PureGrace Consent Connector for AI Privacy Center

PureGrace Consent Connector links your WordPress site to AI Privacy Center, a consent-management service operated by Pure Grace AI, LLC, so your consent banner and your tracker blocking are configured in one place instead of pasted into your theme.

Most cookie-consent plugins stop at the popup. This one also does the part a banner cannot: it neutralizes hard-coded tracker scripts on the server, before the browser parses them, so a tracker physically cannot fire before a visitor consents.

How this differs from the cookie-banner plugins already in the directory

The directory has many consent-banner plugins, so it is fair to ask what this one adds. Two things, and both are structural rather than cosmetic.

It enforces consent on the server, not in the browser. A banner plugin gates trackers with JavaScript after the page has loaded. This plugin rewrites hard-coded tracker tags into inert markup during page generation, before the HTML leaves your server — across four tag types: external <script src>, inline <script> snippets, <img> tracking pixels and <iframe> embeds. A tracker that is never delivered as an executable tag cannot fire in the gap between page load and banner render, which is the gap browser-only gating cannot close. The transform is idempotent and fails safe: unquoted or unrecognized markup is left untouched rather than mangled.

It is a connector, not a standalone banner. The banner, the consent records and the tracker classification live in AI Privacy Center, an external service. This plugin’s job is to bind a WordPress site to that service and to do the server-side enforcement WordPress is uniquely placed to do. It is not a general-purpose cookie banner and is not useful without the service, in the same way an analytics connector is not useful without the analytics account.

If you want a self-contained cookie banner with no external account, one of the existing directory plugins will serve you better. This one exists for sites whose consent state is managed centrally across more than one property.

What the plugin does

• Consent banner — enqueues the AI Privacy Center consent banner on your site, deny-by-default and built to WCAG 2.2 AA. Can be switched off if your site already loads the banner another way.
• Server-side tracker blocking (prior restraint) — rewrites hard-coded trackers into inert tags during page generation, before the browser ever parses them, so they cannot run until consent is given. This covers four tracker types: external <script src> tags, inline (no-src) <script> snippets, tracking <img> pixels, and <iframe> embeds (YouTube, Vimeo, Maps, social widgets, and similar). This catches server-rendered trackers that browser-only banners miss.
• Google Consent Mode signals — passes consent state to Google tags when enabled.
• Cache-aware safeguards — best-effort purge of known page caches when you save your widget key, plus a notice on the plugin’s own screens if an incompatible full-page cache is detected, so you can purge and verify while logged out.

What it does not do

• It does not modify tags injected into the DOM purely by client-side JavaScript after the page has already loaded (for example a script inserted at runtime by another plugin’s own JS) — the server-side rewrite works on the HTML as generated by WordPress, not on later browser-side DOM changes. The consent banner’s own client-side gating still applies to those.
• It does not create or edit your privacy policy pages. Policy publishing is done by the platform through WordPress’ own REST API with an application password you authorize, so WordPress core performs the permission checks. Nothing in this plugin writes posts or pages.
• A full-page cache drop-in can serve pages before plugins load; pages cached while blocking was inactive may serve raw tracker tags until purged. Verify logged out after enabling.

Honest note on compliance. AI Privacy Center gives you tools and records to help you meet your privacy obligations. It is not a law firm and does not guarantee compliance with any law — compliance is an outcome of your own process, not a product setting.

An account is required. This plugin is the WordPress connector for the AI Privacy Center service. You need an account and a widget key to use it, in the same way an analytics plugin needs a property ID. A free plan is available.

No functionality in this plugin is gated behind a paid plan. Everything the plugin’s own code does — the consent banner, and all four kinds of server-side tracker neutralization — runs on a free account as soon as a widget key is saved. There is no licence check, no tier check, no usage cap and no trial timer anywhere in the plugin. The only condition on tracker blocking is a saved widget key, because the plugin has to know which site’s consent state it is enforcing. Paid plans buy additional capability in the hosted service — such as AI-generated policy updates and longer record retention — none of which is implemented in, or withheld by, this plugin.

External services

This plugin relies on one external service: AI Privacy Center, a consent-management platform operated by the plugin author, Pure Grace AI, LLC, at https://app.aiprivacycenter.com. The plugin cannot function without it, because the consent banner and the consent records it produces are the service.

Nothing is sent until you save a widget key. With the key field empty the plugin makes no outbound request of any kind, from the browser or from your server.

Once a key is saved, these requests happen:

• Consent widget script — from the visitor’s browser, on every page view. The plugin enqueues https://app.aiprivacycenter.com/api/v1/widget/apc-stub.min.js. Loading it sends what any browser request for a script sends: the visitor’s IP address, user agent and referring page.
• Banner configuration — from the visitor’s browser, on every page view. The widget requests https://app.aiprivacycenter.com/api/v1/widget/{your-widget-key}/config to learn how your banner is configured. It sends your site’s widget key.
• Initialization beacon — from the visitor’s browser, once the widget loads. A POST to https://app.aiprivacycenter.com/api/v1/widget/health-beacon containing only your widget key, so the platform can show you whether the banner is actually running.
• Consent choices — from the visitor’s browser, when a visitor answers the banner. A POST to https://app.aiprivacycenter.com/api/v1/widget/consent containing your widget key, the consent choices made, how they were made (a banner interaction or a Global Privacy Control signal), and a randomly generated visitor identifier stored in a strictly necessary first-party cookie. That record is what proves consent was given. No name, email address, form content or page content is sent.
• Unrecognized tracker hosts — from your server and from the visitor’s browser. When a page contains a script from a host the blocking table does not recognize, its host name (and, from the browser, the script URL’s origin and path with any query string stripped) is POSTed to https://app.aiprivacycenter.com/api/v1/widget/unknown-scripts with your widget key, so the unknown tracker can be classified rather than silently ignored. Host names only — no visitor data and no page content.
• Configuration check — from your server, only when you click a button. Pressing “Verify configuration” on the settings screen makes one request to https://app.aiprivacycenter.com/api/v1/widget/{your-widget-key}/config to confirm the key is recognized.

Terms and privacy

• Terms of Service: https://puregraceai.com/legal/tos
• Privacy Notice: https://puregraceai.com/legal/privacy

A note on the tracker host names inside this plugin. includes/class-pgcc-neutralizer.php contains a table of third-party host names — googletagmanager.com, connect.facebook.net, maps.googleapis.com, widget.intercom.io and others. That table is a local pattern list used to recognize and block those trackers in your page’s HTML. The plugin never contacts those hosts and sends them no data; matching a host name in that table is what stops it from loading.