Flat Consent

Flat Consent is a cookie consent banner. You set it up in the Flat Consent dashboard; this plugin puts it on your WordPress site.

The plugin does three things:

• It prints your install line as the first thing in the head of every page, before any other script, with no async or defer. The banner can only hold back trackers that load after it, so it has to come first.
• It adds a “Cookie settings link” block and a [flat_consent_settings] shortcode. Both add a link that opens the banner’s settings, so visitors can change their choice from any page.
• It warns you in the admin if another cookie consent plugin is active (CookieYes, WPLP Cookie Consent, Complianz, Cookiebot, iubenda or Termly), so visitors don’t see two banners.

It also tells WP Rocket, LiteSpeed Cache and Autoptimize not to delay, defer or combine the banner script.

What the banner shows, which regions it appears in, its wording and design, and the list of cookies are all set in the Flat Consent dashboard, not in WordPress. You need a Flat Consent account. The free plan covers one site; paid plans are listed at flatconsent.com. On the free plan, the banner shows a small “Powered by Flat Consent” line.

Setting it up

1. Create an account at app.flatconsent.com/signup and add your site.
2. On the Install tab, copy the install line.
3. In WordPress, go to Settings > Flat Consent, paste the line (or only the site ID) and save.
4. If you use a page cache, clear it. Then press Check my site on the Install tab.

Full instructions are at flatconsent.com/docs/install.

External services

This plugin connects your site to Flat Consent, a cookie consent service run by Flat Consent. Without it, the plugin shows no banner.

Once you save a site ID, every page of your site includes a script loaded from https://cdn.flatconsent.com/s/YOUR_SITE_ID.js. The plugin itself sends nothing to Flat Consent; the requests below are made by your visitors’ browsers when a page loads.

• Loading the script. The browser requests the banner script from cdn.flatconsent.com. Like any web request, this sends the visitor’s IP address and browser details.
• Loading the settings. The script requests your site’s banner settings from cdn.flatconsent.com, sending your site ID and the visitor’s preferred languages. We use the IP address only to work out the visitor’s country and state, so the banner can follow the rules that apply there, then discard it.
• Recording a choice. When a visitor accepts, rejects or changes their choice, the script sends a record to cdn.flatconsent.com: a random ID for that choice, the time, the choice for each category, the banner version, the language shown and whether the browser sent Global Privacy Control. We add the visitor’s country and region and the browser family (for example “Chrome”). We store no IP addresses and no full browser strings. Records are kept in a Cloudflare database restricted to EU jurisdiction.

The banner sets one cookie, cmp_consent, which holds the visitor’s choice.

• Terms of service: https://flatconsent.com/terms/
• Privacy policy: https://flatconsent.com/privacy/
• Data processing agreement: https://flatconsent.com/dpa/
• Subprocessors: https://flatconsent.com/subprocessors/
• Security: https://flatconsent.com/security/