LMG Consent 1.3.0 — persistent floating preferences button

Persistent "Cookie preferences" floating button

Adds an always-available control so visitors can reopen preferences and withdraw consent on any page — the standard expected by GDPR (Art. 7(3): withdrawal must be as easy as giving consent) and CPRA (always-available opt-out). Previously this required manually placing the [m_cookie_preferences] shortcode in each site's footer.

What's new

• Floating button, on by default — appears site-wide with no per-site setup. Zero-touch on update.
• 🍪 icon pill with label, collapses to icon-only on mobile. Accessible: aria-label, visible focus ring, honors reduced-motion.
• Admin controls (Settings → LMG Consent): enable/disable, position — bottom right / left / center, and custom label.
• Never overlaps the banner — it stays hidden while the first-visit banner is on screen, appears once a decision is made, and shows immediately for returning visitors.

Notes

• The [m_cookie_preferences] / [lmg_cookie_preferences] shortcode still works for an optional additional in-content link.
• On a site with a bottom-right chat widget, switch the button to bottom-left/center in settings.
• No back-compat changes.

LMG Consent 1.2.1 — block marketing pixels (Meta, LinkedIn, TikTok, Bing, Pinterest, X)

Marketing-pixel blocking

Extends v1.2.0's CIPA prior-blocking beyond Google. The plugin now also neutralizes the common advertising-pixel loaders until the visitor grants Marketing consent — same mechanism (rewrite the external loader to type="text/plain", reactivate after opt-in), so no per-site changes are needed.

Pixels now blocked (all → Marketing)

• Meta / Facebook — connect.facebook.net/…/fbevents.js
• LinkedIn Insight — snap.licdn.com/li.lms-analytics/insight.min.js
• TikTok — analytics.tiktok.com/i18n/pixel/events.js
• Microsoft / Bing UET — bat.bing.com/bat.js
• Pinterest Tag — s.pinimg.com/ct/core.js
• X / Twitter — static.ads-twitter.com/uwt.js

Inline init calls (fbq(…), lintrk(…), ttq.track(…), etc.) are left in place but stay inert without their loader — no transmission until consent.

Notes

• Pixels fired through a GTM container are already covered by the existing gtm.js block (the whole container is held until Marketing consent).
• A site running a non-standard loader can still add it via LMG_CONSENT_EXTRA_PATTERNS.
• No back-compat changes.

LMG Consent 1.2.0 — CIPA hard script-blocking

CIPA prior-blocking for Google Analytics / GTM

Previously the plugin relied solely on Google Consent Mode v2. Consent Mode does not stop GA4 from firing before consent — it only suppresses cookies, while still transmitting the visitor's IP, page URL, referrer, and user-agent to Google as "cookieless pings." That fails CIPA's prior-consent standard.

This release adds true prior-blocking: the plugin now physically prevents Google's tracking loaders from fetching or executing until the visitor opts in.

What changed

• New LMG_Consent_Blocker neutralizes the external Google loader scripts (gtag/js, gtm.js, analytics.js, ga.js) to type="text/plain" before the page is sent — the browser never fetches or runs them pre-consent.
• Works regardless of how the tag was added — Genesis Simple Hooks and Elementor custom code are both covered (no per-site changes needed).
• banner.js reactivates a loader only once its category is granted (on decision, and on load for returning visitors).
• Inline gtag('config', …) is left in place but inert — harmless without the loader.
• Cache-safe: the blocked state is what gets cached; unblocking is per-visitor JS.

Category mapping: gtag.js / analytics.js / ga.js → Analytics; gtm.js → Marketing.

New site overrides (optional, in wp-config.php)

• define('LMG_CONSENT_BLOCKING', false); — disable blocking on a problem site.
• define('LMG_CONSENT_EXTRA_PATTERNS', [['regex'=>'~…~i','category'=>'analytics']]); — block a non-standard loader.

Compatibility

No back-compat changes — cookie/option/table keys, the m_consent:change / lmg_consent:change events, and the [m_cookie_preferences] / [lmg_cookie_preferences] shortcodes are unchanged.

1.1.1

Fix: banner now stays fixed to the bottom of the viewport on themes using transform-based smooth scrolling (GSAP ScrollSmoother, Locomotive, etc.). The banner/modal are re-parented to <body> on load so position: fixed is no longer voided by a transformed ancestor.

1.1.0

First public release of LMG Consent (rebranded from “M Consent”).

• GDPR/CPRA cookie-consent banner with Google Consent Mode v2
• Global Privacy Control (GPC) auto-opt-out
• Consent log with daily retention purge
• Privacy-link fallback to the WordPress Privacy Policy page
• GitHub-based self-updates (this release is the baseline)

Back-compat: storage keys, [m_cookie_preferences] shortcode, and the
m_consent:change event are retained, with lmg_* aliases.