3. DSAR webhook<\/strong> \u2014 When auto-execute DSAR is enabled, CookieKita sends signed data-subject requests (containing the requester\u2019s email) to the plugin so they can be fulfilled on your site.<\/p>\n\nBy using this plugin you agree to the CookieKita Terms of Service (https:\/\/cookiekita.com\/terms) and Privacy Policy (https:\/\/cookiekita.com\/privacy).<\/p>\n\n
Optional third-party tags (only loaded if you enable them)<\/h4>\n\n
CookieKita does not load any of the third-party services below by default. The consent-aware tag installer loads a provider's official script only when you, the site administrator, enter that provider's ID \/ enable it<\/strong>, and even then the script is held back until the visitor gives the matching consent (analytics or marketing). When a tag fires, the visitor's browser loads the provider's script directly and that provider receives standard analytics\/advertising data (e.g. page views, events, IP address, cookie\/device identifiers) \u2014 what is sent and when is determined by that provider. Review each provider's terms and privacy policy before enabling it:<\/p>\n\n\n- Google (Tag Manager, gtag, GA4) \u2014 googletagmanager.com \u2014 terms: https:\/\/policies.google.com\/terms \u2014 privacy: https:\/\/policies.google.com\/privacy<\/li>\n
- Meta Pixel (Facebook) \u2014 connect.facebook.net \u2014 terms: https:\/\/www.facebook.com\/legal\/terms\/ \u2014 privacy: https:\/\/www.facebook.com\/privacy\/policy\/<\/li>\n
- Microsoft Clarity \/ UET \u2014 clarity.ms \u2014 terms: https:\/\/www.microsoft.com\/legal\/terms-of-use \u2014 privacy: https:\/\/privacy.microsoft.com\/privacystatement<\/li>\n
- TikTok \u2014 analytics.tiktok.com \u2014 terms: https:\/\/www.tiktok.com\/legal\/terms-of-service \u2014 privacy: https:\/\/www.tiktok.com\/legal\/privacy-policy<\/li>\n
- LinkedIn Insight \u2014 snap.licdn.com \u2014 terms: https:\/\/www.linkedin.com\/legal\/user-agreement \u2014 privacy: https:\/\/www.linkedin.com\/legal\/privacy-policy<\/li>\n
- X (Twitter) Ads \u2014 static.ads-twitter.com \u2014 terms: https:\/\/legal.twitter.com\/ads-terms.html \u2014 privacy: https:\/\/twitter.com\/en\/privacy<\/li>\n
- Pinterest Tag \u2014 s.pinimg.com \u2014 terms: https:\/\/policy.pinterest.com\/terms-of-service \u2014 privacy: https:\/\/policy.pinterest.com\/privacy-policy<\/li>\n
- Snap Pixel \u2014 sc-static.net \u2014 terms: https:\/\/snap.com\/terms \u2014 privacy: https:\/\/snap.com\/privacy\/privacy-policy<\/li>\n
- Reddit Pixel \u2014 redditstatic.com \u2014 terms: https:\/\/www.redditinc.com\/policies\/user-agreement \u2014 privacy: https:\/\/www.reddit.com\/policies\/privacy-policy<\/li>\n
- Amazon Ads \u2014 c.amazon-adsystem.com \u2014 terms: https:\/\/www.amazon.com\/gp\/help\/customer\/display.html?nodeId=508088 \u2014 privacy: https:\/\/www.amazon.com\/gp\/help\/customer\/display.html?nodeId=468496<\/li>\n
- Criteo \u2014 static.criteo.net \u2014 terms: https:\/\/www.criteo.com\/terms-and-conditions\/ \u2014 privacy: https:\/\/www.criteo.com\/privacy\/<\/li>\n
- Outbrain \u2014 amplify.outbrain.com \u2014 terms: https:\/\/www.outbrain.com\/onyx\/term-of-use\/ \u2014 privacy: https:\/\/www.outbrain.com\/privacy\/<\/li>\n
- Taboola \u2014 cdn.taboola.com \u2014 terms: https:\/\/policies.taboola.com\/terms-of-service\/ \u2014 privacy: https:\/\/policies.taboola.com\/privacy-policy\/<\/li>\n
- Hotjar \u2014 static.hotjar.com \u2014 terms: https:\/\/www.hotjar.com\/legal\/policies\/terms-of-service\/ \u2014 privacy: https:\/\/www.hotjar.com\/legal\/policies\/privacy\/<\/li>\n
- Segment (Twilio) \u2014 cdn.segment.com \u2014 terms: https:\/\/www.twilio.com\/en-us\/legal\/tos \u2014 privacy: https:\/\/www.twilio.com\/en-us\/legal\/privacy<\/li>\n
- Heap \u2014 cdn.heapanalytics.com \u2014 terms: https:\/\/www.heap.io\/terms \u2014 privacy: https:\/\/www.heap.io\/privacy<\/li>\n
- Amplitude \u2014 cdn.amplitude.com \u2014 terms: https:\/\/amplitude.com\/terms \u2014 privacy: https:\/\/amplitude.com\/privacy<\/li>\n
- Mixpanel \u2014 cdn.mxpnl.com \u2014 terms: https:\/\/mixpanel.com\/legal\/terms-of-use\/ \u2014 privacy: https:\/\/mixpanel.com\/legal\/privacy-policy\/<\/li>\n
- FullStory \u2014 fullstory.com \u2014 terms: https:\/\/www.fullstory.com\/legal\/terms-and-conditions\/ \u2014 privacy: https:\/\/www.fullstory.com\/legal\/privacy-policy\/<\/li>\n
- Crazy Egg \u2014 script.crazyegg.com \u2014 terms: https:\/\/www.crazyegg.com\/terms \u2014 privacy: https:\/\/www.crazyegg.com\/privacy<\/li>\n
- Mouseflow \u2014 cdn.mouseflow.com \u2014 terms: https:\/\/mouseflow.com\/legal\/terms\/ \u2014 privacy: https:\/\/mouseflow.com\/legal\/privacy-policy\/<\/li>\n
- Inspectlet \u2014 cdn.inspectlet.com \u2014 terms: https:\/\/www.inspectlet.com\/terms-of-service \u2014 privacy: https:\/\/www.inspectlet.com\/terms-of-service<\/li>\n
- Plausible Analytics \u2014 plausible.io \u2014 terms: https:\/\/plausible.io\/terms \u2014 privacy: https:\/\/plausible.io\/privacy<\/li>\n
- PostHog \u2014 posthog.com \u2014 terms: https:\/\/posthog.com\/terms \u2014 privacy: https:\/\/posthog.com\/privacy<\/li>\n
- Simple Analytics \u2014 simpleanalyticscdn.com \u2014 terms: https:\/\/www.simpleanalytics.com\/terms \u2014 privacy: https:\/\/www.simpleanalytics.com\/privacy-policy<\/li>\n
- HubSpot \u2014 js.hs-scripts.com \u2014 terms: https:\/\/legal.hubspot.com\/terms-of-service \u2014 privacy: https:\/\/legal.hubspot.com\/privacy-policy<\/li>\n
- Intercom \u2014 widget.intercom.io \u2014 terms: https:\/\/www.intercom.com\/legal\/terms-and-policies \u2014 privacy: https:\/\/www.intercom.com\/legal\/privacy<\/li>\n
- Drift \u2014 js.driftt.com \u2014 terms: https:\/\/www.drift.com\/terms-of-service\/ \u2014 privacy: https:\/\/www.drift.com\/privacy-policy\/<\/li>\n
- Crisp \u2014 client.crisp.chat \u2014 terms: https:\/\/crisp.chat\/en\/terms\/ \u2014 privacy: https:\/\/crisp.chat\/en\/privacy\/<\/li>\n
- Tawk.to \u2014 embed.tawk.to \u2014 terms: https:\/\/www.tawk.to\/terms-of-service\/ \u2014 privacy: https:\/\/www.tawk.to\/privacy-policy\/<\/li>\n
- LiveChat \u2014 cdn.livechatinc.com \u2014 terms: https:\/\/www.livechat.com\/legal\/terms\/ \u2014 privacy: https:\/\/www.livechat.com\/legal\/privacy-policy\/<\/li>\n
- Zendesk \u2014 static.zdassets.com \u2014 terms: https:\/\/www.zendesk.com\/company\/agreements-and-terms\/master-subscription-agreement\/ \u2014 privacy: https:\/\/www.zendesk.com\/company\/agreements-and-terms\/privacy-notice\/<\/li>\n<\/ul>\n\n\n
\n- Install through Plugins \u2192 Add New<\/strong>, or upload the
cookiekita<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n- Activate the plugin through the Plugins<\/strong> menu.<\/li>\n
- Open the CookieKita<\/strong> menu and paste your Site Key (skipped automatically if you downloaded a pre-configured copy from your dashboard).<\/li>\n
- (Optional) Activate integrations and paste your tag IDs under CookieKita \u2192 Integrations<\/strong>.<\/li>\n
- (Optional) Add
[cookiekita_cookies]<\/code> to your Privacy Policy page and [cookiekita_dsar]<\/code> to your Data Requests page.<\/li>\n<\/ol>\n\n\n\nDoes this require a CookieKita account?<\/h3><\/dt>\nYes. CookieKita is a companion plugin for the cookiekita.com platform and needs a Site Key from your account. Core banner, blocking, scanner and DSAR form work on the free plan.<\/p><\/dd>\n
Will it slow down my site?<\/h3><\/dt>\nThe banner script is small, async-loaded and CDN-served. The tracker blocker runs a single fast pass per page render.<\/p><\/dd>\n
Does it actually block trackers, or just show a banner?<\/h3><\/dt>\nIt blocks. Recognised tracking scripts and embeds are held back (rendered as inert, consent-gated scripts) and only execute after the visitor consents to the matching category.<\/p><\/dd>\n
How does the consent-aware tag installer work?<\/h3><\/dt>\nYou paste a service ID (e.g. a GA4 Measurement ID or Meta Pixel ID). The plugin emits the vendor\u2019s official loader as a blocked inline script tied to a consent category, so it fires only after the visitor accepts that category.<\/p><\/dd>\n
Is DSAR auto-execution safe?<\/h3><\/dt>\nIt is opt-in (off by default), refuses to delete administrator accounts, and records every action to an audit log. Take a backup before enabling.<\/p><\/dd>\n
Does it work with WooCommerce?<\/h3><\/dt>\nYes. It adds consent-gated eCommerce event tracking (view_item, add_to_cart, begin_checkout, purchase) and uses WooCommerce\u2019s privacy hooks for DSAR.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.8<\/h4>\n\n\n- Admin UI no longer gates any panel behind the account connection. The Settings, Integrations and Shortcodes tabs are now always fully accessible and every option is editable and saved locally at all times \u2014 nothing is hidden or disabled while unconnected. A small, non-blocking hint simply notes that the consent banner goes live on the front-end once the site is connected (the banner script needs the Site Key to load its configuration). This addresses the review concern that locally-implemented features (tracker blocking, tag installer, shortcodes) appeared to be locked behind the service connection.<\/li>\n
- Removed the last padlock icon from the Integrations activation modal (replaced with a shield), so no \"lock\" iconography remains anywhere in the admin.<\/li>\n
- Full audit of every third-party terms\/privacy URL in the External services section; refreshed the ones that had moved or now return an error: Criteo (privacy \u2192 \/privacy\/, terms \u2192 \/terms-and-conditions\/), Meta\/Facebook (added trailing slashes so the pages return 200), Taboola (\u2192 policies.taboola.com), Outbrain terms (\u2192 \/onyx\/term-of-use\/), Mouseflow (\u2192 \/legal\/\u2026), Inspectlet (\u2192 \/terms-of-service) and Segment (\u2192 Twilio legal, since Segment's terms\/privacy are now governed by Twilio). All remaining links were verified reachable.<\/li>\n<\/ul>\n\n
1.0.7<\/h4>\n\n\n- Removed the custom update checker (
update_check_enabled<\/code> \/ ajax_check_update<\/code> \/ fetch_latest_version<\/code>) \u2014 updates are handled exclusively through the standard WordPress.org update flow.<\/li>\n- Renamed
render_lock_gate()<\/code> to render_service_connection_notice()<\/code> and replaced lock-icon UI with a neutral \"connect your account\" prompt. The tabs show a connection prompt because they are managed through the CookieKita external service (Guideline 6), not because features are locked behind a payment or licence.<\/li>\n- Removed lock-icon decorations from Integrations \/ Settings \/ Shortcodes tab buttons.<\/li>\n
- Fixed dead readme URLs: Criteo terms updated; Mouseflow terms\/privacy updated.<\/li>\n<\/ul>\n\n
1.0.6<\/h4>\n\n\n- No functional changes. Submitted in response to review R-29Jun26: confirmed that HubSpot (js.hs-scripts.com) and LiveChat (cdn.livechatinc.com) are fully documented in the External services section, including terms and privacy links. The privacy link for HubSpot (legal.hubspot.com\/privacy-policy) is their official URL; the timeout reported by the automated checker is caused by HubSpot's CDN anti-bot protection on their legal subdomain, not an invalid URL.<\/li>\n<\/ul>\n\n
1.0.5<\/h4>\n\n\n- Branded the \"Connect to CookieKita\" button to match the CookieKita visual style.<\/li>\n<\/ul>\n\n
1.0.4<\/h4>\n\n\n- Fixed \"Connection could not be completed\" \u2014 the connect state token is now shared across all Connect buttons on the page instead of being regenerated per button.<\/li>\n<\/ul>\n\n
1.0.3<\/h4>\n\n\n- The admin now lands on the Connection tab first when the site is not yet connected (all tabs remain accessible).<\/li>\n
- Updated the brand logo in the admin header.<\/li>\n<\/ul>\n\n
1.0.2<\/h4>\n\n\n- Text domain now matches the plugin slug (
cookiekita-gdpr-consent-cookie-banner<\/code>) so the plugin is translatable via the directory.<\/li>\n- Admin notice-hiding CSS is enqueued via
wp_add_inline_style<\/code> instead of an inline <style><\/code> echo.<\/li>\n- Public
\/ping<\/code> endpoint no longer exposes configuration state, feature flags or secret status \u2014 it returns only a minimal reachability response.<\/li>\n- The tracker-blocking output buffer is now explicitly closed (paired
ob_start<\/code>\/ob_end_flush<\/code>).<\/li>\n- Removed an unnecessary
require<\/code> of a WordPress core admin file in the DSAR exporter path.<\/li>\n- Documented all optional third-party tag services (with terms\/privacy links) in the External services section.<\/li>\n<\/ul>\n\n
1.0.1<\/h4>\n\n\n- Security hardening: proof-of-possession required to disconnect, stronger DSAR deletion guard (super-admins), reduced anonymous info in the health endpoint, and a hardcoded update link.<\/li>\n<\/ul>\n\n
1.0.0<\/h4>\n\n\n- Initial public release.<\/li>\n
- Cookie consent banner with real tracker blocking (37+ services) until consent.<\/li>\n
- Integrations directory + consent-aware tag installer (GA4, GTM, Meta Pixel, and more).<\/li>\n
- WooCommerce eCommerce events (view_item, add_to_cart, begin_checkout, purchase), fully consent-gated.<\/li>\n
- Google Consent Mode v2 + Microsoft UET Consent Mode, GPC\/DNT signals.<\/li>\n
- Cookie declaration and DSAR shortcodes, with optional auto-execution of verified requests.<\/li>\n
- One-click \"Connect to CookieKita\" onboarding, with manual Site Key entry as a fallback.<\/li>\n<\/ul>","raw_excerpt":"GDPR cookie consent banner with real tracker blocking, Google Consent Mode v2, consent-aware tag installer, DSAR handling and WooCommerce tracking.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/333142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=333142"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/gdimitrov"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=333142"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=333142"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=333142"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=333142"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=333142"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=333142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}