Privatto
| 开发者 |
interativus
sergioinglez |
|---|---|
| 更新时间 | 2026年7月17日 21:13 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Privatto is a self-hosted consent management platform (CMP) for WordPress, built with Brazil's LGPD and the European GDPR in mind. It does not rely on any external service.
Official website, live demo and documentation: interativus.com.br/privatto
Main features:
- Granular consent banner with per-category preferences (necessary, statistics, marketing, embeds).
- Automatic blocking of third-party scripts and iframes via output buffering: matching
<script>tags are switched totype="text/plain"before the page reaches the browser, so nothing runs before consent. - Google Consent Mode v2 injected with everything denied by default, updated according to the visitor's choice.
- Proof of consent stored in your own database table: unique ID, action, categories (JSON), policy version, IP hash (optional), country, user agent, page URL and UTC timestamp. Exportable to CSV for audits.
- LGPD document generator: privacy policy, terms of use, cookie policy, returns policy and a plain-language summary, built from a guided form — 100% local, with no external calls.
- Data subject rights form (LGPD art. 18) with tracked protocols, 15-day response deadline monitoring and an admin queue.
- Simplified record of processing activities (ROPA) export, as required by ANPD Resolution CD/ANPD No. 2/2022, including for small-scale processing agents.
- "Cookie preferences" link to reopen the banner, letting visitors change or withdraw consent at any time.
安装:
- Upload the plugin under Plugins → Add New → Upload Plugin, or copy the
privattofolder to/wp-content/plugins/. - Activate the plugin. The consent table and default options are created on activation.
- Follow the setup wizard, then fine-tune under Privatto → Settings.
- Generate your legal documents under Privatto → LGPD Documents.
常见问题:
Does the plugin rely on any external service?
No. The banner, blocking, consent records and document generation all run entirely on your own site. Privatto does not make any calls to external services.
How does tag blocking work?
The plugin captures the full page output on template_redirect, injects Google Consent Mode v2 (everything denied) right after <head>, and rewrites any <script> whose src or content matches the configured patterns. When the visitor consents, the allowed scripts are restored and executed.
Where is the proof of consent stored?
In a dedicated table (wp_pvto_consents). Each decision records a UUID, action, categories, policy version, irreversible IP hash (optional), country, user agent, URL and UTC timestamp. You can view it under Privatto → Logs and export it to CSV.
Is data removal on uninstall optional?
Yes. By default, uninstalling preserves the consent tables (they are your audit evidence) and removes only the settings. To delete everything, define PVTO_DELETE_DATA as true in wp-config.php before removing the plugin.
更新日志:
2.0.0
- New: functionality/plugin discovery. Privatto now scans installed plugins (reading only each plugin's own local readme.txt/header — no external calls) and surfaces the ones that may require consent, in a new "Discoveries" screen for human review. Nothing is applied automatically.
- New: curated signature base mapping popular plugins (analytics, marketing, functional) to likely cookie categories, with a heuristic fallback for unknown plugins.
- New: passive script scanner. Third-party script/iframe domains that actually load on the site are recorded (deduplicated) so you can categorize them.
- New: approving a discovery adds its signature to automatic blocking and generates a ready-to-use text suggestion for your documents (draft only — never published automatically).
- New: dashboard reformulated with a 7/30/90-day period selector, KPI variation vs. previous period, and an accept-rate-by-category breakdown.
- New: Records screen with summary cards, structured action/country filters, and category badges instead of raw JSON.
- New: settings for the passive scanner, region behavior and an opt-in "Powered by Privatto" seal.
- New: "Pending suggestions" tab in Documents — approved discoveries generate ready-to-use, editable text you add to a Cookie Declaration draft (never auto-published).
- New: [privatto_declaracao_cookies] shortcode renders a public list of the services/cookies used, built from the approved draft items.
- New: WP Consent API interoperability. When the WP Consent API is active, Privatto additively announces the visitor's choice (mapping its categories to functional/statistics/marketing/preferences) so compatible plugins can read the consent state. Privatto's own blocking is unchanged.
- New: multilingual banner. Add per-locale translations of the banner texts and button labels under Settings → Languages; the correct language is picked automatically from the visitor's locale, falling back to the base language and then to the default texts. English and Spanish ship with ready-to-use suggested translations.
- New: optional "Powered by Privatto" seal on the banner (off by default; enable under Settings → Compliance).
- New: lightweight geolocation (region behavior). Reads the visitor country only from headers your infrastructure already provides (Cloudflare, CloudFront, GeoIP) — no bundled IP database, no external call. Modes: always strict (opt-in for everyone), adaptive (opt-in for BR/EU, configurable elsewhere) or manual. Falls back to strict when geo is unavailable.
- New: confidence levels for discoveries with a certainty-based palette (high=green, medium=blue, low=gray) plus a legend, and a configurable threshold that decides which levels generate automatic document suggestions (default: high only).
- Removed: optional Groq AI text refinement. Document generation is now 100% local, with no external calls at all.
- Note: Privatto remains free and fully self-contained — no telemetry and no remote signature service are used.
- Security hardening: prepared statements with the
%iidentifier placeholder, input unslashing/sanitization, output escaping. - Internationalization: translator comments and ordered placeholders.
- Readme rewritten to follow WordPress.org standards.