Izini Consent Banner Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Izini is a data protection compliance service for Nigerian organisations. This plugin connects your WordPress site to your Izini project:
- the Izini consent banner on every public page, loaded first, with Google Consent Mode defaults set to “denied” until the visitor chooses;
- scripts you choose (from your theme, plugins or pasted snippets such as a Facebook Pixel or Google tag) held back until the visitor accepts their category: scan your home page, pick a category for each script, done (WordPress 6.9 or later);
- a “Privacy choices” link (a block, the shortcode
[izini_privacy_choices], or a menu link to#izini-preferences) that reopens the banner’s preferences; - an Izini menu in wp-admin with the connection, links into your Izini dashboard (banner design, cookie scanner, consent statistics, requests from visitors) and the settings;
- if the WP Consent API plugin is active, the visitor’s choice is passed to it, so plugins that read it wait for consent;
- when an Izini admin, owner or Privacy Engineer connects the site: consent totals for the last 30 days (counts only) on the Izini page and the WordPress dashboard, a cookie scan of this site you can start from WordPress, and your scripts and rules on your project’s Cookies page in Izini, with the cookies well-known trackers’ vendors document for them.
The banner’s wording, categories, languages and colours are set in your Izini dashboard, not in WordPress.
You need an Izini account and a project. The plugin’s main setting is the project code, which is public: it appears in your pages’ source anyway. It stores no password. When the site is connected for statistics and scans, it also keeps a site token: a setting that is not loaded on public pages and is only ever sent to Izini, from this site’s server. The token reaches counts and scans of this site, never personal data; requests from people stay in Izini, behind its sign-in.
The banner also holds back scripts it recognises from your project’s cookie categories (set in Izini, Consent › Cookies). Scripts you have not given a category, and that the banner does not recognise, are not held back; Google tags and plugins that read the WP Consent API wait for the choice on their own.
External service
This plugin relies on Izini, a third-party service run by Izini RegTech Ltd (Lagos, Nigeria). Nothing is loaded or sent until a site administrator saves a project code.
- On every public page, the visitor’s browser loads the banner from https://cdn.izini.ng and fetches the project’s banner settings from it. Like any web request, this reveals the visitor’s IP address to Izini; it is used to limit abuse and is kept only in hashed form for that.
- When the visitor makes or changes a choice, Izini records: a random ID the banner keeps in the visitor’s browser (the
izini_user_idcookie and local storage), the choices, the time, the language, the browser family and operating system, and the country and region worked out from the connection. No name or email address. - From the banner’s preferences, a visitor can download the consent choices recorded for their browser, or delete them.
- At most once a day per browser, the banner sends Izini the names (never the contents) of cookies on your site that your project’s cookie list does not have yet, so you can review them in Izini. Nothing about the visitor is sent with them.
- When an administrator presses “Connect with Izini”, their browser goes to https://app.izini.ng with this site’s address, a one-time code the plugin keeps for 20 minutes and a check value (the SHA-256 of a secret this site keeps). They sign in to Izini, choose a project, and come back with that project’s public code. If they are an Izini admin, owner or Privacy Engineer, a one-time grant comes back too, and this site’s server exchanges it with the secret at https://app.izini.ng/api/v1/site/token for the site token. No password reaches this site.
- With a site token, this site’s server calls https://app.izini.ng/api/v1/site/ with it: for the project’s consent totals and where the banner was last seen (when an administrator opens the Izini page or the WordPress dashboard, at most every ten minutes), for the latest cookie scan (on the Izini page), and to start a scan when an administrator presses “Scan this site now” (Izini then visits this site’s home page). A token unused for 90 days stops working.
- With a site token, this site also sends Izini its scripts and rules: the file addresses (host and path, no query string) of the scripts seen on the site or found by “Scan the home page”, the start of any inline script an administrator gave a rule, and the category each waits for. It sends them when a rule changes, after a scan, when the site is connected, and otherwise at most once a day when an administrator opens the Scripts tab. Izini drops anything that looks like a personal detail before storing it.
- When an administrator turns statistics off, connects another project, or deletes the plugin, this site asks Izini to revoke its token.
- When an administrator connects a project, presses “Check the connection” or opens the Scripts tab, this site asks https://cdn.izini.ng for the project’s name and categories.
- “Scan the home page” reads this site’s own home page; nothing is sent to Izini.
Izini Terms: https://app.izini.ng/legal/terms
Izini privacy policy: https://www.izini.ng/privacy
Screenshots
No screenshots provided
