FAZ Cookie Manager · Version history
FAZ Cookie Manager changelog and version history
- Latest version
- 1.38.0
- Nov 8, 2026 (1 day ago)
- Releases
- 46
- since 2026
- In the last year
- 46
- about one every 4 days
- Tested up to
- WordPress 7.1.4
- PHP 7.4 or later
202646 releases
FAZ Cookie Manager 1.38.0Latest
- Added: Google Consent Mode → Advanced Settings: a new opt-in, off by default, loads the Google Tag Manager container before consent when Advanced Consent Mode is on (#385), so Google tags configured inside Tag Manager send cookieless pings for visitors who have not consented. The container loads fo…
- Added: qTranslate support (qTranslate-XT, qTranslate-X, qTranslate, mqTranslate, qTranslate Plus and zTranslate): the banner follows the language chosen in qTranslate instead of the browser language. With Cache Compatibility Mode on and qTranslate’s query mode (?lang=), cached pages show the defaul…
- Fixed: Keyboard access: after a choice, focus moves to the cookie icon, which has a visible focus ring; the icon moves focus into the banner it reopens, Customise into the preferences, Tab stays inside the open dialog, and Escape returns focus to the button that opened the preferences. All banner l…
- Added: Banner → Colours: background opacity and text alignment; Save button colours, hover colours for the banner buttons, and a custom image for the revisit widget. All empty by default, so existing banners look the same.
- Added: Cookie Policy: privacy contact and DPO addresses are obfuscated as HTML character references by default, so scrapers that read the page source do not get them (#383, by roboes). Visitors see and use them as before.
- Added: Turkish banner, preference centre and category texts (#381, by gven09), and Turkish cookie duration units.
- Fixed: the opt-out popup no longer says a Global Privacy Control signal was detected when the browser sends none, and with the signal the Do Not Sell checkbox is ticked and locked.
- Fixed: FullCalendar calendars (for example PowerPack Event Calendar) did not render with FAZ active (#391).
- Fixed: Divi’s mobile menu could be empty with Polylang (#376), the output buffer broke Breakdance’s builder JSON responses (#356), and a WordPress notice appeared on every page because of a closing script tag in a comment (#361).
FAZ Cookie Manager 1.37.0
- Fixed: With Geo-Targeting on and only a CCPA banner active, visitors who need opt-in consent saw no banner at all (#377): visitors from the EU and the UK, and every visitor on a site that cannot detect the country. They now see your banner as an opt-in banner, with its look and policy links, the de…
- Fixed: The cache-safe jurisdiction bootstrap now works on CCPA-only sites, so those pages can be cached again.
- Added: The notice that explains this also appears on the WordPress Dashboard, and offers an administrator-only check that reopens the banner on your site without clearing consent.
FAZ Cookie Manager 1.36.1
- Fixed: On a site set to Croatian the banner was shown in English, because the banner and category texts come from bundled catalogues and Croatian had none. Both are now included. Banner texts that a site had already saved while they were still the English defaults are shown in the language of the b…
FAZ Cookie Manager 1.36.0
- Added: Banner → Buttons → Button Order chooses the order of the notice buttons (#367). The four orders offered all keep Accept All and Reject All next to each other, because position is part of the equal weight the EDPB and the Garante ask for between accepting and refusing. The order is written in…
- Added: Google Consent Mode → Google Tag: enter up to five Google tag IDs (G-, GT-, AW-, DC-, GTM-) and the plugin loads them itself (#366). Each tag waits for the consent a pasted copy would get: Google Analytics for Analytics, Google Ads and Floodlight for Marketing, each with its own loader, and…
- Fixed: On a domain served through a translation proxy such as the GTranslate Translation Proxy the banner broke: the consent bar ended up inside the revisit button, without its buttons. The banner markup now travels in a template element the proxy translates without breaking it, so the banner also…
- Fixed: On phones the templates reordered the notice buttons with CSS, putting Reject last and away from Accept, while keyboard focus followed a different order (#368). Phones now show the buttons in the same order as desktop, the one chosen under Button Order.
FAZ Cookie Manager 1.35.0
- Added: A cookie declared by hand under Cookies is now a consent service of its own (#360). It appears in window.getFazConsent().services under a stable Service ID shown in the cookie dialog and exposed read-only by the REST API; with per-service consent on it also gets its own toggle in the prefere…
- Added: “Also run the opt-in script on every page load while the category stays accepted” in the cookie dialog. A booking widget or chat loader declared as a per-cookie opt-in script now runs on every later page for a returning visitor who accepted, not only on the page where they clicked accept. It…
- Added: A provider privacy policy URL per cookie, shown as a “Read the provider’s privacy policy” link under the cookie in the preference centre, the generated cookie policy and the [faz_cookie_table] shortcode. Only absolute http(s) addresses are accepted.
FAZ Cookie Manager 1.34.5
- Fixed: On a site translated through a proxy (GTranslate custom domains or language sub-domains, Weglot sub-domains) or served on a mirror domain, the visitor’s choice was not saved, and consent records and Do Not Sell requests were refused as cross-origin. The consent cookie is now stored for the d…
- Added: Settings → Trusted Alternate Domains for any other domain this same site is served on, and the faz_trusted_origins filter. Saving names the lines that are not a valid domain or URL. Credentialed CORS for these domains is limited to the plugin’s own public endpoints.
- Fixed: When the generated configuration file had not applied (an empty cached copy, a wrong Content-Type, a staging login page, a Delay/Defer optimiser), the banner was disabled for the page view and services such as WooCommerce express checkout buttons stayed blocked. The runtime now fetches the f…
- Fixed: Empty or truncated generated files on disk are regenerated instead of being served forever. Perfmatters Delay, Defer and Minify JavaScript receive the plugin’s exclusions automatically.
- Added: System Status shows the runtime bundle version, warns when the plugin directory mixes two versions or holds two copies of the plugin, and checks how the generated configuration file is served.
FAZ Cookie Manager 1.34.4
- Fixed: WooCommerce product galleries remain visible when Divi regroups server-rendered images. Moving unchanged resources preserves the gallery; changed URL attributes still require a consent verdict.
- Fixed: Video-placeholder buttons use service colours darkened enough for readable white text at WCAG AA contrast.
- Changed: The external consent runtime is fetched at high priority without changing execution order. The effect depends on the page; faz_runtime_fetchpriority can disable the hint when it competes with the main image on returning visits.
- Fixed: On Safari and iOS 16, a JavaScript scope incompatibility could leave the consent banner invisible. Runtime bindings are now accessible to the affected engine.
- Fixed: The banner stylesheet loads without blocking the first paint. Page-content utilities remain inline, and the banner waits for its stylesheet before appearing, with a bounded fallback if the download fails.
- Fixed: The first country override now persists when no overrides have been saved yet. The form also prevents overlapping submissions from silently replacing one another. Dynamically inserted scripts parked in place are reconsidered after consent. Restoration retains their original type, checks thei…
- Fixed: WP Fastest Cache and Super Page Cache now honour every FAZ page-cache veto, preventing crawler or visitor-specific output from becoming the shared page. Surge, Jetpack Boost and Cachify page caches are purged after relevant changes and plugin updates. W3 Total Cache, WP-Optimize, SiteGround…
- Fixed: Published cookie policies with incomplete required details are listed in wp-admin, with the missing fields and the visitor-visible outcome for each jurisdiction. The check includes older pages and ignores escaped shortcode examples.
- Changed: The anti-spam setting help now explains the category fallback, custom exceptions and the Necessary-only banner case.
FAZ Cookie Manager 1.34.3
- Added: A new switch under Settings → Script Blocking, “Allow anti-spam services before consent”, decides whether Google reCAPTCHA, hCaptcha and Cloudflare Turnstile load before consent (#343). It is on by default, so nothing changes for existing sites. Switched off, those services are held under th…
- Added: Slovak banner, preference centre, cookie category and cookie descriptions, contributed by Tomáš Jenej (#332). Cookie durations in Slovak now use the correct plural forms (2 dni, 5 rokov, 1,5 roka).
- Fixed: The CAPTCHA endpoints were added to the script-blocking whitelist in code, ahead of every rule, so neither removing them from the exceptions nor a custom blocking rule could hold reCAPTCHA until consent (#343).
FAZ Cookie Manager 1.34.2
- Added: Your consent ID is now shown in the cookie preferences, the data request form has an optional Consent ID field filled in automatically, and administrators can open the matching consent history from the request. The request also records whether the ID matches the consent cookie of the browser…
- Added: The suggested privacy policy text is now built from the features actually enabled on the site, including consent IDs, hashed IP and browser data, retention periods, geolocation, the optional ipinfo.io lookup and privacy requests.
- Added: Each consent record now also stores its time in UTC. Existing records are converted in the background after the update, using the site’s current time zone.
- Fixed: On WordPress multisite, a cookie choice made on one site could be applied on another site of the same network, including subdirectory networks and shared cookie domains. Each site now keeps its own choice, also in the Do Not Sell form; visitors of multisite networks are asked once more after…
- Fixed: The geo rule sets declared IAB GPP support that the plugin does not provide. The declaration is removed, and custom rule sets that still contain it keep working; a GPP string supplied by another consent platform is still recorded in the consent log, also when the visitor leaves the page righ…
- Fixed: Embedded documents held back by server-side blocking could be released by copied or forged markup. They are now restored only when they belong to the page that was served, and a forged hold marker in the page no longer keeps a provider address loading in the browser.
- Fixed: The “How to Manage Cookies” section of the cookie policy always pointed to the floating cookie icon; it now describes the withdrawal route configured on the site. Where the controller’s name is still missing, the opening sentence of a generated policy now names “the operator of this website”…
- Fixed: A few spellings still let a provider load before consent: a address set by a script, a CSS @import written with a comment, character references without a semicolon, named references and line breaks inside embedded documents, and an inline data script followed by code after a line break. They…
- Fixed: While the consent runtime was still loading, a script that inserted an element next to one that was being held (insertBefore, replaceChild, before, replaceWith) lost the new element, and with replaceChild and replaceWith both.
- Fixed: An acceptance given on an AMP page by a visitor in an opt-in region, over the kept US banner, was stored for a year; it now gets the opt-in lifetime of at most six months.
- Fixed: Before the visitor had made a choice, the TCF API reported legitimate interest as established for every vendor while the preference centre showed it switched off. Both now say off until a choice.
- Fixed: An expired form and an invalid consent ID on the data request form now trigger faz_dsar_rejected like every other refusal, and the consent ID error says the field can be left empty. After an erasure, the administrator is no longer told that an unverified consent ID can still be verified.
- Fixed: On AMP pages, a site whose geo rules required opt-in consent but which had no GDPR-family banner (for example one set up as “US only” by the wizard) lost both the consent prompt and the blocking, so analytics, ads and pixels on AMP ran without consent and were cached that way by the AMP cach…
- Fixed: A consent given under one law or banner (for example the US notice) was honoured by the server and by Google Consent Mode on a page served under another (for example the GDPR banner after travelling or a VPN), until the banner script noticed and withdrew it. Every layer now rejects a consent…
- Fixed: Vendors that queued a request on the TCF API before the consent framework finished loading never got an answer: the queue was discarded. Queued commands are now replayed.
- Fixed: The consent log stored the TC string of the previous decision, so a Reject row carried the Accept All string. Each row now records the string of its own decision.
- Added: Right to Object in the IAB TCF section of the preference centre, per purpose and per vendor. Legitimate-interest signals are no longer sent for vendors the visitor switched off or after Reject All, the switches are never shown pre-ticked, and vendor consent is only signalled for vendors that…
- Fixed: A withdrawal made within ten seconds of an acceptance, from the same browser, was dropped by the flood limit, so the log kept saying “accepted”. A correction by the same visitor now goes through; new visitors from one address are still limited.
- Fixed: With Advanced Consent Mode, a custom blocking rule that happened to match the inline Consent Mode default could neutralise it while the Google tags still ran. The default is now protected from the blocker.
- Fixed: Server-side blocking missed video and audio sources and posters, legacy object and embed players, inline style attributes, compact CSS imports and stylesheets inside noscript, all of which load before any script runs. They are now held back until consent like images and frames, and the conse…
- Fixed: A theme or edge service that supplies the visitor’s country through the faz_visitor_country filter was not counted as a country source when deciding whether a page may be cached, so a page rendered for one jurisdiction could be served from cache to another. Tor exits flagged by Cloudflare no…
- Fixed: The data request form refused every submission when its page was served from a full-page cache for longer than the security token lives, and the Do Not Sell form could cache one visitor’s state for everyone. Both pages are now kept out of page caches, the Do Not Sell form recovers an expired…
- Fixed: The consent log now records the jurisdiction that was actually enforced, includes the TC string, GPP string, GPC and DNT signals, country and ruleset in the CSV export, adds the time in UTC, and single Do Not Sell records can be fetched by id.
- Fixed: Generated cookie policies could be published with no controller name or contact for GDPR, CCPA and LGPD; publishing now requires them, while a page already live keeps showing for visitors. International transfers are described under the document’s own law (LGPD, POPIA or neutral) instead of…
- Fixed: The WP Consent API was told the banner’s law instead of the regime actually applied; the IAB labels are now translatable; GPC no longer rewrites the consent cookie on every page view; explicit blocking rules are kept on the client under the payment-gateway exemption; restored embeds keep the…
- Fixed: The inline bootstrap that protects the page while the consent runtime downloads now stands down when an optimiser runs it after the runtime, and hands over to a runtime that arrives late, instead of staying in its fallback mode for the whole visit.
- Fixed: Query Monitor’s admin bar stopped working on any page that loaded a tracker, because its inline data block names the page’s scripts and FAZ read a tracker signature inside it (#322). An inline script that only assigns JSON data is no longer searched for tracker signatures, in both places FAZ…
- Fixed: The “Site Kit by Google” entry of the provider list and its blocking template matched every file of the Site Kit plugin, so its admin bar, dashboard scripts and consent-mode bridge were blocked until analytics was accepted, for the administrator too (#322). The entry now matches only the gta…
- Fixed: With LiteSpeed, or any script that moves elements one by one, pages could freeze and run the browser out of memory: “Remove Query Strings” served the previous consent runtime under the new page, and the inline protection never let such a loop advance. Held elements now move at once, the hold…
- Fixed: A page rendered for a returning visitor whose consent, Global Privacy Control signal or Do Not Sell choice changed the server-side blocking could be cached and served to everyone. Such responses now stay out of shared caches (filter: faz_veto_cache_for_visitor_state). Under CCPA, sale and sh…
FAZ Cookie Manager 1.34.1
FAZ Cookie Manager 1.34.0
FAZ Cookie Manager 1.33.0
FAZ Cookie Manager 1.32.1
FAZ Cookie Manager 1.32.0
FAZ Cookie Manager 1.31.0
FAZ Cookie Manager 1.30.0
FAZ Cookie Manager 1.29.0
FAZ Cookie Manager 1.28.1
FAZ Cookie Manager 1.28.0
FAZ Cookie Manager 1.27.1
FAZ Cookie Manager 1.27.0
FAZ Cookie Manager 1.26.0
FAZ Cookie Manager 1.25.0
FAZ Cookie Manager 1.24.0
FAZ Cookie Manager 1.23.0
FAZ Cookie Manager 1.22.0
FAZ Cookie Manager 1.21.1
FAZ Cookie Manager 1.21.0
FAZ Cookie Manager 1.20.0
FAZ Cookie Manager 1.19.2
FAZ Cookie Manager 1.18.2
FAZ Cookie Manager 1.18.1
FAZ Cookie Manager 1.17.2
FAZ Cookie Manager 1.17.1
FAZ Cookie Manager 1.17.0
FAZ Cookie Manager 1.16.2
FAZ Cookie Manager 1.16.1
FAZ Cookie Manager 1.16.0
FAZ Cookie Manager 1.14.3
FAZ Cookie Manager 1.13.17
FAZ Cookie Manager 1.13.16
FAZ Cookie Manager 1.13.15
FAZ Cookie Manager 1.13.14
FAZ Cookie Manager 1.13.13
FAZ Cookie Manager 1.13.12
FAZ Cookie Manager 1.13.11
Questions about FAZ Cookie Manager’s releases
What is the latest version of FAZ Cookie Manager?
1.38.0, released on Nov 8, 2026 (1 day ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.
How often is FAZ Cookie Manager updated?
46 releases in the last year, about one every 4 days. Its first release on WordPress.org dates from April 2026.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in FAZ Cookie Manager’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.