Unified a fragmented franchise network into one privacy-first WordPress platform.

A national franchise network with dozens of locations across the country had a digital problem that was actually three digital problems. Their web presence was fragmented across individual subdomains — diluting national brand authority, splintering local SEO equity, and creating an administrative nightmare. The visitor experience needed to be friction-free in emotionally sensitive moments. And the legal environment around privacy had moved underneath them, with state-by-state regulations making third-party tracking a growing liability.

I unified all three problems on a single custom WordPress platform: one domain, zero cookie consent banners, and an architecture that pools SEO authority while keeping each franchise’s data cleanly separated.

The situation.

The client operates a national franchise network in a regulated, emotionally sensitive industry. Dozens of locations, each previously running on its own subdomain — location1.brand.com, location2.brand.com, and so on. Each subdomain had its own SEO authority (or lack of it), its own admin interface for the local team, and its own technical maintenance overhead. The corporate team couldn’t enforce brand consistency without manually intervening at each subdomain. The franchisees couldn’t get the SEO lift of being part of a national brand because every subdomain was treated by search engines as an effectively independent site.

The customer-facing problem was just as significant. Many visitors arrive at the site during a difficult moment. Cookie consent banners, intrusive geolocation prompts, and the standard adtech apparatus aren’t just annoying in that context — they’re an emotional barrier between a person who needs help and the local team that can provide it.

And the legal layer was tightening fast. CCPA in California. CPA in Colorado. A growing patchwork of state privacy laws with the same general direction: unconsented third-party data collection is now a real liability, with meaningful penalties.

The constraints.

The brief was unusual in how absolute it was:

• One unified platform, no subdomains. Consolidate SEO authority, simplify operations, and give the corporate team direct governance.
• Strict data isolation between franchises. Each local team should only see and edit their own content, with no possibility of cross-contamination.
• Zero cookie consent banner. Every integrated service had to operate as a “service provider,” not a third-party data collector. No analytics tag, no embed, no widget that triggered consent requirements.
• Frictionless geolocation routing. No standard “Allow Location” browser prompt (rejection rates are too high). Users should arrive at their local franchise’s page without ever being asked.
• Automated onboarding for new franchises. As the network grows, adding a new franchise should take minutes, not days.
• Server-to-server marketing attribution. Franchisees fund their own Google Ads campaigns and need ROI reporting — even though front-end ad tracking was off the table.

What I built.

A single hierarchical custom post type, not a multisite or per-location CPT.

The foundational architectural decision was rejecting two tempting wrong answers.

WordPress Multisite was out: syncing a centralized content library across dozens of siloed sub-site databases creates compounding performance and maintenance overhead. Per-location custom post types were also out: generating a unique CPT for every franchise location requires flushing rewrite rules on every onboarding, bloats ACF location rules, and complicates global API routing.

Instead, every location lives in a single hierarchical custom post type, with each franchise’s data isolated by a custom taxonomy. PublishPress Permissions enforces strict editing scope: when a local franchisee logs in, they’re mathematically locked into editing only their hierarchical page tree. Corporate retains a centralized content library for global messaging; franchisees retain control of local pricing and listings.

This architecture pools the SEO equity of every location into a single domain. It keeps the database optimized. And it scales linearly with franchise count — adding the 100th location adds no architectural complexity over the 10th.

Privacy infrastructure built for zero consent friction.

To achieve full compliance without a consent banner, every integrated service had to be a “service provider” — performing a function for the site rather than collecting behavioral data on its visitors.

I started by hardening WordPress core: stripping the default outbound requests that leak IP addresses (emoji service, oEmbed discovery, Gravatars). Then I went through each third-party integration in the original stack.

Video hosting moved away from YouTube. Even in “privacy-enhanced” mode, YouTube writes tracking identifiers to local storage and passes viewer IPs to Google — both of which trigger consent obligations. I migrated to a private video host with no advertising algorithms attached.

Google Business Profile reviews moved to server-side aggregation. Commercial review widgets execute third-party code in the visitor’s browser, which is exactly what consent regulations are designed to govern. Instead, the WordPress server connects directly to the Google API in the background, downloads review text, programmatically resizes and caches reviewer avatars to the local filesystem, and serves everything from the first-party domain. The visitor’s browser never connects to Google.

Edge-powered geolocation, no browser prompt.

Eliminating the “Allow Location” prompt meant moving geolocation off the browser entirely. I deployed the routing logic at the Cloudflare edge, capturing the user’s coordinates via CF-IPLatitude and CF-IPLongitude HTTP headers before any request reached the WordPress origin.

A custom PHP function uses the Haversine formula (Earth’s 3,959-mile mean volumetric radius) to calculate the precise distance between the visitor’s edge-determined coordinates and the ACF coordinates of every franchise location. Because IP geolocation is region-accurate but not pin-accurate, I used a “soft confirm” interface: the server sorts the closest locations to the top of the page in milliseconds, but the final choice always stays with the visitor.

For the interactive map UI, I used heavily customized Mapbox tiles, with a custom JavaScript hook that forcefully disables Mapbox’s built-in telemetry beacon. The visitor’s IP is used strictly to deliver map tiles. No behavioral logging.

Server-to-server marketing attribution.

Franchisees fund their own local Google Ads campaigns and need ROI proof. But the zero-tracking mandate banned front-end pixels like gtag.js. I engineered a custom dual-layered server-to-server attribution bridge.

When a user clicks a Google Ad, the system securely captures the anonymous Google Click Identifier (gclid) and stores it in a functional first-party cookie. On conversion, the server communicates directly with the Google Ads API in the background to report the conversion. For conversions that happen inside externally-hosted third-party iframes, the JavaScript dynamically injects the gclid into the iframe’s URL on page load, allowing the external developer’s server to report the conversion back to Google from its own infrastructure.

Only an anonymous encrypted hash crosses to Google. Zero personal data. CCPA and CPA compliance hold, and the franchisees get the campaign attribution they need.

One-click new-franchise onboarding.

Manually building out the hierarchical page tree, configuring ACF relationships, and assembling menus for every new location would have been the next operational bottleneck. So I built an Automated Franchise Constructor.

On a secure ACF Options page, a corporate admin types the new franchise name and clicks “Generate.” A custom PHP hook on acf/save_post fires the construction logic, which is then offloaded to the WordPress Action Scheduler so it runs in the background without blocking the request. The script systematically registers the hierarchical parent and child pages, assigns the franchise taxonomy term, compiles the localized navigation menu, and pre-populates the ACF flexible content layouts with global descriptions from the Centralized Content Library.

What used to be hours of tedious data entry per onboarding is now a single click.

The outcome.

• Frictionless visitor experience. Visitors land on their nearest franchise’s page without a single location prompt, without a consent banner, without any friction between intent and outcome.
• Consolidated SEO authority. Migrating from fragmented subdomains to a single domain pooled the brand’s national search equity, accelerating local rankings for every individual franchise.
• Infinite scalability. The automated onboarding lets the corporate team add new franchises in minutes, with zero technical overhead.
• Bulletproof compliance. The server-to-server attribution architecture gives the network complete marketing-ROI visibility while staying fully compliant with CCPA, CPA, and the growing patchwork of state privacy regulations.