CumpleConsent

CumpleConsent is not a translated European plugin. S. 662), it quotes the law in Chilean Spanish, and it does what that law actually asks of a website.

The plugin screens and the legal texts are in Spanish on purpose: the law, its deadlines and the wording it requires are Chilean. The code is fully translatable (text domain cumpleconsent ), so anyone can ship another language.

What it does

• Privacy notice without dark patterns. Accept, reject and configure carry the same visual weight; nothing is pre-ticked; rejecting takes one click. You can raise the notice version to ask for consent again when purposes change.

• Blocking before consent (art. 14 quáter). Four layers: interoperability with wp_consent_api, rewriting of enqueued scripts, rewriting of the output HTML for raw and inline scripts, and embedded content (videos, maps, social, chats) replaced by a placeholder until accepted. It works with full-page caching: the HTML is served inert and each visitor’s browser re-activates according to their own decision.

• Google Consent Mode v2 with a strict or a balanced strategy (cookieless loading, personalisation on acceptance).

• Proof of consent (art. 12). Every decision is logged with date and time, a pseudonym, the purposes accepted and rejected, a cryptographic fingerprint of the notice that was shown, and an integrity HMAC. No name, no email and no plain IP (only an optional salted hash). Exportable to CSV.

• Privacy policy: generator plus an art. 14 ter checker. Generates a draft covering the twelve mandatory contents (a–l) with the site’s real data, and checks the published policy against them, showing what is missing.

• Data subject rights with a legal clock (art. 11). A public request form that registers the request, computes the 30 calendar days to answer (extendable once by 30 more), the 2 business days for a temporary blocking, stores the full reply as evidence, sends an acknowledgement, and warns when a deadline is near. On refusal it records the ground and the 30-business-day window to complain to the Agency.

• International transfers (art. 14 ter h and art. 27). A table of recipients, country and safeguard, publishable with a shortcode, plus a warning when the diagnostics finds an undeclared third party.

• Record of processing activities, risk matrix and protocols (art. 3 of regulation D.S. 662, letters a, d, e, f and g). Downloads a printable dossier to attach to a compliance programme: characterisation of the operations (eleven items), a matrix graded against the penalties in the law, and the protocols in force.

• Site diagnostics. Which third parties actually load, whether the blocking is working, whether another consent manager is competing, and whether the policy claims something the site does not back up.

• Consent in forms. An unticked checkbox with a declared purpose and traceability of the notice, plus integration with Contact Form 7, WPForms and Gravity Forms.

What it does NOT do (no overpromising)

• It is not a compliance programme and it does not appoint a data protection officer: it provides the website-side documentary elements for letters a), d), e), f) and g) of art. 3 of the regulation.

• It does not certify or replace legal advice. The art. 14 ter checker detects contents that are present or absent; it does not judge legal sufficiency.

• It does not verify visitor age or manage consent for children and adolescents (art. 16 quáter).

• It does not encrypt your database and it is not a security plugin.

The plugin’s own privacy: there is no telemetry, no calls to external servers, and no site data is sent anywhere. Everything is processed inside your own installation.

0-or-later. The complete source is in the package you installed: you can read it, audit it and change it.

External services

This plugin does not connect to any external service and does not send data to any server other than the site’s own:

• No telemetry, no calls to the author’s servers, no licence checks, no updates served from another domain.

• If the site already uses Google Tag Manager, the plugin passes the visitor’s decision to the browser ( gtag('consent','update') ) so that tags respect consent. That happens inside the visitor’s browser and targets the container the site already had installed: the plugin sends nothing to Google on its own.

• The consent log, the policy and the rights requests are stored in the site’s own database.

• The diagnostics —and the verification of the privacy policy when the site keeps its text outside the post content (page builders such as Elementor)— make HTTP requests to the site’s own pages (local loopback requests) to read what the site really serves. Those requests never leave the site’s server.

com, and similar). That list exists to block those scripts before the visitor consents: the plugin never contacts those services and never sends them anything. It is a blocking list, not a connection.

Third-party services the plugin interacts with: none.