Title: Cookie Consent Banner — PDPL, GDPR & Arabic RTL (Arqam360)
Author: arqam360
Published: 28. April 2026
Last modified: 6. Oktober 2026
---
Search plugins
# Cookie Consent Banner — PDPL, GDPR & Arabic RTL (Arqam360)
By [arqam360](https://profiles.wordpress.org/arqam360/)
[Download](https://downloads.wordpress.org/plugin/arqam360-consent-privacy-pdplgdpr.2.2.1.zip)
* [Details](https://de-ch.wordpress.org/plugins/arqam360-consent-privacy-pdplgdpr/#description)
* [Reviews](https://de-ch.wordpress.org/plugins/arqam360-consent-privacy-pdplgdpr/#reviews)
* [Installation](https://de-ch.wordpress.org/plugins/arqam360-consent-privacy-pdplgdpr/#installation)
* [Development](https://de-ch.wordpress.org/plugins/arqam360-consent-privacy-pdplgdpr/#developers)
[Support](https://wordpress.org/support/plugin/arqam360-consent-privacy-pdplgdpr/)
## Description
Arqam360 makes Google and Meta tags work properly with consent on WordPress sites
in the Middle East and North Africa: company websites first, and WooCommerce stores
too. The banner renders natively in Arabic, right to left, and in English, and asks
before analytics and advertising tags run, so Google and Meta receive the visitor’s
real choice instead of guessing.
The plugin loads the banner in the page ``, before any other script WordPress
prints, so the Google Consent Mode v2 «denied» default is in place before your tags
read it. When the visitor chooses, the banner updates Consent Mode, records the
decision with its date and time, and keeps the settings reachable so consent can
be withdrawn at any time.
**The free plan** covers one domain and 10,000 pageviews a month, with no time limit
and no credit card: the Arabic and English banner, Saudi PDPL, UAE PDPA and GDPR
rules, Google Consent Mode v2, Global Privacy Control, a bilingual cookie declaration
and a consent log you can export.
**Pro ($29.99/month)** adds the full cookie scanner, a data-request portal, script
and request blocking until consent, and server-side forwarding of consented events
to Meta Conversions API, GA4, server-side Google Tag Manager, TikTok, Snap, LinkedIn
and others.
**Managed** is for businesses that want it done for them: the Arqam360 team installs
the banner, wires Consent Mode, tests your Google and Meta tags and maintains the
setup, for $299 one-off plus $99.99/month per domain.
**Features**
* **Arabic and English** — native right-to-left Arabic, pinned or following the
visitor’s language
* **Google Consent Mode v2** — denied by default in ``, updated on the visitor’s
choice
* **Saudi PDPL, UAE PDPA and GDPR** — with optional detection of the visitor’s
regime by country
* **Consent log** — every decision stored with its date, time and categories, exportable
as CSV
* **Bilingual cookie declaration** — every cookie described in English and Arabic
* **124-pattern cookie classifier** — 37 of the patterns cover services common
in this region, so the scanner can sort local cookies into the right category
* **Script and request blocking** — optional, holds trackers that ignore Consent
Mode until consent
* **Global Privacy Control** — honoured as an opt-out signal
* **WP Consent API** — passes the visitor’s choice to plugins that read it, such
as Google Site Kit’s Consent Mode, WooCommerce and WP Statistics
* **Cookie scanner, data-request portal and server-side events** — on Pro
* **Audience activation** — sync consented first-party segments to ad platforms(
Managed plan)
* **Dashboard inside wp-admin** — opens your Arqam360 dashboard without leaving
WordPress
Works on any WordPress site, with or without WooCommerce.
### Tag manager placement
The plugin loads its script in the document ``, before any other script
WordPress
prints, so the Google Consent Mode v2 «denied» default is set before your tags read
it.
There is one case it cannot control. If your Google Tag Manager or GA4 snippet
is pasted directly into your theme’s `header.php` **above** the `wp_head()` call,
that snippet runs before anything WordPress outputs, including this plugin — and
it will read no consent state.
Two ways to be sure:
* Move the GTM snippet below `wp_head()` in your theme, or
* Install GTM through this plugin’s container guidance instead of hardcoding it.
If you manage tags entirely inside a GTM container loaded via a plugin or
wp_head,
no action is needed.
### Content Security Policy
Most sites have no CSP and need nothing here. If yours sends one — directly, or
through a security plugin — the widget needs three allowances, and it fails silently
without them: the browser blocks the script and no banner appears, which looks like
the plugin is broken rather than like a policy is doing its job.
* `script-src https://cdn.arqam360.com` — the banner script itself.
* `connect-src https://api.arqam360.com` — fetching your widget configuration
and recording consent decisions.
* `style-src 'unsafe-inline'` — the banner builds its stylesheet at runtime so
it can carry your colours and position. If your policy cannot allow inline styles,
tell us and we will work through the alternatives with you rather than have you
weaken the policy site-wide.
The widget contacts no other host. It loads no external fonts and no
third-party
resources.
If you embed the Arqam360 dashboard inside wp-admin, that page additionally
needs`
frame-src https://app.arqam360.com`. That applies only to the wp-admin screen, never
to your public pages.
### Credentials
The plugin uses two credentials from your Arqam360 dashboard, in the same way
Stripe
uses a publishable key and a secret key:
* **Widget Key** (`ciq_live_...`) — public. It appears in your page source and
loads the consent banner. This is by design; it authorizes the banner and nothing
else.
* **Site Token** (`ciq_sk_live_...`) — secret. It opens your Arqam360 dashboard
inside wp-admin and is never written to your pages. It is shown once, when you
create it.
The two are not interchangeable and the settings page will refuse a credential
pasted into the wrong field.
### External Services
This plugin connects to the Arqam360 service to function:
1. **Arqam360 CDN** (cdn.arqam360.com) — The consent banner JavaScript is loaded from
Arqam360’s CDN. This script renders the cookie consent banner on your site and
handles consent collection. No personal visitor data is sent to the CDN; it only
serves the static JavaScript file.
2. **Arqam360 API** (api.arqam360.com) — When a Widget Key is configured, the plugin
fetches your widget configuration (colors, text, position, compliance settings)
from the Arqam360 API. Consent records are also sent to this API for storage and
analytics. Your Widget Key authenticates these requests. If a Site Token is also
configured, it is used only to open the dashboard inside wp-admin, and is sent
from your server to api.arqam360.com over HTTPS — never to a visitor’s browser.
A free Arqam360 account is required (free forever for the consent banner, no credit
card). Sign up at [arqam360.com](https://arqam360.com).
* [Terms of Service](https://arqam360.com/terms)
* [Privacy Policy](https://arqam360.com/privacy)
### For agencies and developers
If you build WordPress or WooCommerce sites for clients, Arqam360 runs a partner
programme. Your client subscribes to Arqam360 directly and you earn 20% of what
they actually pay, for 12 months from their first paid invoice.
You install nothing extra and support nothing — we handle the consent side. A
client
who stays on the free plan earns you nothing, so this is worth it where you are
already recommending a paid tool.
Terms, including how referrals are attributed and how payouts work:
https://arqam360.
com/partners
## Installation
1. In wp-admin go to **Plugins > Add New**, search for Arqam360, then Install and
Activate.
(Or upload the zip under Plugins > Add New > Upload Plugin.)
2. Create a free account at arqam360.com if you do not have one.
3. In your Arqam360 dashboard open **API Keys** and copy both credentials:
the **
Widget Key** (`ciq_live_...`) and the **Site Token** (`ciq_sk_live_...`). The Site
Token is shown only once, when you create it.
4. Back in wp-admin go to **Arqam360 > Settings**, paste both, and save.
5. Load your site in a private window — the banner appears immediately.
The Widget Key runs the banner. The Site Token opens your Arqam360 dashboard
inside
wp-admin. See Credentials below for why there are two.
## FAQ
### Do I need a separate account?
Yes. Sign up at arqam360.com: the free plan needs no credit card and has no time
limit. New accounts get a 14-day Pro trial. Pro is $29.99/month; Managed, where
our team installs and maintains the setup, is $299 one-off plus $99.99/month per
domain.
### How do I add an Arabic cookie banner to my WordPress site?
Install this plugin, paste your Widget Key and Site Token under Arqam360 > Settings,
and open your site in a private window: the banner appears in Arabic for Arabic-
speaking visitors, laid out right to left. You can also pin it to Arabic or English
in Settings.
### Does a business website in Saudi Arabia need a cookie banner?
There is no Saudi law written specifically for cookies, but the Personal Data Protection
Law treats data from a cookie that can identify a visitor as personal data. Analytics
and advertising tags therefore normally need the visitor’s consent first, which
is what the banner asks for and records. Our Saudi PDPL guide explains it: https://
arqam360.com/regulations/saudi-pdpl
### Does this work without WooCommerce?
Yes! Works on any WordPress site.
### What is Google Consent Mode v2?
Google requires consent signals before tracking tags fire. Without it, your ads
lose conversion tracking. This plugin handles it automatically.
### Does it support Arabic?
Yes. The banner is written natively in Arabic and laid out right to left, and the
plugin’s own settings screens support Arabic wp-admin too.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Cookie Consent Banner — PDPL, GDPR & Arabic RTL (Arqam360)” is open source software.
The following people have contributed to this plugin.
Contributors
* [ arqam360 ](https://profiles.wordpress.org/arqam360/)
[Translate “Cookie Consent Banner — PDPL, GDPR & Arabic RTL (Arqam360)” into your language.](https://translate.wordpress.org/projects/wp-plugins/arqam360-consent-privacy-pdplgdpr)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/arqam360-consent-privacy-pdplgdpr/),
check out the [SVN repository](https://plugins.svn.wordpress.org/arqam360-consent-privacy-pdplgdpr/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/arqam360-consent-privacy-pdplgdpr/)
by [RSS](https://plugins.trac.wordpress.org/log/arqam360-consent-privacy-pdplgdpr/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 2.2.1
* Arabic wording: the plugin now says «ملفات تعريف الارتباط», the term Arabic speakers
search for and Google’s own Arabic uses, instead of «ملفات الارتباط». The banner
itself comes from the Arqam360 CDN and already shows the new wording, with per-
language custom text set from the Arqam360 dashboard.
#### 2.2.0
* **WP Consent API support.** When the WP Consent API plugin is active, the visitor’s
choice in the Arqam360 banner is passed on to it: analytics to «statistics» and«
statistics-anonymous», marketing to «marketing», preferences to «preferences»,
and «functional» is always allowed. Plugins that read the WP Consent API, including
Google Site Kit’s Consent Mode, now follow the banner. Before this, with no consent
plugin registered, the WP Consent API reported every category as allowed, whatever
the visitor chose. The plugin also declares itself compatible, so Site Health
no longer lists it as unregistered, and describes its consent cookie to the API.
Without the WP Consent API installed nothing changes.
#### 2.1.0
* Settings page now tells agencies and developers the partner programme exists —
20% of what a referred client pays, for 12 months. Shown only on the plugin’s
own settings page, never as an admin notice, and it tracks nothing: attribution
happens at signup on arqam360.com, not inside wp-admin.
#### 2.0.9
* Split loading now supports regime auto-detection, so choosing it no longer costs
you the per-visitor rule set. Previously, enabling auto-detection quietly switched
you to the larger combined file because only that one implemented it.
#### 2.0.8
* **Arabic admin.** The plugin’s own settings and dashboard screens now lay out
right-to-left correctly. The panel previously reserved space for the admin menu
on the wrong side, so the dashboard slid under the menu on Arabic installs. Arabic
translations added for every string introduced in 2.0.7.
* **Banner language** can now be pinned to English or Arabic instead of following
each visitor’s browser.
* **Page caches are purged when you save settings.** WP Engine, WP Rocket, W3 Total
Cache, WP Super Cache, SiteGround Optimizer, LiteSpeed and Cache Enabler are
all handled. Rotating your key no longer leaves a cached page serving the old
one.
* Regime auto-detection now always serves the script that implements it, instead
of appearing to be on while doing nothing under split loading.
* Documented the Content Security Policy allowances the widget needs.
#### 2.0.7
* Tested against WordPress 7.1.
* **Security.** The plugin now uses two separate credentials: a public Widget Key
for the banner and a secret Site Token for the dashboard. Previously one key
did both jobs, which meant the credential printed in your public page source
could also open your Arqam360 account. Your banner keeps working after this update
with no changes; to use the dashboard inside wp-admin, add a Site Token in Settings.
* **Fixed: Google Consent Mode v2 could fire too late.** The script was loaded
in the page footer with `async`, so tags placed in `` could run before
the «denied» default was set. It now loads synchronously in ``, before
any other script WordPress prints. See the new «Tag manager placement» section
for the one case this cannot cover.
* **Fixed: the «Respect Global Privacy Control» setting did nothing.** It was saved
but never sent to the widget, so unchecking it had no effect. It is now honoured.
* Removed the IAB TCF option. It was never sent to the widget, and Arqam360 is
not a registered IAB CMP, so enabling it would have produced a consent string
that ad-tech vendors reject. It will return once registration is complete.
* Split loading is now the default: a 3KB script sets the consent default immediately,
then the banner loads in the background.
#### 2.0.6
* Listing copy updated to reflect the freemium model — banner is free forever (
no credit card), premium features (scanner, DSAR, server-side events, audiences)
gate behind paid plans. New accounts still get a 14-day Pro trial.
#### 2.0.5
* Removed wordpress.org directory assets (icon-256×256.png) from the plugin zip;
these are now uploaded separately via SVN per WordPress.org plugin guidelines.
#### 2.0.4
* Settings page redesigned with card-grouped sections matching the Arqam360 dashboard
look
* Dashboard empty state refreshed with brand styling and clearer CTAs
* Inline `