Changelog

• Fixes from a WCAG 2.2 AA accessibility audit of every banner state.
• Text colours that wouldn’t be readable on the site’s colours are made readable. Brand colours are left as they are.
• The banner states its own language and text direction, so screen readers switch voice when it differs from the page.
• The notice is named by its own text for screen readers.
• Checkboxes are 24 px and ticked in the brand colour only where it stands out, otherwise in the text colour.

Accessibility conformance report

• Analytics that our site check finds can use a country’s exemption (Matomo, Piwik PRO, Piano or etracker, used for the site alone, never Google Analytics and the like) run from the start. The banner asks only about the rest and says that statistics are on, in 35 languages.
• Cookieless analytics such as Plausible are no longer held.
• A site set to ask first everywhere gets no exemptions.
• Blocking no longer loops with another consent tool that sets script addresses through setAttribute (Usercentrics).

• Where the law says to ask first, Google gets nothing until a visitor says yes. Its cookieless “no consent” requests are held too, including ones a site sends through its own address. Owners can allow them.
• The banner’s “no” is also sent to Google as an update, so a site’s own region-specific Google defaults can’t override it.

• Where visitors are asked first, the banner tells Shopify “no” as soon as the page loads. Shopify’s own pixels otherwise default to allowed.
• Reddit, Snapchat, Criteo, Taboola, Outbrain, Amazon, Quora, Yahoo and AdRoll ads are held by default.

• The inform notice for Mexico’s and Canada’s rules: tracking runs, and a notice says what it’s for and offers Turn off and Settings. In 34 languages.

• Inline code waits for libraries the banner is holding, such as HubSpot forms.
• Shopify is told about a visitor’s choice only when it changes.
• The choice is read again when a visitor comes back to a page with the back or forward button.

Analytics exemptions in France, Spain, Italy and the Netherlands: a site’s own visit statistics, from a tool our site check finds can qualify, run without asking, with each country’s conditions (France: cookies of 13 months at most and shortened IP addresses; Spain: 13 months; Italy: shortened IP addresses). Everything else is still asked about.

After 2026.09.4. No date set yet.

Egypt asks first from 1 November 2026, when the one-year grace period after the Personal Data Protection Law’s Executive Regulations ends. Hungary and Romania link their national cookie provisions.

Trial planned to start on 5 October 2026 at 14:00 UTC, after 2026.09.3 finishes, and live about 14 October.

Laws that only cover larger businesses now apply only to them: each US state rule says who its law covers (revenue, residents, share of revenue from selling data, small business and nonprofit exemptions), and a site that answers About your business gets exactly its laws; unanswered, every law applies as before. Analytics that only count visits for the site run with a notice and a way to object in the UK, Switzerland, Brazil and South Africa when the site says so. Israel and Singapore get a notice, with advertising waiting for a yes. Mexico and Canada get the inform notice (tracking runs, a notice says what for and offers to turn it off; Canada keeps its privacy choices link); needs banner 0.3.12. Chile (until its new law in December) and Argentina ask first, as their laws’ text requires consent. Delaware’s lower thresholds from 2027 added.

Next after 2026.09.2, planned from about 25 September 2026.

Follows each law exactly, from a check of every rule against the official texts. United States: browser opt-out signals are honoured only where a law requires it (no longer in Virginia, Utah, Iowa, Tennessee, Indiana, Kentucky, Rhode Island, Oklahoma, Alabama or states without a privacy law), and the “Your Privacy Choices” link shows only where a law asks for one (California, Colorado, Connecticut, Oregon, Montana, Delaware, New Hampshire, Minnesota, Vermont); elsewhere the law asks for a clear statement of how to opt out, which belongs in the privacy notice. Florida’s law covers only $1B+ companies, so no banner. South Korea: a link to refuse instead of asking first, as the regulator allows for anonymous visitors. New: French overseas regions, Åland and Peru now ask first. Official sources linked for every US state, Nigeria and Turkey.

On 5% of sites from 23 September 2026.