O2 Cookie Consent Pro: the International Cookie Consent Plugin for WordPress

What it is

The heart of the plugin. It contains 32 legal profiles covering 250 countries and territories, the US states and the Canadian provinces: the EU baseline plus national readings (France CNIL, Germany TDDDG, Italy Garante, Spain AEPD, Denmark, the Netherlands, Austria, Ireland), the UK after the Data (Use and Access) Act 2025, Switzerland, California and the other US privacy states, Brazil, Canada, Japan, South Korea, Australia, Turkey and more. Each profile knows whether consent is opt-in or opt-out, how long a choice stays valid, which buttons must appear on the first layer and whether Global Privacy Control must be honoured.

How it helps

A visitor in Paris gets a CNIL-shaped opt-in banner, one in Texas gets an opt-out notice and one in Tokyo gets the external transmission disclosure. You stop over-asking in countries that do not require consent, and you never under-ask where it is required. A visitor who cannot be located – a VPN, a corporate proxy – gets the strictest profile, which is lawful everywhere.

Location is worked out without sending anyone’s IP address to a third party: from your CDN’s country header (Cloudflare and others), your server’s GeoIP module, or a MaxMind-format database you add yourself, and as a last resort from the browser’s time zone and language. It is also cache-safe: every visitor receives the same cached HTML and one small uncached request settles the law, so LiteSpeed, WP Rocket and similar caches keep working.

What it is

The banner visitors see. It carries only the controls the visitor’s law requires – an EU visitor is never shown a US opt-out link and a Japanese visitor is not asked to consent to something their law does not ask consent for. Only the control the law insists on gets the weight of “Accept all”; everything else is a discreet link, so the banner takes less space. The colours are read automatically from your theme (Astra, block themes and others) and the contrast is checked against WCAG 2.2 AA.

How it helps

Equal prominence of “Reject all” and “Accept all” is exactly what the EDPB, the CNIL and the ICO check for, and the plugin will not let you make a legally required button smaller by accident. At the same time, the banner looks like part of your website instead of a generic pop-up, which builds trust and improves acceptance. Links to your Cookie Policy, Privacy Policy and, where relevant, Your Privacy Choices are added automatically.

What it is

The second layer: a dialog where visitors switch each category on or off – Necessary (always active), Preferences, Statistics and Marketing – and see the cookies and services in each. A floating cookie button lets them reopen it at any time, and the [efcc_settings_button] shortcode puts the same button anywhere you like.

How it helps

Granular consent is a GDPR requirement and withdrawing consent must be as easy as giving it. Nothing optional is pre-ticked, and every choice is sent immediately to Google Consent Mode and to the scripts the plugin controls.

What it is

A scanner that opens your pages the way a browser does, waits for tags to load and records everything that was stored – cookies, localStorage, sessionStorage and IndexedDB. It also reads the Set-Cookie headers on the server, so it sees HttpOnly cookies that no JavaScript scanner can. For each item it works out the category, provider and company, purpose, first or third party, Secure/HttpOnly/SameSite and a duration measured from the cookie itself, not copied from a list. It also lists every third-party host your pages contact.

How it helps

A cookie policy must describe what your site actually does. The scanner fills in the details you would otherwise research by hand, and it is honest about it: every row says how it was decided (certain, likely or guess), so you only need to check the few rows marked as a guess.

It also knows the difference between what visitors receive and what only you see: block-editor, SEO-panel and dashboard state that exists only for signed-in staff stays in your register, clearly labelled, and is kept out of the public cookie policy.

What it is

A list of the third-party services your website uses – Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, Microsoft Clarity and Advertising, Hotjar, LinkedIn Insight, TikTok Pixel, Matomo, YouTube, Vimeo, Google Maps, WooCommerce order attribution and your own custom services. Each service is linked to a category and to the scripts, iframes and cookies that belong to it.

How it helps

Scripts are blocked on the server and only released in the browser after the visitor agrees, so nothing optional runs before consent – including YouTube and Google Maps embeds, which get a friendly placeholder until the visitor allows them. Each service also appears automatically in your cookie policy.

What it is

Full support for Google Consent Mode v2: the plugin sends the default state (everything denied where the law requires it) before any Google tag loads, and updates it the moment the visitor chooses – ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage and security_storage. It can load Google Tag Manager itself and pushes clear dataLayer events. It honours Global Privacy Control, publishes /.well-known/gpc.json and writes the IAB GPP string for US states.

How it helps

Since March 2024 Google requires Consent Mode v2 for advertisers with EEA and UK audiences. Without it, remarketing and conversion measurement stop working. With it, GA4 and Google Ads keep modelling conversions for visitors who decline, so you lose far less data.

What it is

The banner, the preferences dialog, the categories and the privacy centre are translated into 38 languages: every official EU/EEA language plus Russian, Ukrainian, Turkish, Arabic, Hebrew, Japanese, Chinese (simplified and traditional), Korean, Hindi, Indonesian, Vietnamese and Thai. Arabic and Hebrew are displayed right-to-left, even on a left-to-right website. The plugin works with WPML, Polylang, TranslatePress and Weglot.

How it helps

Consent is only valid if it is informed, and a visitor cannot be informed in a language they do not read. You can follow the language of the page, the language of the visitor, or always use one language – and correct any text in any language, with your corrections kept through updates.

What it is

The plugin writes a complete Cookie Policy – about fifteen sections that explain the legal basis for each law you follow, your categories, your services and the visitor’s rights – and a Your Privacy Choices page for US visitors. The cookie tables inside are live: they are rendered from the register every time the page is viewed, and whenever a scan or the automatic check changes the register, the plugin empties your page cache – so the policy visitors see is always the current one, even behind LiteSpeed or WP Rocket. Everything is also available as a Gutenberg block and a shortcode.

How it helps

You get a policy that matches what your site really does, without copying tables by hand. Pages you wrote yourself are never overwritten: the plugin only adds its content when you ask, Regenerate saves the previous version first, and Undo brings it back. Policy pages link to your contact page instead of publishing your email address.

What it is

Every choice is recorded with a random consent ID, the date, the choice, the law that applied, the categories and services, the banner version and a truncated IP address. Each record is fingerprinted with SHA-256 chained to the record before it, so editing or removing a row is detectable. Visitors can download a receipt carrying the same fingerprint.

How it helps

Under the GDPR you must be able to demonstrate consent. A log that anyone with database access could quietly edit proves very little; a chained log does. You can search by consent ID, export to CSV and set how long records are kept.

What it is

Two safety nets. Keep watching is on by default: once a week (or daily, or monthly – your choice) the plugin re-checks your pages, adds any new cookie or third-party service to the register, so your cookie policy updates itself, and emails you only when something new appears – typically after a plugin update or a new marketing tag. The Dashboard reminds you to run a full browser scan again after 90 days, because only that one sees what JavaScript stores. The leak check asks for your pages exactly as a visitor who agreed to nothing and reports anything that still loaded.

How it helps

The question regulators ask is not whether a banner appears, but whether refusing actually stops the tracking. The leak check answers that in one click, and monitoring keeps your cookie policy accurate between scans without you lifting a finger.

What it is

A module for the new AI duties. It publishes the notices required by article 50 of the EU AI Act (applying from 2 August 2026) – telling people they are talking to a chatbot and marking AI-generated content – and keeps a register of the AI systems your website uses. It can also reserve your content against AI training in the machine-readable way the EU copyright directive requires: in robots.txt, in /ai.txt and with a TDM-Reservation header, for GPTBot, ClaudeBot, Google-Extended, CCBot, PerplexityBot and 20+ other crawlers.

How it helps

You can show visitors and regulators exactly where AI is used and who checks its output, and decide which AI crawlers may use your content – while keeping search engines and AI assistants that send you traffic, if you want them. The module is off by default, because a website without AI should not publish a page saying it has some.

What it is

A form that lets visitors ask for a copy of their data or its deletion, built on WordPress’s own Export Personal Data and Erase Personal Data tools. The plugin adds the consent log to both, and starts a clock with the shortest deadline among the laws you follow – 30 days under the GDPR, 45 days under most US state laws, 15 days under Brazil’s LGPD.

How it helps

Instead of a second, separate system, requests go through the confirmation email and queue WordPress already has, so WooCommerce and other plugins answer them too. Nothing is forgotten and every deadline is visible.

What it is

The Dashboard shows a compliance checklist, the choices made in the last 30 days (accepted, rejected, customised, Global Privacy Control) and the laws your visitors arrived under. Tools holds the actions you need occasionally: ask everyone again, empty the page cache, re-read the theme colours, check what a visitor actually receives, export and import settings, and reset. In every tab a floating Save button appears as soon as you change something, so you never leave without saving.

How it helps

You see at a glance what is done and what is missing, and you can fix a cache problem or roll a new banner version out to everyone without touching the database.