Aller au contenu principal
AIFORYA

WordPress GDPR Cookie Consent: Scan, Block, Signed Proof

Scan cookies, block trackers before consent and prove every choice with an HMAC/JWT-signed log. AI writes your banner text and audits it (CNIL criteria).

1. The GDPR Consent Management Platform for WordPress, Augmented by AI

Stop struggling with consent management. Run your WordPress GDPR compliance with a self-hosted Consent Management Platform (CMP) that includes AI features no competitor offers.

AIFORYA GDPR & Consent is a complete CMP for WordPress: customisable banner (3 modes, 5 positions), cookie and third-party script scan, auto-blocking of trackers before consent, and a timestamped and signed consent log (HMAC + W3C JWT receipt, Article 7 GDPR). It adds an AI layer — via your own API key (BYOK) — that classic CMPs lack: generation of banner copy aligned with your brand, acceptance-rate prediction, banner UX audit against CNIL criteria, and categorisation of unknown cookies. You keep full control of your data and your costs.

Sold individually for a one-time payment, unlimited AI usage via your own API key.

2. The Challenge: Complex, Time-Consuming, and Evolving GDPR Compliance

User consent management is a pillar of digital trust. For agencies, freelancers, and site administrators, GDPR compliance is no longer an option, but a legal and technical responsibility that impacts their reputation. The problem is that compliance is not a state, but a continuous and demanding process.

A modern WordPress site is a dynamic ecosystem. Each new plugin, each marketing script, each update can introduce new trackers. Web professionals know this: a complete manual audit can immobilise a technician for half a day, and this work must be redone at the slightest modification. At the same time, the regulatory framework itself is evolving. Directives from authorities like the CNIL are becoming more precise, making static approaches obsolete.

Faced with this challenge, traditional solutions show their limits. Most simply display a banner, shifting the heaviest burden to the administrator: identifying, categorising, and documenting each third-party service. This approach creates a dangerous illusion of security. While the banner is active, undeclared scripts can continue to collect data, exposing the company to penalties of up to 4% of its annual global turnover.

It is no longer enough to display a banner; you need tools to see, understand, and document what is actually happening under the hood. AIFORYA GDPR & Consent gives you those: an on-demand tracker scan, effective auto-blocking before consent, a robust proof log, and an AI layer that writes, predicts, and audits your banner.

3. Key Features

Here is what the extension actually does, verified in the code — no empty promises.

Cookie and Third-Party Script Scan

  • Description: From the admin, you launch a scan that crawls your home page and a set of key pages to detect external scripts and dropped cookies. Each element is classified by a rules engine that recognises common services — Google Analytics, Facebook Pixel, Hotjar… — into four categories (Necessary, Analytical, Marketing, Preferences), then stored in your database with its status.
  • Concrete benefit: Get a map of your site's trackers in minutes, instead of a half-day manual audit. Re-run the scan after adding a plugin to spot new trackers.

AI Categorisation of Unknown Cookies

  • Description: For cookies that no static rule recognises, the AI (Anthropic) suggests a category, a likely provider, a purpose, and a confidence score. The result is cached for 30 days to avoid repeated calls, and a "Categorise now" button processes unknowns in bulk.
  • Concrete benefit: Exotic or homemade trackers no longer stay "unclassified". You get a reasoned suggestion that you validate with one click.
  • BYOK Integration: The analysis runs via your Anthropic API key. AIFORYA adds no per-call surcharge.

AI Banner Copy Generation

  • Description: From your site name, its tagline, and your "About" page, the AI (Anthropic) drafts a title, a description, and the labels of the three buttons (accept / refuse / customise), aligned with your brand's tone. The text is saved and remains editable.
  • Concrete benefit: No more generic banner: you get a clear message consistent with your brand, in one click. This is the consent text displayed to your visitors, not a full legal document.
  • BYOK Integration: Generation relies on your API key, regenerable without volume or frequency limits.

AI Acceptance-Rate Prediction

  • Description: The AI (Anthropic) analyses your consent statistics and your banner copy to estimate a 30-day acceptance rate, with a confidence score, a trend, and an actionable recommendation.
  • Concrete benefit: You know whether a change in wording or design is likely to improve your consent rate, before you even deploy it.
  • BYOK Integration: The prediction runs via your API key, with no AIFORYA surcharge.

AI Banner UX Audit (CNIL Criteria)

  • Description: The AI (Anthropic) evaluates your banner against four criteria inspired by CNIL recommendations (refuse/accept equivalence, WCAG AA readability, absence of jargon, accessibility) and returns a score from 0 to 100, the detected issues, and concrete suggestions.
  • Concrete benefit: An automated compliance-ergonomics audit, where you would normally need an expert's eye. No mainstream CMP offers this.

Customisable Consent Banner

  • Description: Compliant banner without jQuery, in three modes (bar, popup, floating) and five positions. Configurable colours, texts, and corners, a four-category "Customise" panel, plus a floating "My cookie choices" widget letting the user withdraw consent at any time (Article 7).
  • Concrete benefit: Adjust the appearance without writing a line of code, and offer consent withdrawal as easy as granting it — a point the CNIL insists on.

Signed and Verifiable Consent Log

  • Description: Each choice (acceptance, refusal) is recorded with an anonymised identifier (SHA-256 hash of IP and user-agent), the selected categories, an HMAC SHA-256 signature, and a W3C JWT consent receipt. The log is viewable and exportable as CSV.
  • Concrete benefit: In case of an audit, you prove consent with a timestamped cryptographic proof — well beyond a simple text log (Article 7 GDPR).

Auto-Blocking of Third-Party Scripts before Consent

  • Description: Until the visitor consents (or if they refuse), the extension neutralises around twenty known third-party domains (Google Analytics, GTM, Facebook, Hotjar, TikTok, Criteo…) by rewriting their src to data-src, with a MutationObserver that also catches dynamically injected scripts (SPA). Scripts are re-injected upon consent.
  • Concrete benefit: Real technical respect for choices: trackers do not load before authorisation, including those added on the fly by JavaScript.

Portability Export (Art. 20) and Encrypted API Keys

  • Description: A visitor can request the export of their consent data by email (CSV, via Resend with wp_mail fallback). Your API keys are encrypted at rest (AES-256-GCM) and masked on display.
  • Concrete benefit: You answer portability requests without manual handling, and your AI provider credentials stay protected.

4. Concrete Use Cases

AIFORYA GDPR & Consent is designed for professionals who turn constraints into opportunities.

For the WordPress Freelancer

A freelancer manages maintenance for 15 client sites. Previously, GDPR compliance for a new site took 3 to 4 hours. With AIFORYA, he reduces this to less than 30 minutes. During the first scan on a client site, the extension detects a forgotten geolocation script, introduced by an old delivery extension. He categorises it, regenerates his banner copy to match the brand, checks the ergonomics with the AI CNIL audit, and offers a new service: a "Continuous Compliance Pack" billed at €150/year/site. He has turned hours of work into a high-value service, generating recurring revenue.

For the Digital Agency

An agency takes on a complex WooCommerce e-commerce site with over 40 external scripts, including retargeting trackers, A/B tests, and behavioural analysis tools. The AIFORYA scan provides a tracker audit in minutes, revealing all scripts and their categories. The agency uses acceptance-rate prediction and the CNIL UX audit to optimise the banner, and relies on the HMAC/JWT signed log as proof to the client. This tangible audit demonstrates its expertise and justifies a consulting service on streamlining the site's third-party ecosystem.

For the E-commerce Merchant

The owner of an online store installs a new customer feedback tool to improve his conversion funnel. He re-runs a scan from his dashboard: the extension detects the new script (feedback-widget.js, origin plugin "UserVoice") and the AI suggests the "Marketing" category. In three clicks, he approves the categorisation, adds it to the banner, and confirms the auto-blocking neutralises the script before consent. He can thus innovate safely, knowing his new trackers do not load without agreement.

5. Clear and Predictable Pricing

AIFORYA GDPR & Consent is sold on its own, for a one-time payment: no subscription, no automatic renewal, nothing to cancel. You choose between three licences — 1 site, 5 sites or 25 sites — and your purchase includes 12 months of updates. The price of each licence is shown in the purchase box on this page. And if the extension does not suit you, you have a 14-day money-back guarantee: a full refund, simply by writing to support@aiforya.fr. After those 12 months, the extension keeps working, including its AI features with your own key: only the updates stop.

Important note on the BYOK model: Your purchase covers the software licence and 12 months of updates. Your AI calls (Anthropic) are billed separately and directly by the provider, via your own API key. For standard usage, this cost generally ranges between €2 and €8 per month. AIFORYA applies NO margin on your AI consumption, and NO commission on your revenue.

6. Frequently Asked Questions (FAQ)

General AIFORYA Model Questions

1. How do I create my Anthropic (or OpenAI) API key? The process takes less than 5 minutes. Create an account on the provider's platform, add a payment method, then generate a key in the "API Keys" section. Detailed step-by-step guides are available in the AIFORYA documentation.

2. Is there a subscription to cancel? No. The extension is bought once, with no subscription and no automatic renewal: there is nothing to cancel. Your purchase includes 12 months of updates, and you have a 14-day money-back guarantee — a full refund, simply by writing to support@aiforya.fr.

3. How does the BYOK (Bring Your Own Key) model work? You insert your own API key into the extension settings. AI calls are then made directly from your WordPress server to the provider, with your key. This guarantees full cost transparency and better confidentiality.

4. What are the real AI costs? They are very low. Categorising cookies, generating banner copy, or running a prediction are one-off actions costing a few cents. For most users, the monthly bill from the provider ranges between €2 and €8, tracked in real time from your provider's dashboard.

5. Are my data stored by AIFORYA? No. All your data (API keys, configurations, consent logs) stays on your WordPress server. AI requests are not logged by AIFORYA.

6. Is the extension compatible with Elementor / Divi / Breakdance? Yes. The banner and auto-blocking operate at the front-end generated by your site, independently of the theme or page builder you use.

7. Is there a trial period? No. Free extensions are available on the "Free extensions" page, with no credit card required, and this extension comes with a 14-day money-back guarantee: a full refund on simple request to support@aiforya.fr.

8. What happens if an AI provider changes its prices? You pay the provider directly at the public rate. This is a BYOK advantage: if prices drop, you benefit immediately.

9. Can I use the extension on multiple sites? Yes: the extension is available with a 1-site, 5-site or 25-site licence.

10. How can I contact AIFORYA? By writing to support@aiforya.fr — including to request a refund within the 14-day guarantee period.

Specific Questions for the GDPR & Consent Extension

11. Are the AI features actually operational? Yes, and we only announce what is. Four AI features are wired today, all powered by Anthropic via your key: categorisation of unknown cookies, banner copy generation, acceptance-rate prediction, and UX audit against CNIL criteria. The AI does not generate a full legal privacy policy or cookie policy — it drafts your banner copy, not a legal document. For your legal notices and policies, consult legal counsel.

12. How are dynamically loaded scripts (AJAX) handled? The server-side scan fetches your pages and parses script sources and dropped cookies. For scripts injected dynamically after load, the browser-side auto-blocking engine takes over: a MutationObserver continuously watches the DOM and neutralises new third-party trackers until consent is given.

13. Can I fully customise the banner design? Yes. You can change colours, texts, corners, display mode (bar, popup, floating), and position directly from the interface, without code.

14. Does the extension support IAB's TCF 2.2? The extension exposes a minimal __tcfapi interface that lets third-party tools detect a CMP is present. It does not embed the full IAB VendorList (1300+ vendors): full TCF compliance is on our roadmap. We prefer to state this clearly rather than imply it.

15. Does the extension work on a multilingual site (WPML, Polylang)? Yes. You can translate all textual elements of the banner for each language configured on your site.

7. AIFORYA Commitments

Client Sovereignty The BYOK model is a guarantee. You keep full control over your data, your costs, and your choice of AI technology, never locked into a proprietary system.

Radical Transparency No hidden margins, no opaque credit systems, no commission on your sales. We announce what the product does today — not what it might do one day.

Service Continuity AIFORYA is designed to last: it undertakes, should it permanently cease its activity, to publish the source code of its plugins under a free licence (MIT), so that you can keep using your extensions — a commitment written into its Terms of Sale (Article 11).

GDPR Compliance by Architecture Privacy is built into the architecture: anonymised identifiers (SHA-256 hash), signed log, encrypted API keys, data kept on your server. Compliance is a prerequisite, not a checkbox.

Inflexible Quality AIFORYA is committed to clean, high-performance, secure code with regular updates. Some capabilities are on our roadmap — automatic scan scheduling, full IAB VendorList, periodic DPO report — and we announce them as such rather than as already delivered.

8. Ready to Simplify Your Compliance?

Stop wasting time with the complexity of GDPR. Turn this constraint into a clear, tooled process: an on-demand scan, effective auto-blocking, a robust proof log, and an AI layer that writes, predicts, and audits your banner.

AIFORYA GDPR & Consent is bought once, with no subscription, and comes with a 14-day money-back guarantee; free extensions are also available, with no credit card required.