Pantry Consent

A cookie banner with categories that holds tags until consent.

A plain bar at the bottom of the page with three buttons and a checkbox for each category you offer. Scripts you mark stay inert until the visitor allows their category. Google Consent Mode is updated when a tag that reads it is on the page, and everything else hears about the choice through one DOM event. The answer goes in a first-party cookie for six months. Nothing is logged, nothing is sent anywhere, and no cookie is written before the visitor chooses.

Using it

1. Activate the plugin. Plugin Pantry > Consent appears.
2. Set the wording, pick the categories you actually use and choose the colours.
3. Mark the scripts that belong to a category (below).
4. Give visitors a way back: the shortcode [pantry_consent_settings], the Cookie settings link block, or the footer link switch on the settings screen.

Marking a script

Change type="text/javascript" (or no type at all) to type="text/plain" and add the category:

<script type="text/plain" data-pantry-consent="marketing" src="https://example.com/pixel.js"></script>

<script type="text/plain" data-pantry-consent="analytics">
  console.log( 'runs only once analytics is allowed' );
</script>

The browser ignores a text/plain script. When the category is allowed, this plugin copies the tag into a real script element with the same attributes, which runs it, once. An unmarked script is left completely alone: this plugin never guesses.

data-pantry-consent="necessary" always runs.

Google Consent Mode v2

When window.gtag is a function at the moment of the choice, the plugin calls:

gtag( 'consent', 'update', {
  analytics_storage:  'granted',   // analytics
  ad_storage:         'granted',   // marketing
  ad_user_data:       'granted',   // marketing
  ad_personalization: 'granted'    // marketing
} );

Pantry Analytics prints the denied defaults and listens for the event below, so the two work together with nothing to configure. The plugin does not load gtag.js and does not create dataLayer.

The event

On every page load, and again on every change, the plugin dispatches pantry-consent on document:

document.addEventListener( 'pantry-consent', function ( event ) {
  if ( event.detail.categories.marketing ) {
    // start the thing that needs marketing consent
  }
  // event.detail.gtag is the map shown above, values 'granted' or 'denied'
} );

event.detail.categories always has all four keys: necessary (always true), analytics, marketing and preferences. A category you switched off on the settings screen is always false: the visitor was never asked, so it is never granted.

Add the listener in the page head or anywhere before the footer, and it will catch the load-time event.

Settings

Setting	What it does
Headline	The heading in the bar. Also the bar's accessible name. Leave empty for no heading.
Message	The sentence under it. Leave empty for no sentence.
Privacy page	The link in the bar. Empty uses the privacy policy page from Settings > Privacy. With neither, no link is shown.
Privacy link wording	The text of that link.
Categories offered	Which of analytics, marketing and preferences the visitor is asked about. Changing this asks everyone again.
Analytics / Marketing / Preferences wording	The label beside each checkbox.
Accept button	Wording for the accept-everything button.
Reject button	Wording for the button that grants nothing.
Save button	Wording for the button that stores the checkboxes. Not shown when no category is offered.
Bar background, Bar text	Colours of the bar.
Accept button background, Accept button text	Colours of the one solid button.
Footer link	Print the Cookie settings link at the end of every page.
Link wording	Wording of that link, the shortcode and the block.

The shortcode and the block both take a wording of their own: [pantry_consent_settings label="Cookies"].

The cookie

One cookie, pantry_consent, first party, path /, SameSite=Lax, Secure over https, 180 days:

{"v":1,"necessary":true,"analytics":true,"marketing":false,"preferences":false}

v is the consent version. It goes up by one whenever you change the list of categories offered, because the old answer no longer answers the question being asked. A cookie stamped with an older version grants nothing and the bar comes back, with the old answers filled in.

The bar markup is only printed when there is a question to ask, or when a Cookie settings link is on the page, in which case it is printed with hidden and the link reveals it. Page caches that vary on cookies handle this correctly; a cache that does not will serve the bar to everyone, and the script hides it for anyone who has already answered.

Filters

pantry_consent_categories

The categories offered, after the setting. Only analytics, marketing and preferences are understood.

add_filter(
	'pantry_consent_categories',
	function ( array $categories ): array {
		return array_values( array_diff( $categories, array( 'preferences' ) ) );
	}
);

pantry_consent_show_bar

Whether the bar markup is printed on this request. Passed the decision and the Bar object.

add_filter(
	'pantry_consent_show_bar',
	function ( bool $show ): bool {
		return is_page( 'landing' ) ? false : $show;
	}
);

pantry_consent_config

The configuration handed to the script: cookie, days, version and categories. Raising version yourself asks every visitor again.

add_filter(
	'pantry_consent_config',
	function ( array $config ): array {
		$config['days'] = 90;
		return $config;
	}
);

What it does not do

No consent log and no proof of consent. No region or country detection. No cookie scanner. No blocking of scripts you have not marked. No texts in more than one language. Those are on the plugin page as a promise, not an apology.

Accessibility

The bar is a region with an accessible name. The three buttons are real buttons and the categories are real checkboxes with labels, so Tab reaches everything and Space or Enter works. It is not a modal: it never traps focus, it never covers the page, and Escape does nothing. The Cookie settings link is a button, because it acts on the page rather than going anywhere.