Lynbro Cookie Consent

A free, multilingual and fully configurable cookie consent banner for WordPress.

It is GDPR/ePrivacy and Google Consent Mode v2 ready out of the box, with an

equally prominent “Reject all” button (in line with Datatilsynet / EDPB guidance)

and no pageview or domain limits. Everything runs locally — no account, no cloud,

no external requests on the front end.

This plugin helps you with cookie compliance but does not constitute legal advice.

Source code and issue tracker on GitHub:

com/andrey-tut/lynbro-cookie-consent

Free features:

• Accessible banner in the footer with equal Accept all / Reject all / Save

preferences buttons (rejection-equality, no dark patterns).

• Granular consent categories: Necessary (always on), Preferences, Statistics,

Marketing — with per-category toggles and descriptions.

• Script blocking before consent: mark scripts as

type=”text/plain” data-lynbro-cc=”statistics|marketing” and they only run

after the matching category is granted. Helper function included.

• Google Consent Mode v2 — free: all signals default to “denied” before consent

(ad_storage, analytics_storage, ad_user_data, ad_personalization,

functionality_storage, personalization_storage, security_storage), updated

after the visitor chooses.

• Geo-aware consent model: EU/EEA/UK → opt-in, US → opt-out (CCPA/CPRA), rest of

world → notice. g. Cloudflare); safe

opt-in fallback when unknown. No external geolocation API.

• Embed/iframe consent placeholders: YouTube, Vimeo, Google Maps, social embeds,

reCAPTCHA and more are blocked until consent and replaced with a tidy,

translatable placeholder with an “allow” button (and an optional “always allow

this service” choice). Zero layout shift — placeholders reserve the iframe size.

• Automatic blocking of well-known trackers by a built-in catalog (Google

Analytics/GA4, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity,

LinkedIn, TikTok and more) in addition to manual script marking. Extendable via

a filter.

• Global Privacy Control (GPC): honors the browser opt-out signal and, in

opt-out mode, automatically applies it with a visible confirmation (California

CPRA 2026).

• CCPA / CPRA “Do Not Sell or Share My Personal Information” link in opt-out mode.

• Cache & performance friendly: the consent core is automatically excluded from

delay/defer/minify/combine of WP Rocket, LiteSpeed, SiteGround Optimizer,

Autoptimize and Cloudflare Rocket Loader, with zero layout shift (CLS).

• Full customization without code: light/dark/auto theme (follows the visitor’s

system), separate light and dark color sets, position (bottom bar, top bar,

floating box with corner choice, center modal), live admin preview and a

WCAG-AA contrast validator.

• Floating “Cookie settings” button (toggle, corner, label, icon) plus the

shortcode [lynbro_cookie_settings] to re-open the banner at any time.

• Local consent log (proof of consent) stored in your own database — with the

policy version, chosen categories, method, language and region, and an

anonymised hash instead of a raw IP address. Includes an admin viewer and a

full CSV export of the entire log.

• WP Consent API compatible: registers as the consent provider and notifies other

plugins (functional / preferences / statistics / marketing).

• Settings import/export (JSON), per-page/post exclusions and policy versioning

with automatic re-consent when the version changes. No “accept on scroll”.

• Accessibility: visible focus, ARIA roles, focus trap in the modal, large touch

targets, RTL ready, reduced-motion support.

• Private, cookieless statistics — stored only in your own database and fully

aggregated (no IP address, no visitor identifier, no personal data). See how

many visitors accept, reject or open preferences, the accept rate per period,

the average time to decision and the browser-language / device / OS mix. On by

default; can be turned off in one click.

• Optional benchmark sharing (off by default): when you opt in, the plugin sends

only aggregated weekly numbers and your site domain to the Lynbro portal so you

can see how your accept rate compares to the average. No visitor data is sent.

• Built-in feedback form: send ideas, requests or bug reports to the developers

straight from the admin (only when you click Send).

• Language on demand: request a translation for a locale that isn’t bundled; it

is stored in your uploads folder (update-safe) and activated automatically.

• Lightweight vanilla JavaScript (no jQuery), no front-end external requests

beyond an optional, non-blocking statistics beacon to your own site.

• Truly multilingual and cache-safe: the initial banner language follows a

cache-safe cascade (current page language of Polylang/WPML/TranslatePress →

site language → English). Optional browser auto-detection and an in-banner

language switcher pick the best language entirely in the visitor’s browser,

so full-page caches are never affected.

• Edit banner texts per language in the admin (title, description, buttons,

category names and descriptions), with the priority your override → bundled

translation → default. You can even add your own locale and texts.

• Fully translatable. Ships with 35 bundled languages — including all 24

official EU languages (Danish, German, French, Spanish, Italian, Dutch,

Polish, Swedish, Greek and more) — plus any other locale on demand and via

org.

• Developer-friendly: filters and a JS API

onChange() ).

Every feature listed here is included for free, with no pageview limits and

nothing locked behind a paywall.

External Services

By default this plugin runs locally. The banner, script blocking, automatic

tracker detection, embed placeholders, Google Consent Mode v2 signalling,

geo-aware consent mode, Global Privacy Control handling, the local consent log

and the local statistics all work on your own server and in the visitor’s

browser, with no account and no third-party API.

The local statistics use a small, non-blocking beacon that is sent only to your

own WordPress site (the same domain) to count aggregated events. It does not

contact any third party and stores no IP address or personal data.

Three optional features can contact the Lynbro portal at

dk. None of them runs automatically without your action,

and none of them sends a visitor IP or any personal data:

-

Benchmark sharing (telemetry) — off by default. When you turn it on, a

weekly background job sends aggregated counters for the last 7 days (banner

shown / accept / reject / manage-open / language-switch totals, the average

time-to-decision, and the browser-language / device / OS distributions) plus

dk/v1/telemetry. The portal

returns an anonymous benchmark so you can compare your accept rate to the

average. Sent only while the option is enabled.

-

Feedback — sent only when you submit the feedback form in the admin. It

posts your message, the chosen category, the plugin version, your site domain

dk/v1/feedback.

-

Language on demand — sent only when you click “Request this language”. It

posts the plugin slug, the plugin version and the requested locale code to

dk/v1/i18n/translate, and stores the returned

translation file in your site’s uploads folder. No visitor data is involved.

Your use of these optional portal features is governed by the Lynbro Privacy

dk.

Note: any third-party scripts or embeds you add to your own site (for example

Google Analytics, Meta Pixel or a YouTube video) continue to contact their own

providers — but only after the visitor grants the matching consent category. This

plugin’s role is to gate them, not to add them.

Privacy

The plugin stores data only in your WordPress database (your settings and, if

enabled, the local consent log and the local aggregated statistics) and in

first-party cookies on the visitor’s browser (their consent choice and, if used,

the chosen banner language). The consent log never stores a raw IP address — only

a salted, anonymised hash for de-duplication. The statistics are fully aggregated

and contain no IP address or visitor identifier; they are recorded via a

non-blocking beacon to your own site only.

The optional portal features — benchmark sharing (telemetry), the feedback form

and language-on-demand — are opt-in and described in the “External services”

section above. They send aggregated data and your site domain only, never a

dk. See our Privacy Policy

and Terms there. GDPR/DK compliant.