Consent Mode HQ

A published California ruling lets Meta Pixel and Google Analytics cases proceed as class actions because the code behaves the same for every visitor. The Third Circuit found standing over…

California's Governor signed SB 690 on 30 September 2026. From 1 January 2027 only the Attorney General can sue over website pen-register claims under Penal Code 638.51, including pending ones.…

Google keeps two different CMP lists, and neither is IAB Europe's TCF registration. Get your CMP's ID from the page with __tcfapi('ping') and check each list in minutes. One of…

GA4 added hostname Include filters on 21 September 2026. They are permanent and drop every event with no hostname or an unlisted one. Measured: denied-consent pings carry the page URL…

The Cookie Store API makes every cookie Secure, so cookieStore.set() stores nothing on localhost in Safari before 27 — measured on 26.6.2. maxAge only exists from Chrome 145, Firefox 148…

tarteaucitron v1.35.0 adds piwikConsentMode, on by default, which loads the Piwik PRO container before the visitor answers and after they click Deny. Measured against v1.34.0, with the one-line setting that…

Before Safari 27, WebKit silently dropped every cookie marked Secure on loopback hosts — measured here on Safari 26.6.2, where both a Set-Cookie header and a document.cookie write vanished while…

On 15 September 2026 the WP Consent API dropped its consent-gating wp_set_cookie() on 200,000 sites, making room for a WordPress core function with the same name, a different signature and…

gtag.js only runs a consent command if it arrives as a real arguments object. Rest parameters, arrow functions and literal arrays are dropped without an error, so the default never…

Regulators converge on six months, CMP libraries default to 120-365 days, and Safari deletes a JavaScript-set consent cookie after seven days without interaction. The sources, the source code, and how…