Nova Sanctum - Per-State Cookie Consent for WordPress
Most consent plugins are built for the EU and treat the United States as one checkbox. Nova Sanctum resolves each visitor down to the state and applies the rules that actually apply there. An opt-out state gets opt-out behavior. A strict regime gets opt-in. A visitor it cannot identify gets the strictest setting, every time.
Built to fail closed
When the plugin cannot identify a visitor with confidence, it gates the trackers instead of guessing. Everything here runs on your server or in the visitor's browser.
Per-state resolution - 19 US states plus a generic US opt-out baseline, Canada under PIPEDA, and Quebec under Law 25 with express consent. In an opt-out state analytics can run by default while the ad pixel waits. Quebec visitors get the bundled French banner strings automatically.
Strict when uncertain - An unknown country, the EU, Quebec, or a visitor arriving through a VPN, TOR exit or public proxy is treated as strict: everything stays parked until they opt in. Unverifiable IPs resolve to strict rather than to permissive.
Cache-safe by design - Every non-essential tag is parked uniformly, so the cached HTML is byte-identical for every visitor regardless of jurisdiction. The browser unparks what is allowed after the fact. This is what keeps the banner correct under WP Rocket and other full-page caches.
GPC and Do Not Sell - A Global Privacy Control signal is honored as an opt-out on every page load, even against a stored accept, in the states that require it. Optional Do Not Sell or Share link for the banner and a persistent footer link, off by default.
Proof-of-consent log - An anonymized log recording the action, resolved state, active profile, rules version, and whether GPC was present, with CSV export. A recorded opt-out is kept for 24 months and the visitor is not re-asked for 12, so cookie expiry alone can never re-enable tracking.
Privacy Law Radar - A cron-driven ingest of authoritative privacy-law feeds, keyword-tagged by topic and surfaced on an admin screen, so a new state act does not quietly make your configuration stale. No AI and no third-party API. It only fetches the feeds you configure.
Consent that actually holds the line
Signalling a tag to behave is not the same as stopping it from loading. Nova Sanctum stops it from loading.