Marketing Source Tracking is a WordPress plugin that remembers where a visit came from and adds that source to the form submission. It was built by BeeClear, a maker of WordPress plugins and smartphone apps. Here we look at one trait: tracking starts only after the visitor consents. Consent comes from Google Consent Mode v2, the Google mechanism that passes a banner decision on to tags, and the Global Privacy Control signal counts as a refusal. An erasing opt-out, masking, queue encryption and retention complete the picture.
Table of contents
- What does consent-based marketing source tracking mean?
- How does the plugin read consent from Google Consent Mode v2?
- What happens when a visitor refuses or withdraws consent?
- Why does the Global Privacy Control signal count as a refusal?
- How can visitors erase their data and switch tracking off?
- How does the plugin mask personal data in logs and the visitor table?
- Why encrypt the submission queue with AES-256-GCM?
- How long does Marketing Source Tracking keep source data?
- Where do you start setting up consent-based tracking?
What does consent-based marketing source tracking mean?
Consent-based marketing source tracking means the plugin records nothing about a visitor before they allow analytics. The source here means the UTM parameters in the link plus the referring site. Marketing Source Tracking keeps them only once the browser holds the bcafc_visitor cookie. That cookie is created only after an explicit grant and holds just a random token. The source data itself sits in a dedicated table of the WordPress database.
There is no fallback identifier built from the IP address and browser details. Such a hash would be a device fingerprint and would rebuild the profile of someone who had cleared their cookies. Without consent, there is no profile and no row in the table. How the source reaches your CRM is covered in a separate article.
How does the plugin read consent from Google Consent Mode v2?
The plugin reads consent from Google Consent Mode v2 straight from the page’s data layer. Its script watches for consent default and update commands, and the analytics_storage category decides the outcome. Because the plugin reads the standard itself, it works with any consent tool that supports Consent Mode v2. Another category can be added on the Marketing tracking screen as a custom source of the Consent state type.
A decision the visitor actually made always beats the default state. Consent Mode re-declares that default on every page load, and the plugin never lets it overwrite a recorded choice. Consent often arrives minutes after landing, so the script keeps checking at growing intervals for about eight minutes. The grant also carries the current page address, which saves the campaign behind the first visit.
On sites running Complianz, Marketing Source Tracking 1.20 and later also reads the Statistics decision straight from the Complianz cookie, without waiting for Consent Mode. A separate article covers that integration, including the entries it adds to the cookie policy.
What happens when a visitor refuses or withdraws consent?
When a visitor refuses or withdraws consent, the plugin deletes the bcafc_visitor cookie and stops collecting. A source recorded earlier is not wiped on the spot. It expires with the retention window, because a withdrawal works going forward. Here is how the plugin responds in each case:
| Situation | Tracking | bcafc_visitor cookie | Stored records |
|---|---|---|---|
| refusal in the consent banner | never starts | never created | nothing to remove |
| consent withdrawn in the banner | stopped | deleted | expire with the retention window |
| GPC signal with no earlier consent | never starts | never created | nothing to remove |
| opt-out box ticked | stopped | deleted | deleted right away |
Without consent, a form can still receive the campaign from the current page URL, with nothing stored in the browser. An optional setting carries the parameters across internal links. It is off by default. It lengthens addresses, and the parameters can reach an external site in the referrer header.
Why does the Global Privacy Control signal count as a refusal?
The Global Privacy Control signal counts as a refusal because Marketing Source Tracking treats it as an objection to tracking. Technically, GPC is the Sec-GPC: 1 header a browser sends to every site. The Honour the Global Privacy Control browser signal option is on straight after installation. A visitor sending it gets neither the consent script nor decorated links, and no source data is collected.
The signal is read on every request and never stored. Turning GPC off therefore ends its effect at once. The exception is someone who had already consented to tracking on this site. Their own decision takes priority over a browser-wide preference. While GPC is active, the shortcode’s opt-out box is locked and shows a note about the signal.
How can visitors erase their data and switch tracking off?
Visitors can erase their data and switch tracking off with a single checkbox from the [bcafc_tracking_optout] shortcode. Place it on your privacy policy page. Ticking the box deletes the visitor’s record from the database along with the bcafc_visitor cookie. The plugin then sets a bcafc_optout objection cookie that lasts a year, so the refusal doesn’t quietly expire. Unticking the box allows tracking again.
This switch answers a request for erasure, which a banner withdrawal deliberately doesn’t. Its default label reads “Delete my data and stop collecting it”. The label attribute lets you change the wording or the language. On cached pages with an expired security token, the script fetches a fresh one and retries the save.
How does the plugin mask personal data in logs and the visitor table?
Masking of personal data covers the email addresses and phone numbers the plugin stores in WordPress. The Store masked contact data in marketing tracking option is on from the start. An email address then keeps its first letter and its domain, as in j***@example.com. A phone number keeps its first three and last two characters, as in +48***89. Switching the option on also masks contacts already saved in the Stored visitors table.
Logs recognize emails and phone numbers by the shape of the value, not by the field name. Fields whose names contain token, password, secret, api_key or authorization are replaced with asterisks. The last 50 warnings and errors are kept in masked form even when logging is off. Masking applies to the copy in WordPress – your CRM still receives the full form data.
Why encrypt the submission queue with AES-256-GCM?
Encrypting the queue with AES-256-GCM protects the full form data waiting in the database to be sent to your CRM. A job leaves the queue once it succeeds, fails for good or is cancelled. The Encrypt queued form data option is off by default. The key stays outside the database, so a database copy alone won’t reveal queued submissions. Retries and the queue screen are covered in a separate article.
The key can live in one of two places. The first is a BCAFC_ENCRYPTION_KEY constant in wp-config.php or the server environment, and the settings screen generates that line in your browser without sending the key to WordPress. The second is a randomly named key file in wp-content, with permissions the plugin tries to restrict to 0600. Saving the setting runs an encryption and decryption test, and the screen shows the result. A lost key leaves waiting jobs unreadable, so include the key file in your backups.
How long does Marketing Source Tracking keep source data?
Marketing Source Tracking keeps source data for 30 days after it was last detected, unless you change it. You set the retention window in the Tracking lifetime field, in minutes, hours or days. Later visits within that window renew the cookie and the record. A daily WP-Cron task removes expired rows, and a new value applies only to future visits.
The Stored visitors table shows Last seen and Expires columns for each record. You can remove a single row with the Delete button or all of them with Delete all. When you uninstall the plugin, its records stay in the database unless you enabled Delete plugin data on uninstall beforehand. That option removes the settings, mappings, logs, queue, visitor table and managed key file.
Where do you start setting up consent-based tracking?
You start setting up consent-based tracking on the Global settings screen. Follow these steps in the order the admin shows them:
- turn on Marketing tracking and keep consent state sync enabled,
- check the data layer name if your Google Tag Manager uses a different one,
- leave the Global Privacy Control option switched on,
- add the [bcafc_tracking_optout] shortcode to your privacy policy page,
- set the retention window and decide on queue encryption.
The plugin provides the mechanisms, while describing the processing in your privacy policy remains the site owner’s job. Marketing Source Tracking comes as a Premium plugin, which you can try for 3 days. Pricing and details are on the Marketing Source Tracking plugin page.
