Hooks, filters & shortcodes

CartConsent is standard, hook-friendly WordPress and WooCommerce. Everything below is stable surface you can build on; the complete, versioned reference lives in the plugin repository.

Shortcodes

Shortcode	What it renders
`[crw_manage_consent]`	A “Manage cookie preferences” link/button that reopens the preference center. Put it in your footer.
`[crw_dsar_form]`	The data-subject request (DSAR) intake form — access, delete, correct, or do-not-sell.

Legal documents are placed as WordPress pages by CartConsent → Documents, using a block. You don't need a shortcode for them — but you can drop the generated page anywhere with the core page/link tools.

WooCommerce capture points

Capture is consent-first by design: it hooks the completed checkout, never keystrokes. The plugin listens on the standard WooCommerce actions, so anything that creates a real order — classic checkout or the Store API / Checkout Blocks — is captured consistently:

woocommerce_checkout_order_processed — classic checkout capture.
woocommerce_store_api_checkout_order_processed — Cart/Checkout Blocks capture.
woocommerce_payment_complete and woocommerce_order_status_changed — mark a cart recovered and stop its sequence.

Orders are always read with wc_get_order(), so the plugin is HPOS-safe. If you build custom checkout flows, firing these standard actions is all that's needed for capture to work.

The consent checkbox on checkout

On the classic checkout, the marketing-consent checkbox renders at woocommerce_review_order_before_submit. On the Blocks checkout it's a real, server-verified additional checkout field registered via woocommerce_register_additional_checkout_field — so the opt-in is trustworthy, not client-side JavaScript you have to trust.

WordPress privacy tools

CartConsent registers with the core privacy framework, so the built-in Tools → Export Personal Data and Tools → Erase Personal Data include captured carts and consent records. DSAR requests submitted through [crw_dsar_form] are queued in the admin with a deadline, and a delete/opt-out request propagates a suppression and consent-withdrawal once you verify and complete it.

Email templates

Recovery emails send through wp_mail(), so your existing SMTP/mail plugin and deliverability settings apply. Merge tags available in subject and body:

Tag	Value
`{first_name}`	Shopper's first name, when known
`{store_name}`	Your store name
`{cart_items}`	The abandoned cart's line items
`{cart_total}`	Cart total, formatted
`{recovery_url}`	One-click cart-restore link
`{coupon_code}`	The single-use recovery coupon, when a step offers one

 
Every recovery email includes a CAN-SPAM-compliant footer (your store's postal address) and an
    RFC 8058 one-click List-Unsubscribe header automatically.
 Constants (wp-config.php)
  Constant Purpose
  CARTCONSENT_CRYPTO_SECRET Set a 64+ char secret so the at-rest email-encryption key never lives in the database (full-DB-dump protection).
 
 
 Extending in code
 
The plugin exposes filters for the consent decision, capture eligibility, and recovery scheduling.
    Because these evolve per release, the authoritative list — with signatures and examples — is kept
    next to the code in the repository readme
rather than duplicated here where it could drift.
 
 
Need an integration point that isn't here yet? Tell us what you're
    building — hooks are cheap to add when there's a real use case.