About this plugin
OW Consent is a consent management suite for WordPress. Eleven compliance profiles ship with it, from the GDPR and the UK PECR to the CCPA, the LGPD, PIPL and Quebec Law 25; the one in force decides the consent model, the Consent Mode defaults and the documents generated.
2 or later. 1 are not offered the update.
Works behind a full-page cache
Nothing on the front end depends on the visitor’s consent cookie: the HTML is identical for every visitor, and the consent state is rebuilt in the browser from the cookie and applied before first paint. Trackers are blocked in the markup for everyone and released client-side for the categories the visitor granted, so a page cache (LiteSpeed, WP Rocket, Varnish, a CDN) cannot serve one visitor’s choices to another.
What it includes
- Cookie banner: four positions, light, dark or automatic theme, “Reject all” as prominent as “Accept all”, keyboard operable, translatable.
- Tracker blocker: scripts, inline snippets, iframes, pixels, resource hints, analytics stylesheets and media, from 183 editable signatures.
- Consent ledger: every action appended to a hash-chained table signed with HMAC-SHA-256, with the profile and the banner actually shown.
- Data-subject requests: shortcode form, e-mail verification, the Article 12.3 deadline, WordPress’s own exporter and eraser hooks.
- Legal documents: a privacy notice and a cookie policy per profile, in that profile’s language, fed by a site scanner that sweeps your own pages on WP-Cron, off by default.
- Google Consent Mode v2, IAB TCF v2.2, Global Privacy Control, geo routing, OW Forms integration: each off unless you enable it.
Limits, stated plainly
The generated documents are drafting aids, not legal advice: have them reviewed before publishing. The scanner reports what your HTML contains plus what an administrator-only probe observed; it is not a completeness guarantee. The TCF module is not a CMP registered with IAB Europe and offers no vendor-level choice, so vendors may reject its signal.
The ledger is tamper-evident only while its signing key lives outside the database, and warns you when it is not.
Each module is documented in the FAQ below.
External services
OW Consent contacts one external service, and only when you enable the feature that requires it.
IAB Europe Global Vendor List
2 module, which is disabled by default. The TCF framework requires the current list of registered ad-tech vendors; the plugin downloads it so it can build a TC String and expose the vendor set through __tcfapi.
2” option is enabled, from a daily WP-Cron job (or from the settings screen when you enable the option). It is never fetched while a visitor’s page is being rendered, and the public owco/v1/tcf/gvl REST route serves the cached copy only — it never triggers an outbound request.
What is sent: nothing. json. No site data, no visitor data, no personal data and no identifier is transmitted; the only information the service receives is what your server necessarily discloses by making an HTTP request (its IP address and its user agent).
The response is stored in a WordPress transient for one week and served from that cache; if a refresh fails, the previously cached list is kept.
Service provided by IAB Europe. eu/privacy-policy/
Requests to your own site
The site scanner issues HTTP requests to your own site’s public URLs in order to inventory the trackers your pages load. These requests never leave your own host: the URL list is restricted to your site’s host after the owco_scanner_urls filter has been applied. No third party is involved.
MaxMind GeoLite2
If you place a GeoLite2 country database in wp-content/uploads/ow-geoip/ and enable the option, the plugin reads that local file with its own bundled reader. It never contacts MaxMind, and it never sends an IP address anywhere: the lookup happens on your server and the address is discarded immediately.
Tracker host names shipped as blocking signatures
json. They are blocking signatures. A host matching one of them is a host the plugin prevents the page from requesting until the visitor has consented to the matching category; the plugin makes no request to any of them, at any point, from the server or from the browser.
The same list is what the browser-side guard compares an injected script against before refusing it, and what the generated cookie policy names as vendors.
2 module is enabled.