CookieBastion is a consent management platform built for developers. A clean JavaScript API and REST backend handle consent collection, tracker blocking, and record storage, while you keep full control of markup, styling, and logic. Framework-native packages for React, Vue, and Next.js, a documented API, and no forced UI make it the consent layer you would have built yourself.
Get your free consent audit
Three calls cover most integrations: init with your site key, onConsent to react when choices change, and getConsent to check state before loading a tag. Every tracker in your codebase maps to a category, and the library gates execution on consent automatically. Server-side, a REST API reads consent records for audits and syncs them to your own systems.
That is the point. CookieBastion ships a solid default banner, but the headless mode exposes every state and action so you can render consent UI in your own design system. React, Vue, and Svelte hooks make the preference center a few components. Your banner can look exactly like the rest of your product because it is your code.
Two mechanisms, your choice: declarative blocking, where you tag scripts with data attributes and the library swaps type until consent, or programmatic gating through the API for anything you load dynamically. Both survive framework hydration, work with tag managers, and emit events your own analytics can observe.
| Capability | CookieBastion | Basic alternative |
|---|---|---|
| Headless mode with full UI control | Yes | No |
| Framework-native packages | Yes | No |
| Public REST API for consent records | Yes | No |
| Self-hostable banner assets | Yes | No |
| Usage-based billing | Yes | No |
| No sales call required to start | Yes | No |
Because they inject opinionated UI, fight your framework's rendering, and hide state behind a black box. Debugging a broken tag becomes guesswork. A developer-first CMP inverts this: consent is state you query, UI is your code, and the blocking mechanism is documented and inspectable. The default banner exists for teams that want it, not as a cage.
Start with the free consent audit: point us at your site and we return the full tracker inventory plus a pre-consent firing report you can reproduce in your own tests. Plans after that scale on consent events, not pageviews, so spiky traffic is not a billing surprise. The audit carries no charge.
Every consent action is stored server-side with timestamp, region, banner version, and the exact purposes accepted. The REST API exports records filtered by date or visitor ID, and webhooks can mirror events into your own warehouse. Records are immutable and retained per the legal framework each region requires.
Yes. The Next.js package handles the consent default during SSR, avoids hydration mismatches, and gates both client components and third-party scripts. Consent state can be resolved server-side from a first-party cookie when you need zero flicker. App Router and Pages Router are both supported.
The client libraries are MIT-licensed and on GitHub, so you can read the exact blocking logic running on your site. The consent backend is hosted, with EU or US data residency at signup. Self-hosting the backend is on the roadmap and available early for teams that need it.
The banner and blocking you could build in a week. What you cannot build in a week: the tracker database, regional rulesets for GDPR/CPRA/LGPD, Consent Mode v2 mapping, immutable audit records, and keeping all of it current as laws and Google requirements change. CookieBastion is the maintained version of the thing you would otherwise own forever.