Complianz

Complianz is a Consent Management Platform (CMP) plugin for WordPress. It helps website operators comply with the GDPR, ePrivacy Directive, CCPA, and other privacy regulations by automatically scanning cookies on the site, displaying a customisable consent banner, blocking third-party scripts until consent is given, storing consent records as proof of compliance, and generating cookie policies and privacy statements. With over one million active installations, it is one of the most widely used consent management solutions in the WordPress ecosystem.

Complianz stores two first party cookies: cmplz_consent_status (containing the granular consent choices, valid 365 days) and cmplz_marketing (recording whether marketing was accepted, 365 days). Optional A/B test mode adds a third cookie cmplz_id. No third party cookies are loaded by the plugin itself.

No. The cookies that Complianz sets (cmplz_consent, cmplz_id, and related cmplz_* cookies) are strictly necessary for the functioning of the consent mechanism itself. Under the ePrivacy Directive, cookies that are technically required to implement a user choice are exempt from prior consent requirements. Visitors do not need to consent to Complianz cookies before the banner is shown, as these cookies exist solely to store and apply the consent decision the visitor is about to make.

No. A Consent Management Platform is considered strictly necessary under Recital 30 of the ePrivacy Directive, since it is the technology required to collect the consent itself. Complianz can therefore be loaded before any consent has been given, and it must block all non essential scripts until the visitor decides.

Complianz sets several first-party cookies, all stored on the operator domain: cmplz_consent (1 year) stores the visitor consent choices per category (functional, statistics, marketing); cmplz_id (1 year) stores a unique anonymous identifier to link consent records; cmplz_consent_status (1 year) records whether the visitor has actively interacted with the banner or dismissed it; and cmplz_policy_id (1 year) stores the version of the cookie policy the visitor accepted, allowing consent to be re-requested if the policy changes significantly.

Complianz processes consent records to fulfil legal obligations (Art. 6(1)(c) GDPR, in combination with Art. 7(1) GDPR which requires the controller to demonstrate consent). The geo IP lookup operated by Really Simple Plugins relies on legitimate interest to display the correct regulation.

Yes. Complianz is designed specifically to help operators achieve and demonstrate GDPR compliance. It is developed by a Dutch company (Really Simple Plugins B.V.) subject to EU law, stores all data in the EU, acts as a data processor under a Data Processing Agreement, and provides the consent records required by GDPR Art. 7(1) to demonstrate valid consent. Using Complianz does not guarantee full GDPR compliance for your site, as compliance also depends on how you configure and use the other services Complianz manages.

No. Complianz is installed on your WordPress server and the optional cloud services (Complianz Hub, geo IP lookup) are operated by Really Simple Plugins B.V. from the Netherlands. There is no transfer to the United States.

By default, Complianz stores consent records in your WordPress database on your own server. No data is sent to Complianz or any third party in this default configuration. Optionally, operators with a Complianz Premium subscription can enable cloud-based consent record storage on Complianz servers located in the Netherlands (EU). In either case, no consent data is transferred outside the European Union. Records include the visitor IP address (or a hashed version), timestamp, banner version, and consent choices per category.

A DPIA is not required for Complianz itself. The plugin is a compliance enabling technology that processes only the minimum data needed to demonstrate consent. It actually reduces risk for the controller.

Yes. Complianz supports multiple privacy regulations through geo-targeting. It can detect the visitor location and display a regulation-specific banner: a GDPR consent banner for EU visitors, a CCPA opt-out notice for California visitors, and customised notices for other regions (Brazil LGPD, Canada PIPEDA, etc.). Each regulation requires a different compliance approach, and Complianz handles the logic automatically based on the visitor IP. Premium users can customise banners and flows for each region independently.

Run the cookie scanner, categorise every detected script, enable consent logging, configure the banner with equally weighted accept and reject buttons, link Google Consent Mode v2 if you use Google services, and display the persistent privacy preferences icon. Re scan monthly.

Other CMPs include Axeptio (France), Didomi (France), CookieFirst (Netherlands), CookieHub (Iceland), Klaro (Germany, open source), Usercentrics (Germany) and OneTrust (US). For WordPress, the closest alternatives are CookieYes and Cookiebot.

The main difference is the deployment model. Complianz is a self-hosted WordPress plugin: all data stays on your server and no data is sent to a third-party CMP platform by default. Cookiebot and OneTrust are SaaS CMPs: consent records and banner configuration are managed on their cloud platforms, which involves a data transfer to their servers (located in the EU or US depending on the provider). Complianz is generally more privacy-friendly by default and less expensive, but offers fewer enterprise features than OneTrust. Cookiebot and OneTrust are platform-agnostic and do not require WordPress.

A full Data Protection Impact Assessment (DPIA) is generally not required for Complianz alone, as the processing it performs is low-risk: it stores consent records in the EU, has no advertising purpose, and does not profile users. However, operators should document the processing of consent records (including IP addresses) in their Record of Processing Activities (RoPA) as required by GDPR Art. 30. A DPIA may become relevant if consent records are combined with other high-risk processing, or if the Complianz Statistics add-on is used at large scale.

Complianz generates the cookie policy dynamically from the scanner results. Schedule a monthly scan and review the generated policy after every theme, plugin or analytics change. Publish the updated policy version date and notify users of any material change.