GDPR Compliance & Cookie Consent

If you enable “Block Cookies” in the General tab, yes for cookies set by WordPress and PHP plugins on the front end and for cookies written by JavaScript on your pages, until the visitor accepts the banner. It does not stop third-party scripts such as analytics or ad tags from loading, so those need to be handled separately, for example by loading them only after consent.

No. It helps with several parts of the job, such as a consent banner, consent checkboxes and data requests, but compliance also depends on your privacy policy, how you process data and which services you use. If you need legal certainty, ask a qualified lawyer.

Place the [stm-gpdr-data-access] shortcode on a page (or add the “GDPR Compliance Widget”). A visitor enters their email address and chooses “Export Personal Data” or “Erase Personal Data”. WordPress sends a confirmation email, and after the visitor confirms, the request appears in your admin under Tools > Export Personal Data or Erase Personal Data, where you process it.

WordPress comments, Contact Form 7, Gravity Forms, WooCommerce, BuddyPress and MailChimp forms. Enable each integration on the “Integrated plugins” tab and edit its checkbox label and error message.

For WordPress comments the date and time the commenter ticked the checkbox is stored with the comment and shown in the comments list. For the cookie banner, acceptance is remembered in a cookie on the visitor’s browser (and, for logged-in users, in their user profile data) until it expires; the plugin does not keep a central log of banner acceptances.

Yes. The banner is always printed hidden and the visitor’s browser shows it only when there is no consent cookie, so page caches (WP Rocket, W3 Total Cache, LiteSpeed, Cloudflare and others) can serve the same HTML to everyone and no cookie needs to be excluded from the cache. Saving the plugin settings also clears the page cache of the common caching plugins. Cookie blocking and Consent Mode also run in the browser. If you still see an old banner after changing settings, purge your cache once.

Yes, it is on by default; see “Google Consent Mode v2” in the description. You can switch it off in the General tab. It works with Google Tag Manager, GA4 and Google Ads tags that honour Consent Mode, including those added by Site Kit.

Add the “Data Access & Erasure Request” block in the block editor, or place the [stm-gpdr-data-access] shortcode on a page, or use the “GDPR Compliance Widget”.

Yes. New installs show it by default; on sites that already had the plugin, tick “Decline button” on the General tab. Under the GDPR, declining should be as easy as accepting. A declined visitor does not see the banner again until the consent cookie expires, Consent Mode stays denied, and the cookie blocker (if enabled) stays active.

The banner, the cookie blocker and Consent Mode are skipped in the Customizer preview and in the WPBakery, Elementor, Divi, Beaver Builder, Oxygen, Brizy, Thrive and SiteOrigin editors.