Avacy CMP connects your WordPress site to Avacy, a Consent Management Platform (CMP). You need an Avacy account: the plugin does not work on its own.

The plugin does four things.

Cookie banner. It shows the Avacy cookie banner on your site. The banner version (v2 or v3) is the one set on your webspace in Avacy: the plugin always loads the same address, and the Avacy CDN serves the right version. The banner is designed and published in Avacy, not in WordPress.

Preemptive block. It can block the scripts of your vendors until the visitor gives consent. The rules come from the vendor list you manage in Avacy. The plugin keeps a local copy of that list, refreshed every 2 hours. You can also refresh it with a button in the settings page. A script that matches a vendor (by its src or by its inline code) is held back, and it runs only after the visitor consents to that vendor and its purposes.

Consent archive for forms. It can send to the Avacy consent archive the consents given through your forms. For each form you choose, in the settings page:

the “Send to Consent Archive” switch, which turns the sending on or off for that form;
the field that identifies the user;
the fields to send;
which checkbox of the form gives each consent (for example newsletter or marketing).

Supported forms: Contact Form 7, WPForms, Elementor Forms (Elementor Pro), HTML Forms, Avada Forms (Avada Builder) and the WooCommerce checkout. To use the archive you need an Access Key, which you create in the consent archive section of Avacy.

WP Consent API. When the WP Consent API plugin is active, Avacy registers itself as a compliant CMP, sets the optin consent type, and passes the banner choices to wp_set_consent. Google Consent Mode flags are mapped to WP Consent API categories like this:

functional: always allowed;
preferences: personalization_storage;
statistics and statistics-anonymous: analytics_storage;
marketing: any of ad_storage, ad_user_data, ad_personalization.

The integration does nothing when WP Consent API is not installed.

External services

This plugin connects to two services run by Avacy (Jump Group). Both are needed for the plugin to work.

Avacy CDN

Address: https://{team}.avacy-cdn.com, where {team} is your Avacy team name. The domain can be changed by Avacy, which communicates it to the plugin.

Banner. When the banner is shown, the browser of each visitor loads the banner script and its settings and texts from the CDN. The visitor’s browser sends its normal request data (for example the IP address) to the CDN.
Vendor list. When the preemptive block is on, your site downloads the list of vendors to block from the CDN. The request carries your team name and webspace key in the address. It happens about every 2 hours, when you press the refresh button, when you change the webspace key, and when you save the settings for the first time with the block on. No visitor data is sent.

Avacy API

Address: https://api.avacy.eu.

Settings. When an administrator opens or saves the Avacy settings page, the plugin sends your team name and webspace key to check them. If an Access Key is set, it sends the Access Key too. The answer tells the plugin which banner version and which CDN domain to use. When the preemptive block is on, your site also sends your team name and webspace key about every 2 hours, together with the vendor list update, to read the banner version. No visitor data is sent.
Form consents. When a visitor submits a form whose “Send to Consent Archive” switch is on, and an Access Key is set, the plugin sends to Avacy: the visitor’s IP address, the consent type, whether consent was given, the values of the fields you selected, the identifier field you chose, the consents given (for example privacy policy, cookie policy, newsletter), the source (“plugin”) and the HTML of the form as proof. The Access Key is sent as authorization.
Banner consents. If the consent archive is on for your webspace in Avacy, the banner sends each choice of a visitor to the archive: the choice made and, after the first one, the id of the previous record. The request comes from the visitor’s browser, so it also carries the visitor’s IP address. Nothing is sent when the archive is off.

Avacy terms of use: https://avacysolution.com/termini-e-condizioni/
Avacy privacy policy: https://api.avacy.eu/jumpgroup/privacypolicy/14/en