More privacy laws, ready to add in a click.

Hey everyone 👋

Geographic Rules now cover many more privacy laws. This release also fixes a few cases where visitors were handled the wrong way. Let’s get into it.

What’s new

More privacy laws in Geographic Rules
Use the Add Regional Rule picker to choose a law, and its countries and consent style are already filled in. New templates include POPIA, PIPEDA, PDPA, Privacy Act, APPI, PIPA, PIPL, DPDP, and others. You can still create your own custom rule.

Fixed

• With the banner set to show only where the law requires, visitors outside all your rules could be treated as saying no when the WP Consent API plugin was active. Analytics and marketing tools stopped working for them. They are now treated as not needing consent, and cached pages are no longer shared between regions with different rules.
• Visitors whose browser tells sites not to track them could still get trackers before consent if they had accepted earlier or were in an opt-out region. They are now blocked.
• An Always Allowed rule for a known service now covers every part of that service, such as both the reCAPTCHA script and its check frame, so forms keep working before consent.
• The Data Request form title and intro couldn’t be translated on WPML and Polylang sites. They now appear under the SureCookie group.

We think you’ll like this one. Update when you’re ready. We also recommend keeping SureCookie and SureCookie Pro updated together.

As always, support is one click away if anything feels off.

Tighter blocking with speed plugins, and fair credit for SureCart affiliates.

Hey everyone 👋

This release mostly closes gaps where speed and caching plugins could let trackers run before a visitor said yes. It also makes sure your SureCart affiliates get credit when visitors do say yes. Let’s get into it.

Better than before

• SureCart affiliates are now credited even when visitors browse a few pages before accepting cookies. The affiliate code is kept on your links until tracking is allowed, and nothing is stored on the visitor’s device. Visitors who say no are still not credited.

Fixed

• On sites using WP Rocket or Autoptimize, trackers served from your own site could run before consent.
• With WP Rocket’s Minify JavaScript on, trackers like Plausible, Fathom, Simple Analytics and Cloudflare Web Analytics were copied to your site and ran before a visitor chose. They now stay at their original address and wait.
• With W3 Total Cache Minify on, blocked scripts could be combined with others and run before consent.
• Visitors whose browser tells sites not to track them could still get extra scripts. They now get only essential cookies and scripts.
• SureCart affiliate tracking could run, and set cookies, after a visitor said no. It now waits for Marketing consent and shows in your cookie policy.
• Saying no or withdrawing consent didn’t remove every cookie in that category. It now removes scanned and manually added ones, and keeps essential and allowed cookies.
• Pages visited during a scan could be saved by your cache with trackers unblocked.
• Some scripts from known services could load before consent unless they were listed one by one. Blocking now covers the whole service, and you can still allow exceptions.
• With delayed JavaScript on, blocking one tracker could stop other scripts from running.
• The cookie banner could lose its styling or show behind content with some optimization settings.
• Some scanned cookies showed “null” as the provider. Existing ones are fixed automatically.
• Duplicate cookies could appear in your cookie policy. They are now merged into one entry in your own wording.
• Dutch and some other translations had errors, including table labels and scan timers.

Before you update

After updating, clear your site cache once so visitors get the corrected pages. This matters most if you use W3 Total Cache or any page caching.

We recommend updating soon, especially if you use WP Rocket, Autoptimize or W3 Total Cache.

As always, support is one click away if anything feels off.

Custom buttons for every region, and cached pages that stay correct.

Hey everyone 👋

Pro can now change your banner buttons by region, not just the message. This release also fixes a few cases where visitors could see the wrong region’s banner. Let’s get into it.

What’s new

Different buttons for each region
Say visitors in the EU need different choices than visitors in the US. In each Geographic Rule, under Custom Configuration, you can now reorder the buttons, hide them, and rename them, just like in Banner > Content. These settings only apply when Custom Configuration is turned on for that rule. Buttons the law requires always stay visible.

Fixed

• Visitors could see the banner meant for another country when your site used a caching plugin. Each visitor now gets the banner for their own region.
• Some scripts from your own site could start before consent, even though your rules said to block them. This happened when Automatic Scanning and Compliance Guard were on. Your rules are now followed.
• Turning off Accept All and then reordering buttons could remove Accept All from that rule for good. You can now bring it back with the eye icon in that rule.
• Visitors could see another region’s button text when their own region had none.
• Button text with apostrophes or “&” showed up as strange symbols.
• The Geographic Rules page title changed after the page loaded.

Before you update

This release needs SureCookie 1.6.0 or later. Please update both plugins together.

If you use Compliance Guard, open a few key pages after updating to make sure everything still works. Scripts from your own site that your rules block may now be held back where they loaded before.

Update when you’re ready, especially if you use Geographic Rules with a caching plugin.

As always, support is one click away if anything feels off.

Your banner buttons, your way, and PixelYourSite finally waits for consent.

Hey everyone 👋

This release gives you full control over your banner buttons, adds consent support for PixelYourSite, and closes several gaps where trackers could run before a visitor said yes. Let’s get into it.

What’s new

This release lets you change your banner buttons, adds support for PixelYourSite, and fixes several cases where tracking could start before a visitor said yes. Let’s get into it.

What’s new

Change your banner buttons in one place
Go to Banner > Content to reorder the buttons, hide the ones you don’t need, and write your own button text. The buttons for managing preferences and saying no always stay visible, so visitors can always opt out.

PixelYourSite now waits for consent
Its tracking stays off until the visitor says yes. Once they do, it starts right away on the same page.

See new versions on your dashboard
Your dashboard now tells you when a new version of SureCookie or SureCookie Pro is ready, with a link to update.

Choose who can manage SureCookie
Agencies can now limit who is allowed to change SureCookie settings on a site. Nothing changes unless you set it up. Your developer can do this for you.

Better than before

The default banner message is shorter. It fits phone screens better and helps your page speed score reflect your content instead of the banner. If you write your own message, nothing changes.

Fixed

• Visitors who had turned on a privacy setting in their browser to opt out of tracking could still be counted as saying yes. Their choice is now respected.
• Asking visitors for consent again didn’t fully clear their old choices. It now does, so nothing tracks them until they choose again.
• Google’s reCAPTCHA and Google Fonts could load before a visitor said yes. They now wait.
• Pages saved by caching plugins could sometimes apply the wrong Google privacy settings to visitors.
• HubSpot tracking wasn’t blocked for portals hosted in the EU.
• Microsoft Clarity wasn’t told when a visitor said yes, so it didn’t work properly.
• Rules for EU and EEA visitors didn’t apply in every country they cover.
• Scripts that rely on each other could start in the wrong order after consent, which could break features.
• Your cookie policy listed services your site doesn’t use.
• The banner could break on sites using W3 Total Cache.
• Screen readers didn’t always read out the button names correctly.

Before you update

If you use Google Consent Mode and have Google’s “I’m not a robot” check (reCAPTCHA) on login or checkout forms, test those forms once after updating. reCAPTCHA now waits until the visitor says yes, so the form may not work until they accept. You can allow it manually if you need to.

As always, support is one click away if anything feels off.

Know what Compliance Guard is holding

Hey everyone 👋

Compliance Guard now makes its decisions clearer. This release also fixes cases where Google services and their consent placeholders showed different states, and where an active license received free scan limits.

Fixed

• Held resources are clearly marked. Scripts and Embeds now shows “Held for review” and explains that visitor consent alone will not release the resource. The scan email and an admin notice also identify held items.
• Google services and placeholders agree. A service no longer loads while its consent placeholder remains visible. This issue could affect reCAPTCHA on login and checkout forms.
• Cookieless analytics no longer wait for administrator review. Services identified as setting no cookies, including Fathom Analytics and Plausible, still follow their consent category.

Before you update

Update SureCookie Core to 1.5.1 or later alongside Pro. The cookieless analytics fix depends on Core’s updated service catalog.

An existing Always allowed rule that names a held resource’s exact address can now release it. Broader keyword and parent-address rules do not. After updating, check Scripts and Embeds → Blocked Until Reviewed to confirm that any newly loading resource is one you intended to allow.

Clearer scans and more dependable consent controls

Hey everyone 👋

A low cookie count does not always tell the full story of a scan. This release makes the results easier to understand and fixes several issues with the consent experience.

What’s new

More ways to translate SureCookie
Developers can now use the “surecookie_translate_string" filter to translate SureCookie text with plugins other than WPML and Polylang. The filter also supports text containing links and other formatting.

Better than before

• Scans show which services SureCookie recognized. You can see service names alongside the cookie count, including when a service sets cookies only after consent.
• Site Health checks visitor identification. If SureCookie sees your CDN or proxy instead of your visitors, it now explains the problem and what to check.
• Cookieless services are identified accurately. The service catalog now records that tools such as Fathom Analytics and Plausible set no cookies. With SureCookie Pro 1.3.1, Compliance Guard no longer holds them for administrator review. They still follow their consent category.

Fixed

• Translated preferences and blocked-content messages retain their links, bold text, and paragraphs on WPML and Polylang sites.
• You can remove cookies declared by a service you no longer use from your cookie policy. If that service is still active, SureCookie can detect it again.
• YouTube and Vimeo embeds appear correctly in Known Services.
• Consent prompts for blocked videos and maps fill the space reserved for the embed.
• Preferences buttons wrap on small screens, so the confirmation button stays visible.
• The scanner connects on sites that keep WordPress in a separate folder, including Bedrock setups.
• Google Analytics 4’s cookie purpose appears in the cookie policy.
• A saved width of zero no longer collapses the floating banner.

Before you update

If you have an Always allowed rule naming an exact resource held by Compliance Guard, that resource may start loading after the update. Check Scripts and Embeds → Blocked Until Reviewed to confirm the rule still reflects your intent.

Thanks, see you in the next update!

A focused release. No new features, but a few fixes that genuinely matter.

Hey everyone 👋

This release is all fixes, but a few of them are important. If you use Geographic Rules, Data Requests, or Always Allowed, read on. Let’s get into it.

Better than before

• The Banner Visibility screen is clearer now: It explains that excluding a role only hides the banner, it doesn’t stop script blocking on its own.

Fixed

• Geographic Rules for individual states now work correctly: Before, setting one state’s banner to hide it across the whole country. Each state now has its own setting.
• Banner decisions for uncovered countries now happen before the page loads, and are cache-safe by country.
• Pro’s text now actually translates: Data request forms, emails, and error messages stayed in English on every non-English site until now.
• Data Requests housekeeping now actually runs: It never ran before, so old requests and export files piled up, and overdue digests were never sent. It runs daily now.
• A consent-reading mismatch could turn off blocking for visitors who’d actually declined: Both systems now read consent the same way.
• Released trackers no longer get stuck.
• “Always Allowed” addresses now match correctly, no matter how they’re written.
• Multisite subsites that opted out of forwarded consent were being ignored.
• Uninstalling Pro now removes everything it created.

Update when you get a chance.

As always, support is one click away if anything feels off.

A new Compliance hub, a privacy policy generator, and fixes worth reading closely.

Hey everyone 👋

This is a big one. We’ve built a proper home for your compliance tools, added a privacy policy generator, and fixed a long list of real bugs, some of which affected whether your site was actually protected. One fix needs a quick check from you after updating, we’ve flagged it clearly below.

What’s new

A new Compliance section: Your legal pages, cookie policy, consent logs, and data requests now live in one place under Compliance.

Generate your privacy policy: Under Compliance > Legal Pages, build a draft privacy policy from your own settings. Nothing publishes automatically, and it stays current as your settings change.

Learn how it works

Business Details, in one place: Store your legal entity name, address, and privacy contact once, then use it across your privacy policy, cookie policy, and shortcodes anywhere on your site.

Learn how it works

Fix or delete cookies the scanner got wrong: Edit a cookie’s purpose, duration, or provider directly, or delete it if it’s no longer relevant. Your changes stick.

Consent records with no IP stored: If you’d rather not store any identifier, records can now skip IP and country entirely. Off by default.

Learn how it works

Target individual US states with Geographic Rules (Pro): Apply a rule to California for CCPA specifically, instead of the whole country.

Action needed after updating

If you’ve ever turned your banner off and back on, check SureCookie > Tracking Manager: A bug meant “Block Scripts Until Consent” could get silently turned off and not restored. This is fixed going forward, but if it happened before, the setting may still be off on your site. Turn it back on if needed.

Fixed

• Geographic rules didn’t work at all behind a CDN or load balancer: Every visitor looked “location unknown,” and the fallback rule applied to everyone.
• The first automatic scan used to block everything at once: Including widgets and payment scripts. It now blocks nothing on the first pass.
• The WP Consent API bridge never worked, on any site: It runs correctly now.
• Google Fonts loaded before consent on every site: Even when blocked, sending a visitor’s IP to Google early.
• “Always Allowed” rules could be too broad: Allowing more than intended.
• Cookie policies no longer list internal name patterns as real cookies.
• Cookie policy details (Purpose, Duration) now show correctly.
• Popular page builders are editable again.

This one’s worth updating soon, especially for the setting check above.

As always, support is one click away if anything feels off.

Hey everyone 👋

SureCookie Pro 1.2.0 adds a full data-request workflow, gives AI assistants more to work with, and makes the Compliance Guard much easier to manage when one tracker needs a closer look. There are also a few thoughtful improvements around scanning, privacy wording, and theme color support.

What’s new

Handle visitor privacy requests from start to finish
There’s a new Data Requests workflow for GDPR and CCPA requests. You can publish the form with the “[ surecookie_data_request ]” shortcode or let SureCookie place it on your privacy policy page, then choose which rights visitors can request, including access, portability, rectification, erasure, objection, restriction, and a free-form other option.

What that means for you:

• Give visitors a clear way to submit privacy requests without building your own process
• Keep everything in one workflow instead of tracking requests manually
• Offer the exact rights your site needs to support

AI assistants can now help with Data Requests and Geographic Rules
With an active license, AI assistants can now work through the data request queue, including spotting requests that are already past their statutory deadline, and manage Geographic Rules as well. Pro settings also describe themselves more clearly and warn when a setting could loosen blocking.

Release one tracker without switching off the whole guard
You can now release a single tracker held by the Compliance Guard instead of turning the whole guard off site-wide. The new Blocked Until Reviewed list shows what’s being held, whether something else would still block it, and lets you release it in one click. SureCookie also remembers those releases and repairs already-stuck entries on the next page load.

SureCookie data now joins WordPress privacy exports and erasure tools
SureCookie’s records now appear in WordPress’s own Tools > Export Personal Data and Erase Personal Data screens. That means requests handled through WordPress core can include the data SureCookie stores too.

Better than before

• Automatic Scanning is easier to review when a scan finds lots of new cookies, with a shorter summary, a separate full-list panel, and Approve All placed up top.
• Long cookie names are now shortened from the middle so both ends stay readable.
• The California privacy template now uses the current “Do Not Sell or Share My Personal Information” wording.
• The California template now better reflects sharing for cross-context behavioral advertising, not just a sale.
• Astra’s global color palette is now available in the custom banner color picker.
• Block theme color palettes are now available in the banner color picker too.

Fixes

• Resources set to Always allowed are no longer released on the server side but blocked again in the browser.
• Domain-based Always allowed entries now match the host correctly, so allowing your own domain won’t accidentally allow a third-party tracker just because it mentions that domain in a query string.

We think you’ll like this one. Update when you’re ready.

As always, support is one click away if anything feels off.