[B] Easy RGPD & Cookies (España)

No. If a page with the same slug already exists (for example, politica-de-privacidad), the plugin reuses it and never overwrites its content. Pages auto-created by the plugin can be freely edited in the WordPress editor. The only time content is reset is when you explicitly click "Restore Default Content" inside the RGPD → Legal Pages panel — and even then, you get a confirmation prompt first.

Documents are stored in wp-content/uploads/beasy-rgpd-secure/{REQUEST_CODE}/ under a randomly generated 24-character filename. The directory is protected by an .htaccess file with Require all denied, a web.config with deny users="*", and a silent index.php. Downloads are only possible from the WordPress admin panel via a nonce + capability-checked AJAX endpoint. When a request is closed, the file is automatically deleted unless the administrator explicitly marks "Retain Document" — satisfying RGPD data minimization requirements.

No. The decision to show or hide the banner is made entirely in the browser based on a first-party consent cookie. The HTML served from cache is identical for all visitors; the banner visibility logic runs in JavaScript after page load. This means aggressive full-page caching does not interfere with the consent flow at all — the banner appears correctly for new visitors and stays hidden for returning visitors who have already consented.

No. Only a salted SHA-256 hash of the IP address is stored — it is not reversible and cannot be used to identify an individual. However, it is sufficient to demonstrate the uniqueness of each consent record if the AEPD requests proof. This approach aligns with the pseudonymization principle under RGPD Art. 4(5) and the AEPD's own guidance on consent logging.

The scanner crawls your public URLs server-side, detects third-party service references in the HTML, captures cookies sent via Set-Cookie headers, and cross-references a built-in catalog of over 12 major providers to propose the cookies those services typically set. It does not execute JavaScript, so cookies deposited by client-side scripts (such as _ga from Google Analytics or _fbp from Meta Pixel) are inferred from the catalog rather than observed directly. Human review of the proposed inventory before publishing is always recommended — the scanner is a productivity tool, not a substitute for due diligence.

No. The blocker only targets hosts explicitly listed in the block list — by default, known analytics and advertising third parties. Scripts belonging to your theme, page builder (Elementor, Divi, Beaver Builder, etc.), WooCommerce, or other essential plugins are never blocked. You can review and customize the block list at any time from RGPD → Cookie Settings → Block List.

Every consent record stores a canonical JSON object containing the exact button labels, category names and descriptions, accent color, interface locale, and plugin version that were active at the moment of consent — plus a SHA-256 hash of that JSON for tamper detection. If the AEPD audits your site and asks "what did user X see on date Y?", you can export a PDF of that consent record showing the rendered banner snapshot alongside the consent metadata. This is the level of documentation the AEPD's 2024 cookie guide implicitly requires for demonstrating valid, informed consent.

Yes. Go to RGPD → Settings → Cookie Banner and toggle the banner off. The legal pages, ARCO+ rights form, consent audit log, cookie inventory panel, and all shortcodes continue to work normally. This is useful if you are deploying the banner through a separate tool (such as a tag manager) but still want the plugin's legal page management and rights request workflow.

A WP-Cron job runs daily and deletes consent records older than the retention period configured in RGPD → Settings → Data Retention (default: 24 months, the AEPD maximum). The purge is logged in the WordPress debug log when WP_DEBUG_LOG is active. You can reduce the retention period at any time; you cannot set it above 24 months, which prevents accidental over-retention.

The plugin is designed and tested for standard single-site WordPress installations. Multisite (network) activation is not officially supported in the current version. Each subsite in a network would need the plugin activated individually at the site level. Full Multisite/network-admin support is on the roadmap for a future release.

By default, uninstalling the plugin removes only the plugin settings options and scheduled cron hooks. Consent logs, rights request records, and legal pages are preserved — because deleting audit records during an uninstall could itself constitute a compliance violation. If you want a full data wipe (for example, when decommissioning a site), you can enable it by adding the filter add_filter('beasy_rgpd_delete_data_on_uninstall', '__return_true'); before uninstalling. This will drop the database tables and delete the secure document upload directory.

A license covers one year of plugin updates and priority support. After expiration, the plugin continues to function with all features intact — nothing is disabled or removed from your site. You lose access to automatic updates and support until you renew. You will receive expiration warning notices in the WordPress admin starting 7 days before the renewal date, with a 3-day grace period after expiration before the warning becomes persistent.