Biscotto – Cookie Consent

Yes, with no extra configuration and no limits.

The plugin implements the technical requirements of the 10 June 2021 guidelines. Overall compliance also depends on a correct privacy notice and on the proper classification of each site's cookies.

Yes, in the specific cases described under "External services" above, and always under your control. In short: the Google (Consent Mode/GTM) and LinkedIn scripts load only if you configure them and only after consent; the "Check for database updates" button contacts the public GitHub API only when you click it, sending no personal or site data. Everything else stays local — Biscotto does not otherwise communicate with any third-party server — and the optional consent log stays pseudonymized in your site's database.

The log is disabled by default, and while it is disabled the REST route is not registered at all. When enabled, the route is public by necessity — anonymous visitors record their own consent through it via navigator.sendBeacon, so there is no user to authorise — but writes are bounded by limits that do not depend on the nonce. Each address is allowed 10 writes per hour. Independently of that, the plugin counts the rows already written in the past hour immediately before inserting and refuses beyond a site-wide ceiling, so rejected requests cannot consume the quota; the ceiling can be adjusted with the biscotto_write_ceiling filter. Identical submissions from the same visitor write nothing for up to 24 hours (the visitor identifier is salted per day, so the effective de-duplication window is shorter for submissions made near midnight UTC), and records older than the configured retention period (12 months by default) are deleted daily.