Frequently asked questions

consent is a cookie banner you add to your website with one script tag. It shows visitors a choice, blocks common trackers until they agree, and keeps a record of each decision.

Yes during the current beta. No credit card is required. If paid plans are introduced later, existing features won't become chargeable without notice.

No tool can guarantee that. consent helps you present a banner, block scripts until a visitor chooses, and keep a record of those choices. You still need accurate wording, the right categories for cookies you actually use, and a privacy policy that matches your site.

Banner message templates are starting points, not legal advice. Edit them to fit your site.

Sign up, add your domain, customize the banner if you want, then paste the snippet from the Install tab as the first script in the <head> of every page. The banner appears for visitors who haven't chosen yet.

In <head> on every page, as the first script — before Google Tag Manager, gtag.js, or any analytics or ads snippet. Don't add async or defer. The banner needs to run first so it can send Consent Mode signals and block trackers before those tags load.

Place the Install snippet first in <head>, then Google's container snippet immediately after it.

Do not add the banner as a Custom HTML tag in Tag Manager. The banner needs to run first.

• The snippet is on the page and is the first script in <head>.
• The page hostname matches the domain in Details, or an extra hostname on the allowlist (www vs the bare domain is a common miss).
• The site status in Details is Active, not Paused.
• You haven't already made a choice in this browser. Open the live preview on Install and hit Reset, or try a private window.
• If you're on localhost, a preview URL, or Tag Manager preview, add a token (see below) — those hostnames usually aren't on your allowlist.

The domain is your live site. The banner loads and records consent there.

The allowlist is for extra stable hostnames that should show the same banner — for example www, a staging subdomain, or another brand domain. You don't need to repeat the primary domain. Allowlist changes apply when you save.

A token is for pages with no stable hostname you can list: localhost, a one-off preview URL, or Google Tag Manager preview. Add the token before the snippet. Generating or removing a token takes effect immediately.

<script>window.__cosmoopsConsentToken = "YOUR_TOKEN";</script>
<script src="https://your-consent-host/api/embed/SITE_ID/script.js"></script>

The banner shows once until they choose, then stays away. Add a “Manage cookie preferences” link (for example in your footer) that opens the same Customize view:

<a href="#" onclick="window.cosmoopsConsent.showPreferences(); return false;">Manage cookie preferences</a>

Their choice is saved in the browser (localStorage), not as a cookie. That's why Reset on the Install preview, or a private window, shows the banner again.

Yes. Listen for window.cosmoopsConsent.consent or the cosmoopsConsentUpdated event, and run or skip your own tags from there. Auto-blocking still applies to recognized trackers unless you handle those yourself.

They are separate on purpose.

• The Cookies tab is what visitors see when they open Customize — name, provider, purpose, and expiry.
• Blocking (on Install) stops a script from running until the matching category is allowed.

A script can be blocked without being listed, and a cookie can be listed without being blocked. Visitors expect both: the script stays off until they agree, and they can see what they're agreeing to.

If the consent script is placed first, it recognizes and blocks common trackers inserted at runtime (including Meta Pixel, TikTok Pixel, LinkedIn Insight, and HubSpot) until the matching category is allowed.

Google Analytics and Google Ads depend on Consent Mode on the Banner tab. In Basic they are blocked until the visitor allows Statistics or Marketing. In Advanced they are not blocked — they're told what the visitor chose and honour it themselves (cookieless pings until then).

For a hardcoded script, or one we don't recognize, change its type to text/plain and add data-cosmoops-consent set to preferences, statistics, or marketing. We'll run it once that category is allowed:

<script type="text/plain" data-cosmoops-consent="statistics" src="https://www.googletagmanager.com/gtag/js"></script>

• Necessary — required for the site to function. Always on; visitors can't turn it off.
• Preferences — remembers settings like language or region.
• Statistics — analytics about how visitors use the site.
• Marketing — used to show relevant ads.

You can turn Preferences, Statistics, and Marketing off in the Banner tab if you don't use them, and you can edit the labels visitors see.

When you add a site we scan it in the background, and you can run Scan again from the Cookies tab. Suggested cookies stay off the public banner until you approve them. Unrecognized names still get a visitor-facing provider and purpose (from the cookie's domain and category) — they open for review first so placeholder text never reaches visitors.

Basic: Google's tags don't load until a visitor allows the matching category — Statistics for Analytics, Marketing for Ads. Nothing is sent to Google beforehand, not even cookieless pings. Visitors who decline are missing from reports.

Advanced: Google's tags load right away and honour each category. Until Statistics or Marketing is allowed they send cookieless pings (no cookies, no identifiers) so Google can estimate what it can't see. Once allowed, they measure normally.

• Necessary → security_storage (always granted)
• Preferences → personalization_storage, functionality_storage
• Statistics → analytics_storage
• Marketing → ad_storage, ad_user_data, ad_personalization

Every visit starts with denied for everything except security_storage, then updates to the visitor's stored choice. That's why the consent script must load before GTM or gtag.

Yes, if you want Tag Manager to send Consent Mode signals from inside your container. You still need the Install snippet on the page for the banner.

Running both is safe — both start by denying everything except Necessary. Keep the template's Global row set that way, and keep Consent Mode on Advanced.

Configure region defaults, URL passthrough, and ads data redaction in one place. If both are set, the template takes priority.

They set what each visitor starts with, before they choose — only in Advanced mode. Add a Global row for the worldwide default, then extra rows for specific countries or regions. If there's no Global row, everything except Necessary starts denied.

Codes are ISO 3166-2: a country (GB, FR) or a subdivision (US-CA). Separate multiple codes with commas. Global can't share a row with country codes.

Both apply in Advanced mode while Marketing is denied. Passing ad click IDs through URLs helps Google keep conversion measurement without cookies. Redacting ad identifiers strips those IDs when ads storage is denied.

If you also use our Tag Manager template, set these in one place — the template's values take priority.

In their browser: the choice itself (so the banner doesn't keep asking). On our side: an anonymous visitor ID, which categories they allowed, and when. We don't collect visitors' IP addresses, names, or other directly identifying information through the banner.

Individual log entries are kept for 30 days, then deleted. The totals and daily chart are not affected — those stay so you can see trends. Banner configuration is kept until you delete the site or your account.

It loads your live site and reports performance, accessibility, best practices, and SEO scores, plus sitemap and robots.txt health, Core Web Vitals, and the highest-impact things to fix. There's a public checker with no account, and a fuller report on the Performance tab after you sign in.

This test is a single run we just did (mobile or desktop). Real visitors is 28 days of field data from people who actually used the site. A site without much traffic may not have real-visitor numbers yet.

Pause from Details — the banner is hidden but the site and its settings stay. Delete from the same tab; that permanently removes the site and the banner on your website will stop working.

Email hello@cosmoops.com. For how we handle data, see the Privacy Policy; for using the service, see the Terms of Service.