Consent management for GDPR and CCPA
A consent banner that follows the rules for each visitor's region, speaks Google Consent Mode v2 to your tags, and keeps evidence you can show a regulator. One small script, nothing else to load.
What you get
Built for sites that run Google Tag Manager and a handful of marketing pixels, and for the agencies that look after them.
Visitors in the EEA, UK and Switzerland start opted out and choose to opt in. US visitors get the opt-out model. Other regions follow a default you set per site (opt-in unless you change it), and on plans that include geo rules you can choose opt-in, opt-out or no banner per country or state.
Consent defaults are set before Tag Manager boots, then updated on every choice. Events like cc_marketing_granted let any pixel wait for a yes.
Every choice is recorded with region, device and policy version. Optionally add a salted IP hash (pseudonymous, not a raw IP). Consent records never store a raw IP address.
Accept and decline trends, opt-ins per category, withdrawals, and a geography breakdown that drills from country to region to city.
We can scan a site to check the snippet is installed and placed correctly, spot competing consent tools, and inventory the trackers on the page with how to gate each one.
Register all your hostnames on one site and visitors see a single banner and share their choice across the subdomains.
Running consent for many client sites? We set up and manage them for you, and on plans that include it we can issue a provisioning API key so you can create sites and domains from your own tooling.
When a browser sends the GPC signal, visitors are opted out of every non-essential category automatically, and the signal is logged.
How it works
Paste the snippet into your page head, above Google Tag Manager. Register the hostnames your site answers on. That is the whole install.
Set the wording, colors and position, and choose the categories your tags belong to: analytics, marketing, preferences or your own.
Watch consent choices land in your logs, have your installation scanned for gaps, and pull up the evidence whenever someone asks.
Pricing
Start with one site on Starter. Move up when you need more sites, per-region rules or API access.
Preview pricing: final plans and limits are confirmed when your access is set up.Page views are a soft limit: your banner never switches off if you pass it.
Questions
If your site has visitors in the EU, UK or Switzerland and you use analytics, advertising pixels or similar cookies and trackers, GDPR and the ePrivacy rules require consent before they run. Several US states, including California under CCPA/CPRA, require a way to opt out of the sale or sharing of personal data. If you only use strictly necessary cookies you may not need one. This is not legal advice; check your own situation with a lawyer.
GDPR is opt-in: nothing non-essential runs until the visitor says yes. CCPA is opt-out: tracking can run until the visitor objects, and you must make objecting easy and honor signals like Global Privacy Control. ConsentChecks applies the right model for each visitor's location automatically, and lets you override it per region on plans that include geo rules.
It is how Google tags (Analytics 4, Google Ads, Floodlight) learn what a visitor agreed to. ConsentChecks sets the consent defaults before Tag Manager loads, then updates them on every choice: analytics maps to analytics_storage, marketing to ad_storage, ad_user_data and ad_personalization, and preferences to personalization_storage.
The script is about 18 KB uncompressed, has zero dependencies, makes no third-party calls (its only requests go to your ConsentChecks server), and is written so that an error inside it can never throw into your page. It renders the banner inside a shadow root so your site styles do not collide with it.
ConsentChecks consent records never store a raw IP address; they keep the visitor's country and region. If you turn it on for a site, a salted SHA-256 hash of the IP is stored as evidence that someone from that network consented at that time. That hash is pseudonymous, not anonymous: whoever holds the secret salt can test a known IP address against the stored hashes, which is what makes it useful in a consent dispute. It is never used to apply one visitor's consent to another.
Yes. Each site can have many registered hostnames, for example example.com, www.example.com and shop.example.com. They use one snippet, show one banner, share the visitor's choice and combine their analytics. Separate brands on different registered domains are separate sites for now.
Yes. We can issue your account a provisioning API key, which lets your own tooling create sites with their domains and settings in one call, add domains later and list sites, so you can wire consent setup into your onboarding automation. Keys are issued by us on request, so mention it when you request access.
Every decision is logged with a timestamp, the site and domain, the action (accept, reject, update, withdraw or GPC opt-out), the categories granted, country and region, device details and the policy version in force. Filter the logs, open any entry to see its full detail, and, on plans that include CSV export, download them.
Request access
We are onboarding accounts by hand for now, so every new customer gets set up properly.
We will review it and email you when your account is ready. If you do not hear from us within a couple of business days, write to [email protected].