Flexy Consent - Cookie Consent Management (GDPR, CCPA) -- WordPress 插件

开发者	flexyconsent
更新时间	2026年11月1日 18:37
PHP版本:	7.4 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

1.6.5

Consent & Privacy: a note in the IAB TCF (Advertising) section for websites that show Google AdSense or Ad Manager ads: in Google's “Privacy & messaging”, under “European regulations” > Settings, turn off “Allow Google to maximize message coverage”. Since October 2026 Google shows its own fallback consent message in the EU / EEA, the UK and Switzerland when it finds no IAB TCF consent tool as its ad tag loads; with IAB TCF on there, FlexyConsent already passes the visitor's choice to Google, and the fallback only adds a second consent message wherever Google's ad tag loads before FlexyConsent. The FAQ says the same. Translated in all 42 bundled languages; Google's menu and setting names stay in English, as Google's screens show them.
Plans and plugin description: the consent banner is shown in 58 languages, Luxembourgish included; the plan cards, the plugin description and the readme said 57. Translated in all 42 bundled languages.
Website Settings: Google & Microsoft Consent Mode is its own section, first on the Consent & Privacy tab, with its own switch "Send Consent Mode signals to Google and Microsoft". Before, Consent Mode was switched on whenever any browser-storage region was selected; now the switch decides, whatever the regions say. Under it a status line says where Google and Microsoft get the visitor's answer, and a warning box lists anything inconsistent when the page opens and on every change (consent management off, no tracker category in any region, a region where the law requires consent but nothing asks the visitor, an invalid "Wait for update"), each with a "Show" link to the field. The Consent Mode options moved into the section; they are greyed out while the switch is off. Switching Consent Mode on also switches on the tracker categories for the European Union, Quebec and Türkiye where neither they nor IAB TCF ask the visitor (save to keep it); switching it off again puts them back. Saving with Consent Mode on and no tracker category in any region asks first. A "Wait for update" of 0 is now saved as 0. "Browser storage consents" is now called "Tracker categories (cookie consent)". Translated in all 42 bundled languages.
Website Settings: separate preferences for every supported US state (US National plus all 16 states). Existing values and unknown fields survive saves; untouched missing state settings keep the banner's defaults.
Website Settings: new option "Buttons on the Preferences screen" on the General tab, under "List trackers one by one in the consent popup": where the Allow all / Reject all / Save buttons of the consent popup's Preferences screen sit. "Automatic (recommended)", the default, keeps them at the bottom and moves them right under the category list only when the bottom of the screen is hidden (a short phone, the phone's own navigation bar); "At the bottom" never moves them; "Right under the category list" always puts them there. Translated in all 42 bundled languages.
Website Settings: "Hide embeds again when a visitor withdraws consent" (an on/off switch on the General tab) is now "Re-hide embeds and trackers when a visitor withdraws consent", a choice of three: "Automatic (EU / UK / Switzerland) — recommended", the default, "Everywhere" or "Never". When a visitor withdraws consent, the embeds they had allowed are hidden again and the cookies and browser storage your website declared for the trackers they now refuse are deleted; Automatic does this for visitors in the EU / EEA, the UK and Switzerland. The old switch could say only on (now "Everywhere") or off, and off meant Automatic: a website that had it on shows "Everywhere", one that had it off shows "Automatic", nothing changes for its visitors, and "Never" can now be chosen. Translated in all 42 bundled languages.
Consent & Privacy: new switch "This website has signed the IAB Multi-State Privacy Agreement (MSPA)" in the United States Section Preferences, under "Enable United States regulations (GPP)". Off, the default, the US privacy signals tell your ad partners that a transaction is not covered by the MSPA; turn it on only if your company has signed the IAB MSPA, and they say each transaction is covered (Opt-Out Option Mode). Translated in all 42 bundled languages.
Consent banner script: optimisation and caching plugins leave it alone. The FlexyConsent script has to run first in the page, before ad and tracking tags, so it can hold back trackers and answer the IAB consent APIs. Plugins that defer, delay, combine or minify every script could make it run late. Its tag now carries the documented "do not optimise" markers of Cloudflare Rocket Loader, WP Rocket, LiteSpeed Cache, Autoptimize, WP Fastest Cache, Jetpack Boost and WP Meteor, it is added to the script exclusion lists of WP Rocket, LiteSpeed Cache, Autoptimize and SiteGround Optimizer, and an async or defer setting another plugin puts on it is removed. Your other scripts are not affected.
Cookie Scanner: the scanner has its own page in the FlexyConsent menu, right under Cookie Manager. It shows the website selector, Start New Scan (with the page address to scan) and the scan history with a Refresh button; a scan you start appears in the history at once. Cookie Manager keeps the tracker list and the Cookie Declaration Script, with a "Cookie Scanner" button that opens the scanner for the website chosen there.
Cookie Manager: a card at the top of the page says what it is for: the cookies and similar technologies found on your website with each one's category, provider, purpose and retention period; the privacy laws that require telling visitors about them (GDPR and the ePrivacy rules, Brazil's LGPD, Türkiye's KVKK, US state privacy laws); where FlexyConsent uses the list (the tracker list in the consent popup, the auto-blocker, the cookie declaration); and what to check (every tracker in the right category, Essential only for what the website needs to work). Translated in all 42 bundled languages.
Cookie Manager: a "Language of the cookie list" card chooses the language of the cookie list your Cookie Declaration Script shows on your cookie policy page: the visitor's language (from your page and their browser) or always one language you pick, and a switch lets visitors change the language on the list themselves. It applies to the cookie list of every website in your account; the list updates within a few minutes of saving. Translated in all 42 bundled languages.
Website Settings: clicking anywhere on a region card (not only on its switch) now keeps the change. For Quebec and for the countries that follow "Other countries" (Türkiye, Brazil, South Africa, Japan, Australia, South Korea, Thailand, India) such a click was undone when you saved.
Website Settings: a website the FlexyConsent server refuses (for example one that is already registered) is now reported on the page instead of being silently skipped.
Cookie Manager: a description you type for a language other than English is saved in that language. Before, every description was saved as the English one.
Website Settings: "Apply US National settings to all states" is now a switch that stays on, as on the FlexyConsent panel. While it is on, every state uses the US National choices (its own choices are shown greyed out) and saving US National updates all states. The US state sections the plugin has no controls for (Texas, Oregon, Montana and the other states) are now kept when you save; before, a save dropped them.
Dashboard: a new "Ad partners on your site" card lists the ad and measurement services found on your website, says whether each can receive your visitors' consent choices (IAB TCF, Consent Mode, Google additional consent), and warns when your settings block them after a visitor rejects (IAB TCF off in a region where the banner shows, Consent Mode v2 off), with a link to the settings. Translated in all 42 bundled languages.
Dashboard: a "Consent over time" card shows the accept rate per day and the decisions per day (accepted, partially accepted, rejected) for the date range you pick, with a table view, as on the FlexyConsent panel.
Dashboard: Export data downloads the server's one-row-per-visitor-day CSV, as the publisher panel does — Source and GPC columns included. The file covers the date range on screen for this website and keeps the name FlexyConsent gives it. Before, the button (then "Export CSV") wrote a summary of the dashboard cards. Translated in all 42 bundled languages.
Documents: a new page in the FlexyConsent menu, right under Cookie Scanner, makes a Privacy Policy, Terms of Use, Data Processing Agreement or Cookie Policy for your website, as the FlexyConsent panel's Document Generator does. Choose the website, the document and its language (your admin language first), fill in your company details (they are saved for the website and used in every document; the fields the chosen document needs are marked) and generate it: the document is shown in a preview, "Download HTML" saves it as a file and "Print / Save as PDF" opens your browser's print dialog, where "Save as PDF" gives a PDF. The FlexyConsent server fills the document, including the cookie policy's list of the trackers found on your website. When there is no template in the language you chose, the page says the document is in English. The Cookie policy text card on Cookie Manager links to it. Translated in all 42 bundled languages.

1.6.4

Consent Logs: the privacy requests tool (look up, download or erase what is stored for one visitor) is also on the Consent Logs screen, above the table. Each row whose client ID is a visitor key has a Look up button that fills the tool with that key and looks it up; after an erase the log reloads. The tool stays on the Website Settings page as well.
Cookie Manager: a row you add or edit uses the same field names as a row the scanner found (category, product name, scripts), and a save sends each field once. Before, a changed category could come back as it was after Save, because the save also sent the category it had loaded. The "Display Name" box is the product name: left empty, the list shows the cookie name and nothing is stored in its place. The Script URL box takes several URL patterns, one per line. Exported files use the new field names; files exported before can still be imported.
Plugin description and readme: FlexyConsent is described as a consent management platform certified by IAB Europe, IAB Canada and Google (it said "IAB-registered").
Website Settings: new option "Show the privacy button only near the bottom of the page" on the General tab, under "Display privacy button". It is off by default, which is how the privacy button has always worked. Switch it on and the privacy button stays hidden while visitors read and appears as they scroll to the bottom of the page; on a page that does not scroll, it is shown as usual. Translated in all 42 bundled languages.
Consent & Privacy: new section "Relaxed mode: ads before consent" with one switch, on by default and marked "recommended". On: ad code loads before the visitor answers the banner; Google's ads stay non-personalised until the visitor accepts, and the other ad networks on the IAB list load with their cookies whatever the visitor decides. Off (strict): no ad code loads until the visitor accepts. Analytics, advertisers' pixels and embedded content wait for consent either way. It applies to Türkiye, Brazil, India, Japan, South Africa, South Korea, Australia, Thailand and every other country without a consent framework; where IAB TCF is on for a country, the visitor's TCF choices decide there. The EU/EEA/UK, Switzerland, the United States and Canada are left to their consent frameworks. Translated in all 42 bundled languages.
Consent & Privacy: Switzerland is part of the EU / EEA / UK group for IAB TCF, since it follows the GDPR and Google requires IAB TCF there as in the EEA and the UK. The IAB TCF section has no separate Switzerland switch any more; the EU card reads "European Union / European Economic Area / United Kingdom / Switzerland", and Switzerland gets IAB TCF exactly when the EU / EEA / UK does. Browser storage keeps its own Switzerland switch. Translated in all 42 bundled languages.
Consent & Privacy: the IAB TCF cards of Türkiye, Brazil, South Africa, Japan, Australia, South Korea, Thailand and India follow "Other countries" until you change them, as FlexyConsent now treats them: a card you never set shows "Same as other countries until you change it", moves with the "Other countries" card, and is saved as following it. Before, such a card showed as on and a save fixed it at that value. A click on the card sets it apart, as before. Browser storage is unchanged. Translated in all 42 bundled languages.

1.6.3

Plans: the Free plan card no longer crosses out the Cookie Scanner, Auto Blocker, Google Consent Mode V2 and API support, and no longer says "Single Language" — every plan has the same features and the same 57 banner languages. The card now lists them and the "Powered by FlexyConsent" link the Free plan shows on the banner.
Consent & Privacy: the IAB TCF region cards no longer say "legally required" — no law requires the TCF itself. EU/EEA/UK and Switzerland now say "required for Google ads": Google requires a certified consent tool with TCF to serve its ads there.
Wording: the "Allow page interaction" tooltip no longer claims an IAB rule that does not exist; the Cookie Declaration Script says what it shows (each cookie's category, purpose and duration) and what it covers ("Information for GDPR Article 13 notices", "Formatting suited to GDPR and CCPA disclosures") instead of promising compliance.
Readme: the free subscription is described as it is (5,000 pageviews a month, with a "Powered by FlexyConsent" link); the old text about ad impressions did not apply.
Translations: every changed text is updated in all 42 bundled languages.

1.6.2

Plugin name: the plugin is called FlexyConsent (one word) in the Plugins list, the admin menu and the start page, and the plugin description says what it does: an IAB-registered consent management platform with a cookie consent banner in 57 languages, IAB TCF 2.4, GPP and Google Consent Mode v2.
Developers: the admin screen IDs follow the new menu name, so flexy-consent_page_flexyconsent-* is now flexyconsent_page_flexyconsent-* (the admin body class changes the same way). Custom code or CSS that targeted the old IDs needs the new prefix. The start page (toplevel_page_flexyconsent-startPage) and the page URLs are unchanged.
Fixed two PHP deprecation notices ("Passing null to parameter …") that the plugin wrote to the debug log on PHP 8.1 and later when WordPress set an admin screen during an AJAX request, for example while loading the Dashboard widgets.
Plans: the plan descriptions now say TCF 2.4, the IAB TCF version the consent banner implements; they said TCF 2.2 (TCF 2.3 in Latvian).
Start page: the welcome text no longer offers a "view pricing" option the page does not have, and no longer calls FlexyConsent "the most affordable CMP" or promises that continuing makes you compliant. It says what Continue does: set up your consent banner, then pick a plan on the Subscription page.
Website Settings: the "Enable US regulations (GPP)" description names the US National section and the 16 US state laws the banner implements, not only five laws.
Geo Preview: the European group is labelled "Europe / EEA, UK & Switzerland" with "GDPR / UK GDPR / FADP"; it already included the United Kingdom.
Cookie Manager: the scanner texts no longer claim to find all cookies, and the Cookie Declaration Script's benefits no longer list "ISO 27001 documentation standards", which the script has nothing to do with.
Readme: the description and feature list are updated — IAB TCF 2.4, GPP v1.1 with the US National section and 16 US state laws, Quebec, 14 consent regions, 57 banner languages, 42 admin languages — and the user guide and FAQ match the current screens.
Translations: every changed text is updated in all 42 bundled languages, and the translation template (flexyconsent.pot) is regenerated from the current source.

1.6.1

Dashboard: the statistics rows and the CSV export now show the date range you picked; they used to show all-time totals under the selected dates. A slow answer for an older range no longer overwrites a newer one.
Regions: Quebec (Law 25) is its own region inside Canada. It follows your Canada settings until you change it, and the banner speaks French first to Quebec visitors whose browser lists French.
Plans: the plan descriptions now say 57 languages and TCF 2.2.
Translations: "Cookie Declaration Script" is translated in Finnish, Norwegian Bokmål and Swedish.
Form consent changes now require an explicit Save, including enabling collection and deleting a form. Cancel restores the saved configuration, switching tabs keeps pending edits, and leaving the page warns about unsaved changes.
Form selector hints are cached per project from successful form configuration reads/saves and install a selective guard before the SDK loads. After changing forms centrally, reload the settings page and open the Form consents tab to refresh installation hints.
Form consents: a separate tab configures forms by CSS selector with up to ten independent purposes. Optional choices start unchecked. Dedicated API saves protect concurrent changes; receipts include text and version, form filters, pagination and formula-safe CSV export with UTC timestamps. Records describe submission attempts, not delivery or marketing subscription. No form field values are collected.
Language-specific banner wording: write a separate heading and description for each supported language. Empty fields fall back to the base language, then the default wording, then the built-in translation. Custom text is not translated automatically. Switching languages keeps drafts; clearing one language leaves the defaults and other languages intact.
New Banner content tab groups default wording, banner experiments and language-specific wording. The original default-wording warning is retained, with a clarification that language-specific entries take priority and a separate localized-content warning.
Translations: the new editor labels and fallback explanations are translated in all 42 bundled languages.
Website Settings: new option "List trackers one by one in the consent popup" on the General tab, after "Hide empty cookie categories". It is on by default, which is how the popup has always worked. Switch it off and the popup shows the cookie categories only: visitors accept or refuse a whole category, and the trackers are not listed one by one. The details of each cookie can then be shown on a page of your own site with the Cookie Declaration Script from the Cookie Manager. Translated in all 42 bundled languages.

1.6.0

Consent Logs: new Domain and Source columns, showing where each decision came from: the banner, the preferences screen, a blocked video or embed, your site's own link or button, or an automatic Global Privacy Control signal. Consent states are translated and colour-coded correctly.
Consent Logs: a "Load more" button fetches older decisions 40 at a time. A failed refresh or load no longer empties the table or hides the button; you see an error message instead. The CSV export has translated headings and is protected against spreadsheet formula injection.
Dashboard: new "Decisions by source" card (decisions, accepts, rejects, partial accepts and accept rate per source), also included in the dashboard CSV export.
Dashboard: new "Consent by region" table with the consent outcomes per country and US state for the selected dates, with country names in your admin language. Countries with only a few visitors are grouped as "Other", so no single visitor can be identified.
Dashboard: the date-range presets and the Apply, Cancel and Custom Range buttons are translated, and the CSV export names each group instead of printing internal keys.
New Privacy requests tool: when a visitor asks what you hold about them, or asks you to delete it, look up their record by the key stored in their browser, download it as JSON, or erase it. Your daily reports keep their numbers.
New Cookie policy text: a cookie section built from what the scanner actually found on your site, listing each cookie with its provider, purpose and retention, ready to copy into your cookie policy page.
New banner wording editor: replace the banner heading and description with your own words, or leave them empty to keep our wording, translated into every language.
New banner experiments: show a version B of the banner heading or description to a share of your visitors, and read the results (completion rate per version, and whether one is ahead) in the plugin.
Website Settings: the Consent & Privacy tab is redesigned, with collapsible sections, region cards, a tab per US state, a Configure dialog that turns whole feature groups on or off, and a world Coverage Map shading every region you cover. The map's libraries ship with the plugin; nothing is loaded from a third-party CDN.
Website Settings: new options for a monthly scan report e-mail (off by default), a placeholder with a one-click allow where a blocked video or embed would be (on by default), a visitor display-preferences button for text size, contrast, motion and font (off by default), and hiding embeds again when a visitor withdraws consent mid-visit (off by default).
Website Settings: the page now says that saved changes appear on your site within a few minutes.
Fixed connecting a brand-new install, which failed with "Unknown error: Can not encode NULL or empty byte array."
Fixed the messages explaining why an account cannot be closed, which showed raw [endDate], [projectNames] and [serviceNames] placeholders in every language. The values sent by the server are now filled in, escaped, next to the link to the page where you can change them.
Translations: every string is translated in all 42 bundled languages, including everything new in this release.
The readme lists the open-source libraries the plugin bundles, with their licences.

1.5.1

Subscriptions: fixed an error that left the page blank when the subscription list failed to load, and a crash when an over-limit subscription had no assigned website.
Cookie Manager: the scanner status, cookie details and edit dialogs now show a proper error message instead of appearing to hang when a request fails.
Cookie Manager: cookie names, descriptions and other fields are now HTML-escaped everywhere they are displayed, so a cookie discovered by the scanner cannot inject markup into the admin screen.
Cookie Manager: fixed the "Start Scan" and "View Status" buttons reverting their loading state before the request finished.
Fixed an empty accessibility label on the Cookie Manager domain and language selectors.
Housekeeping: removed dead code, corrected an admin redirect helper, and hardened the payment page against direct access.

1.5.0

IAB TCF support updated to v2.3.
Fixed 26 of the 42 bundled translations, which never loaded because their files used locale codes WordPress does not recognise (for example ja_JA instead of ja, ko_KO instead of ko_KR, zh_ZH instead of zh_CN, pt_br instead of pt_BR). Turkish, German, French, Spanish, Italian and ten other locales were unaffected.
Completed every bundled translation. The 184 strings added by the Cookie Manager, Consent Logs, Geo Preview and tabbed settings screens were previously shown in English in all languages; all 41 languages WordPress can load are now fully translated.
Rebuilt the translation template (flexyconsent.pot) from the current source, so external translators see the real string set. It had last been generated before the 1.2.0 interface changes.
The download no longer contains the 42 .po translation sources, which WordPress never reads — about 2.7 MB smaller. The compiled .mo files and flexyconsent.pot still ship.
Bundled translations now act as a per-string fallback behind translations from translate.wordpress.org, instead of being ignored entirely as soon as one exists there. Previously the first community-translated string would have switched the whole bundled catalogue off, reverting every other string to English.
Lowered the WordPress requirement to 5.9, so sites that were held back from the 1.2.0 security fixes by a stricter requirement can now update. The oldest WordPress API the plugin actually calls dates from 4.7.
Updated the plugin description and tested-up-to version.

1.4.0

Reorganised the Website Settings page into tabs — General, Consent & Privacy, Layout Properties and Geo Preview — matching the FlexyConsent web panel. All settings still save together with one Save button.

1.3.2

Fixed checkboxes on the settings pages appearing blank when ticked (a white checkmark on a white background, caused by a conflict with WordPress admin styles). Checked boxes now show a clear blue box with a checkmark.

1.3.1

Fixed the plugin disconnecting itself (account information lost, returning to the Welcome screen) after visiting an admin page. The account identifier was being wiped because it was validated as an e-mail address, which it is not for WordPress accounts.
Fixed a related issue where the stored API key could be dropped when the settings were re-saved.
Fixed sign-up being blocked on a brand-new install: the connection request was refused because the site was not yet connected.

1.3.0

Added Geo Preview to Website Settings: see how the consent message appears to a visitor from a specific region, country, US state and language, based on your current settings.

1.2.1

Fixed the settings preview not refreshing when you change an option (it tried to reload a cross-origin frame).
The Website Settings page no longer stops setting up its controls when an account has an unusual project shape (missing subscription or consent-mode data), which could leave some checkboxes unresponsive.

1.2.0

Websites: cookie and privacy policy links are now set per domain instead of once for the whole account, so sites with several domains can point each one at its own policies.
Added a Consent Logs page: sortable, paginated, with CSV export.
Cookie Manager: added Storage Type (HTTP cookie, local storage, session storage, tracking pixel) and import/export of cookies as JSON.
Dashboard: added CSV export of the statistics currently on screen.
Consent: IAB TCF now covers all 13 regions (adds Türkiye, Brazil, South Africa, Japan, Switzerland, Australia, South Korea, Thailand and India), up from 4.
Consent: added browser storage consent, with per-region control over when visitors are asked before data is stored in their browser.
Consent: added United States Section Preferences for US National, California, Virginia, Colorado, Utah and Connecticut, plus an "apply US National to all states" shortcut.
Consent: Google Consent Mode is now enabled automatically whenever a browser storage region is selected, instead of being a separate switch. "Wait for update" now defaults to 1000ms.
Design: added banner theme (19 presets), banner position, custom icon and an allow-page-interaction option. Theme, logo, icon and position are no longer hidden behind "Enable customization".
Added "Show Reject all on the first layer" and "Hide empty cookie categories".
Security: the API key is no longer sent to the browser. All calls to the FlexyConsent API now go through a server-side proxy, and the key is stored encrypted.
Security: the API key and account email were previously readable on every wp-admin page by any logged-in user, including Subscribers. Fixed.
Security: the settings REST endpoint now accepts only known keys and validates every value. The front-end script URL is restricted to flexyconsent.com.
Removed the loader that was installed into wp-content/mu-plugins. It hardcoded the plugin folder name, so renaming the folder caused a site-wide fatal error that could not be cleared from the admin. Existing installs are cleaned up automatically on upgrade.
Fixed the settings registration, which sanitized an array with sanitize_text_field() and so discarded saved settings.
Requires PHP 7.4. Fixed a call to str_starts_with() that fataled on PHP below 8.0.
Translations now load on init, avoiding the WordPress 6.7 notice about early loading.
Admin page templates are no longer loaded on front-end requests.
Updated Bootstrap to 5.3.3 and removed unused vendor files, reducing the plugin by about 6.4 MB.
Added uninstall cleanup so deleting the plugin removes its options.

1.1

Added Cookie Manager

1.0

Initial version

FlexyConsent - Cookie Consent Management (GDPR, CCPA, IAB TCF)

标签

下载

详情介绍:

安装:

屏幕截图:

升级注意事项:

常见问题:

更新日志: