# Using HandL UTM Grabber as your site's consent tool (WP Consent API)

## UTM attribution overview

Most consent banners only control the plugin they came with. HandL UTM Grabber can do more than that: with one switch it becomes the consent tool for your whole site, so a single banner governs every consent aware plugin you run, and you keep clean UTM attribution on the visitors who agree.

This guide explains how that works, what it covers and what it does not.

### What the WP Consent API is

The [WP Consent API](https://wordpress.org/plugins/wp-consent-api/) is the WordPress standard for passing consent between plugins. It was published on WordPress.org in February 2020, runs on more than 200,000 sites, and is maintained by Rogier Lankhorst, the developer behind Complianz.

The problem it solves is simple. A script blocker can stop a third party script from loading, but it cannot stop a WordPress plugin from setting a cookie in PHP, because that happens on your server before any blocking runs. The API gives those plugins a common way to ask "do I have consent for marketing?" and get a reliable answer.

Most of the well known consent plugins already speak it, including Complianz, Cookiebot, CookieYes, iubenda, consentmanager, CookieFirst, CookieHub, Pressidium and TrustArc, along with plugins that consume consent such as Google Site Kit, WP Statistics, Burst Statistics and WooCommerce.

HandL UTM Grabber speaks it in both directions. It can listen to someone else's consent, and it can be the one that broadcasts it.

### Turning it on

Install and activate the free WP Consent API plugin, then go to **UTM > GDPR**. The **Act as a Consent Tool** switch becomes available once the plugin is detected.

![Act as a Consent Tool with WP Consent API detected](https://docs.utmgrabber.com/uploads/images/gallery/2026-08/handl-wp-consent-api-detected.jpg)

Turn it on, make sure the consent banner itself is enabled, and click Save Changes.

### What happens once it is on

* Every Accept, Deny or Preferences choice made in the HandL banner is broadcast site wide through the API
* Any plugin that supports the standard reads that decision and behaves accordingly
* Consent is declared as **opt in**, which means nothing is allowed until your visitor actively agrees
* Changes apply immediately, with no page reload, so a visitor who accepts later starts being tracked straight away
* Turn the switch off and the banner goes back to controlling only HandL's own tracking

The practical result is that you configure one banner, in one place, instead of running a dedicated consent plugin next to HandL.

### What it covers, and what it does not

This is worth understanding before you remove anything from your site.

**It covers** WordPress plugins that support the WP Consent API. That is where first party cookies and server side tracking come from, and it is exactly the part a script blocker cannot reach.

**It does not cover** third party scripts and embeds, such as a Facebook pixel pasted into your header, a YouTube or Google Maps iframe, or a tag manager container. Those never ask the API, so nothing tells them to stop. Blocking them requires a consent plugin with script blocking built in.

So if your tracking comes from WordPress plugins, this can replace a dedicated consent plugin. If you also embed third party scripts, keep a consent plugin for the blocking and let it handle consent, using the integrations list instead.

To see where your own site stands, the WP Consent API plugin reports how many of your active plugins do not yet support the standard.

### Which mode should I use?

| Your setup | What to do |
| --- | --- |
| Tracking comes from WordPress plugins, no consent plugin yet | Enable the HandL banner and turn on Act as a Consent Tool |
| You already run Complianz, Cookiebot, CookieYes and similar | Leave the HandL banner off and use Consent Plugin Integrations |
| You embed third party scripts or iframes | Keep a consent plugin with script blocking, and let HandL wait for it |
| US visitors only | No banner needed, publish your cookie list instead |

> Running the HandL banner at the same time as another consent plugin's banner means visitors see two. The GDPR tab warns you when it detects this.