FlexyConsent - Cookie Consent Management (GDPR, CCPA, IAB TCF)
| 开发者 | flexyconsent |
|---|---|
| 更新时间 | 2026年10月18日 02:59 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
FlexyConsent is a Consent Management Platform certified by IAB Europe, IAB Canada and Google (CMP ID 317) for WordPress. It adds a customizable consent banner to your site, can block trackers until visitors agree, records what every visitor chose, and gives you the reporting you need to show it — all configurable from the WordPress admin, with no coding.
The plugin supports IAB TCF v2.4, IAB TCF Canada, Google Consent Mode v2, the IAB Global Privacy Platform (GPP v1.1) and Global Privacy Control. You set the rules per region: the EU/EEA and the United Kingdom, Switzerland, the United States (the US National section and 16 state laws, with dedicated settings for California, Virginia, Colorado, Utah and Connecticut), Canada and Quebec (Law 25), Türkiye, Brazil, South Africa, Japan, Australia, South Korea, Thailand and India — and, if you choose, the rest of the world.
The consent banner speaks 57 languages, including right-to-left languages: it follows each visitor's browser language and location, or shows the default language you choose. The admin interface is available in 42 languages, including Turkish, German, French, Spanish, Italian, Portuguese, Dutch, Polish, Russian, Japanese, Korean and Simplified Chinese.
安装:
Recommended Installation
- In your WordPress dashboard, choose Plugins >Add New
- Search for "FlexyConsent" with the search bar in the top right corner.
- After finding our plugin in the results, click Install Now
- Download our plugin as a .zip file from this link: FlexyConsent.
- From your WordPress dashboard, choose Plugins > Add New
- Click Upload Plugin at the top of the page.
- Click Choose File , locate the plugin .zip file, then click Install Now
- After the installation is complete, click Activate Plugin
屏幕截图:
常见问题:
What is a CMP and what does it do?
A CMP, Consent Management Platform, is a tool used by websites to manage permissions for collecting and processing data from visitors. It informs visitors about data usage and obtains necessary permissions. IAB-certified CMPs facilitate the collection and processing of personal data in line with Transparency and Consent Framework (TCF) standards.
What is TCF and why is it important?
The Transparency and Consent Framework is a standard used in the digital advertising industry to help comply with data protection laws in Europe. This framework provides internet users with more transparency and control over the digital advertising ecosystem. FlexyConsent implements IAB TCF 2.4.
What are the advantages of using an IAB-certified CMP?
An IAB-certified CMP manages data collection and processing in line with TCF standards. This helps protect user privacy rights and helps advertisers meet their legal requirements. Additionally, it provides the advantage of adhering to a trusted industry standard.
Why should I, as a website owner, use an IAB-certified CMP?
Using an IAB-certified CMP helps you comply with data protection laws in Europe and better manage your visitors' privacy preferences. It also provides a reliable solution for regulating your relationships with advertisers.
Can I turn off your plugin at any time?
Yes. There is no commitment that binds you to FlexyConsent. In Website Settings you can turn consent management on or off at any time, or simply deactivate the plugin.
How can I follow up on stats?
We provide you with a dashboard to follow up on your stats.
How can I contact you?
You can contact us via our website FlexyConsent or by email at support@flexyconsent.com.
更新日志:
1.6.4
- Consent Logs: the privacy requests tool (look up, download or erase what is stored for one visitor) is also on the Consent Logs screen, above the table. Each row whose client ID is a visitor key has a Look up button that fills the tool with that key and looks it up; after an erase the log reloads. The tool stays on the Website Settings page as well.
- Cookie Manager: a row you add or edit uses the same field names as a row the scanner found (category, product name, scripts), and a save sends each field once. Before, a changed category could come back as it was after Save, because the save also sent the category it had loaded. The "Display Name" box is the product name: left empty, the list shows the cookie name and nothing is stored in its place. The Script URL box takes several URL patterns, one per line. Exported files use the new field names; files exported before can still be imported.
- Plugin description and readme: FlexyConsent is described as a consent management platform certified by IAB Europe, IAB Canada and Google (it said "IAB-registered").
- Website Settings: new option "Show the privacy button only near the bottom of the page" on the General tab, under "Display privacy button". It is off by default, which is how the privacy button has always worked. Switch it on and the privacy button stays hidden while visitors read and appears as they scroll to the bottom of the page; on a page that does not scroll, it is shown as usual. Translated in all 42 bundled languages.
- Consent & Privacy: new section "Relaxed mode: ads before consent" with one switch, on by default and marked "recommended". On: ad code loads before the visitor answers the banner; Google's ads stay non-personalised until the visitor accepts, and the other ad networks on the IAB list load with their cookies whatever the visitor decides. Off (strict): no ad code loads until the visitor accepts. Analytics, advertisers' pixels and embedded content wait for consent either way. It applies to Türkiye, Brazil, India, Japan, South Africa, South Korea, Australia, Thailand and every other country without a consent framework; where IAB TCF is on for a country, the visitor's TCF choices decide there. The EU/EEA/UK, Switzerland, the United States and Canada are left to their consent frameworks. Translated in all 42 bundled languages.
- Consent & Privacy: Switzerland is part of the EU / EEA / UK group for IAB TCF, since it follows the GDPR and Google requires IAB TCF there as in the EEA and the UK. The IAB TCF section has no separate Switzerland switch any more; the EU card reads "European Union / European Economic Area / United Kingdom / Switzerland", and Switzerland gets IAB TCF exactly when the EU / EEA / UK does. Browser storage keeps its own Switzerland switch. Translated in all 42 bundled languages.
- Consent & Privacy: the IAB TCF cards of Türkiye, Brazil, South Africa, Japan, Australia, South Korea, Thailand and India follow "Other countries" until you change them, as FlexyConsent now treats them: a card you never set shows "Same as other countries until you change it", moves with the "Other countries" card, and is saved as following it. Before, such a card showed as on and a save fixed it at that value. A click on the card sets it apart, as before. Browser storage is unchanged. Translated in all 42 bundled languages.
- Plans: the Free plan card no longer crosses out the Cookie Scanner, Auto Blocker, Google Consent Mode V2 and API support, and no longer says "Single Language" — every plan has the same features and the same 57 banner languages. The card now lists them and the "Powered by FlexyConsent" link the Free plan shows on the banner.
- Consent & Privacy: the IAB TCF region cards no longer say "legally required" — no law requires the TCF itself. EU/EEA/UK and Switzerland now say "required for Google ads": Google requires a certified consent tool with TCF to serve its ads there.
- Wording: the "Allow page interaction" tooltip no longer claims an IAB rule that does not exist; the Cookie Declaration Script says what it shows (each cookie's category, purpose and duration) and what it covers ("Information for GDPR Article 13 notices", "Formatting suited to GDPR and CCPA disclosures") instead of promising compliance.
- Readme: the free subscription is described as it is (5,000 pageviews a month, with a "Powered by FlexyConsent" link); the old text about ad impressions did not apply.
- Translations: every changed text is updated in all 42 bundled languages.
- Plugin name: the plugin is called FlexyConsent (one word) in the Plugins list, the admin menu and the start page, and the plugin description says what it does: an IAB-registered consent management platform with a cookie consent banner in 57 languages, IAB TCF 2.4, GPP and Google Consent Mode v2.
- Developers: the admin screen IDs follow the new menu name, so
flexy-consent_page_flexyconsent-*is nowflexyconsent_page_flexyconsent-*(the admin body class changes the same way). Custom code or CSS that targeted the old IDs needs the new prefix. The start page (toplevel_page_flexyconsent-startPage) and the page URLs are unchanged. - Fixed two PHP deprecation notices ("Passing null to parameter …") that the plugin wrote to the debug log on PHP 8.1 and later when WordPress set an admin screen during an AJAX request, for example while loading the Dashboard widgets.
- Plans: the plan descriptions now say TCF 2.4, the IAB TCF version the consent banner implements; they said TCF 2.2 (TCF 2.3 in Latvian).
- Start page: the welcome text no longer offers a "view pricing" option the page does not have, and no longer calls FlexyConsent "the most affordable CMP" or promises that continuing makes you compliant. It says what Continue does: set up your consent banner, then pick a plan on the Subscription page.
- Website Settings: the "Enable US regulations (GPP)" description names the US National section and the 16 US state laws the banner implements, not only five laws.
- Geo Preview: the European group is labelled "Europe / EEA, UK & Switzerland" with "GDPR / UK GDPR / FADP"; it already included the United Kingdom.
- Cookie Manager: the scanner texts no longer claim to find all cookies, and the Cookie Declaration Script's benefits no longer list "ISO 27001 documentation standards", which the script has nothing to do with.
- Readme: the description and feature list are updated — IAB TCF 2.4, GPP v1.1 with the US National section and 16 US state laws, Quebec, 14 consent regions, 57 banner languages, 42 admin languages — and the user guide and FAQ match the current screens.
- Translations: every changed text is updated in all 42 bundled languages, and the translation template (flexyconsent.pot) is regenerated from the current source.
- Dashboard: the statistics rows and the CSV export now show the date range you picked; they used to show all-time totals under the selected dates. A slow answer for an older range no longer overwrites a newer one.
- Regions: Quebec (Law 25) is its own region inside Canada. It follows your Canada settings until you change it, and the banner speaks French first to Quebec visitors whose browser lists French.
- Plans: the plan descriptions now say 57 languages and TCF 2.2.
- Translations: "Cookie Declaration Script" is translated in Finnish, Norwegian Bokmål and Swedish.
- Form consent changes now require an explicit Save, including enabling collection and deleting a form. Cancel restores the saved configuration, switching tabs keeps pending edits, and leaving the page warns about unsaved changes.
- Form selector hints are cached per project from successful form configuration reads/saves and install a selective guard before the SDK loads. After changing forms centrally, reload the settings page and open the Form consents tab to refresh installation hints.
- Form consents: a separate tab configures forms by CSS selector with up to ten independent purposes. Optional choices start unchecked. Dedicated API saves protect concurrent changes; receipts include text and version, form filters, pagination and formula-safe CSV export with UTC timestamps. Records describe submission attempts, not delivery or marketing subscription. No form field values are collected.
- Language-specific banner wording: write a separate heading and description for each supported language. Empty fields fall back to the base language, then the default wording, then the built-in translation. Custom text is not translated automatically. Switching languages keeps drafts; clearing one language leaves the defaults and other languages intact.
- New Banner content tab groups default wording, banner experiments and language-specific wording. The original default-wording warning is retained, with a clarification that language-specific entries take priority and a separate localized-content warning.
- Translations: the new editor labels and fallback explanations are translated in all 42 bundled languages.
- Website Settings: new option "List trackers one by one in the consent popup" on the General tab, after "Hide empty cookie categories". It is on by default, which is how the popup has always worked. Switch it off and the popup shows the cookie categories only: visitors accept or refuse a whole category, and the trackers are not listed one by one. The details of each cookie can then be shown on a page of your own site with the Cookie Declaration Script from the Cookie Manager. Translated in all 42 bundled languages.
- Consent Logs: new Domain and Source columns, showing where each decision came from: the banner, the preferences screen, a blocked video or embed, your site's own link or button, or an automatic Global Privacy Control signal. Consent states are translated and colour-coded correctly.
- Consent Logs: a "Load more" button fetches older decisions 40 at a time. A failed refresh or load no longer empties the table or hides the button; you see an error message instead. The CSV export has translated headings and is protected against spreadsheet formula injection.
- Dashboard: new "Decisions by source" card (decisions, accepts, rejects, partial accepts and accept rate per source), also included in the dashboard CSV export.
- Dashboard: new "Consent by region" table with the consent outcomes per country and US state for the selected dates, with country names in your admin language. Countries with only a few visitors are grouped as "Other", so no single visitor can be identified.
- Dashboard: the date-range presets and the Apply, Cancel and Custom Range buttons are translated, and the CSV export names each group instead of printing internal keys.
- New Privacy requests tool: when a visitor asks what you hold about them, or asks you to delete it, look up their record by the key stored in their browser, download it as JSON, or erase it. Your daily reports keep their numbers.
- New Cookie policy text: a cookie section built from what the scanner actually found on your site, listing each cookie with its provider, purpose and retention, ready to copy into your cookie policy page.
- New banner wording editor: replace the banner heading and description with your own words, or leave them empty to keep our wording, translated into every language.
- New banner experiments: show a version B of the banner heading or description to a share of your visitors, and read the results (completion rate per version, and whether one is ahead) in the plugin.
- Website Settings: the Consent & Privacy tab is redesigned, with collapsible sections, region cards, a tab per US state, a Configure dialog that turns whole feature groups on or off, and a world Coverage Map shading every region you cover. The map's libraries ship with the plugin; nothing is loaded from a third-party CDN.
- Website Settings: new options for a monthly scan report e-mail (off by default), a placeholder with a one-click allow where a blocked video or embed would be (on by default), a visitor display-preferences button for text size, contrast, motion and font (off by default), and hiding embeds again when a visitor withdraws consent mid-visit (off by default).
- Website Settings: the page now says that saved changes appear on your site within a few minutes.
- Fixed connecting a brand-new install, which failed with "Unknown error: Can not encode NULL or empty byte array."
- Fixed the messages explaining why an account cannot be closed, which showed raw [endDate], [projectNames] and [serviceNames] placeholders in every language. The values sent by the server are now filled in, escaped, next to the link to the page where you can change them.
- Translations: every string is translated in all 42 bundled languages, including everything new in this release.
- The readme lists the open-source libraries the plugin bundles, with their licences.
- Subscriptions: fixed an error that left the page blank when the subscription list failed to load, and a crash when an over-limit subscription had no assigned website.
- Cookie Manager: the scanner status, cookie details and edit dialogs now show a proper error message instead of appearing to hang when a request fails.
- Cookie Manager: cookie names, descriptions and other fields are now HTML-escaped everywhere they are displayed, so a cookie discovered by the scanner cannot inject markup into the admin screen.
- Cookie Manager: fixed the "Start Scan" and "View Status" buttons reverting their loading state before the request finished.
- Fixed an empty accessibility label on the Cookie Manager domain and language selectors.
- Housekeeping: removed dead code, corrected an admin redirect helper, and hardened the payment page against direct access.
- IAB TCF support updated to v2.3.
- Fixed 26 of the 42 bundled translations, which never loaded because their files used locale codes WordPress does not recognise (for example ja_JA instead of ja, ko_KO instead of ko_KR, zh_ZH instead of zh_CN, pt_br instead of pt_BR). Turkish, German, French, Spanish, Italian and ten other locales were unaffected.
- Completed every bundled translation. The 184 strings added by the Cookie Manager, Consent Logs, Geo Preview and tabbed settings screens were previously shown in English in all languages; all 41 languages WordPress can load are now fully translated.
- Rebuilt the translation template (flexyconsent.pot) from the current source, so external translators see the real string set. It had last been generated before the 1.2.0 interface changes.
- The download no longer contains the 42 .po translation sources, which WordPress never reads — about 2.7 MB smaller. The compiled .mo files and flexyconsent.pot still ship.
- Bundled translations now act as a per-string fallback behind translations from translate.wordpress.org, instead of being ignored entirely as soon as one exists there. Previously the first community-translated string would have switched the whole bundled catalogue off, reverting every other string to English.
- Lowered the WordPress requirement to 5.9, so sites that were held back from the 1.2.0 security fixes by a stricter requirement can now update. The oldest WordPress API the plugin actually calls dates from 4.7.
- Updated the plugin description and tested-up-to version.
- Reorganised the Website Settings page into tabs — General, Consent & Privacy, Layout Properties and Geo Preview — matching the FlexyConsent web panel. All settings still save together with one Save button.
- Fixed checkboxes on the settings pages appearing blank when ticked (a white checkmark on a white background, caused by a conflict with WordPress admin styles). Checked boxes now show a clear blue box with a checkmark.
- Fixed the plugin disconnecting itself (account information lost, returning to the Welcome screen) after visiting an admin page. The account identifier was being wiped because it was validated as an e-mail address, which it is not for WordPress accounts.
- Fixed a related issue where the stored API key could be dropped when the settings were re-saved.
- Fixed sign-up being blocked on a brand-new install: the connection request was refused because the site was not yet connected.
- Added Geo Preview to Website Settings: see how the consent message appears to a visitor from a specific region, country, US state and language, based on your current settings.
- Fixed the settings preview not refreshing when you change an option (it tried to reload a cross-origin frame).
- The Website Settings page no longer stops setting up its controls when an account has an unusual project shape (missing subscription or consent-mode data), which could leave some checkboxes unresponsive.
- Websites: cookie and privacy policy links are now set per domain instead of once for the whole account, so sites with several domains can point each one at its own policies.
- Added a Consent Logs page: sortable, paginated, with CSV export.
- Cookie Manager: added Storage Type (HTTP cookie, local storage, session storage, tracking pixel) and import/export of cookies as JSON.
- Dashboard: added CSV export of the statistics currently on screen.
- Consent: IAB TCF now covers all 13 regions (adds Türkiye, Brazil, South Africa, Japan, Switzerland, Australia, South Korea, Thailand and India), up from 4.
- Consent: added browser storage consent, with per-region control over when visitors are asked before data is stored in their browser.
- Consent: added United States Section Preferences for US National, California, Virginia, Colorado, Utah and Connecticut, plus an "apply US National to all states" shortcut.
- Consent: Google Consent Mode is now enabled automatically whenever a browser storage region is selected, instead of being a separate switch. "Wait for update" now defaults to 1000ms.
- Design: added banner theme (19 presets), banner position, custom icon and an allow-page-interaction option. Theme, logo, icon and position are no longer hidden behind "Enable customization".
- Added "Show Reject all on the first layer" and "Hide empty cookie categories".
- Security: the API key is no longer sent to the browser. All calls to the FlexyConsent API now go through a server-side proxy, and the key is stored encrypted.
- Security: the API key and account email were previously readable on every wp-admin page by any logged-in user, including Subscribers. Fixed.
- Security: the settings REST endpoint now accepts only known keys and validates every value. The front-end script URL is restricted to flexyconsent.com.
- Removed the loader that was installed into wp-content/mu-plugins. It hardcoded the plugin folder name, so renaming the folder caused a site-wide fatal error that could not be cleared from the admin. Existing installs are cleaned up automatically on upgrade.
- Fixed the settings registration, which sanitized an array with sanitize_text_field() and so discarded saved settings.
- Requires PHP 7.4. Fixed a call to str_starts_with() that fataled on PHP below 8.0.
- Translations now load on init, avoiding the WordPress 6.7 notice about early loading.
- Admin page templates are no longer loaded on front-end requests.
- Updated Bootstrap to 5.3.3 and removed unused vendor files, reducing the plugin by about 6.4 MB.
- Added uninstall cleanup so deleting the plugin removes its options.
- Added Cookie Manager
- Initial version