Terms & Conditions Consent Log

Yes. Activate it on any WordPress site and the Records, Settings, CSV export, PDF certificate and Privacy Tools integration all work the same way. The WooCommerce-specific bits (checkout capture, order metabox, order list column, order email line) only load when WooCommerce is active.

Open Consent log > Settings > Integrations and tick "Log every CF7 form submission that ticks an [acceptance] field". Then make sure your CF7 forms include an [acceptance] field, e.g.: [acceptance privacy] I have read and agree to the privacy policy. [/acceptance] The plugin uses the form ID as part of the consent_type (cf7_form_{ID}), so each form is filterable separately. The first email field of the form is used as the subject email. No snippets, no functions.php edits.

Open Consent log > Settings > Integrations and tick "Log every WPForms submission that ticks a GDPR Agreement field". Then add a GDPR Agreement field to your form from the WPForms builder (Fancy Fields → GDPR Agreement) and edit its label to the exact wording you want recorded (e.g. "I have read and agree to the privacy policy."). The plugin uses the form ID as part of the consent_type (wpforms_form_{ID}), so each form is filterable separately. The first email field of the form is used as the subject email, and the GDPR Agreement field label is what gets stored as the accepted text. Works with WPForms Lite and Pro. No snippets, no functions.php edits.

It renders a self-contained consent checkbox + submit button, with optional email field for visitors who are not logged in. Submission posts to a REST endpoint that records the consent through tccl_save_consent(). Drop it in any page, post or widget area as a stand-alone block, e.g.: [tccl_consent_box text="I have read and agree to the privacy policy." consent_type="newsletter_signup"] The same functionality is also available as a Gutenberg block called "Consent box". Important: the shortcode renders its own <form> with a submit button, so it should NOT be nested inside another form builder's form (Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Elementor Forms, etc.). If you embed it inside another form you will end up with two submit buttons and conflicting submit flows. For form builders, use the dedicated integration (Contact Form 7 and WPForms are built in; for the rest, hook tccl_save_consent() from the relevant submission action — see the Gravity Forms / Fluent Forms FAQ below). Also: do NOT use this shortcode as a substitute for the cookie checkbox of a cookie/banner plugin (Complianz, CookieYes, Real Cookie Banner, etc.). The legal context is different — cookie banners cover ePrivacy/cookies, this consent log covers GDPR art. 7.1 specific consents to specific personal-data processing. Mixing them yields ambiguous evidence.

The plugin hooks into the standard wp_login event (which covers both wp-login.php and the WooCommerce My Account login) and into the public registration events (register_new_user for the WP form and woocommerce_created_customer for the WC form). For each event, it inspects the submission $_POST for a ticked consent checkbox and, if one is present, writes a record with consent_type set to wp_login, wp_register, wc_login or wc_register accordingly. A few specifics worth knowing: "Remember me" is excluded by design. It is an ePrivacy preference about extending the session cookie, not a GDPR Article 7.1 consent. Logging it would contaminate the audit trail with non-consent events. The exclusion is hard-coded. No checkbox in the form, no record. The plugin does not log "raw logins" — it only writes a row when there is something resembling an explicit consent checkbox to record. A login or registration without a consent field never produces a record. The detector is heuristic. Field names containing consent, gdpr, privacy, terms, acceptance, agreement, accept, rgpd, politica, privacidad or terminos (case-insensitive) are treated as the consent checkbox. If your GDPR / privacy plugin uses a different name, list it in Settings → Integrations → "Custom consent field names" (comma-separated, exact match). The injected checkbox option fills the WooCommerce gap. WooCommerce does not include a consent checkbox in its register form out of the box — only a privacy-policy paragraph. If your site does not run a separate GDPR plugin, enable "Add a required consent checkbox to the WooCommerce registration form" in Settings; the plugin will render the checkbox above the submit button and reject the registration if it is left unticked. The same option exists for the WP register form. Social logins are not captured. Plugins like Nextend Social Login bypass the WP login form entirely (OAuth callback), so there is no submission $_POST for the detector to inspect. Use the public tccl_save_consent() function from the social plugin's own "after login" hook if you need that coverage. The stored consent_text comes from Settings. Paste in "Consent text for login / registration" the exact wording that the visitor sees on the form (whether it comes from your GDPR plugin or from the injected checkbox), so the record reflects what was actually shown. HTML is allowed in that field, so you can include a link to your privacy policy.

Yes, by default. Only comments where the visitor ticks the native "Save my name, email, and website..." checkbox are recorded. You can opt out in Consent log > Settings > Integrations if your site uses Disqus, Jetpack Comments or any other third-party comments system where the native checkbox is not rendered.

Not yet. The classic checkout is fully supported. Block Checkout support is on the roadmap.

In a custom indexed table called wp_tccl_consents (with your site prefix). When WooCommerce is active, each order also gets three meta entries (_tccl_terms_accepted, _tccl_terms_version, _tccl_recorded_at) so the order edit screen can show the summary without querying the table.

Edit the version field in Consent log > Settings, or simply check "Bump version on save". The plugin can also bump it automatically if it detects the checkbox text has changed but the version field has not. Three things to keep in mind: The version string in Settings must match the version label of your terms document character by character (e.g. 1.1-2026-05-17). It is a free-text identifier and the plugin just compares strings, so a trailing space or a different separator will be treated as a different version. Once you bump the version, every record stored under the previous version is automatically flagged as "Outdated" in the records list. This is on purpose — it is the GDPR audit trail showing which exact wording each subject accepted at that moment. "Outdated" is a feature, not a bug. Do NOT delete or "clean up" Outdated records. They are the legal proof of consent for the version that was in force when the subject accepted it. If the user retires the terms and a regulator later asks for evidence, those rows are what you show them.

Use the WordPress native Tools > Erase Personal Data screen. The plugin registers an eraser that anonymises records linked to the requested email (it does not delete them, since the record itself is the lawful basis to keep the proof of consent). You can also anonymise filtered records from the Records tab.