongside this plugin.

What is the Global Privacy Control (GPC)?

GPC is a browser-level opt-out signal (like Do Not Track, but legally binding in 12 US states). When a user enables it in their browser or privacy extension, their browser sends Sec-GPC: 1 on every HTTP request. This plugin detects that header server-side and blocks tracking without requiring the user to interact with a banner.

Will this break my WooCommerce store?

No. The plugin only dequeues scripts that are enqueued through WordPress’s script system. It does not modify orders, prices, or checkout logic. If you use a tracking script that is injected outside of wp_enqueue_scripts (for example, hardcoded into a theme), the free tier will not block it — that case is handled by the Pro output-buffer feature.

Does this work with Google Tag Manager?

Yes, for Consent Mode v2 purposes. The plugin emits gtag('consent','default',...) before GTM loads so GTM respects the consent state and suppresses or permits its tags accordingly. Note: the free tier does not prevent the GTM container script itself from loading — it only controls what GTM does once loaded. If you need to block the GTM script entirely when consent is denied, enable the Pro output-buffer mode.

How do I view the audit log?

The consent log is stored in the {prefix}gpcg_opt_out_log database table. A monthly summary is shown at the bottom of the WooCommerce > GPC Compliance settings page. Pro users can download a full date-ranged CSV from that same page.

Is the audit log GDPR-compliant?

IPs are hashed with SHA-256 and a site-specific salt before storage. The raw IP is never stored. Hashed IPs cannot be reversed to identify individuals, which means the log does not constitute personal data under most interpretations of GDPR. You should still mention the log in your privacy policy and confirm with your legal counsel whether your specific jurisdiction requires additional disclosures.

What happens when a user has already set GPC and visits a new page?

The server detects Sec-GPC: 1 on every request independently. No cookie or session is required for GPC to be honored — the header is checked fresh on each page load. The JavaScript fallback cookie (gpcg_gpc_js) is also checked on each request but is only a fallback for environments where the HTTP header is stripped.

Does this work with page builders (Elementor, Divi, Bricks)?

Yes for script blocking. The plugin dequeues scripts by WordPress handle name, which works regardless of which page builder renders the page. The Consent Mode v2 defaults are emitted via wp_head at priority 1, which fires before any page builder output. If your page builder injects tracking scripts by hardcoding them into a template (outside of wp_enqueue_scripts), those scripts will not be blocked by the free tier — use the Pro output-buffer mode in that case.

What data does uninstalling the plugin delete?

Deleting the plugin via Plugins > Delete removes all plugin options and all plugin transients from wp_options on every site of the network. The consent audit log table ({prefix}gpcg_opt_out_log) is also dropped. This is irreversible — export a CSV before uninstalling if you need to retain the log for compliance purposes.

Will blocking tracking hurt my conversion rate?

The plugin only blocks tracking for visitors who have actively opted out (declined the banner or enabled GPC) or who have not yet interacted with the banner. Visitors who accept cookies are unaffected. For opted-out visitors, GA4’s consent mode modeling can still estimate conversions from anonymized signals — which requires the gtag('consent','default',...) call this plugin provides.

How does multi-state consent work?

Version 1.1 introduces automatic jurisdiction detection using CDN headers (Cloudflare, CloudFront, Vercel). When Jurisdiction-aware mode is enabled in the advanced settings, visitors from opt-out US states (Virginia, Texas, Utah, and others) are allowed tracking by default unless they actively decline — matching the legal standard for those states. Visitors from strict opt-in states (California, Colorado, Connecticut, Oregon) and the EU/EEA always require an explicit consent grant. Conservative mode (the default) requires opt-in everywhere regardless of jurisdiction.

Does this work with page caching (WP Rocket, LiteSpeed, Cloudflare)?

Yes. Because script blocking is a per-visitor decision, the plugin automatically marks any response that depends on a consent cookie or GPC signal as non-cacheable (via the DONOTCACHEPAGE constant and no-cache headers), registers the gpcg_consent / gpcg_gpc_js cookies with WP Rocket and LiteSpeed Cache, and bypasses Cache Enabler for those requests. In the default Conservative mode this is fully safe: the only cacheable page (a first visit with no cookie and no GPC) renders with tracking already stripped, so a cached copy can never leak tracking to anyone.

Two configuration notes for maximum safety:

1. Static-file caches that serve a stored page before WordPress loads (Cache Enabler, WP Super Cache, W3 Total Cache) decide whether to serve from cache based on their own excluded-cookies list. Add gpcg_consent and gpcg_gpc_js to that list so a visitor who already made a choice is always served a fresh page. WP Rocket and LiteSpeed are handled automatically.
2. CDN-level full-page caches (Cloudflare APO, Fastly, Varnish) sit in front of WordPress and do not see DONOTCACHEPAGE; configure them to vary on the gpcg_consent / gpcg_gpc_js cookies and the Sec-GPC request header.

When Jurisdiction-aware mode (Pro) is enabled, the plugin disables full-page caching entirely, because the rendered consent state depends on the visitor’s geo — which page caches do not vary on.

Do I need a Freemius account for the free version?

No. The free tier works entirely without a Freemius account. Freemius is only used for the Pro license key activation and upgrade flow.

Does this plugin send any data to external services?

The plugin itself sends nothing off-site: consent decisions and the audit log stay in your WordPress database. The bundled Freemius SDK powers optional Pro licensing and is strictly opt-in: on first activation it shows a consent screen, and no data is transmitted unless you explicitly opt in. If you choose Skip, the plugin remains fully functional and nothing is ever sent. Details: freemius.com/privacy (Freemius privacy policy).