CookieFlame

CookieFlame is a cookie consent plugin that finds your site’s cookies for you, runs on your own server, and shows each visitor the banner their region requires. com.

Finds cookies for you

• Watch for new cookies: your visitors’ browsers report cookies as they browse, so a new plugin’s or tag’s cookies appear in the Cookie Manager without you scanning. Get an email about changes weekly, daily, or not at all.

• Cookie Discovery: for a full list now, browse your own site with every cookie allowed for your browser only. It uses your own browser.

The right banner for each region

• UK, EU/EEA, Switzerland, Brazil and South Africa: an opt-in banner with Accept All and Manage preferences. You can also show Decline All on the first screen (off by default).

• United States: a short notice with a “Do Not Sell or Share My Personal Information” link that opens a real opt-out choice.

• Everywhere else: no banner.

Country comes from CDN headers such as Cloudflare’s, or a free MaxMind database you upload, with the time zone as a fallback. If none works, the opt-in banner is shown.

Global Privacy Control

A browser that sends Global Privacy Control (GPC) is opted out of selling and sharing straight away: marketing cookies stay off and Google’s ad signals are denied. US visitors see that the signal was honoured, and OK only closes the notice. The opt-out is saved, so a later visit without GPC keeps it.

A visitor can opt back in only through a separate, clear choice.

Blocks trackers before consent

Tracking scripts and image pixels are rewritten on your server before the page is sent, so blocking works with WP Rocket, LiteSpeed, Cloudflare APO and other caches. Scripts and pixels added later, for example by Google Tag Manager, are stopped in the browser. Built-in patterns cover Google Analytics, Google Ads, Google Tag Manager, Microsoft Ads, Meta, X (Twitter), LinkedIn, Pinterest, Reddit and TikTok.

Cookies you classify get matching rules automatically.

YouTube, Vimeo, Google Maps, Spotify, SoundCloud, Dailymotion and Elementor videos show a click-to-load placeholder until the visitor consents.

Google Consent Mode v2

All Google consent signals start as denied before any tag runs and update the moment a visitor chooses. Google Tag Manager starts only after that update, and only once analytics or marketing is allowed: by the visitor where a banner asks, by default in the US and regions with no banner. Give each tag a consent setting in Tag Manager, so it follows the choice too.

For developers

• Events: cc:ready, cc:update, cc:accept-all, cc:decline-all, cc:save and cc:banner-rendered.

• JavaScript API: CookieConsent.getState(), show(), showSettings() and more.

• [cookieflame_settings_link] shortcode, or the class cc-open-settings on any link, to reopen a visitor’s choices.

• CSS custom properties (–cc-accent, –cc-bg, –cc-radius, –cc-font and others) to restyle the banner.

• Filters cookieflame_frontend_config, cookieflame_digest_email, cookieflame_unsafe_block_hosts and cookieflame_url_passthrough, and the action cookieflame_settings_sections.

• An optional consent log endpoint for your own audit trail.

CookieFlame Pro

Pro identifies and classifies cookies automatically, creates the blocking rules, and adds instant emails. com.

Compliance note

CookieFlame helps with GDPR, CCPA, LGPD, POPIA and similar laws; how you set it up is your responsibility. For legal advice, ask a qualified professional.

External services

CookieFlame does not phone home. These requests happen only in the cases described.

Google Tag Manager (optional). js) loads only after consent, once analytics or marketing is allowed, and never for visitors you exclude from tracking. In the US and regions with no banner, where they’re allowed by default, it loads on the first page, and still does after an opt-out, which turns off marketing only.

Tags inside it follow the visitor’s Consent Mode choices. Sent: the container ID and the browser’s standard request data (IP address, user agent, page URL). Terms, privacy policy.

Microsoft UET (optional). js) loads only after consent, once Marketing is allowed, and never for visitors you exclude from tracking. In the US and regions with no banner it loads on the first page unless the visitor has opted out.

Sent: the tag ID and the browser’s standard request data. Microsoft Advertising agreement, privacy statement.

Consent log endpoint (optional). If you enter a URL in the Consent Log Endpoint setting, each consent choice is sent there from the visitor’s browser as JSON: an anonymous ID, time, action, the choice per category, region, country code, page URL, user agent, the GPC flag, consent version and plugin version. No cookie values or IP address are in it.

You choose the destination and are responsible for it.

net) are only used to recognise and block scripts; they are never contacted.