Legal Box Plus Compliance

Legal Box Plus Compliance helps site owners obtain, store, and respect visitor consent before any third-party service is loaded. It blocks cookies, iframes, and tracking scripts in advance, shows a customizable consent banner with granular categories, keeps proof of every decision, and connects with Legal Box Plus to publish always up-to-date legal texts.

Prior blocking

• Blocks third-party iframes and scripts anywhere on the page: post content, widgets, theme templates, headers and footers, page builders, and code written directly in the theme.
• Inline code, styles, <noscript> content, templates, and HTML comments are never rewritten, so the theme’s own JavaScript keeps working.
• Supports lazy-loaded iframes (data-src) and JavaScript modules.
• Blocked embeds are replaced by an accessible placeholder that shows the service and category, with “Allow category and load” and “Load only this time” buttons.
• X/Twitter blockquotes are held back together with their widget script.
• Whole-page processing can be switched off; embeds inside post content are always blocked.
• Page builder editors (Elementor, Divi, Beaver Builder, Bricks, Oxygen, WPBakery, Brizy, Thrive, Breakdance), the Customizer, feeds, REST, and AJAX responses are never processed.

Known services

More than 30 services are recognized by domain, path, and inline code signature, and each one can be switched off individually:

• Video and audio: YouTube, Vimeo, Dailymotion, Twitch, Wistia, Spotify, and SoundCloud.
• Social networks: X/Twitter, Facebook, Instagram, TikTok, LinkedIn, Pinterest, and Bluesky.
• Third-party features: Google Maps, OpenStreetMap, and Calendly.
• Analytics: Google Analytics and Google Tag Manager, Hotjar, Microsoft Clarity, Matomo Cloud, and Yandex Metrica.
• Advertising: Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag, X Ads, Microsoft Advertising, Snap Pixel, Criteo, and Google Ads/DoubleClick.

Google tags are not blocked while advanced Google Consent Mode is active, because they adapt to the consent signals themselves.

Your own blocking rules

• Custom rules: block any other domain (subdomains included), optionally limited to a path, and assign it a consent category.
• Exclusions: any iframe or script whose address, ID, or code contains one of the listed texts is never blocked.
• Script manager: delay WordPress script handles, including their inline data and translations, until their category is accepted.
• Code snippets: paste tracking codes (for example a pixel) in the plugin instead of the theme. They are printed blocked and run only after consent, at the head or at the end of the page. <noscript> fallbacks are discarded because they would load the tracker without consent. Only users allowed to publish unfiltered HTML can edit snippets.

Consent banner

• Granular categories: Essential (always active), Preferences, Analytics, Marketing, Social, and Video.
• “Accept all”, “Reject”, and “Preferences” in the first layer, with a preferences panel to choose categories one by one.
• Five layouts: bottom bar, top bar, floating box on the left or right, and centered window with a backdrop.
• Background, text, and button colors, plus corner radius.
• Option to give “Reject” the same prominence as “Accept all”, enabled by default.
• Editable banner title, message, and button texts.
• Editable name and description for every consent category.
• Links to the mapped privacy policy, cookie policy, and legal notice pages.
• Live preview in the settings screen.
• Accessible dialog markup, keyboard focus handling, and Escape to close once a choice exists.
• Floating preferences button with custom text, left or right position, and a compact icon-only mode.
• Gutenberg blocks: a consent button and a consent area that shows its inner blocks only after a chosen category is accepted.
• [rgpd_lb_preferences] shortcode to reopen the preferences panel from any page.

Proof of consent

• Every decision (accept all, reject all, custom selection, or category allowed from an embed) is stored in a table of your own database.
• Each record keeps a random consent ID, the accepted categories, the consent version, the date, the IP address with its last part removed, the browser user agent, and the page path.
• Visitors can see their consent ID in the preferences panel.
• The Consent records screen shows totals for the last 30 days, search by consent ID, pagination, and CSV export.
• Records are deleted automatically after 1, 2, 3, or 5 years.
• Suggested text for the WordPress privacy policy guide.
• Records never leave your site.

Google Consent Mode v2

• Denied-by-default consent state in the page head, before any Google tag runs.
• Consent updates when the visitor decides: ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, and security_storage.
• Basic and advanced modes, wait_for_update, ads_data_redaction, url_passthrough, and per-region defaults.
• Configurable list of Google script handles that are never blocked in advanced mode.

Cookie scanner

• Loads a real page of your site twice: before consent and with every category accepted.
• Reports the cookies created by the browser, by JavaScript, and by the server (including HttpOnly cookies from the response headers), with a suggested category.
• Highlights non-essential cookies that already appear before consent.
• Lists the external domains requested by the page.
• Cookie values are never stored.

Legal texts with Legal Box Plus

• Step-by-step wizard to connect a Legal Box Plus account and sync the account data automatically.
• Creates or maps the legal notice, privacy policy, and cookie policy pages.
• Generates each legal text from Legal Box Plus, in singular or plural form, and keeps it up to date.
• Cached documents with automatic refresh, and the last good version is kept if the service is unavailable.
• Connection log with configurable retention to diagnose API errors.

Languages

The plugin is written in English and includes Spanish, French, and Italian translations, also for the block editor.

External services

Legal Box Plus API

The legal-document features connect to https://app.legalbox.plus. When an administrator authenticates, the plugin sends the entered email address, password, and remember-session choice so the service can issue an API token. During account synchronization and legal-document generation, it sends that token, Legal Box Plus account identifiers, the selected plan identifier, the configured website URL, and the requested document type. The service returns account/domain information and generated legal-document HTML. These requests occur only when an administrator uses the Legal Box Plus assistant or when a mapped legal page needs refreshing. Cookie-consent management works locally without a Legal Box Plus login, and cookie scanner results are not sent to this service.

Legal Box Plus is provided by Ocean Legaltech, S.L.:

• Terms of service: https://legalbox.plus/condiciones-de-contratacion/
• Privacy policy: https://legalbox.plus/politica-de-privacidad/

Google Consent Mode and Google/YouTube services

The plugin does not install Google Analytics, Google Tag Manager, advertising tags, or YouTube embeds. When the site owner has installed compatible Google tags and enables Consent Mode, the plugin sends consent-state signals to those tags on page load and whenever the visitor changes consent. Those separately configured Google tags or YouTube embeds may then send the visitor’s IP address, browser/device information, page URL, referrer, consent signals, and Google cookie or advertising identifiers according to the site’s tag configuration. YouTube connections are delayed until the visitor grants the Video category or chooses to load an individual embed.

• Google and YouTube terms: https://policies.google.com/terms
• Google and YouTube privacy policy: https://policies.google.com/privacy

Vimeo embeds

The plugin does not create Vimeo embeds. If a page already contains one, the connection is delayed until the visitor grants the Video category or loads that embed once. Loading it can disclose the visitor’s IP address, browser/device information, page URL, referrer, and Vimeo cookies or identifiers to Vimeo.

• Vimeo terms: https://vimeo.com/legal/
• Vimeo privacy policy: https://vimeo.com/legal/privacy

X, Facebook, Instagram, and Bluesky embeds

The plugin does not create social-network embeds. If a page already contains a supported embed, it is replaced with a local placeholder until the visitor grants the Social category or loads that embed once. Loading an embed connects the visitor’s browser to the relevant provider and may disclose the IP address, browser/device information, page URL, referrer, and that provider’s cookies or identifiers.

• X terms: https://x.com/en/tos
• X privacy policy: https://x.com/en/privacy
• Facebook and Instagram terms: https://www.facebook.com/legal/terms
• Meta privacy policy: https://www.facebook.com/privacy/policy/
• Bluesky terms: https://bsky.social/about/support/tos
• Bluesky privacy policy: https://bsky.social/about/support/privacy-policy

Other recognized services

The plugin does not add any of the other services listed under “Known services” to your site, and it never contacts those providers itself. When the site owner has already added one of them, the plugin only delays the connection until the visitor accepts the related category or loads that embed once. From then on the provider receives whatever its own code sends, typically the IP address, browser/device information, page URL, referrer, and its cookies or identifiers, under that provider’s terms and privacy policy. The same applies to code snippets and custom rules configured by the site owner.

Consent records are stored only in the site’s own database and are never sent to Legal Box Plus or any other service.