Title: PureGrace Consent Connector for AI Privacy Center
Author: Pure Grace AI, LLC
Published: <strong>September 15, 2026</strong>
Last modified: September 16, 2026

---

Search plugins

![](https://ps.w.org/puregrace-consent-connector/assets/banner-772x250.png?rev=3697757)

![](https://ps.w.org/puregrace-consent-connector/assets/icon-256x256.png?rev=3697757)

# PureGrace Consent Connector for AI Privacy Center

 By [Pure Grace AI, LLC](https://profiles.wordpress.org/puregraceai/)

[Download](https://downloads.wordpress.org/plugin/puregrace-consent-connector.1.7.0.zip)

 * [Details](https://wordpress.org/plugins/puregrace-consent-connector/#description)
 * [Reviews](https://wordpress.org/plugins/puregrace-consent-connector/#reviews)
 *  [Installation](https://wordpress.org/plugins/puregrace-consent-connector/#installation)
 * [Development](https://wordpress.org/plugins/puregrace-consent-connector/#developers)

 [Support](https://wordpress.org/support/plugin/puregrace-consent-connector/)

## Description

PureGrace Consent Connector links your WordPress site to AI Privacy Center, a consent-
management service operated by Pure Grace AI, LLC, so your consent banner and your
tracker blocking are configured in one place instead of pasted into your theme.

Most cookie-consent plugins stop at the popup. This one also does the part a banner
cannot: it neutralizes hard-coded tracker scripts **on the server, before the browser
parses them**, so a tracker physically cannot fire before a visitor consents.

**How this differs from the cookie-banner plugins already in the directory**

The directory has many consent-banner plugins, so it is fair to ask what this one
adds. Two things, and both are structural rather than cosmetic.

_It enforces consent on the server, not in the browser._ A banner plugin gates trackers
with JavaScript after the page has loaded. This plugin rewrites hard-coded tracker
tags into inert markup **during page generation, before the HTML leaves your server**—
across four tag types: external `<script src>`, inline `<script>` snippets, `<img
>` tracking pixels and `<iframe>` embeds. A tracker that is never delivered as an
executable tag cannot fire in the gap between page load and banner render, which
is the gap browser-only gating cannot close. The transform is idempotent and fails
safe: unquoted or unrecognized markup is left untouched rather than mangled.

_It is a connector, not a standalone banner._ The banner, the consent records and
the tracker classification live in AI Privacy Center, an external service. This 
plugin’s job is to bind a WordPress site to that service and to do the server-side
enforcement WordPress is uniquely placed to do. It is not a general-purpose cookie
banner and is not useful without the service, in the same way an analytics connector
is not useful without the analytics account.

If you want a self-contained cookie banner with no external account, one of the 
existing directory plugins will serve you better. This one exists for sites whose
consent state is managed centrally across more than one property.

**What the plugin does**

 * **Consent banner** — enqueues the AI Privacy Center consent banner on your site,
   deny-by-default and built to WCAG 2.2 AA. Can be switched off if your site already
   loads the banner another way.
 * **Server-side tracker blocking (prior restraint)** — rewrites hard-coded trackers
   into inert tags during page generation, before the browser ever parses them, 
   so they cannot run until consent is given. This covers four tracker types: external`
   <script src>` tags, inline (no-src) `<script>` snippets, tracking `<img>` pixels,
   and `<iframe>` embeds (YouTube, Vimeo, Maps, social widgets, and similar). This
   catches server-rendered trackers that browser-only banners miss.
 * **Google Consent Mode signals** — passes consent state to Google tags when enabled.
 * **Cache-aware safeguards** — best-effort purge of known page caches when you 
   save your widget key, plus a notice on the plugin’s own screens if an incompatible
   full-page cache is detected, so you can purge and verify while logged out.

**What it does not do**

 * It does not modify tags injected into the DOM purely by client-side JavaScript
   after the page has already loaded (for example a script inserted at runtime by
   another plugin’s own JS) — the server-side rewrite works on the HTML as generated
   by WordPress, not on later browser-side DOM changes. The consent banner’s own
   client-side gating still applies to those.
 * It does not create or edit your privacy policy pages. Policy publishing is done
   by the platform through WordPress’ own REST API with an application password 
   you authorize, so WordPress core performs the permission checks. Nothing in this
   plugin writes posts or pages.
 * A full-page cache drop-in can serve pages before plugins load; pages cached while
   blocking was inactive may serve raw tracker tags until purged. Verify logged 
   out after enabling.

**Honest note on compliance.** AI Privacy Center gives you tools and records to 
help you meet your privacy obligations. It is not a law firm and does not guarantee
compliance with any law — compliance is an outcome of your own process, not a product
setting.

**An account is required.** This plugin is the WordPress connector for the AI Privacy
Center service. You need an account and a widget key to use it, in the same way 
an analytics plugin needs a property ID. A free plan is available.

**No functionality in this plugin is gated behind a paid plan.** Everything the 
plugin’s own code does — the consent banner, and all four kinds of server-side tracker
neutralization — runs on a free account as soon as a widget key is saved. There 
is no licence check, no tier check, no usage cap and no trial timer anywhere in 
the plugin. The only condition on tracker blocking is a saved widget key, because
the plugin has to know which site’s consent state it is enforcing. Paid plans buy
additional capability _in the hosted service_ — such as AI-generated policy updates
and longer record retention — none of which is implemented in, or withheld by, this
plugin.

### External services

This plugin relies on one external service: **AI Privacy Center**, a consent-management
platform operated by the plugin author, Pure Grace AI, LLC, at `https://app.aiprivacycenter.
com`. The plugin cannot function without it, because the consent banner and the 
consent records it produces are the service.

**Nothing is sent until you save a widget key.** With the key field empty the plugin
makes no outbound request of any kind, from the browser or from your server.

Once a key is saved, these requests happen:

 * **Consent widget script — from the visitor’s browser, on every page view.** The
   plugin enqueues `https://app.aiprivacycenter.com/api/v1/widget/apc-stub.min.js`.
   Loading it sends what any browser request for a script sends: the visitor’s IP
   address, user agent and referring page.
 * **Banner configuration — from the visitor’s browser, on every page view.** The
   widget requests `https://app.aiprivacycenter.com/api/v1/widget/{your-widget-key}/
   config` to learn how your banner is configured. It sends your site’s widget key.
 * **Initialization beacon — from the visitor’s browser, once the widget loads.**
   A POST to `https://app.aiprivacycenter.com/api/v1/widget/health-beacon` containing
   only your widget key, so the platform can show you whether the banner is actually
   running.
 * **Consent choices — from the visitor’s browser, when a visitor answers the banner.**
   A POST to `https://app.aiprivacycenter.com/api/v1/widget/consent` containing 
   your widget key, the consent choices made, how they were made (a banner interaction
   or a Global Privacy Control signal), and a randomly generated visitor identifier
   stored in a strictly necessary first-party cookie. That record is what proves
   consent was given. No name, email address, form content or page content is sent.
 * **Unrecognized tracker hosts — from your server and from the visitor’s browser.**
   When a page contains a script from a host the blocking table does not recognize,
   its host name (and, from the browser, the script URL’s origin and path with any
   query string stripped) is POSTed to `https://app.aiprivacycenter.com/api/v1/widget/
   unknown-scripts` with your widget key, so the unknown tracker can be classified
   rather than silently ignored. Host names only — no visitor data and no page content.
 * **Configuration check — from your server, only when you click a button.** Pressing“
   Verify configuration” on the settings screen makes one request to `https://app.
   aiprivacycenter.com/api/v1/widget/{your-widget-key}/config` to confirm the key
   is recognized.

**Terms and privacy**

 * Terms of Service: https://puregraceai.com/legal/tos
 * Privacy Notice: https://puregraceai.com/legal/privacy

**A note on the tracker host names inside this plugin.** `includes/class-pgcc-neutralizer.
php` contains a table of third-party host names — `googletagmanager.com`, `connect.
facebook.net`, `maps.googleapis.com`, `widget.intercom.io` and others. That table
is a local pattern list used to **recognize and block** those trackers in your page’s
HTML. The plugin never contacts those hosts and sends them no data; matching a host
name in that table is what stops it from loading.

## Screenshots

[⌊The consent banner on a live site (deny-by-default, WCAG 2.2 AA).⌉⌊The consent
banner on a live site (deny-by-default, WCAG 2.2 AA).⌉[

The consent banner on a live site (deny-by-default, WCAG 2.2 AA).

[⌊The plugin settings screen — paste your widget key.⌉⌊The plugin settings screen—
paste your widget key.⌉[

The plugin settings screen — paste your widget key.

[⌊The "Verify configuration" check reporting the plugin's current blocking state.⌉⌊
The "Verify configuration" check reporting the plugin's current blocking state.⌉[

The “Verify configuration” check reporting the plugin’s current blocking state.

[⌊The AI Privacy Center dashboard - plan, connected sites, open privacy requests
and setup status.⌉⌊The AI Privacy Center dashboard - plan, connected sites, open
privacy requests and setup status.⌉[

The AI Privacy Center dashboard – plan, connected sites, open privacy requests and
setup status.

## Installation

 1. In WordPress go to **Plugins  Add New**, search for **PureGrace Consent Connector**,
    then **Install Now** and **Activate**. You can instead upload the plugin folder
    to `/wp-content/plugins/puregrace-consent-connector`, but installing from the directory
    means updates arrive automatically.
 2. Create an account at https://aiprivacycenter.com if you do not have one, and copy
    the **Widget Key** for this website from your dashboard. Each website has its own
    key.
 3. Go to **Settings  AI Privacy Center** — there is also a **Settings** link on the
    plugin’s own row of the Plugins screen — paste the Widget Key and save. Nothing
    is blocked and no banner is shown until a key is saved.
 4. If this site already loads the AI Privacy Center banner another way, such as a 
    theme option or a snippet plugin like WPCode, untick **Inject the consent banner**
    or visitors will see two.
 5. Leave **Google Consent Mode** unticked unless you deliberately run Consent Mode.
    When it is ticked, Google tags are exempted from the server-side blocking and are
    governed by Consent Mode instead.
 6. Purge any page cache, then use **Verify configuration** on the settings screen 
    and load your site **in a private window**. A page cached before the plugin was
    active can keep serving unblocked tracker tags to visitors even though it looks
    correct to you as an admin.

## FAQ

### Do I need an AI Privacy Center account?

Yes. The plugin is the WordPress connector for the service, and it needs a widget
key to know which site’s consent state it is enforcing. A free plan is available,
and every feature implemented in this plugin — banner and all server-side tracker
blocking — works on it. Paid plans add capability in the hosted service (for example
AI-generated policy updates); nothing in the plugin’s own code is switched off by
plan.

### How is this different from a normal cookie banner plugin?

A browser-only banner blocks trackers in the visitor’s browser. This plugin also
neutralizes hard-coded external tracker scripts on the server, before the page reaches
the browser.

### Does it block every tracker?

It blocks known hard-coded trackers via server-side rewriting across four tag types—
external `<script src>` tags, inline `<script>` snippets, `<img>` pixels, and `<
iframe>` embeds — plus client-injectable and tagged scripts via the widget. It does
not modify tags a page injects client-side after load. See “What it does not do”
above.

### Does it work with caching plugins?

Yes, with a caveat: a full-page cache can serve pages before plugins load. The plugin
purges known caches when you save your key and warns you if it detects an incompatible
cache. Always verify logged out after enabling.

### Will it slow down my site?

The consent widget core is small and served from an edge CDN. The server-side rewrite
runs during normal page generation.

### Does this make my site legally compliant?

No plugin can. AI Privacy Center provides tools and records to help you meet your
obligations; compliance is an outcome of your own process.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“PureGrace Consent Connector for AI Privacy Center” is open source software. The
following people have contributed to this plugin.

Contributors

 *   [ Pure Grace AI, LLC ](https://profiles.wordpress.org/puregraceai/)
 *   [ Pure Grace AI ](https://profiles.wordpress.org/kevin10676/)

[Translate “PureGrace Consent Connector for AI Privacy Center” into your language.](https://translate.wordpress.org/projects/wp-plugins/puregrace-consent-connector)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/puregrace-consent-connector/),
check out the [SVN repository](https://plugins.svn.wordpress.org/puregrace-consent-connector/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/puregrace-consent-connector/)
by [RSS](https://plugins.trac.wordpress.org/log/puregrace-consent-connector/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.7.0

 * Added a “Your AI Privacy Center” panel to the settings screen, linking to the
   parts of your account this plugin does not handle: websites and scan results,
   Compliance Watch, privacy requests, generated documents, and unclassified scripts
   awaiting a decision. The settings screen previously gave no route to any of them.
 * No new network requests: these are ordinary links, built from the Platform URL
   already configured on this screen. The plugin makes exactly the same requests
   as before.
 * Shown only once a Widget Key is saved.

#### 1.6.6

 * readme correction only, no code change. The Installation steps still sent people
   to “Settings  Consent Connector”, which was renamed in 1.6.5, and said nothing
   about the two settings that most often go wrong on a first install.
 * Installation now covers installing from the directory, the Settings link added
   in 1.6.4, the second-banner case, when to leave Google Consent Mode off, and 
   why a cached page must be checked logged out.

#### 1.6.5

 * The Settings submenu entry is now labelled “AI Privacy Center” instead of “Consent
   Connector”. The old label carried none of the service name, so operators scanning
   the Settings menu for the product they signed up for did not find it. Nothing
   else changed: the page, its URL and all settings are the same.

#### 1.6.4

 * Added a Settings link on the plugin’s row of the Plugins screen. There was previously
   no visible route from activating the plugin to configuring it.
 * Added a short numbered “Getting started” panel to the settings screen, shown 
   only while no Widget Key is saved.
 * The Widget Key field and the “no Widget Key” notice now link straight to the 
   dashboard page the key is copied from, instead of describing where to look.
 * No change to blocking, the banner, or any stored setting.

#### 1.6.3

 * Fixed: a site that still had the plugin’s predecessor (“AI Privacy Center”, version
   1.5.x and earlier) active alongside this one showed visitors two consent banners.
   The folder name changed when the plugin was renamed, so WordPress keeps both 
   installed instead of upgrading one to the other. This plugin now detects the 
   older one and does not load its banner until the older one is removed, and says
   so on its settings screen and the Plugins screen.
 * Server-side tracker blocking is deliberately not affected by that check and keeps
   running in both plugins: the rewrite is idempotent, and this version blocks inline
   scripts, tracking pixels and iframe embeds that 1.5.x did not.

#### 1.6.2

 * Corrected the Plugin URI header, which pointed at a page that had not been published.
 * Housekeeping only. No change to plugin behavior.

#### 1.6.1

 * readme correction only, no code change. Earlier readme text said script blocking
   required a paid plan. That was never true of this plugin: the server-side neutralizer
   runs on any account once a widget key is saved, and the plugin contains no licence,
   tier, quota or trial logic. The incorrect statements have been removed and replaced
   with an explicit statement of what is and is not gated.
 * Added a section explaining how the plugin differs from the consent-banner plugins
   already in the directory.

#### 1.6.0

 * Renamed to PureGrace Consent Connector for AI Privacy Center, with the slug `
   puregrace-consent-connector`.
 * All functions, classes, constants, options, settings groups and AJAX actions 
   re-prefixed from `apc_` to `pgcc_` to avoid name collisions. Existing settings
   are migrated automatically on first load after the upgrade; no reconfiguration
   is needed.
 * Removed the plugin’s custom REST route for publishing policy pages. Policy publishing
   goes through WordPress core’s own REST API, which applies core’s per-post permission
   checks.
 * The settings screen’s JavaScript is now a registered, enqueued file rather than
   an inline script.
 * Admin notices are limited to the plugin’s own settings screen and the Plugins
   screen, and the advisory ones are dismissible.
 * readme now fully documents the external service, what it sends and when, and 
   clarifies that the tracker host names in the blocking table are never contacted.
 * Tested up to WordPress 7.1.

#### 1.5.2

 * Added the plugin-header fields the directory expects: Plugin URI, Author URI,
   Requires at least, Requires PHP, and License URI.
 * Text Domain corrected to match the plugin slug.
 * No functional change.

#### 1.5.1

 * Directory-guideline fixes found by the official Plugin Check tool: widget script
   now registered/enqueued via wp_enqueue_script() instead of a raw printed tag,
   parse_url() calls switched to wp_parse_url(), and a direct-file-access guard 
   added to the neutralizer class.
 * No functional/behavioral change for site visitors — same tracker-blocking logic,
   same script loaded at the same point in `<head>`.

#### 1.5.0

 * Server-side neutralization of hard-coded trackers (prior restraint) across scripts,
   inline snippets, pixels, and iframe embeds.
 * Cache-detection admin notice and best-effort purge on key save.
 * Google Consent Mode signal support.
 * Robust widget-key validation and verify-config pull.

#### 1.2.0

 * Banner injection toggle; loud guardrails for empty-key / misconfiguration.
 * Dead-URL default fixes.

## Meta

 *  Version **1.7.0**
 *  Last updated **1 week ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 5.8 or higher **
 *  Tested up to **7.1.2**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [CCPA](https://wordpress.org/plugins/tags/ccpa/)[cookie banner](https://wordpress.org/plugins/tags/cookie-banner/)
   [cookie consent](https://wordpress.org/plugins/tags/cookie-consent/)[GDPR](https://wordpress.org/plugins/tags/gdpr/)
   [Privacy Policy](https://wordpress.org/plugins/tags/privacy-policy/)
 *  [Advanced View](https://wordpress.org/plugins/puregrace-consent-connector/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/puregrace-consent-connector/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/puregrace-consent-connector/reviews/)

## Contributors

 *   [ Pure Grace AI, LLC ](https://profiles.wordpress.org/puregraceai/)
 *   [ Pure Grace AI ](https://profiles.wordpress.org/kevin10676/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/puregrace-consent-connector/)