CMP Configuration

CleanClicks can respond to consent signals from supported WordPress and browser integrations. The result depends on the deployed plugin or tag version, the site's consent management platform (CMP), its configuration, the site's policies, and the customer's legal choices.

CleanClicks documentation does not choose a legal basis or consent category for a customer. Review those choices with the customer's policy owner or counsel.

Identify the Current Path

Before changing a CMP:

1. Record the site, CMP name and version, CleanClicks plugin or tag version, and active consent integration.
2. Record the categories or services the site currently exposes.
3. Confirm whether WordPress WP Consent API, a named bridge, Google Consent Mode, or another site-specific path carries the signal.
4. Back up the current CMP and CleanClicks settings.

Support for WP Consent API or a named CMP does not prove that the site's categories, services, or legal basis are correct.

Configure

Use the customer's approved consent model. Map CleanClicks to the category or service selected by that model, then configure the current plugin or tag to receive the CMP signal.

Do not classify CleanClicks as Strictly Necessary, Functional, Statistics, or Marketing merely because this guide names the category. The correct classification depends on the customer's use, data flow, policy, and legal review.

If a CMP does not expose a supported signal path, stop and document the gap. Do not add a broad custom bypass.

Required Test Matrix

Run every applicable row in a clean browser state:

Record the browser, timestamp, domain, consent state, event ID, order ID when applicable, CleanClicks receipt, and destination result. Missing evidence blocks the specific claim.

WordPress

The CleanClicks WordPress plugin integrates with the WP Consent API and ships a OneTrust bridge. It registers itself as a WP Consent API compliant plugin, so CMPs that warn about non-compliant plugins stop flagging it.

The plugin asks at the service level first: it calls wp_has_service_consent('cleanclicks') where the site's CMP supports WP Consent API v2.0+, so a visitor can grant or deny the cleanclicks service on its own rather than through a shared statistics or marketing category. Where only v1.x is available it falls back to category-level wp_has_consent(). The plugin declares its own cookies and storage keys to the WP Consent API as functional.

OneTrust does not integrate with the WP Consent API on its own, so the plugin bridges it: groups C0001, C0002 and C0004 map onto WP Consent API categories, synced once on load and again on OneTrustGroupsUpdated and OneTrust.OnConsentChanged. Separately, cc.js reads consent state directly from CookieYes, OneTrust, Cookiebot and iubenda, and treats Global Privacy Control as a denial.

Those are plugin and tag behaviors. A bridge carries a signal; it does not decide the customer's category or legal basis.

Practical CMP Checks

1. Identify the CMP and its version in WordPress Plugins or the site's banner configuration. Record the deployed CleanClicks plugin version too.
2. Confirm which category or service the customer's approved consent model assigns to CleanClicks. Do not change that category merely to make a test pass.
3. In each row of the test matrix, inspect whether cc-wp.js loads and whether the CMP's consent signal reaches the plugin. The plugin reads wp_has_service_consent('cleanclicks') first and falls back to wp_has_consent(); check which of the two your CMP's WP Consent API version exposes.
4. For Complianz, inspect script management and the cleanclicks-wp script handle. A blocked script cannot receive a later consent callback. Confirm its loading behavior matches the approved policy before changing a rule.
5. For OneTrust, compare the selected banner groups with the observed CleanClicks consent state. The bridge reads groups C0001, C0002 and C0004 only, so a group outside those three carries no signal to CleanClicks.
6. For CookieYes, Cookiebot, Iubenda, or another CMP, review the current vendor configuration and test its callback and script-blocking behavior. Menu names and defaults can differ by version.

Where Google Consent Mode settings such as url_passthrough or ads_data_redaction are part of the site's approved configuration, record their actual values and test their effect. These settings do not establish a consent category or guarantee attribution.

If a test fails, save the CMP/version, consent choice, script-load result, request IDs, and destination result. Ask support to resolve that specific mismatch rather than adding a blanket endpoint allowlist.

Shopify and Custom Sites

Verify the current Shopify customer-privacy settings or custom-site consent signal before installing or enabling a pixel. Confirm the browser and webhook paths separately. A server-side webhook does not remove the need to apply the customer's approved consent and destination policy.

Troubleshooting

Need Help?

Contact helpdesk@cleanclicks.io with the domain, CMP and version, CleanClicks plugin or tag version, the failed matrix row, and the relevant screenshots or request IDs. Do not send raw access tokens or customer personal data.

---

Related: WordPress Setup | Shopify Setup | Data and Privacy