=== IBS Consent Mode Manager ===
Contributors: ibsofts, laddoo
Donate link: https://donate.stripe.com/14keXEbyJ2xp43SdQR
Tags: consent-mode, gtm, ccpa, cpra, multisite
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Display a consent banner and manage Google Consent Mode v2 for Google Analytics, Ads, and GTM, with CCPA/CPRA, GPC, and Multisite support.

== Description ==

🌐 <a href="https://www.ibsofts.com/plugins">Official Website</a>  | 📖 <a href="https://support.ibsofts.com/knowledgebase/articles/installing-and-activating-ibs-consent-mode-manager" rel="nofollow ugc">Documentation</a> | 💁 <a href="https://support.ibsofts.com/">Support</a>

🚀 **IBS Consent Mode Manager** displays a consent banner that allows visitors to Accept, Reject, or Manage Preferences for Analytics and Advertising. It uses Google Consent Mode v2 to set and update consent signals based on the visitor's choices, controlling how Google Tag Manager, Google Analytics, and Google Ads tags operate.

The plugin supports CCPA/CPRA-related California use cases, Global Privacy Control (GPC), configurable consent scopes for California, all US traffic, or all traffic, and Strict and Soft modes for Google Tag Manager. It also provides centralized consent configuration for WordPress Multisite, with each subsite able to set its own GTM Container ID and choose Strict or Soft blocking mode.

### 🚀 How It Works

When a visitor enters a site covered by the configured consent rules, the plugin establishes the appropriate Google Consent Mode defaults and displays the consent banner.

**Accept** to grant Analytics and Advertising consent.
**Reject** to deny both categories.
**Manage Preferences** to independently allow or deny Analytics and Advertising.

The selected preferences are stored in the site's consent cookie and used to update Google's consent signals.

In **Strict Mode**, the GTM container remains blocked until the visitor grants consent. In **Soft Mode**, GTM loads immediately while Google tags operate according to the configured Consent Mode defaults.

### 🚀 Key Features

☑️ **Google Consent Mode v2** - Sets Google's consent defaults before the configured Google Tag Manager container can load and updates consent signals based on the visitor's choices.
☑️ **Consent Banner** - Displays a consent banner with Accept, Reject, and Manage Preferences options.
☑️ **Customizable Banner Content** - Customize the banner heading, message, Accept button text, Reject button text, and Manage Preferences button text for each subsite.
☑️ **Granular Consent Preferences** - Visitors can separately control Analytics and Advertising consent through the preferences panel.
☑️ **Customizable Preferences Panel** - Customize the panel heading, introductory text, category labels and descriptions, and Reject All, Save Preferences, and Accept All button text.
☑️ **Analytics Consent** - Controls Google's analytics_storage consent signal.
☑️ **Advertising Consent** - Controls Google's ad_storage, ad_user_data, and ad_personalization consent signals together.
☑️ **Strict Mode** - Prevents the Google Tag Manager container from loading until a consent decision allowing tracking is made.
☑️ **Soft Mode** - Loads Google Tag Manager immediately with Consent Mode defaults, allowing Google tags to operate according to the denied consent state.
☑️ **Global Privacy Control (GPC)** - Detects and honors GPC preferences, regardless of the visitor's geographic location.
☑️ **California, US, or Worldwide Scope** - Apply consent rules to California visitors, all US visitors, or all traffic worldwide.
☑️ **WordPress Multisite** - Configure shared consent logic at the network level, while each subsite can set its own Google Tag Manager Container ID, choose Strict or Soft blocking mode, and customize its own banner settings.
☑️ **Self-Hosted Consent Management** - The consent mechanism runs directly on your WordPress installation without requiring a separate external consent-management platform.

### 🚀 Privacy Policy

☑️ Stores the visitor’s consent choice in a cookie. It does not store personal data, and the cookie expires after 365 days by default.
☑️ Uses Cloudflare geolocation headers or a configured external geo-IP API to determine consent scope. When the external geo-IP API is used, the visitor’s IP address is sent to that service for geolocation. The plugin does not intentionally store the visitor’s raw IP address as a permanent setting.
☑️ Runs on your WordPress site. The plugin does not send data to the plugin developer.
☑️ Sends Google Consent Mode signals based on visitor consent choices so Google tags configured by the site administrator can respond according to the selected consent state.

== External Services ==

=== Google Tag Manager ===

This plugin can connect to Google Tag Manager (GTM) to load and manage tags configured by the site administrator.

☑️ Service:
Google Tag Manager
https://www.googletagmanager.com/

☑️ Purpose:
GTM loads and manages tags configured by the site administrator, which may include Google Analytics, Google Ads, and other third-party services.

☑️ Data sent:
When GTM is loaded, the visitor's browser connects to Google's servers and may send standard web request information such as IP address, browser/device information, requested URL, and request metadata. GTM may also process consent signals and information associated with tags configured in the container.

☑️ When used:
GTM is loaded only when a container ID is configured and the plugin's consent/blocking settings allow it. In Strict Mode, loading is delayed until the applicable consent condition is satisfied. In Soft Mode, GTM is loaded after the configured Consent Mode defaults are established.

When JavaScript is disabled, the plugin may use the standard GTM noscript iframe fallback.

☑️ Terms:
https://www.google.com/intl/en/policies/terms/

☑️ Privacy:
https://policies.google.com/privacy/

☑️ Additional GTM privacy information:
https://support.google.com/tagmanager/answer/9323295


=== IP Geolocation API ===

This plugin can use an external IP geolocation service to determine a visitor's country or region for consent-scope detection.

☑️ Service:
IPAPI by Kloudend, Inc.
https://ipapi.co/

☑️ Purpose:
The service determines geographic information such as country and region/state so the plugin can determine the applicable consent scope.

☑️ Data sent:
When the geo-IP API is used, the visitor's IP address is sent to the configured API endpoint. The service may return geographic information such as country and region.

☑️ When used:
The plugin normally uses Cloudflare geolocation headers when configured. If a US country code is available but the required region information is missing, the configured geo-IP API may be used as a fallback. The administrator can also select an external geo-IP API provider directly.

Results are cached server-side for the configured cache duration.

☑️ Default endpoint:
https://ipapi.co/{ip}/json/

The administrator may configure a different geo-IP API endpoint.

☑️ Terms:
https://ipapi.co/terms/

☑️ Privacy:
https://ipapi.co/privacy/


The site administrator is responsible for reviewing the privacy, consent, and data-processing requirements applicable to services configured on their website. This plugin provides technical consent-management functionality and does not provide legal advice or guarantee regulatory compliance.

== Installation ==

1. Navigate to WordPress **Admin → Plugins → Add New**.
2. Click **Upload Plugin** and select the plugin ZIP file.
3. Click **Install Now** to begin the installation.
4. Once installed, click **Activate Plugin**.


= Requirements =
* WordPress 6.0 or higher
* PHP 7.4 or higher

== Screenshots ==

1. Configure GTM Container ID, blocking mode, and consent scope.
2. Customize the consent banner heading, message, and action buttons.
3. Configure granular Necessary, Analytics, and Advertising preferences.
4. Display a customizable consent banner to website visitors.
5. Allow visitors to manage Analytics and Advertising preferences individually.

== Frequently Asked Questions ==

= Does Global Privacy Control (GPC) override my configured scope? =
Yes. If a visitor's browser sends a GPC signal, they are always treated as denied for both Analytics and Advertising, regardless of your configured scope (California, all US, or worldwide).

= Can each subsite in my network use a different Google Tag Manager container? =
Yes. Every subsite sets its own GTM Container ID and its own Strict or Soft blocking mode. Consent scope and GPC handling are configured once at the network level and apply to all subsites.

= What's the difference between Strict and Soft mode? =
In Strict mode, the GTM container does not load at all until the visitor grants at least one category of consent. In Soft mode, GTM loads immediately, and Consent Mode's default signals restrict how Google tags behave until consent is granted.

= Where is a visitor's consent decision stored? =
In a cookie on the visitor's browser, along with being pushed to Google's consent signals via gtag('consent', 'update', ...) so GTM, GA4, and Google Ads tags can respond to it in real time.

= Does this plugin make my site fully CCPA or CPRA compliant on its own? =
 No. It handles the technical consent-gating mechanism only. You are still responsible for your Privacy Policy language and for any account-level settings on the Google Ads/Analytics side. This is not legal advice - confirm your specific obligations with legal counsel.

 == Changelog ==

= 1.0.0 =
* Initial release of the plugin.

== Upgrade Notice ==

= 1.0.0 =
* Initial release of the plugin.
