CookieStart – CMP Banner & Cookie Consent

CookieStart is a consent management platform for WordPress websites and WooCommerce stores.

The plugin connects your website to the CookieStart service and provides access to CMP configuration directly from the WordPress administration panel. It can display the CookieStart consent banner, detect scripts and cookies, classify them into consent categories, scan website URLs, review consent history, and control script behavior before consent is granted.

Main features:

• Cookie consent banner provided by the CookieStart platform.
• CookieStart account registration directly from WordPress.
• Connection of an existing CookieStart account using an API key and domain ID.
• Website status dashboard with integration status and scan information.
• Website compliance score and audit summary.
• Manual and automatic website scans.
• Scan progress, scanned URL list, errors, and scan history.
• Detection and classification of scripts used by the website.
• Detection and classification of cookies.
• Manual category overrides for scripts and cookies.
• Consent categories: necessary, preferences, statistics, and marketing.
• Consent records and consent change history.
• Automatic processing and transformation of supported scripts.
• Optional automatic blocking of scripts before consent.
• Optional blocking of unknown scripts.
• Script allowlist and blocklist rules.
• Default category for unrecognized scripts.
• Optional grouping of first-party scripts.
• Google Consent Mode v2 support.
• Local preview of scripts detected in WordPress output.
• Runtime configuration cache management.
• Debug mode and integration logs.
• Usage statistics and scan limits available in the dashboard.
• Support for WordPress and WooCommerce websites.

An active CookieStart account and a website configuration in the CookieStart platform are required. You can create or connect an account from the plugin administration panel.

The plugin requires PHP 8.1 or newer.

Important: Installing and configuring this plugin does not by itself guarantee compliance with GDPR, ePrivacy, or any other law. The website owner is responsible for the correct configuration of the service, classification of cookies and scripts, legal notices, and compliance with applicable laws.

Learn more:
https://cookiestart.pl/

CookieStart panel:
https://panel.cookiestart.pl/

Privacy policy:
https://cookiestart.pl/polityka-prywatnosci/

External services

This plugin connects to external CookieStart services that are required for account management, website configuration, scanning, consent management, and delivery of the consent banner.

On a fresh installation, CookieStart processing is enabled. The frontend SDK is not loaded and the plugin does not send frontend visitor requests to CookieStart until an administrator connects a domain and configures its CookieStart credentials.

The plugin does not contact Google, Facebook, Google Maps, or other third-party providers whose scripts it can recognize. References to those providers are local detection and classification patterns for scripts already present on the website. The plugin does not use administrator or visitor data for its own analytics or advertising and does not independently track administrators or visitors.

The plugin may connect to the following services:

• https://identity.cookiestart.pl – account registration, login, authentication, and token renewal.
• https://parameter.cookiestart.pl – website configuration, runtime settings, script and cookie classification, statistics, integration status, and related CMP configuration.
• https://crawler.cookiestart.pl – website scans, scan status, scanned URLs, and scan results.
• https://consent.cookiestart.pl – consent records and consent history.
• https://cdn.cookiestart.pl – delivery of the CookieStart consent runtime SDK used on the website frontend.

Depending on the action performed and the enabled features, the following data may be transmitted:

• CookieStart account email address and password when the administrator registers or logs in through the plugin.
• The administrator’s IP address during account registration.
• Authentication tokens and the CookieStart user identifier.
• Website URL, domain name, allowed domain, CookieStart domain identifier, and public API key.
• Plugin version, integration type, and website URL in an integration heartbeat sent approximately every six hours after the website has been connected.
• Detected script patterns, script assignments, cookie rules, consent categories, and manual category overrides.
• Website scan requests, scan identifiers, scan status, scanned URLs, and scan results.
• Consent records and consent history requested by an authorized website administrator.
• Standard technical request data processed by the service infrastructure, such as IP address, request headers, browser information, timestamps, and server logs.

The frontend loads the CookieStart runtime SDK from cdn.cookiestart.pl. After CookieStart credentials are configured, the SDK receives the connected website identifier and public API key and retrieves the consent configuration required to display and operate the banner.

These external services are provided by CookieStart and are required for the plugin’s core functionality.

Service website:
https://cookiestart.pl/

Privacy policy:
https://cookiestart.pl/polityka-prywatnosci/

Terms of service:
https://cookiestart.pl/regulamin/

Privacy

The plugin stores CookieStart configuration and authentication tokens in the WordPress database. Account passwords are transmitted only when the administrator registers or logs in and are not stored by the plugin. Session renewal uses a rotating access and refresh token pair.

The website administrator is responsible for:

• Informing website visitors about the use of CookieStart.
• Maintaining an accurate privacy policy and cookie policy.
• Correctly classifying cookies and scripts.
• Configuring consent categories and legal bases.
• Reviewing the data processing terms applicable to the CookieStart service.
• Testing the website after activation and after configuration changes.

For details about processing performed by CookieStart, see:
https://cookiestart.pl/polityka-prywatnosci/