About this plugin
Privatto is a self-hosted consent management platform (CMP) for WordPress, built with Brazil’s LGPD and the GDPR in mind. It requires no external service.
Main features:
- Granular consent banner with per-category preferences (necessary, analytics, marketing, embeds).
- Automatic blocking of third-party scripts and iframes via output buffering: matching <script> tags are switched to type="text/plain" before the page reaches the browser, so nothing runs before consent.
- Google Consent Mode v2 injected with everything denied by default, updated when the visitor decides.
- Proof of consent stored in your own database table: unique consent ID, action, categories (JSON), policy version, hashed IP (optional), country, user agent, page URL, and UTC timestamp. Exportable to CSV for audits.
- LGPD document generator: privacy policy, terms of use, cookie policy, returns policy, and a plain-language summary, built from a guided form. Optional AI text refinement (Groq API) for the business description only — mandatory legal clauses never go through AI.
- Data subject rights form (LGPD art. 18) with tracked protocols, 15-day response deadline monitoring, and an admin queue.
- Simplified record of processing activities (ROPA) export, as required by ANPD Resolution CD/ANPD No. 2/2022, including for small-scale processing agents.
- “Cookie preferences” reopen link so visitors can change or revoke consent at any time.
Important notice: the generated documents are a structured starting point aligned with the LGPD; they are not legal advice. Review by a lawyer is recommended, especially for complex operations.
External services
This plugin connects to one optional third-party service:
Groq API — used only if you paste a Groq API key in Privatto → LGPD Documents. It is used to (1) rewrite, in more natural language, the free-text description of your site/business that you typed into the document form, and (2) generate a plain-language summary of your privacy policy for the same document. Only that free text (and the derived facts needed to build the summary) is sent; the mandatory legal clauses are always generated locally and never sent to the API.
This call happens only when you click the “Refine with AI” / “Generate summary with AI” buttons — never automatically and never on the public-facing site. If no key is configured, these buttons are disabled and everything works normally without any external call.
com ). com/privacy-policy
g. Google Analytics, Meta Pixel, Stripe) when writing your cookie policy. This catalog does not make any outbound request to those services — it is local, offline pattern-matching against your own site’s HTML.