Cookie Consent Plugin for SynaptikCMS

Cookie consent banner for SynaptikCMS with per-category opt-in, stateless customizable UI, and a public JavaScript API so themes and other plugins can defer their tracking scripts until consent is granted for the matching category.

Why

Any site with visitors in the EU/UK is legally required to obtain informed consent before setting non-essential cookies (GDPR, ePrivacy Directive, French CNIL guidelines). This plugin gives SynaptikCMS a zero-configuration, out-of-the-box consent banner that ticks the main UI-side compliance boxes:

  • Explicit opt-in per category (analytics, marketing).
  • Reject-all button as prominent as accept-all (required by the CNIL).
  • Consent expires and is re-prompted after a configurable delay (default 180 days, the CNIL's recommended maximum).
  • No pre-checked boxes for non-essential categories.
  • Persistent access to change or withdraw consent later via a shortcode.

⚠️ Important — read this before assuming you are compliant

Installing this plugin does NOT, by itself, make your site GDPR-compliant. It handles the consent UI and does a best-effort cookie purge, but it cannot magically prevent third-party tracking scripts already present in your theme from running. If you have GA / Meta Pixel / anything else loaded as a plain <script src="..."> in your theme, those scripts will run on every page load regardless of what the visitor clicks.

What this plugin does:

  1. Shows a legally-styled consent UI and stores the visitor's choice in localStorage.
  2. After the fact, deletes cookies matching known tracker patterns (GA, Matomo, Meta Pixel, etc.) when the visitor rejects a category. Runs on every page load, so returning visitors stay purged.
  3. Exposes window.SynaptikCookies.onConsent(...) so scripts can opt into being deferred until consent is given.

What this plugin does NOT do automatically:

  1. It does not intercept <script> tags already in your theme. If your footer.php contains <script src="gtag.js"></script>, that script will load, execute, and set cookies on every page load, independently of consent. The plugin's purge kicks in after that, which means the cookies get set and then deleted — the initial requests to Google's servers still happen (IP, User-Agent, referer leaked), and the cookies exist for a brief moment before being cleared.
  2. It does not stop server-side tracking (server logs, CDN analytics, backend Meta Conversions API, etc.). Those are outside the browser's reach entirely.

For real strict compliance you must, in your theme:

  • Wrap every tracking script in SynaptikCookies.onConsent('category', ...) (see the JavaScript API section below).
  • Or replace <script src="..."> with the deferred type="text/plain" pattern once the data-consent-category v2 feature ships.
  • Test with your browser DevTools → Application → Cookies to confirm that no analytics/marketing cookies appear before the visitor clicks Accept.

If you are OK with the plugin only doing "consent UI + post-hoc purge" without the theme-side effort, that is a defensible middle ground for most non-critical sites, but do not tell your legal team you are "fully GDPR-compliant" without the theme modifications.

Admin

Admin → Cookie Consent. One page with a top-level on/off toggle (disable the banner without deactivating the plugin, e.g. for local development), plus panels for banner position, colors, consent lifetime, category toggles, and the optional privacy-policy link.

Reopening the settings modal

GDPR requires visitors to be able to change or withdraw their consent at any time. Paste the following shortcode anywhere on your site — the footer text, a menu item, your privacy policy page — and it renders as a plain text link that opens the preferences modal when clicked:

[cookie_settings]

The link text is customizable via the cc_settings_link_label key in lang/en.json / lang/fr.json / lang/es.json. Default is "Cookie settings" (en), "Préférences cookies" (fr), and "Preferencias de cookies" (es).

On consented pages (where the plugin normally skips injection to keep the source clean), the shortcode still works: it renders as a link to ?cc_open=1 on the current URL. When clicked, the server sees that param, injects the banner assets on that one request, and the JS boots directly into the settings modal. Once the visitor saves their new choice, the cc_open param is silently stripped from the URL via history.replaceState, so a page refresh does not reopen the modal.

JavaScript API — for theme and plugin developers

The banner exposes a public API as window.SynaptikCookies. Use it to defer any tracking script until the visitor has granted consent for the matching category (see README.md documentation inside the plugin folder).

Tags:

plugins