Consent

When Cookie Rocks recognises the cookie plugin of your banner, the section says: “Your current cookie plugin was recognised: what Cookie Rocks reads in its settings is below.” Its name is given on the Overview only, on the Cookie banner card. For some cookie plugins, Cookie Rocks reads their settings on your site. For others, it relies on what it knows about their free version, and gives the date of that check. See Cookie plugins for the banners the Audit recognises.

Apart from Choice kept for, a row appears only when Cookie Rocks can tell.

A visitor’s choice lasts a set time. After that, the banner asks again. This is the choice duration, not the proof retention, set on the Proof of consent screen.

After a while, visitors must be asked again. Some countries set a longest duration for consent, and a few set a shortest one for a refusal: after a refusal, the banner must wait that long before asking again. Cookie Rocks compares your banner with the countries of your profile, set on the Obligations screen. For example: “Your jurisdictions ask for: at most 6 months in …”.

When no country of your profile sets a duration, the row says: “Recommended: 6 months. 13 at most.” Country by country: How long a cookie choice lasts.

When the duration does not fit, the Overview shows a point to fix, with See the laws. The Obligations screen shows the same finding under How long a choice lasts.

The privacy policy and the cookie policy are two different pages. The privacy policy says who you are, what personal data you collect and why, for how long, and what rights visitors have. You write it. The cookie policy lists the cookies and similar technologies of the site. Cookie Rocks can write it for you.

The section starts with: “The Obligations page checks your privacy policy and lists what it should contain. With the Cookie Rocks banner, Cookie Rocks also checks every day that your home page links to both policies.”

Visitor accounts matters for the cookie policy. When visitors can sign in (customer accounts, members, courses, forum), the policy lists the WordPress sign-in cookies. The analysis detects it from your settings and plugins. Correct it if your site signs visitors in another way.

Under Cookie policy page, a line says whether the Manage cookies button of the policy works with your banner. When it does: “Its “Manage cookies” button opens the banner of your current cookie plugin.” It works with several of the banners the Audit knows. Otherwise: “Its “Manage cookies” button cannot open the banner of your current cookie plugin: add the “Manage cookies” link it gives you.” Add that link to the page, so that visitors can change their choice. With no cookie plugin at all: “Its “Manage cookies” button needs a cookie banner to open: it works once you add one.” Another line reminds you that Cookie Rocks does not replace a lawyer’s advice.

Credit adds a thin frame at the bottom of the cookie policy, with one sentence: “This cookie policy is written and kept up to date by Cookie Rocks, a WordPress plugin.” The words “Cookie Rocks” link to cookierocks.com. With the Audit alone, it is off, and nothing shows until you tick it.

Put the shortcode [cookie_rocks_policy] in a page, and choose that page as Cookie policy page. Cookie Rocks writes the policy there, in the language of the page (in English while that language is not available). The policy contains:

• how long the visitor’s choice is kept, when Cookie Rocks can read it in your banner;
• a Manage cookies button, when Cookie Rocks knows how to open your banner;
• a link to your privacy policy, for the other personal data (forms, orders, newsletter);
• one section per category of cookies used, with the cookie of your banner that remembers the choice, the WordPress sign-in cookies when visitors can sign in, and each tool found by the analysis, with its cookies, what it stores in the browser, and how long;
• one line for the categories not used on the site;
• the date of the last analysis, with the note “This list is updated from the analysis of this site.”;
• the credit at the bottom, when Credit is ticked.

The policy follows the analysis. A tool not seen for 30 days drops out of the list and of the policy. Analyse the site again from time to time: the Overview reminds you when the last analysis is old.

Cookie Rocks also reads your privacy policy and lists what it should contain on the Obligations screen, with a text to copy for each missing point.

When a page is missing, the Overview shows a point to fix:

• “No privacy policy page is set. Your cookie banner needs to link to one.”, with Choose or create the page.
• “No cookie policy page is known. Choose yours, or let Cookie Rocks write one.”, with Choose the page. The Obligations screen also offers Create the page.

Global Privacy Control (GPC) is a signal sent by some browsers: the visitor does not want their data sold or shared. European law does not require sites to honour it today. In the United States, some states require it, each from its own date.

When Cookie Rocks can read your banner’s setting, the row Global Privacy Control shows Honoured or Ignored. Under it: “Required by these states of your visitors: …”, or “Not required by the laws of your jurisdictions.”

When your Obligations profile includes the United States and the signal is off in your banner, the Overview shows a point to fix, with See the laws. It names the states that require it, or says that honouring it is simple and safe when none does. When a state requires it, the point is a red Alert, at the top of the list. The Obligations screen has the point United States: the Global Privacy Control signal, which also names the states where it is “Required soon”.

The Audit shows what needs your attention in the administration: a number next to its menu, and the points to fix on the Overview. It sends no email and no Slack message. It keeps no statistics of the answers to your banner: see Statistics.

At the bottom of the screen, a box titled With the Cookie Rocks banner says what Cookie Rocks Pro does for consent. Click Hide: it does not come back for your user account.

With Pro, the screen also holds these settings of the Cookie Rocks banner:

• At the top, under Before the visitor chooses, Known trackers: Hold them until consent (recommended) or Do not hold them. Keep the first in every case: Meta, LinkedIn, TikTok, Pinterest, X, Snap and Hotjar wait for the matching category, and in basic mode Google tags wait too. A line under the setting says what it does with your Rules by country. When they are on and your business is based in an opt-out country, visitors from opt-out countries, such as the United States, get these trackers at once and can turn them off. If you have not said where your business is based, or if that country asks for consent first, every visitor waits for consent. Visitors from countries that ask for consent first, and visitors whose country is not known, wait for their consent. When they are off, one rule applies to every visitor. Do not hold them loads them at once for every visitor, before any choice, visitors from the European Union included: choose it only if you hold each script yourself. Links that open a connection to a held tool in advance (preconnect, dns-prefetch) are removed from the page too.
• Google reCAPTCHA and hCaptcha, shown only when your site uses one: Ask visitors before they send a form (recommended) or Treat it as necessary and load it without consent. Cloudflare Turnstile is never held: it is used for security only.
• Banner: On (default) or Off. Off means no banner, no consent signals, and no tracker is held. Use it only to test or to switch tools.
• Children: This site is aimed at children (off by default). Advertising, profiling and consent-based statistics stay off for every visitor, and videos, maps and social media posts ask a parent or guardian to confirm before they load. Turning it on or off asks every visitor again.
• Serve Google Fonts from this site (on by default): the Google Fonts found in your pages and stylesheets are copied to your site when you tick the box or click Copy the fonts now, and a scheduled task copies what visits and the daily check find later. Your pages then load the copy, and the links to Google’s servers are removed once everything is copied. Visitors’ IP addresses no longer go to Google for fonts. A theme or plugin that already serves its fonts from your site is left as it is. Since 2.11.2 A Google font called by an @import in a stylesheet of your site is copied too, and that stylesheet is read again every day. The first reading of your pages runs after activation, from your next visit to the dashboard, without a click, and the daily check copies what is missing. Each font is listed with its state: served from your site, waiting to be copied, could not be copied, or cannot be copied (Adobe Fonts, Font Awesome, Fontshare, Monotype).
• Payments: Load payment and anti-fraud scripts without consent only on cart, checkout and account pages (off by default). On other pages, they wait for consent, as EU law asks. One-click buy buttons on product pages may then not show to visitors who refuse cookies.
• Audience measurement without consent (Always ask consent or Exempt audience measurement, until the visitor objects) and Information mode (Ask consent first or Inform, and let visitors refuse): shown only when every country of your profile allows them. With Rules by country on, the first one depends on the country where your site is established, and applies only to visitors from countries that allow it. Both are off by default. See Website statistics without consent.
• Ask everyone again: shows “Current consent version: …”. Ask all visitors again shows the banner to every visitor on their next page view. Use it after adding cookies that need consent, or after changing how you use data.

Rules that change with the visitor’s country are set on the Rules by country screen.

Without a valid key, the settings of the banner are locked. The banner keeps working. You can still turn it off, choose your policy pages and ask everyone again.