CoreConsent

CoreConsent is a lightweight, self-hosted cookie consent plugin. It shows visitors a consent banner, holds your tracking scripts until they choose, and sends Google Consent Mode v2 signals — all handled on your own site, with no calls out to a third-party consent platform.

It’s built to stay out of the way: the banner is plain JavaScript (no jQuery), consent is applied in the visitor’s browser, and your pages cache normally — so adding consent doesn’t slow your site down or break full-page caching.

Free features

• Customizable consent banner — accept, reject, and per-category preferences.
• Unlimited consent services and categories, with a one-click template library for common trackers.
• Google Consent Mode v2 — sends the full set of v2 consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization, and more), defaulted to denied, and loads your Google tags only after the visitor consents.
• Consent-based script control — automatically holds recognized scripts you’ve added as services, plus any script you tag for consent, and activates them when the visitor agrees.
• Region rules — show or adjust the banner based on the visitor’s region. You decide where and how it appears; CoreConsent does not determine your legal obligations.
• Honors Global Privacy Control (GPC).
• No data leaves your site — consent is stored and handled entirely on your own WordPress install.

CoreConsent Pro

• Automatic scanning — find the trackers and cookies actually running on your site, with scheduled re-scans and email digests.
• Automatic blocking — catch hardcoded and inline trackers, not just the ones you’ve tagged.
• Script Manager — hold and manage tags for consent without editing code.
• Custom banner styling.
• Consent logging with CSV export — keep records of the consent your visitors gave.
• Translations for a multilingual banner.

CoreConsent Agency

• White-label the plugin as your own.
• Multisite: scan and push consent settings across every site in your network.

Cookies Set By This Plugin

CoreConsent sets first-party cookies of its own, which you should list in your site’s cookie/privacy policy:

• coreconsent (name configurable under Developer options) — stores the visitor’s consent choices so the banner is not shown again and scripts obey the saved decision. Expiry follows the «Cookie expiration» setting (365 days by default). This is a strictly necessary cookie: it contains only the consent state, no identifiers or personal data, and storing it does not itself require consent under GDPR/ePrivacy.
• cc_geo — only set when the optional Geo-targeting feature is enabled. Caches the resolved region behavior for 24 hours so the region lookup does not repeat on every page view. Contains a region behavior string and a timestamp, no personal data. When Geo-targeting is disabled, the plugin removes this cookie from returning visitors automatically.

If «Storage method» is set to localStorage instead of cookies, consent choices are kept in the browser’s localStorage under the same key and no consent cookie is set.

External Services

This plugin makes no connections to any third-party service and sends no data anywhere. The consent banner, visitor choices, consent-gated script loading, region rules, and Google Consent Mode signals are all handled entirely on your own WordPress install. No visitor or end-user data ever leaves your site, and no external scripts, fonts, or stylesheets are loaded.

A separate, optional CoreConsent Pro plugin (sold from our website, not hosted on WordPress.org) adds automatic scanning, custom styling, and other features. Two of its optional features involve external services, both disclosed on the Pro download page: license activation/updates through its licensing service, and an optional web-font picker served by Bunny Fonts (fonts.bunny.net), a zero-logging Google Fonts mirror. Neither is part of this plugin.