Okito Cookie Consent

Descripción

Okito Cookie Consent adds a customizable cookie consent banner to your WordPress site and keeps Google Analytics, Google Ads and your other tags in line with each visitor’s choice. It helps you meet the GDPR, UK GDPR, ePrivacy, CCPA/CPRA and other US state privacy laws, Brazil’s LGPD and Türkiye’s KVKK.

You design the banner in the Okito dashboard; the plugin connects your site with one click and loads a single asynchronous script. No coding and no theme changes are needed.

Why Okito

• Google Consent Mode v2 — ad_storage, analytics_storage, ad_user_data and ad_personalization are set before your Google tags run and updated the moment a visitor decides. Works with Google Analytics 4, Google Ads, Google Tag Manager and Site Kit by Google.
• IAB TCF v2.3 — registered IAB Europe CMP (ID 508) with the full __tcfapi, Google Additional Consent (AC string) and Google’s enableAdvertiserConsentMode, for sites that run AdSense, Ad Manager or programmatic ads.
• WP Consent API — every choice is passed to the WP Consent API, so Site Kit and other compatible plugins follow it automatically.
• Geo-targeting by privacy law — show the banner only where consent is required (EEA, UK, Switzerland, Türkiye, Brazil and similar) and keep measurement on elsewhere.
• US privacy — opt-out notice with a “Do Not Sell or Share My Personal Information” link, the IAB US Privacy API (__uspapi) and Global Privacy Control (GPC) support.
• Automatic script blocking — tracking scripts wait until the visitor consents to their category.
• Cookie scanner — Okito scans your site and sorts cookies into categories for your cookie policy.
• Consent records — every decision is logged as proof of consent.
• 50+ languages — the banner speaks your visitor’s language automatically.

Built for WordPress

• Connect with Okito — sign in, pick your site and the banner is live. No key to copy.
• Fast — one small asynchronous script. Nothing is rendered by PHP, so your pages stay light.
• Caching and optimization friendly — works with WP Rocket, LiteSpeed Cache, Autoptimize, SiteGround Optimizer, W3 Total Cache and Cloudflare; the consent scripts are never delayed, combined or deferred.
• Site Health checks — Tools → Site Health warns you about a second cookie plugin, a missing WP Consent API, Site Kit’s Consent Mode setting and Google tags that load before your consent defaults.
• Debug mode — add ?okito_debug=1 to any URL to see whether the consent defaults load before your Google tags.

Free plan

Start free and upgrade when you need more websites or advanced features. See Okito pricing.

External services

This plugin relies on Okito, a third-party cookie consent and compliance platform operated by Okito (https://okito.com). It is required for the plugin to function: the banner, consent storage, IAB TCF v2.3 signals, Google Consent Mode v2 and the cookie scanner are all delivered by Okito’s service. A free plan is available.

The plugin contacts the Okito service in three ways:

1. CDN script load (visitor’s browser, public pages only when the banner is enabled)

• Endpoint: https://cdn.okito.com/js/{WEBSITE_KEY}
• When: On every public page view in the visitor’s browser, after the plugin is enabled and a Website Key is configured.
• What is sent: The visitor’s browser performs a standard HTTPS request for the script file. This means Okito receives the Website Key (as part of the URL), the visitor’s IP address, User-Agent and the standard Referer header sent by the browser. While the banner is displayed, it stores the visitor’s consent choices in the browser (cookies / local storage) and reports anonymized consent metrics to Okito so they can be shown in your Okito dashboard.
• Why: This is what renders the cookie consent banner, captures the visitor’s choice, blocks/unblocks tagged third-party scripts and feeds the Okito analytics for that website.

1. Admin “Test Connection” request (server-side, WordPress admin only)

• Endpoint: https://cdn.okito.com/js/{WEBSITE_KEY}
• When: Only when an administrator clicks the “Test Connection” button on the Okito → Settings page.
• What is sent: A standard HTTPS GET request from your server containing only the Website Key entered in the form. No visitor data, posts or user information is transmitted.
• Why: To verify that the Website Key is valid against the Okito CDN.

1. “Connect with Okito” (administrator’s browser, WordPress admin only)

• Endpoint: https://app.okito.com/integrations/wordpress/connect
• When: Only when an administrator clicks “Connect with Okito”.
• What is sent: The site’s home URL, the URL of the plugin settings page and a random one-time code. After the administrator signs in to Okito and chooses a website, Okito sends the browser back to the settings page with the Website Key and the same code, which the plugin checks before saving the key.
• Why: To connect the site to an Okito account without copying the Website Key by hand.

The plugin does not send any other data to Okito or any other third party. No personal data of WordPress visitors is transmitted by PHP code in this plugin.

Use of the Okito service is subject to:

• Okito Terms of Service: https://okito.com/terms-of-service/
• Okito Privacy Policy: https://okito.com/privacy-policy/

Site administrators are responsible for ensuring their own privacy policy describes the use of Okito where required by law. Suggested wording is registered with WordPress and visible under Settings → Privacy after this plugin is active.

Privacy

This plugin:

• Saves your Okito Website Key and an enabled/disabled flag in the WordPress options table.
• When enabled, loads the script described in External services on public pages so visitors see the cookie banner and consent features.

Suggested wording for your Privacy Policy is available in WordPress under Settings → Privacy after this plugin is active.