Omea Consent – Cookie Banner, Consent Mode v2 & Conversions API

Maelezo

Omea Consent is a cookie consent banner for WordPress built around the consent rules: the scripts you add wait for consent in their category, Google Consent Mode v2 is always on, banner choices are logged as evidence, and a cloud scan checks from the outside that nothing slips through. The plugin gives you the tools; whether your site complies depends on how you set it up.

Free, and fully functional:

• Cookie banner and preferences window – four layouts (bottom right or left box, top or bottom bar), dark or light theme, your own colors and texts in every language (Polylang, WPML). Reject is as easy as accept.
• Your visitors’ language – the banner, preferences and cookie policy page are built in for 12 languages: English, Finnish, Swedish, Danish, Norwegian, Estonian, German, Dutch, French, Spanish, Italian and Polish. Polylang and WPML sites get each page’s language.
• Accessible banner – built and tested for WCAG 2.2 Level AA (automated axe-core checks plus keyboard and screen reader tests): keyboard and screen reader friendly, readable contrast in both themes, “Reject all” exactly as prominent as “Accept all”, and a warning in the settings if your own colors are hard to read.
• Google Consent Mode v2 – always on. Every consent type is denied before any Google tag loads and updated the moment the visitor chooses. You choose, in plain words in the setup checklist: Advanced (Google’s recommendation – cookieless pings to Google before consent and after a rejection) or Basic (nothing sent to Google before consent). Optional url_passthrough.
• Consent signals for Microsoft and HubSpot – Microsoft Advertising (UET) and Clarity, and the official HubSpot plugin, get the visitor’s choice automatically – also when their tags come through Google Tag Manager or another plugin. Optional stricter rule: HubSpot’s tracking code loads only after Statistics consent.
• Script blocking – paste tracking snippets by consent category, or turn on auto-blocking to also hold known tracking scripts that themes and other plugins add, until consent.
• Embed placeholders – YouTube and Vimeo videos, Google Maps and Facebook embeds wait behind a placeholder that names the provider, with “Load once” and “Allow” buttons – no blank gap and no cookies before consent. Works with or without auto-blocking.
• US state laws (CCPA/CPRA) and Global Privacy Control – switch to the opt-out model: categories run until the visitor opts out, and a notice with “Do Not Sell or Share My Personal Information” replaces the consent banner. A footer link (shortcode) opts out in one click. A browser’s Global Privacy Control (GPC) signal is honored automatically in opt-out regions and the notice says so; in opt-in regions the banner says Marketing stays off. Opt-outs don’t expire, and every opt-out lands in the consent log.
• Consent log (proof of consent, GDPR art. 7(1)) – every banner and preferences choice, and every embed loaded once, stored on your own site with a consent ID, time, categories and banner version. CSV export and a retention setting.
• Cookie scanner and cookie policy – a local scan, plus one free cloud scan: our scanner visits your site like a first-time visitor in the EU and checks what is set before any choice, after “Reject all” and after “Accept all” – and finds pages where the banner doesn’t run. Results fill the cookie table and an auto-updating cookie policy page (a Cookie table block, or the shortcode).
• Setup wizard – five short steps after activation (look, your visitors, Google tags, scripts, policies), each choice explained in plain words.
• Setup checklist and “Found on your site” – the plugin spots tags already on your site, other cookie banner plugins and WooCommerce, and tells you what to do next.
• WordPress Consent API – other plugins can read the visitor’s choice.

Omea Consent Pro (paid add-on, 7-day free trial) turns consent into measurement you can trust:

• One-click pixels and tags – Google Analytics 4 (GA4), Google Tag Manager (GTM), Google Ads, Meta Pixel (Facebook Pixel), TikTok Pixel, Microsoft Advertising (UET), LinkedIn Insight Tag and Snap Pixel. Paste an ID – no code. Google tags use Consent Mode v2, the others wait for Marketing consent (or, if you choose, load with the platform’s own consent mode).
• Conversion tracking – define a conversion once (a thank-you page, a button click, a form, omea.trackEvent('lead') or data-omea-event) and send it to every platform. WooCommerce purchases, checkouts and add-to-carts and booked HubSpot meetings are set up for you; server-side WordPress events (sign-ups, logins) work without JavaScript.
• Server-side tracking with Conversions APIs – each conversion is also sent from your WordPress server, so it arrives despite ad blockers and browser limits: Meta Conversions API (CAPI), TikTok Events API, LinkedIn Conversions API and Snap Conversions API, with the same event ID as the pixel or tag so each platform counts it once. Server-side conversions (WooCommerce purchases, sign-ups) also reach GA4 through the Measurement Protocol, and Google Ads enhanced conversions add the customer’s hashed email through the Google tag in the browser, after Marketing consent. Email, phone and address details are SHA-256 hashed (the IP address and browser details are sent unhashed, as the platforms ask), and everything is sent only with the visitor’s consent – no tagging server (sGTM, Stape) to set up or pay for.
• Unlimited cloud scans – a scan every month and an email when a new cookie shows up before consent or after “Reject all”.
• The banner beyond WordPress – one line shows the same banner on pages a HubSpot blog or landing page tool serves under your domain; one choice covers both.
• Rules per region – opt-in in the EU, UK and Switzerland, the US opt-out notice in the US, and your choice (or no banner) everywhere else, each region with its own layout. The country is looked up on your own server once per session, so page caching keeps working.
• Age gate, full-screen banner and custom CSS.

More about Pro: https://www.cultmetrics.com/products/omea-consent-pro/

Privacy

Omea Consent stores the visitor’s consent choices in a first-party consent cookie and matching browser storage key so choices can persist across page loads. With the opt-in model nothing is stored before the visitor chooses; with the opt-out model (US state laws) the default settings are stored right away so tags and other plugins can follow them. Site administrators control any tracking snippets added through the plugin settings.

As proof of consent, each choice is also recorded in a database table on your own site (Omea Consent → Consent Log): a random consent ID (kept in the visitor’s first-party omea_consent_id cookie), the time, the choice per category, a hash identifying the banner text shown, the page path and a salted hash of the shortened IP address (pseudonymised – the records are still personal data, linked to the consent ID). Records are deleted automatically after the retention period you set (default 365 days). Nothing is sent to Cultmetrics or any third party. A suggested privacy-policy paragraph is added to Settings → Privacy.

External services

Omea Consent ships with a local Open Cookie Database catalog for cookie matching. By default, the scanner uses this bundled local catalog and does not contact a remote cookie database service.

Site administrators can enable optional CookieDatabase.org lookups in the plugin settings. When enabled, Omea Consent may send detected cookie or browser storage names to CookieDatabase.org during an admin-initiated scan so the plugin can retrieve cookie classification metadata such as category, purpose, provider, and retention. This service is provided by Complianz B.V. Terms: https://cookiedatabase.org/terms-of-use-api/. Privacy: https://cookiedatabase.org/plugin-use-of-cookiedatabase-org-privacy-terms/.

The scanner includes local pattern matching for common script providers such as Google Tag Manager, Google Analytics, Meta Pixel, and HubSpot. These patterns are used only to detect scripts already present on the scanned site. Omea Consent does not send data to those providers as part of the scan.

The optional “Upgrade to Pro” admin page contains “Start free trial” buttons for the paid Omea Consent Pro add-on and the Omea Pro bundle (Consent Pro with Omea Analytics Pro). Clicking it opens a window (or, as a fallback, a new tab) with the checkout page at account.cultmetrics.com (operated by Cultmetrics Oy), where payment is handled by Stripe. The page receives the site’s domain, the admin address it was opened from and the plugin version, so it can show the new license key in that window. Nothing is loaded or sent until an administrator clicks the button; card details are entered only in Stripe’s fields, never inside WordPress. More about Pro: https://www.cultmetrics.com/products/omea-consent-pro/. Cultmetrics terms of sale: https://www.cultmetrics.com/terms/. Cultmetrics privacy policy: https://www.cultmetrics.com/privacy-policy/. Stripe terms: https://stripe.com/legal. Stripe privacy: https://stripe.com/privacy.

The Scanner page and the setup checklist offer an optional cloud scan by Cultmetrics (one free scan per site; unlimited with Omea Consent Pro). Nothing is sent until an administrator clicks “Run free cloud scan” or “Cloud scan” – or, with Omea Consent Pro, when its monthly scan runs (it can be turned off on the Scanner page). Then the plugin sends the site’s home URL, the plugin version and a one-time token (or, with Pro, the license key) to account.cultmetrics.com (operated by Cultmetrics Oy). Cultmetrics’ scanner in the EU loads up to 10 public pages of the site like a first-time visitor – before any choice, after “Reject all” and after “Accept all” – and returns the cookie names and settings, browser storage keys, script addresses and third-party hosts it saw (never cookie values). To confirm the request came from the site, the scanner first fetches the token from the public REST route /wp-json/omea-consent/v1/cloud-scan/verify, which only answers for a scan the administrator just started. The site address and the result are kept for 90 days. Cultmetrics privacy policy: https://www.cultmetrics.com/privacy-policy/. Terms: https://www.cultmetrics.com/terms/.

Credits

The cookie icon is “Cookie” from Phosphor Icons (https://phosphoricons.com), MIT License.