OrioleOne Easy Cookies

OrioleOne Easy Cookies is a local-first consent and cookie-management plugin for WordPress. It provides an accessible consent banner, WP Consent API integration, Google Consent Mode and Microsoft Clarity consent signalling, strict script controls, local service discovery, and optional aggregate consent statistics. No external account is required.

OrioleOne Easy Cookies provides technical tools that help website owners manage consent and cookie disclosures. Website owners remain responsible for configuration and legal compliance.

Features

• Accept All, Reject All, and granular preferences.
• Necessary, Functional, Preferences, Analytics, Performance, and Advertisement categories.
• Strict prior blocking or consent signalling.
• WP Consent API provider integration for compatible plugins such as Site Kit.
• Google Consent Mode v2 signals without installing a Google tag.
• Microsoft Clarity Consent API v2 signals without installing Clarity.
• Explicit reviewed-service registry, existing WordPress script-handle controls, and accessible embed placeholders.
• Local same-origin discovery scanner with administrator review.
• Optional local aggregate consent-interaction statistics.
• Strict global, European/UK, US-oriented, and custom regional templates.
• Global Privacy Control support for Advertisement/targeted-advertising preferences.
• No plugin telemetry, affiliate links, promotional backlinks, remote admin assets, or required SaaS account.

Local-first design and privacy

Consent choices are stored in the first-party necessary ooec_consent cookie. OrioleOne does not send consent, scan, analytics, configuration, domain, or visitor data to the plugin developer. Optional statistics remain in the site’s own WordPress database and represent interactions, not guaranteed unique people.

The local scanner requests only administrator-selected same-origin URLs and stores findings locally. It does not use a remote scanning or geolocation service.

Setup

Strict global opt-in is the default. Every optional category starts denied. European/UK mode uses opt-in behavior; US-oriented mode changes the notice template and WP Consent API consent type but does not silently grant optional storage. Custom mode uses administrator-configured text and category visibility.

OrioleOne does not infer legal jurisdiction or use IP geolocation. A trusted site-owned mechanism may select an explicit mode through the oriole_one_easy_cookies_regional_mode filter.

Increase the policy/configuration version after material changes that should invalidate an existing choice.

WP Consent API integration

WP Consent API must be installed and activated separately. OrioleOne registers through documented public interfaces and communicates its validated source-of-truth choice. It does not modify WP Consent API internals or Site Kit options.

Mappings include Functional to functional, Preferences to preferences, Analytics to statistics, Advertisement to marketing, and configurable Performance mapping.

Google Consent Mode

OrioleOne can send documented Consent Mode v2 defaults and updates to an existing Google integration. Optional storage defaults to denied and security_storage remains granted. The plugin does not install Google Analytics, Google Tag Manager, Google Ads, Site Kit, or measurement IDs.

The denied default is emitted as a synchronous, local, critical inline script before ordinary head scripts. Use Google Tag Assistant to verify ordering, values, and duplicate-default warnings. Exclude the script IDs oriole-one-easy-cookies-consent-bootstrap and oriole-one-easy-cookies-wp-consent-type from delay, defer, combine, or relocation features in caching/optimization tools.

Site Kit can consume the WP Consent API mapping. If Site Kit’s own Consent Mode feature is enabled, disable OrioleOne’s direct Google Consent Mode signalling to avoid two default initializers; continue using OrioleOne as the stored-choice provider through WP Consent API.

Microsoft Clarity

OrioleOne can call the documented Clarity consentv2 interface for an independently installed Clarity integration. It does not install Clarity, set a project ID, create Clarity cookies, or load Clarity assets.

Strict script blocking

Strict mode activates only reviewed and enabled service definitions after the assigned category is granted. It supports existing WordPress script handles and their dependents, associated inline blocks, and registered iframe placeholders. The registry does not accept JavaScript, PHP, CSS, or external script URLs, and the plugin does not download or insert vendor scripts. It intentionally avoids broad page output rewriting. Strict mode cannot block an undeclared tag inserted directly by another plugin, a tag manager, or cached HTML; every optional service must be reviewed and explicitly registered.

Withdrawal prevents future registered loads and attempts configured first-party cookie/storage cleanup. Code already executed cannot reliably be unloaded, and data already transmitted cannot be recalled.

Scanner

The local scanner inspects selected same-origin pages, response headers, browser-visible resources, known local service signatures, and browser-visible storage when an administrator initiates browser assistance. Findings require human review.

Scanner results are not legal advice and are not guaranteed complete.

Statistics

Statistics are disabled by default. When enabled, minimized local interactions are retained briefly, aggregated into daily counts in bounded transactional batches, and deleted according to separate raw and aggregate retention settings. Optional path collection removes query strings and fragments and redacts identifier-like segments. Full IP addresses, user agents, referrers, and browser fingerprints are not stored. CSV export contains paginated grouped counts only.

Regional modes

• Strict global opt-in: default privacy-protective template.
• European/UK opt-in: opt-in template for administrator configuration.
• US-oriented notice/opt-out: notice template and opt-out consent type without a compliance claim.
• Custom/manual: administrator-controlled wording and visibility.

Regional templates are technical starting points, not legal determinations.

Global Privacy Control

When enabled, Sec-GPC: 1 and navigator.globalPrivacyControl hold Advertisement consent at denied and withdraw a prior advertising grant. GPC does not infer a choice for Functional, Preferences, Analytics, or Performance.

This feature does not guarantee compliance with US state privacy laws.

External services

OrioleOne itself does not contact the plugin developer or a remote API. All plugin CSS and JavaScript assets are bundled locally. Domain names in the scanner signatures and service templates are inert detection metadata: the plugin compares locally observed resource names with those strings, but it does not request those domains.

The following optional interoperability can cause a connection only when the website owner has separately installed/configured the named service or deliberately places a supported embed:

• Google services (Google Analytics, Tag Manager, Ads, Site Kit, Consent Mode, Maps, reCAPTCHA, or YouTube): OrioleOne can send consent-state commands to an existing Google integration and can reveal an administrator-configured Google/YouTube embed after the visitor grants its category. OrioleOne sends no measurement ID and installs no Google tag. The independently configured Google service may receive the visitor’s IP address, browser/device data, requested page or embed URL, consent state, and any data that the website owner configured it to collect when that integration or embed loads. Google terms: https://policies.google.com/terms ; Google privacy policy: https://policies.google.com/privacy
• Microsoft Clarity: OrioleOne can call the local clarity('consentv2', ...) interface only when the website owner has independently installed Clarity. OrioleOne does not load Clarity or send a project ID. Once installed by the website owner, Clarity may receive consent state and the visitor/browser data covered by the owner’s Clarity configuration. Microsoft Services Agreement: https://www.microsoft.com/servicesagreement ; Microsoft Privacy Statement: https://www.microsoft.com/privacy/privacystatement
• Meta Pixel: the bundled template and scanner can identify an independently installed Meta Pixel; OrioleOne does not install or contact Meta Pixel. If the website owner independently loads it after consent, Meta may receive consent state and the visitor/browser and event data configured by that owner. Meta terms: https://www.facebook.com/terms ; Meta privacy policy: https://www.facebook.com/privacy/policy/
• Vimeo: the optional [ooec_embed] shortcode can reveal an administrator-supplied Vimeo player URL after consent. Loading that player can send the visitor’s IP address, browser/device data, requested video URL, and player interactions to Vimeo. Vimeo terms: https://vimeo.com/legal ; Vimeo privacy policy: https://vimeo.com/legal/privacy

WP Consent API is a separate WordPress plugin, but communication with it occurs locally inside the WordPress site and does not itself transmit data to an external service.

Scanner limitations

Scans can miss HttpOnly cookies, cross-origin or partitioned storage, dynamically generated resources, authenticated routes, interaction-triggered services, and behavior hidden by consent or caching. Suggested provider, purpose, duration, confidence, and category values require administrator review.

Developer documentation

Public helpers and hooks include service/script registration, consent-state access, consent events, ooec:gpc-applied, and the trusted-local oriole_one_easy_cookies_regional_mode filter. Human-readable documentation is included in the docs directory.

No compilation is required. Distributed PHP, JavaScript, and CSS are the human-readable source. Development-only PHPCS and PHPUnit dependencies are described by composer.json and are excluded from the release ZIP.

Legal disclaimer

OrioleOne Easy Cookies provides technical tools to help website owners manage consent and cookie disclosures. Website owners remain responsible for configuration and legal compliance. The plugin is not a legally certified or Google-certified consent management platform and does not guarantee compliance in any jurisdiction.