interativus.com.br\/privatto<\/a><\/p>\n\nMain features:<\/strong><\/p>\n\n\n- Granular consent banner with per-category preferences (necessary, statistics, marketing, embeds).<\/li>\n
- Automatic blocking of third-party scripts and iframes via output buffering: matching
<script><\/code> tags are switched to type=\"text\/plain\"<\/code> before the page reaches the browser, so nothing runs before consent.<\/li>\n- Google Consent Mode v2 injected with everything denied by default, updated according to the visitor's choice.<\/li>\n
- Proof of consent stored in your own database table: unique ID, action, categories (JSON), policy version, IP hash (optional), country, user agent, page URL and UTC timestamp. Exportable to CSV for audits.<\/li>\n
- LGPD document generator: privacy policy, terms of use, cookie policy, returns policy and a plain-language summary, built from a guided form \u2014 100% local, with no external calls.<\/li>\n
- Data subject rights form (LGPD art. 18) with tracked protocols, 15-day response deadline monitoring and an admin queue.<\/li>\n
- Simplified record of processing activities (ROPA) export, as required by ANPD Resolution CD\/ANPD No. 2\/2022, including for small-scale processing agents.<\/li>\n
- \"Cookie preferences\" link to reopen the banner, letting visitors change or withdraw consent at any time.<\/li>\n<\/ul>\n\n
Important notice:<\/strong> the generated documents are a structured, LGPD-aligned starting point; they are not legal advice. Review by a lawyer is recommended, especially for complex operations.<\/p>\n\nExternal services<\/h3>\n\n
Privatto does not connect to any external service. The banner, blocking, consent records, plugin\/script detection and document generation all run entirely on your own server, with no data sent anywhere.<\/p>\n\n
About the third-party domain names found in the source code:<\/strong> the plugin ships a static, local catalog of well-known tracking\/embed services (Google Tag Manager, Meta Pixel, Stripe, RD Station\/CloudFront, etc.). These domain strings are reference data only, used to (a) describe \u2014 in the generated cookie policy \u2014 services the site owner already uses, and (b) match script\/iframe patterns for consent-based blocking. Privatto never makes any request to those domains and never loads any remote file from them.<\/p>\n\nNote: the plugin also ships a static reference catalog (service name, vendor and known script\/domain signatures) used only to help the document generator recognize and describe third-party services that your own site may already be using<\/em> (e.g. Google Analytics, Meta Pixel, Stripe) when writing your cookie policy. This catalog makes no outbound request to those services \u2014 it is a local, offline pattern check against your own site's HTML.<\/p>\n\n\n\n- Upload the plugin under Plugins \u2192 Add New \u2192 Upload Plugin, or copy the
privatto<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n- Activate the plugin. The consent table and default options are created on activation.<\/li>\n
- Follow the setup wizard, then fine-tune under Privatto \u2192 Settings<\/strong>.<\/li>\n
- Generate your legal documents under Privatto \u2192 LGPD Documents<\/strong>.<\/li>\n<\/ol>\n\n\n
\nDoes the plugin rely on any external service?<\/h3><\/dt>\nNo. The banner, blocking, consent records and document generation all run entirely on your own site. Privatto does not make any calls to external services.<\/p><\/dd>\n
How does tag blocking work?<\/h3><\/dt>\nThe plugin captures the full page output on template_redirect<\/code>, injects Google Consent Mode v2 (everything denied) right after <head><\/code>, and rewrites any <script><\/code> whose src<\/code> or content matches the configured patterns. When the visitor consents, the allowed scripts are restored and executed.<\/p><\/dd>\nWhere is the proof of consent stored?<\/h3><\/dt>\nIn a dedicated table (wp_pvto_consents<\/code>). Each decision records a UUID, action, categories, policy version, irreversible IP hash (optional), country, user agent, URL and UTC timestamp. You can view it under Privatto \u2192 Logs<\/strong> and export it to CSV.<\/p><\/dd>\nIs data removal on uninstall optional?<\/h3><\/dt>\nYes. By default, uninstalling preserves the consent tables (they are your audit evidence) and removes only the settings. To delete everything, define PVTO_DELETE_DATA<\/code> as true<\/code> in wp-config.php<\/code> before removing the plugin.<\/p><\/dd>\n\n<\/dl>\n\n\n2.0.0<\/h4>\n\n\n- New: functionality\/plugin discovery. Privatto now scans installed plugins (reading only each plugin's own local readme.txt\/header \u2014 no external calls) and surfaces the ones that may require consent, in a new \"Discoveries\" screen for human review. Nothing is applied automatically.<\/li>\n
- New: curated signature base mapping popular plugins (analytics, marketing, functional) to likely cookie categories, with a heuristic fallback for unknown plugins.<\/li>\n
- New: passive script scanner. Third-party script\/iframe domains that actually load on the site are recorded (deduplicated) so you can categorize them.<\/li>\n
- New: approving a discovery adds its signature to automatic blocking and generates a ready-to-use text suggestion for your documents (draft only \u2014 never published automatically).<\/li>\n
- New: dashboard reformulated with a 7\/30\/90-day period selector, KPI variation vs. previous period, and an accept-rate-by-category breakdown.<\/li>\n
- New: Records screen with summary cards, structured action\/country filters, and category badges instead of raw JSON.<\/li>\n
- New: settings for the passive scanner, region behavior and an opt-in \"Powered by Privatto\" seal.<\/li>\n
- New: \"Pending suggestions\" tab in Documents \u2014 approved discoveries generate ready-to-use, editable text you add to a Cookie Declaration draft (never auto-published).<\/li>\n
- New: [privatto_declaracao_cookies] shortcode renders a public list of the services\/cookies used, built from the approved draft items.<\/li>\n
- New: WP Consent API interoperability. When the WP Consent API is active, Privatto additively announces the visitor's choice (mapping its categories to functional\/statistics\/marketing\/preferences) so compatible plugins can read the consent state. Privatto's own blocking is unchanged.<\/li>\n
- New: multilingual banner. Add per-locale translations of the banner texts and button labels under Settings \u2192 Languages; the correct language is picked automatically from the visitor's locale, falling back to the base language and then to the default texts. English and Spanish ship with ready-to-use suggested translations.<\/li>\n
- New: optional \"Powered by Privatto\" seal on the banner (off by default; enable under Settings \u2192 Compliance).<\/li>\n
- New: lightweight geolocation (region behavior). Reads the visitor country only from headers your infrastructure already provides (Cloudflare, CloudFront, GeoIP) \u2014 no bundled IP database, no external call. Modes: always strict (opt-in for everyone), adaptive (opt-in for BR\/EU, configurable elsewhere) or manual. Falls back to strict when geo is unavailable.<\/li>\n
- New: confidence levels for discoveries with a certainty-based palette (high=green, medium=blue, low=gray) plus a legend, and a configurable threshold that decides which levels generate automatic document suggestions (default: high only).<\/li>\n
- Removed: optional Groq AI text refinement. Document generation is now 100% local, with no external calls at all.<\/li>\n
- Note: Privatto remains free and fully self-contained \u2014 no telemetry and no remote signature service are used.<\/li>\n<\/ul>\n\n
1.4.0<\/h4>\n\n\n- Security hardening: prepared statements with the
%i<\/code> identifier placeholder, input unslashing\/sanitization, output escaping.<\/li>\n- Internationalization: translator comments and ordered placeholders.<\/li>\n
- Readme rewritten to follow WordPress.org standards.<\/li>\n<\/ul>","raw_excerpt":"Self-hosted LGPD\/GDPR consent: cookie banner, real third-party script blocking, Consent Mode v2 and consent receipts in your own database.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/335220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=335220"}],"author":[{"embeddable":true,"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sergioinglez"}],"wp:attachment":[{"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=335220"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=335220"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=335220"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=335220"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=335220"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/so.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=335220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}