Consent signals and integrations

GoConsent passes each visitor’s choice to the tags and plugins on your site through the standard signals below. The signals are set in the visitor’s browser, so they stay correct behind page caches.

Signal	What GoConsent does
Google Consent Mode v2	Sets defaults before any other script runs, and updates them the moment a visitor chooses.
Meta Pixel consent	Calls fbq('consent', 'grant') or 'revoke' to match the Marketing choice.
Global Privacy Control	Honored as an opt-out of marketing, and saved with the consent record. On by default.
IAB GPP	__gpp returns a US National (usnat) section that matches the visitor’s choice and GPC. IAB TCF is not included.
WP Consent API	Sets statistics, statistics-anonymous and marketing, so WooCommerce and other plugins that read it follow the visitor’s choice.
goconsent	The one first-party cookie, holding the visitor’s choice for 12 months.

Google Consent Mode v2

GoConsent prints a small inline script at the top of the page, so Google tags always see the defaults first:

• ad_storage, ad_user_data and ad_personalization: denied until the visitor allows Marketing.
• analytics_storage: denied until the visitor allows Analytics. In US opt-out mode, where no banner shows, it starts as granted.
• functionality_storage and security_storage: granted, because the site needs them to work.
• wait_for_update is 500 ms and ads_data_redaction is on. Until Marketing is allowed, Google Signals and ad personalization signals are off.

When the visitor chooses, GoConsent sends a consent update, and pushes a goconsent_update event to the dataLayer with goconsent_analytics, goconsent_marketing and goconsent_media set to granted or denied. In Google Tag Manager, use that event as a trigger.

Global Privacy Control

GoConsent reads navigator.globalPrivacyControl. When it’s set, Marketing stays off, even if the visitor allowed it earlier. For signed-in visitors it also reads the Sec-GPC header and remembers the signal on their account, so it applies on every device they sign in from. It’s controlled by Honor Global Privacy Control.

IAB Global Privacy Platform

__gpp follows GPP 1.1 and supports ping, addEventListener, removeEventListener, hasSection, getSection and getField. Ads in iframes reach it through a frame named __gppLocator. When your last scan found ad tags, sale, sharing and targeted ads read as opted out until the visitor allows Marketing. For visitors in European time zones, applicableSections is [-1]. GoConsent isn’t registered with the IAB, so it reports CMP ID 1.

Read consent in JavaScript

GoConsent.get();        // { analytics, marketing, media, decided, gpc, maps }
GoConsent.onChange( function ( state ) { … } );
GoConsent.open();       // opens Your Privacy Choices
document.addEventListener( 'goconsent:change', function ( e ) { e.detail; } );

decided is true once the visitor has made a choice. media is the Maps & videos choice.

Hold your own scripts

GoConsent recognizes common trackers and holds them for you. To hold a script of your own, give it type="text/plain" and data-goconsent="analytics" or data-goconsent="marketing". It runs as soon as the visitor allows that category. GoConsent leaves any script with a data-goconsent attribute as it is.

<script type="text/plain" data-goconsent="analytics" src="https://example.com/stats.js"></script>

Scripts added after the page loads

Tracking scripts that other code injects later are held too, and released when the visitor allows their category. Checkout and payment scripts such as Stripe and PayPal count as necessary.

The goconsent cookie

It stores the choice for each category, when it was made, whether GPC was on and the visitor’s Consent ID. It’s set with SameSite=Lax, and Secure on HTTPS. When the visitor turns Analytics or Marketing off, GoConsent also clears common tracking cookies such as _ga and _fbp.

PHP filters

• goconsent_skip_request: return true to leave a request alone, with no banner and no blocking.
• goconsent_filter_page: return false to stop GoConsent holding scripts in a page’s HTML.
• goconsent_signatures: add a service it should recognize, as id => array( label, category, needles ).
• goconsent_visitor_ip: the visitor IP, if your site sits behind a proxy. The consent log saves it masked.

Outside requests

GoConsent contacts nothing on activation, and nothing until an administrator accepts its terms. The scanner requests your own pages and, if your site uses one, your public Google Tag Manager container. Google Fonts hosting is optional and off by default.