GDPR & CCPA CMP for WordPress is a consent management plugin that adds cookie banners, privacy request forms and data handling tools to a WordPress site. It is sold on CodeCanyon by the developer createit-pl for $24 and covers two separate privacy regimes: the EU General Data Protection Regulation and the California Consumer Privacy Act. It suits site owners who collect visitor data and need a documented, auditable way to ask for permission and act on requests.
The listing has moved 9,319 sales and holds a 4.5 out of 5 rating across 191 reviews, which puts it among the better-established compliance plugins in the CodeCanyon WordPress utilities category. That track record matters here, because a consent plugin is only useful if it keeps working after WordPress, WooCommerce and browser privacy rules change underneath it.
What the plugin actually does
The core of the product is a cookie consent layer. A visitor sees a banner, chooses which categories of cookies to allow, and the plugin blocks the scripts that fall outside that choice until permission is given. A one-click cookie detector scans the site and reports which cookies are in use, which is the part most site owners underestimate: before anything can be blocked or disclosed, someone has to know what is actually being set.
Beyond the banner, the plugin handles the rights that GDPR grants to individuals. There is a form for a visitor to request a copy of the personal data held about them, and a second form to request deletion. Both requests land in the WordPress admin, where they can be reviewed and answered, with custom email notifications attached to each stage. That workflow is what separates a compliance tool from a decorative cookie bar, since a banner alone does nothing to satisfy a subject access request.
Several supporting features round this out:
- Policy consent gating. Terms and Conditions and Privacy Policy pages can be held back until the visitor accepts, so consent is recorded before the documents are acknowledged.
- Service-level consent. Consent checkboxes can be inserted automatically into forms across the site, covering contact forms, newsletter signups and similar collection points.
- Data portability. Stored user data can be exported to JSON or plain text, and the export can be emailed automatically.
- Pseudonymisation and erasure. Identifiable fields can be masked or removed from the admin panel, which supports the privacy-by-design principle of keeping less identifiable data in the first place.
- Breach notification. A global email can be dispatched to affected users if a data breach occurs.
For California, the plugin adds the elements CCPA expects that GDPR does not: a “Do Not Sell My Information” page, an age verification step, and a disclaimer on the account page. The two regimes overlap but are not identical, and the plugin treats them as separate configuration tracks rather than assuming one satisfies the other.
Two operational details stand out. First, a geolocation option allows the consent machinery to be hidden from visitors outside the EU, which avoids showing a cookie banner to traffic that has no legal reason to see one. Second, the banner can be positioned in a top panel rather than as a floating overlay, which is a small thing that matters on sites where a centred modal obscures the content people came for.
Compatibility is broad. The vendor lists WordPress 5.4 through 6.7, WooCommerce 5.x through 9.x, WPML for multilingual sites, and Bootstrap 4 and 5. The plugin is marked as Gutenberg optimised, and source files in JavaScript, CSS and PHP are included, so a developer can extend or restyle it. Fourteen professionally translated language versions ship with it, including German, French, Spanish, Italian, Dutch, Polish and the Scandinavian languages.
Where it fits, and where it does not
This is a sensible purchase for a small or mid-sized business running its own WordPress site and collecting leads, orders or newsletter subscribers from Europe or California. A WooCommerce store is the clearest fit: the combination of cookie blocking, consent checkboxes on checkout, and a data export path covers the practical questions a store actually receives. Agencies maintaining several client sites will also get value from the global on/off switch and the geolocation rule, since both reduce the amount of per-site fiddling.
It is also a reasonable choice for a site that has already been running without any consent layer and needs to reach a defensible position quickly. The admin panel keeps everything in one place, and the request-handling forms mean the site can respond to a deletion demand the same week it is installed.
Where it is the wrong choice: an organisation operating under a sector-specific regime with mandatory breach reporting to a regulator, or one handling health, financial or children’s data at scale, needs legal counsel and often a dedicated enterprise consent platform with server-side logging and a consent receipt standard. A $24 WordPress plugin is not a substitute for that. The same applies to a publisher running dozens of ad-tech vendors through a tag manager, where the consent signal must be passed to each vendor in a format they recognise — a job that typically belongs to a certified consent management platform rather than a WordPress utility.
Strengths and limitations
Strengths
- The request workflow is genuinely two-sided: forms for visitors, a review queue and email notifications for the site owner. Many cheaper plugins stop at the banner.
- Cookie detection is built in, so the inventory step does not require a separate scanning service.
- Broad version support across WordPress and WooCommerce, including older branches that many plugins have dropped.
- Source files are included, which gives developers room to modify behaviour rather than fight it.
- Fourteen shipped translations reduce the cost of running a multilingual site.
- The geolocation switch prevents unnecessary banners for non-EU traffic.
Limitations
- The listing does not state that the plugin provides a TCF-registered consent string or IAB-compatible signal, despite the vendor’s headline referring to a TCF compliance toolkit. Sites monetising through programmatic advertising should confirm this directly with the developer before relying on it.
- There is no mention of a consent log with timestamps and IP records in the supplied data. If an audit trail is required, that gap needs checking.
- Compliance depends on configuration. The plugin supplies the mechanisms; it does not decide which cookies are necessary, how long data is retained, or what the privacy policy must say.
- Support for Internet Explorer 11 is listed, which suggests parts of the codebase carry legacy weight that a modern-only site does not need.
- Older WordPress branches, back to 5.4, are supported, but running a compliance plugin on an outdated core is a contradiction worth avoiding.
How it compares with the wider category
Consent tools for WordPress divide roughly into three groups. The first is free, single-purpose cookie banner plugins that display a notice and little else. They are adequate when the only obligation is to inform visitors, but they do not handle access or deletion requests, which is where most of the legal exposure sits.
The second group is hosted consent management platforms, usually billed monthly and designed for advertising-heavy sites. They excel at passing consent signals to hundreds of vendors and at producing audit logs, but they add a recurring cost and an external dependency, and they generally leave the WordPress side of data requests untouched.
This plugin sits in the third group: self-hosted, one-time purchase, WordPress-native toolkits that try to cover both the banner and the rights workflow. Compared with the free banner plugins it is clearly more complete. Compared with hosted platforms it trades advertising-grade signal handling for a flat fee, no data leaving the site, and tighter integration with WordPress users and WooCommerce orders. For a business whose main concern is a contact form, a store and an analytics tag, that trade is usually the right one.
Frequently Asked Questions
Does this plugin make a WordPress site fully GDPR compliant?
No plugin can make a site fully compliant on its own. This one provides the technical mechanisms — consent collection, cookie blocking, access and deletion request forms, and data export — but compliance also depends on a correct privacy policy, a lawful basis for processing, retention rules and staff training. Treat it as the technical half of the job.
Can it block cookies before a visitor gives consent?
Yes. The plugin includes a cookie blocker that prevents non-essential scripts from loading until the visitor makes a choice, and a one-click detector to find which cookies the site sets. Blocking before consent is the behaviour European regulators expect, and it is the main practical difference between this and a simple notice bar.
Does it work with WooCommerce and WPML?
The vendor lists WooCommerce 5.x through 9.x and WPML as compatible, alongside WordPress 5.4 to 6.7 and Bootstrap 4 and 5. WooCommerce compatibility matters because checkout collects personal data, and WPML matters because consent text must appear in the visitor’s language. The plugin ships fourteen translated language versions.
Is there a recurring fee or a hosted component?
The plugin is a one-time $24 purchase on CodeCanyon with no subscription stated in the listing. It runs inside the WordPress installation, so visitor consent data stays on the site rather than passing through a third-party consent platform. Buyers should check the vendor’s current support and update terms on the item page before purchasing.
Verdict
Buy this if the site runs on WordPress, collects personal data from European or Californian visitors, and needs a practical consent layer plus a way to answer access and deletion requests without paying a monthly platform fee. The 9,319 sales and 4.5 rating suggest the developer has kept it in reasonable shape across a wide range of WordPress and WooCommerce versions. Do not buy it expecting the plugin to interpret the law, produce a certified advertising consent signal, or replace legal advice. Sites in regulated sectors, or those monetising heavily through programmatic ads, should look at a dedicated consent management platform first and treat this as a complementary tool at best.
