=== DSGN Lightweight Cookie Consent ===
Contributors: dsgncc
Tags: cookies, consent, gdpr, privacy, consent-mode
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lightweight cookie consent with Google Consent Mode v2 and a GDPR consent log. Self-hosted, no phone-home, no pasted scripts.

== Description ==

A small, honest cookie consent banner. It asks for consent properly, tells your Google tags about it through Consent Mode v2, and keeps a record so you can demonstrate the consent you collected.

It is **self-hosted**: no external requests, no phone-home, no account, no per-site licence. Everything runs on your own server and in the visitor's browser. The banner is rendered inside a **Shadow DOM**, so your theme's CSS cannot reach it — it looks the same on every theme.

= It will not let you paste scripts, and that is deliberate =

Most consent plugins give you a textarea and invite you to paste in tracking code. That turns the plugin into a channel for running arbitrary JavaScript on every page of your site, and it is how well-meaning site owners end up pasting something they did not write and do not understand. We do not do that. There are exactly two ways a tag gets gated here, and neither involves this plugin holding your code:

1. **By ID.** Enter a Google tag ID (G-…, GT-…, AW-…), a Google Tag Manager ID (GTM-…) or a Meta Pixel ID. The plugin checks the ID against a strict pattern, discards anything that is not a well-formed ID, and composes the vendor's official snippet itself.
2. **By attribute.** For anything else, leave the code where it already lives — your theme, or the plugin that owns it — and mark it up so this plugin knows when it may run:

`<script type="text/plain" data-dcc-consent="marketing" src="..."></script>`

The script stays inert until the visitor consents to that category, then runs untouched. Your code never passes through this plugin, and this plugin never stores it.

= What it does =

* A consent banner with **equal-prominence** Accept, Reject and Customise actions — the balance regulators expect.
* Three categories named after their purpose (necessary, statistics, marketing). Necessary is always on and cannot be switched off.
* **Google Consent Mode v2**, default-denied, injected before your Google tags.
* **A consent log**: one record per consent action — proof of consent under Article 7(1) GDPR — with CSV export and automatic retention. The visitor's IP address is never stored in clear; it is hashed one-way with a salt unique to your site.
* A first-party consent cookie with a configurable **policy version** — change it to ask everyone again.
* A persistent floating control to reopen the banner and change or withdraw consent at any time.
* Full-width bottom bar, configurable accent colour, translation-ready.

= Honest by design =

This plugin does not fake compliance, and no plugin can grant it. Consent for cookies comes from the ePrivacy Directive (in Italy, art. 122 of the Codice Privacy and the Garante's 2021 cookie guidelines); the GDPR is what defines valid consent and requires you to be able to demonstrate it. This plugin gives you the mechanisms — prior blocking, Consent Mode signalling, granular categories, a consent record. The wording, the Cookie Policy and the legal assessment remain yours.

Built by [DSGN](https://dsgngroup.it), a digital studio.

== Installation ==

1. Install and activate the plugin.
2. Go to **Settings → Cookie Consent** and set your texts, accent colour and Cookie Policy URL.
3. Enter the IDs of the tags you use (Google tag, GTM, Meta Pixel).
4. For any other tag, mark it up with `type="text/plain" data-dcc-consent="…"` where it currently lives. **Settings → Cookie Consent → Blocking your own tags** walks through it, with before/after examples and how to verify it in the Network tab.
5. Save. The banner appears on your site's front end.

== Frequently Asked Questions ==

= Can I paste my Google Analytics snippet into the plugin? =

No, and that is on purpose — see the Description. Enter the ID instead and the plugin will build the official tag for you. For anything without an ID field, use the `data-dcc-consent` attribute on the tag where it already lives.

= What is Google Consent Mode v2? =

It is Google's mechanism for telling Google tags whether they may use cookies. This plugin sets every signal to denied by default, before any Google tag loads, and flips the relevant signals to granted when the visitor consents.

= When exactly do the Google tags load? =

By default, only after consent: nothing contacts Google before the visitor has agreed, which is the safer reading of the ePrivacy rules. There is an option to load them immediately instead, kept cookieless by Consent Mode, which preserves Google's conversion modelling. Off by default; it is your decision to make.

= Does it send data anywhere? =

No. There are no external requests of its own and no phone-home. Consent is stored in a first-party cookie on your own domain, and the consent log lives in your own database.

= What does the consent log store, exactly? =

A random consent ID, the timestamp, the policy version, the choices made, which button was used, the page URL, and a one-way hash of the IP address. The IP is never stored in clear. Records are deleted automatically after the retention period you set (365 days by default), and you can export or empty the log at any time.

= Why doesn't the log endpoint use a nonce? =

Because visitors are anonymous and the banner is served from full-page caches, where a nonce would be baked in for everyone and then expire, silently breaking the log. The endpoint validates the payload strictly instead — only known categories, boolean values — and rate-limits writes per hashed IP.

= Will it clash with my theme? =

No. The banner is rendered inside a Shadow DOM, so theme CSS cannot reach it, not even rules marked !important. The mount point that does live in the theme's DOM is locked down separately.

= Does installing this make my site compliant? =

No plugin can promise that. Compliance depends on your Cookie Policy, the tags you actually load and how you configure them. This plugin gives you the technical building blocks.

== Screenshots ==

1. The consent banner: Accept, Reject and Customise, with equal prominence.
2. Granular preferences, with categories named after their purpose.
3. The floating control to reopen, change or withdraw consent at any time.

== Changelog ==

= 1.0.0 =
* Initial release: consent banner with equal-prominence actions, Google Consent Mode v2, tag gating by validated ID or by the data-dcc-consent attribute, consent log with CSV export and automatic retention, Shadow DOM isolation, first-party cookie with policy versioning.
