Blog

CMP Free Plans: What the Free Tier Quietly Leaves Out

Every CMP has a free plan, and every free plan ends somewhere. The cutoffs that matter are not the price. They are the missing DSAR workflow, the missing TCF support, and the per-domain billing that starts the day you add a second site. November 14, 2026

Your A/B Test Needs Consent First: The Testing Cookies Nobody Banners

VWO and Optimizely set cookies before your banner has an answer. Under the ePrivacy Directive those cookies need consent, and the UK's 2026 rule change does not save an EU visitor. November 14, 2026

The Reject Button That Logs Nothing: Consent Records After a No

Most consent platforms log an accept in detail and a reject in one line. The reject is the record a regulator asks for, and it is the one most stacks cannot produce. November 13, 2026

Consent Mode v2 Defaults: The Four Signals and What Breaks When They Fire Late

Consent mode v2 has been mandatory for EEA and UK traffic since March 6, 2024. The four signals have to be set before any tag fires, and on most sites they are not. November 13, 2026

The Reject Button That Does Not Survive Navigation

A visitor rejects tracking, clicks to the next page, and the banner pops up again as if the choice never happened. The choice was recorded. It just was not read. November 11, 2026

The Consent Cookie That Expires in 30 Days: What Short Expiry Does to Your Records

The consent cookie expires after 30 days. The consent record is supposed to last three to five years. The gap between those two numbers is where the proof disappears. November 11, 2026

The Meta Pixel After Third-Party Cookies: Consent Gating That Has to Be Manual

The browser is killing third-party cookies. The pixel still fires, still sends, and still needs consent, and no consent signal gates it for you. November 10, 2026

Push Notifications Are Not Cookies: The Permission Prompt That Still Needs a Consent Decision

The browser asks the visitor to allow notifications. The visitor taps allow. That tap is a permission, not a marketing consent, and treating it as one is a compliance gap. November 10, 2026

The Cookies Your Consent Banner Sets Before Anyone Chooses

The banner asks the visitor to choose. Before the choice, the banner itself sets cookies. That sounds like a contradiction. It is not, but only if those cookies do one job. November 9, 2026

The Back Button Problem: When bfcache Restores a Page Without Re-Checking Consent

The back button does not reload the page. It restores it from memory, frozen, with the old consent state. If the visitor changed their choice in the meantime, the restored page never finds out. November 9, 2026

What Your CMP Charges When a Subdomain Counts as a Domain

The quote said twelve euros a month. The invoice said ninety. The difference was three subdomains, and the CMP counts each one as a domain. How per-domain pricing really multiplies, and when flat pricing wins. November 8, 2026

The Consent Banner Test That Measures the Wrong Thing

Variant B won by a wide margin, and the consent records got worse. It had moved the reject button behind a settings link. Accept rate is the wrong number to optimize, and here is what to measure instead. November 8, 2026

TCF Vendor Lists: Why 900 Vendors on Your Banner Is a Liability

The IAB's vendor list passed 900 entries, and the Belgian DPA's 2022 ruling against the TCF turned on whether consent through a list that long can ever be informed. November 6, 2026

CMP Pricing Per Domain vs Per Session: How the Bill Actually Grows

Consent platforms price by domains, sessions, or subpages, and the cheapest quote on page one is rarely the cheapest bill at the end of the year. November 7, 2026

Consent Renewal: How Long a Yes Lasts Before You Have to Ask Again

A consent record has a shelf life. Some laws set it, some vendors set it, and some sites never set it at all, which means their oldest consent is old enough to vote. November 7, 2026

Consent Records: How Long to Keep Proof, and What to Keep

A consent banner without a record is a claim with no evidence. The record needs the choice, the version of what was shown, the time, and the policy version, kept long enough to answer a complaint. November 6, 2026

The Best OneTrust Alternatives for 2026

OneTrust is the default choice for large enterprises, and for many teams it is more platform than they use. The alternatives worth switching to are the ones that pass the prior blocking test. November 5, 2026

Test the Denied State. That Is Where Consent Actually Lives.

Most consent testing happens in the accepted state, which is the state where everything works. The denied state is where the failures are, and it takes ten minutes to check. November 5, 2026

One Brand, Several Domains: Keeping Consent State Coherent Across Subdomains

A shop on one subdomain, accounts on another, support on a third. Consent set in one place and ignored in another is the normal state of multi domain brands, and it is fixable with a shared consent domain plan. November 4, 2026

Prior Blocking: The Tags That Must Not Fire Before a Choice Exists

Prior blocking is the unglamorous core of cookie compliance: nothing non essential loads before consent. The embeds and pixels that defeat it, and a test that finds them in minutes. November 4, 2026

Consent State Across Subdomains: Where the Shop, Blog, and Support Site Disagree

Visitors move between www, shop, blog, and support subdomains in one session. If the consent cookie is scoped to one host, they get asked repeatedly and the record fragments into three partial answers. November 3, 2026

Reading a TCF Consent String When a Partner Says You Sent the Wrong One

Advertising partners reject traffic over consent string problems the publisher cannot see. Decoding the string, checking purpose and vendor bits, and knowing where strings get truncated or stale is basic hygiene for sites in the TCF ecosystem. November 3, 2026

The Best OneTrust Alternatives for 2026

Large consent platforms earn their keep at enterprise scale and frustrate everyone below it. What smaller and mid sized teams should compare when looking at alternatives, from scan depth to record exports. November 2, 2026

Top Cookiebot Alternatives Worth Switching To

Switching consent platforms is mostly a records and testing job disguised as a shopping job. How to compare alternatives on scanning, banner parity, and consent mode behaviour using your own site as the test bed. November 2, 2026

TCF Consent Strings: What a Publisher Is Actually Passing to the Ad Stack

Behind every programmatic consent banner sits an encoded string carrying purposes, vendors, and legal bases to dozens of partners. What is inside it and how to read yours. November 1, 2026

Geo Targeting the Cookie Banner: The Mistakes That Show the Wrong Law to the Wrong Visitor

Showing banners by visitor location sounds tidy until VPNs, travellers, CDNs, and cached pages hand a Californian the GDPR flow and a German the opt out link. Where geo rules break. November 1, 2026

Consent Cookie Lifetimes: Auditing Expiry Dates Nobody Set on Purpose

Consent cookies living for years, session cookies that are not, and tracker expiries inherited from defaults. How to audit lifetimes and align them with your notice. October 31, 2026

Pre-Consent Tag Blocking: Verifying Nothing Fires Before the Click

Blocking tags before consent is the whole promise of a consent platform, and it fails silently more often than it works. A verification routine using the network panel, step by step. October 31, 2026

When to Ask Again: Setting a Consent Refresh Cadence

Consent does not expire on a single universal schedule, but never refreshing it is its own risk. How to set a renewal cadence tied to identifier lifetimes and material changes. October 30, 2026

Auditing Tag Manager Consent Defaults: Where the Leaks Actually Are

Most consent leaks are not banner bugs. They are tag manager defaults: triggers that fire on page view, vendors loaded outside the container, and default states set to granted. An audit order that finds them. October 30, 2026

Consent State Across Subdomains: Why Your Banner Keeps Coming Back

Users accept on www, get re prompted on shop, app, and support subdomains. Cookie scope, domain attributes, and the cases where separate consent is actually correct. October 29, 2026

Consent Logs in a Data Breach: What Your Banner Records Expose

Consent databases hold identifiers, IP addresses, timestamps, and browsing linked choices for every visitor. Why that store is a breach target, and how to shrink what it keeps. October 29, 2026

Top Cookiebot Alternatives Worth Switching To

A practical guide to Cookiebot alternatives: what separates serious consent platforms on records, script weight, pricing, and consent signals, and how to pilot a switch without losing proof of past choices. October 28, 2026

Testing Consent Banners Across Browsers and Devices: A Working Checklist

Consent banners fail quietly on the setups nobody tested: an old phone browser, a blocked script, a rotated tablet. A practical device and browser testing checklist for consent flows. October 28, 2026

The Best OneTrust Alternatives for 2026

Large consent platforms are powerful and heavy. A practical comparison of what smaller and mid sized alternatives do well, where they differ, and how to shortlist. October 27, 2026

Consent Mode Signals Missing: How to Find and Fix Dropped Consent States

Advertising and analytics platforms show missing or default denied consent states even after visitors agree. Where signals get dropped and how to debug the chain. October 27, 2026

Server Side Tagging and Consent: Keeping the Signal Intact

Server side tagging moves tracking off the browser, which makes teams assume consent is handled. It is not automatic: the consent signal must travel with every event, and a broken handoff quietly breaks the whole setup. October 26, 2026

Consent and Email Marketing Pixels: What Happens After the Open

Email tracking pixels tell senders who opened, where, and on what device, and many subscribers have no idea they exist. How email tracking interacts with consent, and how senders can measure honestly. October 26, 2026

Consent Mode Basics for Small Sites: What It Does and What It Does Not

Consent mode adjusts how analytics and ad tags behave based on visitor consent. For a small site the setup is simpler than the documentation suggests, as long as defaults, ordering, and testing are handled in the right order. October 25, 2026

After the Redesign: Retesting Your Cookie Banner Before It Costs You

Redesigns quietly break consent setups: reordered scripts, new embeds, lost categories. A retest sequence for the week after launch that catches blocking failures, stale cookie lists, and consent mode breaks. October 25, 2026

The Best OneTrust Alternatives for 2026

Large consent platforms suit large estates. For everyone else, the real comparison is scanning quality, blocking reliability, pricing shape, and how fast a small team can fix a broken banner. October 24, 2026

Top Cookiebot Alternatives Worth Switching To

When a popular consent tool stops fitting, switching is about blocking quality, record exports, and pricing at your traffic level. A practical framework for comparing alternatives and migrating cleanly. October 24, 2026

Consent on Webinar Registration Pages: Tracking Before the Form Is Even Sent

Webinar pages load marketing trackers on arrival and bundle recording, marketing, and partner sharing into one checkbox. How registration consent should be split so each choice is real. October 23, 2026

Consent and QR Codes: Where the Offline to Online Handoff Loses Its Notice

A QR code on a poster or table tent jumps a phone straight into a tracked flow with no room for the usual notices. How to design QR journeys that carry consent with them. October 23, 2026

Switching Consent Platforms Without Losing Your Consent Records

Consent platform migrations fail quietly: receipts lost, choices reset, banners double firing. A migration plan that keeps records and choices intact. October 22, 2026

Consent and Live Chat Widgets: The Tracker in the Corner of Every Page

Chat widgets load early, fingerprint quietly, and record conversations. Where chat sits in consent categories and how to load it without leaking data first. October 22, 2026

Consent and Embedded Video: Loading Players Without Loading Trackers

Embedded video players bring trackers with them. Facade patterns, privacy enhanced modes, and click to play choices that respect consent. October 21, 2026

Cookie Walls and Paywall Choices: When Access Depends on Consent

Requiring tracking consent to read content is under pressure in Europe. How pay or consent models work and what makes the paid option real. October 21, 2026

Consent and A/B Testing: Running Experiments Without Breaking the Rules

Experimentation tools want to assign, track, and analyze every visitor. Consent says wait. How to bucket visitors compliantly, handle the control group, and keep results honest. October 20, 2026

Preference Centers: Making It Easy to Change a Consent Choice

Withdrawing consent must be as easy as giving it. How to design the preference center link, layout, and save flow so changing your mind is a feature, not a scavenger hunt. October 20, 2026

Consent for Server Side Tagging: The Gateway Changes Nothing and Everything

Server side tagging moves tracking off the page, which tempts teams to treat consent as optional. Why the duties follow the data, how to forward consent state, and the audit that proves it. October 19, 2026

Consent Banners on Multilingual Sites: Translation Is a Legal Task

A banner translated carelessly can misstate purposes and invalidate the choices collected. Managing consent text across languages, regions, and notice versions without losing the record. October 19, 2026

Consent and A/B Testing: Your Experiments Are Tracking Too

Experimentation platforms assign visitors, record exposures, and often fingerprint for consistency, all before anyone reads a result. How to bring testing tools inside the consent perimeter. October 18, 2026

Consent or Pay: How 'Accept Tracking or Subscribe' Models Work

News and media sites increasingly offer a third option beside accept and reject: pay for the tracking free version. How consent or pay works, why regulators are scrutinizing it, and what makes a model defensible. October 18, 2026

Consent in Progressive Web Apps: When the Site Works Offline and the Banner Logic Does Not

PWAs cache the app shell, sync in the background, and outlive the browser tab. Consent state stored for a website meets an app that updates silently, and the mismatches nobody tests. October 17, 2026

The Accessible Consent Banner: Screen Readers, Keyboard Paths, and Choices That Exclude Nobody

A banner a screen reader cannot parse or a keyboard cannot reach collects agreement from some visitors and silence from others. The accessibility failures that invalidate consent design, and how to test them. October 17, 2026

Web Workers and Consent: The Scripts Your Wrapper Cannot See

Consent wrappers intercept script tags and network calls in the main thread. Web workers run analytics and fingerprinting in a separate thread that most wrappers never inspect. How the blind spot works and how to close it. October 16, 2026

Prefetch, Preconnect, and Consent: Network Hints That Leak Before a Choice

Resource hints tell the browser to contact advertising and analytics domains before the visitor clicks anything, sometimes before the banner is answered. What leaks, what does not, and how to audit your hints. October 16, 2026

How Consent Records Hold Up in a Regulatory Audit

When a regulator asks for proof of consent, what do they actually examine? The fields a defensible record needs, the gaps that fail audits, and how to test your own records before someone else does. October 15, 2026

Returning Visitors and Consent Expiry: When to Ask Again

Consent choices expire, purposes change, and visitors return on new devices. How long to store a choice, what events should trigger a fresh ask, and how to re-ask without training people to click anything to make the banner go away. October 15, 2026

Consent Granularity: Why Category Level Choices Beat All or Nothing

All or nothing banners are simple to build and poor at everything else. What granular, category level consent means in practice, how many categories is enough, and how to keep choices honest. October 14, 2026

Top Cookiebot Alternatives Worth Switching To

Switching consent platforms is worth it when scanning, blocking, or pricing stops fitting your site. How to shortlist alternatives and run a switch without gaps. October 13, 2026

The Best OneTrust Alternatives for 2026

Comparing consent management platforms for teams that found the enterprise default too heavy. What to evaluate, where the alternatives differ, and how to switch without breaking consent. October 12, 2026

Consent and service workers: the background sync that outlives the banner

Service workers can keep syncing analytics and personalization data long after the user rejects tracking. How background sync and push bypass consent wrappers, and the patterns that bring them back under control. October 11, 2026

The Beacon API: the quiet request that skips your consent wrapper

navigator.sendBeacon fires as the page unloads, often outside your consent wrapper's control. Why analytics beacons are the tracking request your banner never sees.

Shadow DOM and web components: the consent blind spot inside encapsulated markup

Web components hide their internals from the page, including from your consent blocking rules. How trackers inside shadow DOM slip through, and how to close the gap. October 9, 2026

Third-party scripts that re-add themselves after removal: the zombie tracker problem

You removed the tag from your tag manager, but it is back on the site. Zombie trackers get re-added by bundled plugins, theme updates, and agency leftovers. Here is how to kill them for good. October 8, 2026

Consent inside iframes: the postMessage consent relay pattern

Your banner cannot reach inside a cross-origin iframe. How the postMessage consent relay works, handling the load race, and what to do when the vendor offers no consent API. October 7, 2026

Consent in mobile webviews: the wrapper your blocking rules do not reach

Native apps wrap web pages in webviews that skip your consent blocking entirely. How in-app browsers defeat page-level consent wrappers, and what developers can do. October 6, 2026

Consent at the edge: the scripts your CDN and edge workers inject before the page loads

Edge middleware and CDN rules can inject analytics and personalization scripts before your page or your consent wrapper ever loads. Where to look, and how to gate what you find. October 5, 2026

Consent in the service worker: the requests your page-level wrapper never sees

Consent wrappers control what the page loads, but service workers make their own network requests on their own thread. What leaks through background sync, push handlers, and prefetching, and how to gate the worker. October 4, 2026

Speculative prerendering and prefetch: the consent hole your tag manager cannot see

Prerendered pages execute scripts before the visitor ever sees a banner. How the gap works, how to detect it, and the fixes in order of reliability. October 3, 2026

Consent for single-page apps: why route changes break your tag blocking

Single-page apps break the page-load assumption most consent tools rely on. Why route changes skip tag blocking, and the call-site checks that fix it. October 2, 2026

Tracking inside web workers: the consent gap your wrapper can't see

Web workers run JavaScript off the main thread, and trackers use them for exactly that reason. Why consent wrappers miss worker traffic, how to detect it, and the message-passing pattern that closes the gap. October 1, 2026

Consent-aware analytics: measuring what matters when visitors reject tracking

Reject-heavy traffic breaks traditional analytics. How to build consent-aware measurement: aggregated signals, server-side counting, and the metrics that survive without cookies. September 30, 2026

Why your session replays should record the consent state they were captured under

A session replay captured under 'reject all' that replays in a tool assuming full consent is misleading evidence. Tagging replays with the consent state they ran under fixes a class of debugging nobody can reproduce. September 29, 2026

Testing consent blocking in CI: catching tracker leaks before they deploy

Consent regressions ship like any other regression: silently. A CI test that loads the site under "reject all" and fails the build when an unconsented tracker fires. September 28, 2026

How to debug consent race conditions in lazy-loaded components

2026-09-27. Lazy-loaded components can mount before consent state resolves, firing trackers in the gap. Reproduce the race reliably, find the ordering bug, and gate every integration behind consent resolution.

How to handle consent across route changes in single-page apps

Single-page apps navigate without reloading, and consent banners built for page loads miss the gap. Re-check consent state on every route change.

How to sync consent state across subdomains

Your visitor accepts on the marketing site, then gets the banner again on the app subdomain. One shared consent record: root-domain cookies, consistent reads, and real-time propagation.

What to do when a third-party SDK ignores your consent state

Some SDKs initialize on load and track no matter what your banner says. Lazy init, gated wrappers, and network-level blocking: the developer patterns for containing them.

How to write automated tests for your consent banner

Consent banners break silently. A deploy reorders scripts, a new tag fires early, a framework upgrade changes load timing, and nobody notices for weeks because the banner still looks fine. Automated tests catch that drif

How to block scripts before consent without breaking your site

Mark scripts inert, let consent state decide, and observe the DOM for late injections. The developer pattern that works.

How do I add a cookie consent banner to a React or Next.js app?

Add the consent script as early as possible in the document head, gate every non-essential script behind the visitor's consent state, and expose the.

What is a consent management API?

A consent management API lets your code ask a consent platform what the visitor agreed to, so every script, component, and server process can respect.