RoyalComply – Cookie Consent, GDPR & CCPA Compliance Banner

RoyalComply uses WordPress's script_loader_tag filter to change script types from text/javascript to text/plain until consent is given. This prevents scripts from executing. The approach does not require output buffering or DOM manipulation.

Yes. When Google Consent Mode v2 is enabled, RoyalComply outputs the required gtag('consent', 'default', {...}) call before GTM loads, then updates consent state when the user makes a choice.

RoyalComply is designed to help site owners meet GDPR's consent requirements. It blocks analytics and marketing scripts until the visitor gives explicit opt-in consent, stores a record of each consent choice with a SHA-256 hashed identifier, and provides a "Reject All" button with the same prominence as "Accept All". Whether a given site is fully GDPR compliant also depends on the rest of its privacy practices (privacy policy, data processing agreements, etc.), which are outside the scope of this plugin.

Yes. When the visitor's region is detected as California (or any configured opt-out jurisdiction), RoyalComply switches the banner to opt-out mode and displays a "Do Not Sell or Share My Personal Information" link that records the visitor's opt-out choice.

No. Geo detection uses CDN headers (Cloudflare, etc.) that are already present in the request, plus browser timezone as a fallback. No third-party services are contacted.

Yes. Visitor identifiers are SHA-256 hashed with a site-specific salt. No IP addresses or personally identifiable information is stored.

Yes. WooCommerce session and cart cookies are automatically categorized as "necessary" and are never blocked.

CookieYes, Complianz, Cookiebot, Iubenda, OneTrust, and Termly are commercial cookie consent solutions that typically charge $9–49/mo per site or per-page-view (Cookiebot's pricing scales with monthly visitors and can reach hundreds of dollars per month for high-traffic sites). RoyalComply is free with no usage limits, no per-page-view billing, and no external SaaS dependency. Core features — script blocking, Google Consent Mode v2, GDPR opt-in, CCPA opt-out, regional auto-detection, consent logging, and the cookie scanner — are included.

Yes. Enable Google Consent Mode v2 in RoyalComply settings and the plugin outputs the required gtag('consent', 'default', { analytics_storage: 'denied', ad_storage: 'denied', ... }) call before GA4 or Google Tag Manager loads. When the visitor accepts, RoyalComply fires a gtag('consent', 'update', ...) event with their selections and GA4 begins receiving data. Without consent, GA4 still runs in cookieless mode and reports basic anonymized events (this is Google's intended Consent Mode v2 behavior).

Yes. Meta Pixel, Google Ads, LinkedIn Insight Tag, TikTok Pixel, Pinterest Tag, Twitter (X) Pixel, Snapchat Pixel, and Reddit Pixel are auto-categorized as "Marketing" cookies and blocked until the visitor accepts marketing consent. The script-blocking approach uses WordPress's script_loader_tag filter to change each script's type attribute to text/plain until consent is granted, so pixels never fire prematurely.

No. The combined frontend CSS and JavaScript is under 8KB. Banner state is checked from localStorage, which is faster than a server round-trip. The cookie scanner runs only when an admin clicks "Scan Site" — never on a visitor request.

Yes. The banner is rendered with the same HTML for every visitor and the show/hide decision is made client-side by reading localStorage. Page caches serve the same HTML to all visitors and the banner correctly hides for returning visitors who already gave consent. No cache exclusion rules required.

In RoyalComply settings, enable CCPA mode and set California as an opt-out jurisdiction. When a visitor's request arrives with a CDN header indicating California (or matches a California timezone fallback), the banner automatically switches from opt-in to opt-out mode and displays the "Do Not Sell or Share My Personal Information" link. Clicking the link records the visitor's opt-out in the consent log.

Yes. Go to RoyalComply > Consent Log and click "Export CSV". The export includes hashed visitor IDs, timestamps, region, banner version, and category selections — sufficient for demonstrating consent under GDPR Article 7 and CCPA record-keeping requirements. No IP addresses are exported.