Consent Mode HQ

Tag Assistant shows what your page declared, not what it sent. The gcs and gcd parameters on the outgoing request show the real state — and gcs is blind to…

The CNIL's deliberation 2025-131, consolidated in January 2026, sets out how consent can follow a logged-in account across devices. It is optional — but if you adopt it, withdrawal must…

Article 5(3) covers storing or accessing any information on a device, not cookies specifically. We built a page that stores five identifiers and sets no cookie: document.cookie came back empty…

CookieConsent v3 blocks script tags and nothing else. Klaro handles iframes, but only via data-src. And the standard blocked-YouTube placeholder fetches its thumbnail from a Google host before consent —…

Klaro and CookieConsent have no geolocation, and Google's consent region parameter resolves the country by an undocumented method. Resolve the country once at the edge, drive the banner and the…

Klaro stores a bare service-to-boolean map; CookieConsent v3 stores a consent ID and timestamps, but only in the browser. The EDPB says a correct site configuration is not proof. What…

A working Playwright script that captures every network request and cookie written before a visitor touches the consent banner, plus the false positives and blind spots that trip up static…

A $3.85M settlement, a split among 2026 courts on whether CIPA's pen-register provision covers websites, and a bill (SB 690) that passed the Assembly on 28 August 2026 but is…

tarteaucitron.js ships a built-in googleConsentMode flag. What it actually sets, verified against the library's own source (v1.34.0): default-denied signals, the softConsentMode hard/soft split, and how to wire GA4 and Google…

The EDPB's 2026 coordinated enforcement action targets transparency and information obligations under Articles 12-14, with 25 authorities taking part and the findings phase running now. Your banner is in scope,…