Harbor Privacy Guard for WooCommerce

Harbor Privacy Guard for WooCommerce enforces visitor privacy choices on the server. Instead of setting a client-side consent flag for tracking scripts to read, it detects the visitor’s consent state in PHP and dequeues known tracking script handles before WordPress renders the page, so scripts that were declined never load.

GPC Browser Signal Detection

GPC (Global Privacy Control) is a browser-level opt-out signal that is legally binding in 12 US states. When a user enables it — through their browser settings or a privacy extension — their browser sends Sec-GPC: 1 on every HTTP request. This plugin detects that header server-side, requiring no user interaction with a banner. A small JavaScript snippet also reads navigator.globalPrivacyControl and sets a first-party cookie (gpcg_gpc_js) so GPC is honored even when the header is absent (some proxies strip it).

Google Consent Mode v2

The plugin emits gtag('consent','default',{...}) before GTM loads, at wp_head priority 1 — the integration point Google’s Consent Mode v2 documentation requires. Google’s GA4 behavioral modeling needs this consent signal to be present even for visitors who deny tracking; the plugin supplies it so modeling continues to work for users who have denied or not yet responded.

California CPRA Opt-Out Audit Trail

California’s CPRA regulations (effective January 2026) require stores to log opt-out signals with a timestamped record. This plugin stores consent decisions in a dedicated database table ({prefix}gpcg_opt_out_log) rather than wp_options. Opt-outs are recorded where they happen — when a visitor declines (or accepts) the banner, when an automatic GPC signal is detected (deduplicated to once per visitor per day), and at WooCommerce checkout — so the trail covers non-purchasers, not only completed orders. Each row records the hashed IP address (SHA-256 with a dedicated, stored plugin salt kept separate from WordPress auth keys so it survives key rotation — the raw IP is never written to disk), the consent state (granted / denied / gpc), the signal source (banner / gpc_header / gpc_js / default), the WooCommerce order ID, the page URL, and a UTC timestamp. A confirmation notice is displayed on the WooCommerce thank-you page to satisfy the California requirement that users receive visible confirmation of their opt-out.

Minimal Performance Impact

On the fast path — consent granted, no GPC signal — there is no output buffering and no HTML rewriting; the expensive work never runs. To keep per-visitor consent state correct, responses that depend on a consent cookie or GPC signal are automatically excluded from full-page caches (and the consent cookies are registered with WP Rocket and LiteSpeed Cache); first-visit pages remain cacheable. Output buffering for script stripping is a Pro feature and is never activated for consented users.

Free vs Pro

Feature Free Pro

GPC header detection (Sec-GPC) ✓ ✓

GPC JavaScript detection ✓ ✓

Block WooCommerce Google Analytics integration ✓ ✓

Block Facebook / Meta Pixel ✓ ✓

Block TikTok Pixel — ✓

Block Bing / Microsoft UET — ✓

Google Consent Mode v2 dataLayer defaults ✓ ✓

Consent banner (accept / decline) ✓ ✓

Opt-out confirmation on WooCommerce thank-you page ✓ ✓

Audit log of banner, GPC, and checkout consent events (hashed IP, order ID, state, source) ✓ ✓

Output-buffer script stripping (catches inline + third-party injected scripts) — ✓

Custom domain blocklist — ✓

CSV compliance export — ✓

Multi-state consent UI (California vs Virginia vs Colorado) — ✓

How It Works

1. On every request, PHP checks the Sec-GPC header and the gpcg_gpc_js cookie (set by a tiny JS snippet that reads navigator.globalPrivacyControl).
2. If GPC or no consent: known tracking script handles are dequeued; gtag('consent','default',{ad_storage:'denied',...}) fires before GTM at wp_head priority 1.
3. Consent decisions are logged to a dedicated audit table (SHA-256 hashed IP, UTC timestamp) when the visitor uses the banner, when GPC is detected (once per visitor per day), and at WooCommerce checkout completion.

Privacy

This plugin stores consent decisions in the database table {prefix}gpcg_opt_out_log. Visitor IP addresses are hashed with SHA-256 and a site-specific salt before storage — raw IPs are never written to disk. The hashed IP, consent state (granted/denied/gpc), signal source (banner/gpc_header/gpc_js/default), WooCommerce order ID (when applicable), and page URL are retained until the plugin is uninstalled or the site administrator exports and purges the table. This plugin transmits nothing to external servers; the bundled Freemius SDK is opt-in only, used solely for Pro license activation if you choose to enter a license key.