felixarntz / wp-gdpr-cookie-notice

Simple performant cookie consent notice that supports AMP, Web Stories, granular cookie control and live preview customization.

WP GDPR Cookie Notice

Simple performant cookie consent notice that supports AMP, Web Stories, granular cookie control and live preview customization.

Details

This plugin adds a simple performant cookie consent notice to your WordPress site that supports AMP, Web Stories, granular cookie control and live preview customization.

Not only does the notice allow you to provide the regular message that your site uses cookies, you can also optionally grant your site visitors permission to granularly allow which cookie types are allowed, supporting groups of functional (always required), preferences, analytics and marketing cookies. This aims towards compliance with how the new GDPR regulations recommend implementing cookie control for your site.

In addition to the Privacy Policy page setting that WordPress core provides, you also get a settings to optionally set an extra Cookie Policy page, and you can easily link to either of them from the cookie consent notice.

The cookie notice content and appearance can easily be tweaked using the Customizer, with an immediate live-preview of what your changes will look like.

Last but not least, another important thing that this plugin takes care of, other than most other cookie consent plugins, is that it actually ensures cookies are only placed if the respective cookie type has been allowed by the visitor. The plugin does this by implementing cookie rules for WordPress itself, and also for the following plugins:

• AMP
• Google Analytics for WordPress by MonsterInsights
• Jetpack
• Simple Analytics
• Site Kit by Google

More plugins will be supported in the future. If you are a developer though, it's also very easy to add cookie rules for other code, by using the flexible cookie rule component the plugin provides as an extension point.

Feature Summary

• Lightweight and easy-to-use: Simply activate the plugin, and the notice will appear.
• Live Preview: Use the Customizer to adjust the notice to your needs, with an instant live preview.
• Customizable Appearance: Specify the notice position, colors, border, button size and more.
• Customizable Content: Adjust the notice heading, text and button label to your preferences. You can easily link to your cookie policy page or privacy policy page, and even give visitors granular control about which cookie types they allow.
• Cookie Policy Support: Define an optional cookie policy page if your site has one, or alternatively provide an ID attribute to the cookie section in your privacy policy.
• Cookie Integrations: Supported cookies are only set once the visitor has given their consent. The cookie rules implemented also respect the more granular cookie control.
• JavaScript-driven: The cookie notice is inserted into the page as necessary via JavaScript, but at the same time provides easy access to whether it should be displayed via its PHP API.
• AMP Support: The notice is fully AMP-compatible using <amp-consent>, integrating seamlessly with the AMP plugin. It integrates with Web Stories as well.
• Coding Best Practices: The plugin is fully object-oriented and is coded after best practices, such as using interfaces, traits, dependency injection or the single responsibility principle. It also implements modern coding features requiring PHP 7, such as scalar type hints or return type hints.

Disclaimer

This plugin does not provide any legal protection. You as a site administrator are required to ensure that it meets legal standards. This plugin is a technical tool, not a lawyer.

Requirements

• PHP >= 7.0
• WordPress >= 4.9.6

wp-gdpr-cookie-notice's Issues

Add support for AMP legacy theme

Issue Overview

The plugin doesn't work on AMP plugin's Legacy theme as it doesn't use wp_footer hook

Steps to Reproduce (for bugs)

1. Install and Activate AMP Plugin
2. Choose Reader mode Legacy theme
3. Check on fronend

Expected Behavior

Should also work on AMP legacy theme

Current Behavior

dosen't show at all

Possible Solution

Plugin_Notice_Controller->load_notice

add_action( 'amp_post_template_footer', [ $this->notice, 'render' ], 100, 0 );

Screenshots / Video

Before

After

Related Issues and/or PRs

https://wordpress.org/support/topic/amp-legacy-personalization/#post-14085058

Todos

• Tests
• Documentation

Compatibility with Jetpack Stats: deprecated functions removed

Issue Overview

In the next version of the Jetpack plugin, scheduled to be released in the beginning of May, we'll be removing a few functions that have been deprecated for a while. See the related PR for more information:
Automattic/jetpack#29780

I'm reaching out here because this plugin is relying on those deprecated functions:

wp-gdpr-cookie-notice/src/cookie-integrations/class-jetpack-stats-cookie-integration.php

Lines 74 to 78 in fdd6c25

	public function add_hooks( bool $allowed ) {
	if ( ! $allowed ) {
	remove_action( 'template_redirect', 'stats_template_redirect', 1 );
	remove_action( 'wp_footer', 'stats_footer', 101 );
	remove_action( 'wp_head', 'stats_add_shutdown_action' );

It may consequently be best to move away from those deprecated functions. One way to go about it would be to rely on the script_loader_tag tag, as was suggested in the Pull Request above.

Constant FILTER_SANITIZE_STRING is deprecated - PHP 8.2

Issue Overview

Constant FILTER_SANITIZE_STRING is deprecated

Steps to Reproduce (for bugs)

1.install wordpress
2.instal this plugin
3. enable define('WP_DEBUG', true); on wp-config.php in public_html or www
4. enable php 8.2
5. access website and show the error public_html/wp-content/plugins/wp-gdpr-cookie-notice/src/cookie-notice/class-cookie-notice-form.php on line 139

Cyber Panel
PHP 8.2
Google Chrome latest version
Cloudflare
Windows 10

Expected Behavior

Don't show errors and works fine

Current Behavior

Not stopped working

Possible Solution

Not use this Constant anymore

Screenshots / Video

Related Issues and/or PRs

Todos

• Tests
• Documentation

Ensure cookies are set correctly with domain and path

Use setcookie() correctly.

Styling issues on wp-login.php

Issue Overview

The WordPress login screen has some CSS that affects the cookie notice, for example there's a border around the OK button.

Steps to Reproduce (for bugs)

Visit wp-login.php and compare styling of the notice with the one on the homepage.

Expected Behavior

The notice should be styled the same on wp-login.php as on any other page.

Current Behavior

Styling differences

Possible Solution

Add some CSS to override WP login CSS.

Screenshots / Video

Homepage:

wp-login.php:

wp-login.php with different layout for the notice:

Related Issues and/or PRs

Todos

• Tests
• Documentation

Add option to allow unchecked as the default

For most of the EU, the GDPR stipulates that the box to accept the cookie notice be unchecked. Please include an option for this in the plugin settings.

Implement Customizer control dependencies

Some controls in the Customizer should only appear based on other option values. The codebase already contains TODO notices for the relevant areas.

Add support for Web Stories plugin

amp-consent is supported in AMP Stories via a amp-story-consent UI component: https://amp.dev/documentation/components/amp-consent/#prompt-ui-for-stories

Support for that should be added based on the Web Stories plugin.

Deprecated: Creation of dynamic property Felix_Arntz\WP_GDPR_Cookie_Notice\Cookie_Notice\Cookie_Notice::$amp_story_markup is deprecated

Issue Overview

Constant FILTER_SANITIZE_STRING is deprecated

Steps to Reproduce (for bugs)

1.install wordpress
2.instal this plugin
3. enable define('WP_DEBUG', true); on wp-config.php in public_html or www
4. enable php 8.2
5. access website and show the error public_html/wp-content/plugins/wp-gdpr-cookie-notice/src/cookie-notice/class-cookie-notice.php on line 115

Cyber Panel
PHP 8.2
Google Chrome latest version
Cloudflare
Windows 10

Expected Behavior

Don't show errors and works fine

Current Behavior

Not stopped working

Possible Solution

Fix usage in the file

Screenshots / Video

Related Issues and/or PRs

Todos

• Tests
• Documentation

Add support for Site Kit

There should be a Cookie_Integration class covering Google Site Kit and the tags it's placing on the page.

See https://wordpress.org/support/topic/support-for-google-site-kit/

About WordPress comment cookies

Issue Overview

Is WordPress_Comments_Cookie_Integration useful? WordPress already asks for consent for the cookie when the user is posting a comment. Asking for consent twice seems odd.

This issue is intended to create a discussion, and not directly ask for a change.

Story behind this

I found that the "Block WordPress from identifying visitors when they submit a comment?" cookie integration option was active on my site despite having a plugin for removing comments completely.

I thought it could be just fixed by detecting the cookie removal plugin. However, before I fired off a PR with a simple change, I wanted to look closer at what the cookie integration is supposed to do, how it does that, and what cookie does WordPress even store when posting a comment.

WordPress asks for consent already

(Screenshot taken from the site that WordPress generates after installation with the Twenty Twenty-One theme.)

There is a checkbox called "Save my name, email, and website in this browser for the next time I comment". With this, WordPress already asks for consent for saving the cookie.

Apparently, this consent feature was added in WordPress 4.9.6, which also is the minimum version that this plugin supports. In other words, all WordPress versions that can use this plugin, will also ask for consent even without the plugin.

If I understood the code correctly, if the user disables "preference" cookies in the cookie notice popup, but checks the consent checkbox when writing a comment, the cookie probably won't get stored. This may be confusing for the user.

The question

The question I wanted to ask with this PR is: Should WordPress_Comments_Cookie_Integration even exist, because WordPress already asks for consent? Is there something WordPress is missing, and therefore this plugin also asks for consent? Alternatively, should this plugin remove the checkbox that WordPress adds? Should an exception for comment removal plugins (such as this) be implemented?

Also, apologies for not fully following the issue template's guidelines, it's hard to fit this into that, because this is not a bug or a suggestion, and rather a question.

Stylesheet for GDPR Cookie Notice inexplicably disabled in Chrome inside Customizer preview

As raised by @felixarntz to me, there is a strange issue whereby the GDPR cookie notice initially appears in the Customizer preview:

But then after ~5 seconds of loading the styles for the notice are just disabled. It's as if the stylesheet is removed from the DOM. Nevertheless, the style#wp-gdpr-cookie-notice-stylesheet element remains intact in the DOM. The unstyled notice looks like this (with position:fixed removed it then appears in the footer):

I added a DOM breakpoint to break on subtree modifications to the document and it breaks here immediately before the stylesheet gets disabled:

The link element being removed at this point (as reported by DevTools) is:

<link rel="preconnect" href="https://src.wordpress-develop.test" referrerpolicy="origin">

If I open dev tools and merely touch the contents of the style element (just click to edit but then click out without making any changes):

Then the stylesheet is somehow re-enabled and the notice gets re-styled.

I reproduced this issue in Chrome 67 and Chrome 69 (Canary). I could not reproduce the issue in Safari or Firefox.

(Note that the Customizer preview serves dirty AMP (that is, a non-valid AMP document) because the interface requires custom scripts and styles to live preview changes. This use of AMP is not officially supported.)

To reproduce the issue:

1. Install the latest develop build of the AMP plugin.
2. Activate the wp-gdpr-cookie-notice plugin
3. Activate one of the core themes, like Twenty Sixteen.
4. Go to the WP Admin > AMP and enable Native mode.
5. Access the Customizer in Chrome via /wp-admin/customize.php.
6. Wait 5 seconds after the edit shortcuts appear, and blink the notice disappears.

I suspect it could be a Blink bug.

Ensure settings are correctly saved initially

When you save settings for the first time via the Customizer, only parts of the settings are saved. For some reason they are not merged with the defaults, instead settings from the other sections are simply empty afterwards.

Expected Behavior

All settings should be correctly saved, together with default values for those settings that were not changed.

Current Behavior

Settings that are untouched are saved with an empty value.

Change Speed Insights to Lighthouse

Hi
Now the UA for PSI (PageSpeed Insights) is Chrome-Lighthouse not Pagespeed Insights, so, I think, must be changed in these files:
/src/cookie-notice/class-cookie-notice.php Line 169
src/cookie-notice/class-cookie-notice-script-utils.php Line 80

Fix block login setting to work correctly

There are some issues with the integration that is supposed to block users from logging into WordPress until they have accepted cookies. It seems that sometimes the notice doesn't show so it's impossible to accept the cookie, other times it seems there is some odd redirect loop which keeps them logged out - sometimes without even an error message.

For now this can be worked around by disabling the respective setting:

1. Open the Customizer.
2. Go to Cookie Notice > Integrations.
3. Uncheck the box that says “Block users from logging in to the backend?”

See also https://wordpress.org/support/topic/plugin-causing-redirect-login-loop/

Performance Issues On AMP First Sites

Issue Overview

On AMP sites the amp-consent component makes a POST request to admin-ajax with every page load. The request is uncached, which leads to substantial performance issues on sites with meaningful amounts of traffic. This has been observed on the Newspack site https://asiatimes.com/.

No thanks button required in Denmark

Issue Overview

I really like how this plugin implements cookie consent, but unfortunately it is not usable in Denmark (and maybe not in any EU country - if other EU-countries interpret the rule in the same fashion).

In a recent decision the danish authorities has clarified that the users option to not accept cookies should be equally prominently displayed as the option to accept.

Basically they are saying, that there should be a button stating ’no thanks, ’I do not accept’ or something similar.

Possible Solution

Implement an option to display a second button for saying ’no, thanks to cookies’

I am uncertain whether the button should just close the modal letting the user continue to browse the site in what ever way is possible with out having set any cookies, since storing the ’no cookies’-wish would probably require a cookie.

Screenshots / Video