Lynbro Cookie Consent

A free, multilingual and fully configurable cookie consent banner for WordPress. It is GDPR/ePrivacy and Google Consent Mode v2 ready out of the box, with an equally prominent „Reject all“ button (in line with Datatilsynet / EDPB guidance) and no pageview or domain limits. Everything runs locally — no account, no cloud, no external requests on the front end.

This plugin helps you with cookie compliance but does not constitute legal advice.

Source code and issue tracker on GitHub: https://github.com/andrey-tut/lynbro-cookie-consent

Free features:

• Accessible banner in the footer with equal Accept all / Reject all / Save preferences buttons (rejection-equality, no dark patterns).
• Granular consent categories: Necessary (always on), Preferences, Statistics, Marketing — with per-category toggles and descriptions.
• Script blocking before consent: mark scripts as type=“text/plain“ data-lynbro-cc=“statistics|marketing“ and they only run after the matching category is granted. Helper function included.
• Google Consent Mode v2 — free: all signals default to „denied“ before consent (ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage, security_storage), updated after the visitor chooses.
• Geo-aware consent model: EU/EEA/UK → opt-in, US → opt-out (CCPA/CPRA), rest of world → notice. Region detected from CDN/edge headers (e.g. Cloudflare); safe opt-in fallback when unknown. No external geolocation API.
• Embed/iframe consent placeholders: YouTube, Vimeo, Google Maps, social embeds, reCAPTCHA and more are blocked until consent and replaced with a tidy, translatable placeholder with an „allow“ button (and an optional „always allow this service“ choice). Zero layout shift — placeholders reserve the iframe size.
• Automatic blocking of well-known trackers by a built-in catalog (Google Analytics/GA4, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity, LinkedIn, TikTok and more) in addition to manual script marking. Extendable via a filter.
• Global Privacy Control (GPC): honors the browser opt-out signal and, in opt-out mode, automatically applies it with a visible confirmation (California CPRA 2026).
• CCPA / CPRA „Do Not Sell or Share My Personal Information“ link in opt-out mode.
• Cache & performance friendly: the consent core is automatically excluded from delay/defer/minify/combine of WP Rocket, LiteSpeed, SiteGround Optimizer, Autoptimize and Cloudflare Rocket Loader, with zero layout shift (CLS).
• Full customization without code: light/dark/auto theme (follows the visitor’s system), separate light and dark color sets, position (bottom bar, top bar, floating box with corner choice, center modal), live admin preview and a WCAG-AA contrast validator.
• Floating „Cookie settings“ button (toggle, corner, label, icon) plus the shortcode [lynbro_cookie_settings] to re-open the banner at any time.
• Local consent log (proof of consent) stored in your own database — with the policy version, chosen categories, method, language and region, and an anonymised hash instead of a raw IP address. Includes an admin viewer and a full CSV export of the entire log.
• WP Consent API compatible: registers as the consent provider and notifies other plugins (functional / preferences / statistics / marketing).
• Settings import/export (JSON), per-page/post exclusions and policy versioning with automatic re-consent when the version changes. No „accept on scroll“.
• Accessibility: visible focus, ARIA roles, focus trap in the modal, large touch targets, RTL ready, reduced-motion support.
• Private, cookieless statistics — stored only in your own database and fully aggregated (no IP address, no visitor identifier, no personal data). See how many visitors accept, reject or open preferences, the accept rate per period, the average time to decision and the browser-language / device / OS mix. On by default; can be turned off in one click.
• Optional benchmark sharing (off by default): when you opt in, the plugin sends only aggregated weekly numbers and your site domain to the Lynbro portal so you can see how your accept rate compares to the average. No visitor data is sent.
• Built-in feedback form: send ideas, requests or bug reports to the developers straight from the admin (only when you click Send).
• Language on demand: request a translation for a locale that isn’t bundled; it is stored in your uploads folder (update-safe) and activated automatically.
• Lightweight vanilla JavaScript (no jQuery), no front-end external requests beyond an optional, non-blocking statistics beacon to your own site.
• Truly multilingual and cache-safe: the initial banner language follows a cache-safe cascade (current page language of Polylang/WPML/TranslatePress → site language → English). Optional browser auto-detection and an in-banner language switcher pick the best language entirely in the visitor’s browser, so full-page caches are never affected.
• Edit banner texts per language in the admin (title, description, buttons, category names and descriptions), with the priority your override → bundled translation → default. You can even add your own locale and texts.
• Fully translatable. Ships with 35 bundled languages — including all 24 official EU languages (Danish, German, French, Spanish, Italian, Dutch, Polish, Swedish, Greek and more) — plus any other locale on demand and via translate.wordpress.org.
• Developer-friendly: filters and a JS API (window.LynbroCookieConsent.getConsent() / .openSettings() / .onChange()).

Every feature listed here is included for free, with no pageview limits and nothing locked behind a paywall.

External Services

By default this plugin runs locally. The banner, script blocking, automatic tracker detection, embed placeholders, Google Consent Mode v2 signalling, geo-aware consent mode, Global Privacy Control handling, the local consent log and the local statistics all work on your own server and in the visitor’s browser, with no account and no third-party API.

The local statistics use a small, non-blocking beacon that is sent only to your own WordPress site (the same domain) to count aggregated events. It does not contact any third party and stores no IP address or personal data.

Three optional features can contact the Lynbro portal at https://plugins.lynbro.dk. None of them runs automatically without your action, and none of them sends a visitor IP or any personal data:

1. Benchmark sharing (telemetry) — off by default. When you turn it on, a weekly background job sends aggregated counters for the last 7 days (banner shown / accept / reject / manage-open / language-switch totals, the average time-to-decision, and the browser-language / device / OS distributions) plus your site’s domain to https://plugins.lynbro.dk/v1/telemetry. The portal returns an anonymous benchmark so you can compare your accept rate to the average. Sent only while the option is enabled.

2. Feedback — sent only when you submit the feedback form in the admin. It posts your message, the chosen category, the plugin version, your site domain and (optionally) the email you type, to https://plugins.lynbro.dk/v1/feedback.

3. Language on demand — sent only when you click „Request this language“. It posts the plugin slug, the plugin version and the requested locale code to https://plugins.lynbro.dk/v1/i18n/translate, and stores the returned translation file in your site’s uploads folder. No visitor data is involved.

Your use of these optional portal features is governed by the Lynbro Privacy Policy and Terms at https://plugins.lynbro.dk.

Note: any third-party scripts or embeds you add to your own site (for example Google Analytics, Meta Pixel or a YouTube video) continue to contact their own providers — but only after the visitor grants the matching consent category. This plugin’s role is to gate them, not to add them.

Privacy

The plugin stores data only in your WordPress database (your settings and, if enabled, the local consent log and the local aggregated statistics) and in first-party cookies on the visitor’s browser (their consent choice and, if used, the chosen banner language). The consent log never stores a raw IP address — only a salted, anonymised hash for de-duplication. The statistics are fully aggregated and contain no IP address or visitor identifier; they are recorded via a non-blocking beacon to your own site only.

The optional portal features — benchmark sharing (telemetry), the feedback form and language-on-demand — are opt-in and described in the „External services“ section above. They send aggregated data and your site domain only, never a visitor IP or personal data, to https://plugins.lynbro.dk. See our Privacy Policy and Terms there. GDPR/DK compliant.