Cookie consent, real script & iframe blocking, Google Consent Mode v2 and an audit-ready consent log — GDPR prior opt-in, all from one WPStack panel with no third-party consent service.
Included in every planUpdated August 2026
Overview
The GDPR module adds a compliant cookie-consent layer to any WordPress site: a banner, category-based blocking of trackers and embeds, Google Consent Mode v2 signals, and a record of every choice.
It follows the strictest common model — GDPR prior opt-in for everyone: nothing but essential cookies loads until the visitor consents, and Reject is as easy as Accept. Consent is remembered per visitor and can be changed or withdrawn at any time.
What you can do
Show a consent banner (bar or floating box) with four categories: functional, preferences, statistics and marketing
Block known third-party scripts and embeds until consent — GA, GTM, Pixel, Hotjar, Clarity, YouTube, Vimeo, Maps and more
Fire Google Consent Mode v2 signals so GA4 and Google Ads stay compliant
Keep an audit log of every consent (categories, policy version, hashed IP) with CSV export and retention
Publish a cookie-policy table and a “Manage consent” link with two shortcodes
Let visitors re-open or revoke consent from a floating widget on any page
How the pieces fitThe banner collects consent, the blocker holds trackers until it’s given, Consent Mode tells Google what’s allowed, and the records log proves it. Turn it on and the defaults are EU-ready.
Requirements & compatibility
GDPR runs on any modern WordPress host with no external service.
Requirement
Minimum
Recommended
WordPress
6.0
6.5 or newer
PHP
7.4
8.1 or newer
Caching
Compatible
Blocking is server-side + cache-safe
HTTPS
Recommended
Site-wide
Works with any theme & page builderThe banner and buttons are id-scoped and forced over theme / Elementor styles, so they keep their look on any site. Colours, layout and text are all configurable.
Installation & activation
GDPR ships inside WPStack — switch it on per site from the modules panel.
1
Open the WPStack modules panel
In your WordPress admin, go to WPStack → Modules and find GDPR.
2
Activate GDPR
Flip the GDPR toggle to on. A new GDPR item appears in the WPStack menu and the banner goes live.
3
Set your banner
Open WPStack → GDPR → Banner to set the layout, colours, texts and category descriptions.
4
Review blocking
Under Services & Blocking, keep the built-in tracker list or add your own, and enable Google Consent Mode v2.
5
Add the policy shortcode
Put [wpstack_gdpr_cookies] on your cookie-policy page and, optionally, [wpstack_gdpr_manage] in your footer.
The banner & categories
The banner collects prior consent. Buttons give equal prominence to Accept and Reject, with a Preferences dialog for granular choice.
Banner
GDPR / Cookie Consent
Status
Appearance
Layout
Box (floating card)
Position
Bottom-left (box)
Theme
Light
Accent colour
Button style
Position
Right-aligned
Size
Small
Corner radius
9
px
The Accept button uses the accent colour above; Reject / Preferences stay neutral so Accept stands out.
The Banner tab — status, appearance (layout, position, theme, accent) and button style.
Categories
Functional — always on; essential cookies that can’t be switched off
Preferences — remember choices like language or region
Statistics — anonymous analytics
Marketing — advertising and retargeting
Re-ask on changesBump the policy version under the Cookie-policy tab whenever your cookie usage changes — the banner then re-appears for every visitor so consent stays current.
Content & languages
All the banner copy lives on the Content tab, with a one-click language preset that refills every field.
Content
GDPR / Cookie Consent
Language
Fills the title, message, button labels and category descriptions below in the chosen language — and saves automatically.
Fill all content
Nederlands
Text & buttons
Title
Wij respecteren uw privacy
Message
We gebruiken cookies om uw ervaring te verbeteren, gepersonaliseerde inhoud te tonen en ons verkeer te analyseren.
Accept button
Alles accepteren
Reject button
Alles weigeren
Preferences button
Voorkeuren
Save button
Voorkeuren opslaan
The Content tab — a “Fill all content” language dropdown above the title, message, button labels and category descriptions.
The Content tab holds the banner’s title and message, the four button labels, the cookie-policy link label and the four category descriptions — everything a visitor reads.
Fill all content
Pick a language from the Fill all content dropdown and every field is filled in that language and saved automatically. The dropdown remembers your choice, so you can see which language is active at a glance.
English
Nederlands (Dutch)
Français (French)
Deutsch (German)
Español (Spanish)
Presets are a starting point — after filling a language you can still edit any field, and your wording is kept.
Script & iframe blocking
GDPR neutralises known trackers in the page HTML so they can’t run before consent, then unblocks per visitor client-side.
Blocking is applied server-side to everyone (so it works behind page caches). A lightweight script then activates only the categories a visitor accepts. Because it’s an allow-list of known services, first-party and theme scripts are never touched.
Services & Blocking
GDPR / Cookie Consent
Blocking
Built-in services
Auto-detected and blocked by category. First-party and theme scripts are never touched.
Service
Type
Category
Google Analytics / gtag.js
script
Statistics
Google Tag Manager
script
Statistics
Google Ads / DoubleClick
script
Marketing
Meta / Facebook Pixel
script
Marketing
Hotjar
script
Statistics
Microsoft Clarity
script
Statistics
LinkedIn Insight
script
Marketing
X / Twitter Ads
script
Marketing
TikTok Pixel
script
Marketing
YouTube
iframe
Marketing
Vimeo
iframe
Marketing
The Services & Blocking tab — blocking + Consent Mode toggles and the built-in tracker list.
Built-in services
Service
Type
Category
Google Analytics / gtag
script
Statistics
Google Tag Manager
script
Statistics
Google Ads / DoubleClick
script
Marketing
Meta / Facebook Pixel
script
Marketing
Hotjar · Microsoft Clarity
script
Statistics
LinkedIn · X · TikTok
script
Marketing
YouTube · Vimeo
iframe
Marketing
Google Maps
iframe
Preferences
Custom servicesAdd any other script or embed under Services & Blocking → Custom services by a URL / inline fragment it contains (e.g. cdn.example.com), and assign it a category.
Blocked embedsA blocked YouTube, Vimeo or Maps iframe is replaced with a click-to-load placeholder so visitors can still load a single embed on demand.
Google Consent Mode v2
GDPR speaks Google’s consent signals so GA4 and Google Ads behave correctly.
On every page, before any gtag, GDPR sets consent default to denied for all signals except security_storage. When a visitor consents it calls consent update, mapping categories to signals.
Visitors can always change their choice after consenting.
A floating “Manage consent” button appears after a choice is made (toggle + position under the Banner tab)
The [wpstack_gdpr_manage] shortcode opens the same dialog anywhere
Any element with data-gdpr-action="prefs", or window.wpstackGDPROpen() in JS
Changing a choice re-blocks or unblocks the matching scripts immediately and writes a fresh consent record.
Settings reference
The GDPR admin is split into five tabs.
Setting
Type
Default
What it does
Banner
tab
—
Enable the banner, layout (bar/box) & position, theme, accent colour, button style, and the floating re-open widget.
Content
tab
—
The banner copy — title, message, button labels and category descriptions — with a language preset (EN/NL/FR/DE/ES) that fills every field and saves.
Services & Blocking
tab
—
Toggle script/iframe blocking and Google Consent Mode v2; view built-in services and add custom ones.
Consent records
tab
—
The consent log with retention, CSV export, per-row delete and clear-all.
Cookie policy
tab
—
Bump the policy version to re-ask everyone, manage the cookie list for the shortcode, and see the shortcodes.
FAQ
It blocks. Known trackers and embeds are neutralised in the page HTML server-side; a lightweight script unblocks only the accepted categories client-side, which keeps it compatible with page caching.
Yes — via Consent Mode v2. Consent defaults to denied, then updates on consent, and the GA tag only loads once statistics consent is given.
Yes — every choice is logged with categories, policy version and a hashed IP (never the raw address), with CSV export and retention.
Always — a floating “Manage consent” button and the [wpstack_gdpr_manage] shortcode reopen the dialog on any page.
Changelog
1.0.8
August 2026
newNew Content tab with a five-language preset (EN/NL/FR/DE/ES) that fills the whole banner in one click.