Release
Consent Manager 1.1: nothing loads before consent, Moodle 5.3
Consent Manager 1.1 blocks every request to a service before consent in whitelist mode, also from players other plugins create, and asks managers and teachers for consent too. For Moodle 4.5 to 5.3. Check whitelist mode before you upgrade.
- Published
- 12 November 2026
- Version
- 1.1
- Runs on
- Moodle 4.5 – 5.3
- Plugin
- Consent Manager
Consent Manager 1.1 supports Moodle 4.5 to 5.3. In whitelist mode, browsers now send nothing to a service before consent, including from players that other plugins create, such as Vimeo and YouTube in Video Time or H5P interactive videos. Managers and teachers now give consent like learners. Using whitelist mode? Read Before you upgrade first: whitelist mode now blocks more, and a login page with reCAPTCHA needs one setting before you update.
Nothing loads before consent
Whitelist mode blocks every request to a service before consent, without changes to other plugins. Where there is no element to put a placeholder in, an alert at the top of the page asks for consent. This includes content that H5P writes into frames.
Blocked sites
A new page, Blocked sites (Site administration > Users > Privacy and policies), lists the sites whitelist mode blocked, with Always allow for the ones you trust.
Consent for managers and teachers
Managers and teachers now give consent like learners. The upgrade removes View blocked external content without consent from all role definitions; overrides in categories, courses and activities stay.
Status checks
Moodle’s status checks warn when Policies is not the site policy handler, and that blacklist mode does not block content that other plugins load in the browser.
Services that cover more
The default services know more domains of YouTube, Vimeo and Google Maps, where you did not change their domains, and service domains now cover their subdomains, such as m.youtube.com. Poster images, text tracks, background images, scripts, stylesheets and SVG images of services no longer load before consent.
Fixes
Embeds from sites without a service, such as Google Maps, load again in blacklist mode. Videos from the multimedia plugins and YouTube or Vimeo embed codes keep their size and position after consent. The consent and withdraw buttons work on Moodle 5.2 and 5.3, and Withdraw consent only appears where withdrawing hides the content again.
Guides
New guides for administrators, managers, teachers, students and developers.
Consent only for yourself
The web service function filter_consentmanager_accept_policy and the pre-built Consent Manager external service are removed. Users give and withdraw consent only for themselves, and only for the active policy version of an enabled service. Output is escaped in placeholders, alerts and the service list, and service logos come only from uploaded files.
Moodle 4.5 to 5.3
Consent Manager 1.1 supports Moodle 4.5, 5.0, 5.1, 5.2 and 5.3, with Policies (tool_policy) as the site policy handler.
Before you upgrade: whitelist mode
Only sites in whitelist mode are affected; in blacklist mode, the default, nothing changes. Whitelist mode now covers every request, including scripts, styles and fonts, so features that load from other sites stop working until you allow those sites. Most important: with reCAPTCHA on the login page, nobody can log in, administrators included. Before you upgrade, add a service without a policy for www.recaptcha.net and www.gstatic.com, or switch reCAPTCHA off. If you are locked out, switch back to blacklist mode on the server: php admin/cli/cfg.php –component=filter_consentmanager –name=mode –set=blacklist. MathJax formulas show as TeX code until you host MathJax yourself or allow cdn.jsdelivr.net. Also affected: PayPal, TinyMCE premium plugins, Gravatar, OAuth 2 login icons, external tools shown in a frame and code in Additional HTML. After the upgrade, the Blocked sites page lists what was blocked.
After the upgrade
Allow View blocked external content without consent again for roles that should see external content without consent. Upload logos for services whose logo was only stored as an address. All upgrade steps are in the administrator guide. Back up your site before upgrading, as always.
Stay inspired
Never miss a release note
Join the Product Hub for your plugins and get news about releases, webinars and design packages by email. Free sign-up on bdecent.io.
