How to Enable GDPR?
- 'Enabling GDPR' documentation with screenshots for UTM Tracking Consent
- 'Enabling GDPR' documentation video tutorial for UTM Tracking Consent
- Publishing your cookie list for US privacy laws (CCPA, CPRA) with screenshots
- Using HandL UTM Grabber as your site's consent tool (WP Consent API)
'Enabling GDPR' documentation with screenshots for UTM Tracking Consent
UTM attribution overview
This guide explains how to collect and respect cookie consent with HandL UTM Grabber, so you stay compliant while keeping the UTM parameters you need for accurate WordPress attribution across forms, bookings, signups and sales.
Everything lives under UTM > GDPR.
The panel at the top of the tab points you to the right setup:
- EU or UK visitors: you need consent before tracking. Use the consent banner below. It can collect consent just for HandL, or act as the consent tool for your whole site through the WP Consent API.
- Already using a consent plugin: leave the banner off and tell HandL to wait for it.
- US visitors only: no cookie banner is required, but you do need to disclose the cookies you set. See Publishing your cookie list for that.
1. Turn on the consent banner
2. Customize the wording and the look
Change the heading, message, button labels and the privacy policy link to match your site. Under Appearance you can set:
- Position: bottom bar, bottom left, bottom right or centered modal
- Theme: light or dark
- Corner radius and individual colors, if you need an exact brand match
The Live Preview on the right updates as you type, so you can see the result before saving.
3. What your visitors see
Preferences lets them choose per category. Essential is always on, Statistics and Marketing can be turned off.
If a visitor denies, any tracking cookies already set are removed. If they accept later, capture starts immediately with no page reload.
Letting visitors change their mind: add the class handl-consent-open to any link or button and it reopens the banner. A "Cookie settings" link in your footer is the usual place:
<a href="#" class="handl-consent-open">Cookie settings</a>
4. Let HandL manage consent for your whole site
By default the banner controls HandL's own tracking. Turn on Act as a Consent Tool and the same banner becomes the consent tool for your whole site, so every consent aware plugin you run follows the choice your visitor makes in it.
It needs the free WP Consent API plugin, the WordPress standard for sharing consent between plugins. Install and activate it and the switch becomes available.
For sites whose tracking comes from WordPress plugins, this can replace a dedicated consent plugin entirely. Third party scripts and embeds are a different matter, since they never ask the API. See Using HandL UTM Grabber as your site's consent tool for what this mode reaches, what it does not, and which setup to pick.
Already using another consent plugin?
Leave the HandL banner off and use Consent Plugin Integrations at the bottom of the tab instead. Turn on the switch next to your plugin and HandL waits for the consent that plugin collects, so your visitors only ever see one banner.
Supported plugins appear in this list automatically when they are active, including Cookiebot, Complianz, Borlabs, CookieYes, Real Cookie Banner, WPConsent, Cookie Notice by dFactory and the WP Consent API.
If you enable the HandL banner while another consent plugin is also showing its own banner, the GDPR tab warns you, since your visitors would see two.
The old Enable GDPR checkbox on the HandL Options tab still works and controls the same setting. The GDPR tab is where you customize it.
'Enabling GDPR' documentation video tutorial for UTM Tracking Consent
UTM attribution overview
This guide explains 'Enabling GDPR' documentation video tutorial for UTM Tracking Consent with HandL UTM Grabber. It helps you respect consent choices while preserving UTM parameters for compliant WordPress attribution and keep the marketing context needed for accurate reporting across forms, bookings, signups, and sales.
Please watch the related Video Tutorial below
and click right to the video and open link in new tab
Setting GDPR in HandL UTM Grabber is very easy.
It is literally a click of a button to enable GDPR. Once it is enabled, clients will see a message in the footer to either accept or deny data collection.
If GDPR is active, there will be no data collected in client's browser until client gives consent (hit "Accept" button). User decision will be kept in COOKIES, so when user visits your site, it will honor user's previous decision.
It is also easy to integrate with other similar WordPress plugin developed such as "Cookie Notice" plugin, so basically if you are already using a GDPR plugin, you can integrate HandL UTM Grabber to recognize the GDPR plugin of your choice.
Publishing your cookie list for US privacy laws (CCPA, CPRA) with screenshots
UTM attribution overview
If your visitors are in the US, you generally do not need a cookie banner. What US privacy laws such as California's CCPA and CPRA, plus Virginia, Colorado, Connecticut and Utah, do require of the businesses they cover is that you disclose what you collect. Publishing the list of cookies this plugin sets is the simplest way to cover that, and it is good practice whether or not those laws apply to you.
HandL UTM Grabber builds that list for you and keeps it up to date.
This is not legal advice. These laws generally apply above certain revenue and volume thresholds.
1. Open UTM > GDPR and find the Cookie Declaration card
You will see a live table of every cookie the plugin sets on your site, with a plain English purpose, a category and how long each one lasts.
2. Publish it to your privacy policy
Click Publish your cookie list, confirm, and a Cookies section is added to the privacy policy page set in Settings > Privacy. Clicking again never duplicates it.
If your site has no privacy policy page yet, the button creates one as a draft using WordPress's own suggested policy text plus your cookie list, so you can review it before it goes live. Nothing is ever published for you.
Your visitors then see the list on the page itself:
Or place it anywhere yourself
Copy the shortcode and paste it into any page or post:
[handl_cookie_declaration]
To show only one category:
[handl_cookie_declaration category="marketing"]
The table is plain HTML with no styles of its own, so it inherits your theme's look.
Page builders: if your privacy page is built with Elementor or a similar builder, the one click button cannot edit it. Copy the shortcode and drop it into a Shortcode widget instead.
It updates itself
The list is generated fresh every time the page loads, so it never goes stale:
- Add a custom parameter on the Custom Fields tab and it appears in the list right away
- Change your cookie duration and every row updates
- Turn on session cookies and every duration reads "Session"
- Turn the consent banner on and its own cookies are listed too
You never have to re-publish anything.
WordPress Privacy Policy Guide
HandL also adds a suggested section to Settings > Privacy > Policy Guide, which you can copy into your policy if you prefer to write the page yourself.
Publishing a cookie list covers disclosure, which is one requirement among several. It does not by itself make a site compliant.
Using HandL UTM Grabber as your site's consent tool (WP Consent API)
UTM attribution overview
This guide explains how that works, what it covers and what it does not.
What the WP Consent API is
The WP Consent API is the WordPress standard for passing consent between plugins. It was published on WordPress.org in February 2020, runs on more than 200,000 sites, and is maintained by Rogier Lankhorst, the developer behind Complianz.
The problem it solves is simple. A script blocker can stop a third party script from loading, but it cannot stop a WordPress plugin from setting a cookie in PHP, because that happens on your server before any blocking runs. The API gives those plugins a common way to ask "do I have consent for marketing?" and get a reliable answer.
Most of the well known consent plugins already speak it, including Complianz, Cookiebot, CookieYes, iubenda, consentmanager, CookieFirst, CookieHub, Pressidium and TrustArc, along with plugins that consume consent such as Google Site Kit, WP Statistics, Burst Statistics and WooCommerce.
HandL UTM Grabber speaks it in both directions. It can listen to someone else's consent, and it can be the one that broadcasts it.
Turning it on
Install and activate the free WP Consent API plugin, then go to UTM > GDPR. The Act as a Consent Tool switch becomes available once the plugin is detected.
Turn it on, make sure the consent banner itself is enabled, and click Save Changes.
What happens once it is on
- Every Accept, Deny or Preferences choice made in the HandL banner is broadcast site wide through the API
- Any plugin that supports the standard reads that decision and behaves accordingly
- Consent is declared as opt in, which means nothing is allowed until your visitor actively agrees
- Changes apply immediately, with no page reload, so a visitor who accepts later starts being tracked straight away
- Turn the switch off and the banner goes back to controlling only HandL's own tracking
The practical result is that you configure one banner, in one place, instead of running a dedicated consent plugin next to HandL.
What it covers, and what it does not
This is worth understanding before you remove anything from your site.
It covers WordPress plugins that support the WP Consent API. That is where first party cookies and server side tracking come from, and it is exactly the part a script blocker cannot reach.
It does not cover third party scripts and embeds, such as a Facebook pixel pasted into your header, a YouTube or Google Maps iframe, or a tag manager container. Those never ask the API, so nothing tells them to stop. Blocking them requires a consent plugin with script blocking built in.
So if your tracking comes from WordPress plugins, this can replace a dedicated consent plugin. If you also embed third party scripts, keep a consent plugin for the blocking and let it handle consent, using the integrations list instead.
To see where your own site stands, the WP Consent API plugin reports how many of your active plugins do not yet support the standard.
Which mode should I use?
| Your setup | What to do |
|---|---|
| Tracking comes from WordPress plugins, no consent plugin yet | Enable the HandL banner and turn on Act as a Consent Tool |
| You already run Complianz, Cookiebot, CookieYes and similar | Leave the HandL banner off and use Consent Plugin Integrations |
| You embed third party scripts or iframes | Keep a consent plugin with script blocking, and let HandL wait for it |
| US visitors only | No banner needed, publish your cookie list instead |
Running the HandL banner at the same time as another consent plugin's banner means visitors see two. The GDPR tab warns you when it detects this.