# What Flat Consent does A cookie banner that sets itself up from a check of your site. Flat Consent puts a small cookie banner on your website, keeps trackers switched off until a visitor agrees, and records every choice. You paste one line into your site, and we set up the rest from a check of your pages. ## In one minute 1. We check your site. A real browser opens your pages as a first-time visitor would and lists every cookie and outside service that loads before anyone agrees. 2. We set up your banner in your colours and font, with wording that names only what your site uses and the right behaviour for visitors from each country. 3. You paste one line into your site's settings, then press **Check my site** and we confirm the banner is working. ## What you get - A small banner in a corner of the page, in your site's colours and font. - **Accept all** and **Reject all** buttons that carry the same weight, with the settings behind a text link. - Trackers, ads and embedded videos held back until a visitor agrees. - A record of every choice, stored in Europe, without IP addresses. - A cookie list page your visitors can read. - The rules for Europe, the UK, the US and everywhere else, applied according to where each visitor is. You don't need to know them yourself. ## Words we use - **Tracker**: any cookie, script or outside service that records what visitors do. Analytics tools and ad pixels are trackers. - **Consent**: a visitor saying yes. In Europe and the UK, trackers may only run after consent. - **Category**: what a cookie is for. We use four: Required, Preferences, Statistics and Advertising. See [Categories](/docs/categories). - **Where it shows**: what the banner does for visitors from each place. Depending on the law where the visitor is, it asks first, shows an opt-out link or stays out of the way. See [Where the banner shows](/docs/regions). --- # Install One line, placed before any other script. The Install tab in the dashboard shows the exact line for your site. It looks like this: ```html ``` This line always loads the current version of the banner, so fixes and new legal requirements reach your site within minutes without you changing anything. The line must load before any other script, because the banner can only hold back trackers that load after it. Put it first in the ``. ## Where it goes | Platform | Where | |---|---| | Webflow | Site settings > Custom code > Head code. Paste it at the very top, then publish. | | Framer | Site settings > General > Custom code > "Start of head tag". Then publish. | | WordPress | Install the [Flat Consent plugin](https://wordpress.org/plugins/flat-consent/) (Plugins > Add New, search "Flat Consent"), then paste your site ID in Settings > Flat Consent. It puts the line first in `` and keeps caching plugins from delaying it. Then clear any page cache. | | Shopify | Online Store > Themes > Edit code > `layout/theme.liquid`, on the first line after ``. Leave Shopify's own privacy banner switched off. | | Squarespace | Settings > Advanced > Code injection > Header, at the top. | | Wix | Settings > Custom code > Add code to Head, set to load once on all pages. | | Anything else | The template that renders ``, above every other script tag. | ## Pinning a version If your security policy requires a file that never changes (for example, so you can use Subresource Integrity), load a pinned version instead: ```html ``` A pinned file stays exactly as it is, so you have to change the version number yourself to get fixes. ## Check it's working Press **Check my site** on the Install tab. We load your site in a real browser and report on each of these: - **The line is on your site.** If we can't find it, check that you published the change. - **It loads before your other scripts**, so nothing can slip past it. - **The banner is running.** If the line is on the page but not running, a Content Security Policy may be blocking it; see [Troubleshooting](/docs/troubleshooting). - **Google tags wait for consent**: our line runs before Tag Manager or gtag. - **Another cookie banner is still installed.** Remove it so visitors see one banner, not two. - **No "Cookie settings" link in your footer yet.** Add one as shown below. We only mention this when the floating button is off. ## Footer link Add a "Cookie settings" link to your footer so visitors can change their mind from any page: ```html Cookie settings ``` When your page has this link, the floating button stays hidden. See [Footer link](/docs/footer-link). --- # The site check What the check looks at and what the numbers mean. The check opens your site in a fresh browser in Western Europe, visits up to six pages without clicking anything, and records what loads. ## What you see - **Cookies and trackers before a visitor agrees**: cookies and outside services in the Statistics or Advertising categories that loaded before the visitor made a choice. In Europe and the UK, this is what regulators fine sites for. The number should be zero. - **Cookies**: every cookie and browser storage key we found, with what it is for and which company set it. - **Outside services**: other websites your pages contacted while loading. Fonts, payments and security checks are normal. Ad networks and analytics are trackers. - **Other cookie banner found**: if your site already has a cookie banner, we name it so you can remove it after switching. ## How we know what a cookie is for 1. We look it up in a database of thousands of known cookies and services. 2. For anything the database doesn't know, an AI model (Jev, from TypeSafe) picks the most likely of the four categories and says how sure it is. Below 70 percent we mark it **Not sure** instead of guessing. A cookie is only treated as Required when the model is at least 90 percent sure, and an outside service is never treated as Required on the model's word alone. 3. You have the last word. Every row on the Cookies tab has a **Used for** choice you can change, and outside services have a **Before a visitor agrees** switch (Blocked or Runs). Your corrections are kept when the site is checked again. 4. Services that sites need in order to work, such as reCAPTCHA, Cloudflare and payment providers, are always Required. ## How accurate the AI is We measure it. We take 400 cookies whose purpose we already know (100 of each kind), hide the answer, and ask the model to judge each one from its name and the domain that set it, the same information it gets during a check. Results from 27 September 2026, model jev-1.13.0: - **Whether a cookie needs consent:** right 96.9% of the time. This is what decides whether the banner holds a cookie back. - **Cookies a site needs to work:** 92 of 100 recognised as required. A cookie is only marked required when the model is at least 90% sure, and an outside service is never marked required on the model’s word. - **The exact category:** right 65% of the time. Most mistakes are preferences mistaken for statistics or the other way round. Both wait for consent, so these mistakes don’t change what the banner blocks. The AI only judges cookies our database doesn’t already know, and you can correct any category on the Cookies tab. We re-run this measurement when the model changes and update this page. ## What happens with the results - Trackers we are sure about become rules, and the banner holds them until a visitor agrees. Anything we are unsure about waits for you to pick what it is used for on the Cookies tab. - The cookie list page for your visitors is built from the results. - The banner's colours, font and wording are taken from your pages. - Where the banner shows follows the law where each visitor is. See [Where the banner shows](/docs/regions). Run a new check (**Visit again** on the Cookies tab) whenever you add a tool to your site. Checks browse from Western Europe, so the results show what a first-time visitor there meets. Each check records the country it browsed from. ## Monthly checks We check every site again every 30 days. If a check finds something new that would run before visitors choose, or something we can't identify, we email you and show it at the top of the Cookies tab. Nothing changes on your site until you decide. ## Seen on real visits Our visit only sees public pages, and it never signs in. Services that only load behind a login, such as in-app chat, product analytics or session recording, are invisible to it. So the banner itself reports what it sees on real visits. On about one page view in ten, it sends the names of the outside services the page contacted and the names of the cookies the page can read, never their values and nothing about the visitor. The Cookies tab lists anything those visits found that our visit didn't, with the company and what it's used for when we know them. Pick what each is used for and whether it waits for consent, as with everything else on the tab. The list leaves out noise: a name has to turn up on at least 3% of reports, and hosts that browser extensions add to pages (password managers, writing assistants, shopping add-ons) are dropped. It starts after 10 reports and covers the last 7 days. --- # Use with Claude and other AI tools Let your coding assistant do the install, check the result and read these docs. These docs are written to be read by people and by the AI tools that help them. You can bring Flat Consent into an AI tool in five ways, listed below. ## 1. Paste a prompt Copy one of these into Claude Code, Cursor, Codex or any agent that can read the web. **Install on my site** ``` Install Flat Consent on this site. Read https://flatconsent.com/docs/install.md and https://flatconsent.com/docs/embeds-and-scripts.md first. Put the script tag before any other script in the head, add a "Cookie settings" link with data-cmp="settings" to the footer, convert YouTube and Maps iframes to data-cmp-src, and mark any custom tracking scripts with type="text/plain" data-cmp="analytics" or "marketing". My site id is: ____ ``` **Check what my site does** ``` Use the Flat Consent MCP tool check_site on ____ and tell me, in plain words, whether I need a cookie banner in Europe, the UK and the US, and which trackers run before anyone agrees. ``` **Explain a setting** ``` Read https://flatconsent.com/docs/regions.md and explain what visitors from California see on my site. ``` ## 2. Install the Claude Code plugin These two commands give Claude Code the install skill and the MCP server together: ``` /plugin marketplace add mlingner/flatconsent-claude /plugin install flatconsent@flatconsent ``` Then ask: "Use the flatconsent skill to add cookie consent to this site." ## 3. Connect the MCP server on its own The server needs no login for checks, install steps and the docs. Claude Code: ``` claude mcp add --transport http flatconsent https://mcp.flatconsent.com/mcp ``` Claude desktop and claude.ai: add a custom connector with the URL `https://mcp.flatconsent.com/mcp`. Cursor, Windsurf and others: add an HTTP MCP server with that URL. Tools that work without a key: `check_site`, `get_check`, `install_steps`, `search_docs` and `get_doc`. ## 4. Let Claude manage your sites Create an API key in the dashboard under **API**, then connect with it: ``` claude mcp add --transport http flatconsent https://mcp.flatconsent.com/mcp --header "Authorization: Bearer fc_..." ``` With a key you can also use `list_sites`, `get_site`, `add_site`, `update_site`, `run_check`, `check_install`, `site_choices` and `match_brand`. These go through the same validation and plan limits as the dashboard, and brand colours are used exactly as given. A key can do anything you can do in the dashboard except create more keys, so keep it as safe as a password. If it leaks, revoke it on the API page. Prompts that work well with a key: ``` Add example.com to Flat Consent, wait for the check, then show me the banner settings it chose. ``` ``` On site ____, switch the wording to plain, ask first in California, and turn the floating settings button on. ``` ``` Check whether Flat Consent is installed correctly on ____ and fix anything it reports in this repo. ``` ## 5. Add only the skill To add the skill without the plugin: ``` mkdir -p .claude/skills/flatconsent && curl -sL https://flatconsent.com/skill.md -o .claude/skills/flatconsent/SKILL.md ``` ## Every page as Markdown Add `.md` to any docs address to get the page as Markdown, for example `https://flatconsent.com/docs/install.md`. The index is at [`/llms.txt`](/llms.txt), and every page in one file is at [`/llms-full.txt`](/llms-full.txt). Each page also has a **Copy for LLM** button. --- # Where the banner shows How the banner follows the law where each visitor is, and how to change it for a place. The banner does what the law asks in the place each visitor is in. It works out the visitor's country, and in the US and Canada their state or province, then does one of three things. This page describes the rules in force today (release 2026.09.2). Updates that are already scheduled are listed under [Scheduled changes](#scheduled-changes). | Visitors see | What runs before they choose | Where | |---|---|---| | **Asks first** | Only what the site needs to work. | The EU (including France's overseas regions and Åland), Iceland, Norway, Liechtenstein, Switzerland, the UK, Quebec, Brazil, Colombia, Peru, Vietnam, Thailand, Turkey, South Africa, Nigeria, China, Saudi Arabia, Indonesia; Chile from 1 December 2026 and India from 13 May 2027 | | **Opt-out link** | Everything, until the visitor opts out. Where the law asks for one, a “Your privacy choices” link is added to your footer. | The 19 US states with a privacy law in force, including California, Texas, Virginia and Colorado; Canada outside Quebec; South Korea | | **No banner** | Everything. A settings link stays available. | Everywhere no law asks for a banner, including US states without a privacy law, and Florida, whose law only covers very large companies | Four more US states have privacy laws with a start date, and the banner switches to an opt-out link there on that day: Oklahoma and Louisiana on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028. The full list, with the reason for each place, is on your site’s **Banner** tab under **Where it shows**, then **See every place**. ## Your own visit statistics Some countries let a site count its own visits without asking first, under certain conditions. You don't have to fill anything in: our site check looks at which analytics your site runs and decides whether they qualify. Under the rules in force today, no place where the banner asks first lets them run without asking yet, so visitors there are asked about statistics too. That changes with the scheduled updates: in the UK, Switzerland, Brazil and South Africa with 2026.09.3, and in France, Spain, Italy and the Netherlands with 2026.09.5 (see [Scheduled changes](#scheduled-changes)). - **Tools that can qualify:** Matomo, Piwik PRO, Piano Analytics and etracker, when they measure your site alone. - **Tools that can’t:** Google Analytics, Adobe, Hotjar, Clarity and others whose providers use the data themselves. Visitors are asked first wherever the law says so. - **Cookieless tools** (Plausible, Fathom, Simple Analytics, Umami, Cloudflare Web Analytics) store nothing on the device and need no consent anywhere, so they run for everyone. ## Browser opt-out signals Visitors whose browser sends Global Privacy Control are opted out automatically wherever a law requires the signal to be honoured. Today that covers 12 of the 19 US states with a privacy law in force, including California, Colorado, Connecticut, Texas and New Jersey. In California the banner also confirms the opt-out on screen (“Opt-out request honored”), as California has required since January 2026. See [Footer link](/docs/footer-link/) for where the link goes. ## Changing it On the **Banner** tab, under **Where it shows**: - **Follow the law where each visitor is** is the default and the setting we recommend. - **Ask first everywhere** asks every visitor, wherever they are. You may collect less data. - **Ask first in California too** is stricter than California’s law. Some sites choose it to lower the risk of lawsuits over tracking pixels. It stays off unless you turn it on. - **About your business** is where you say how large your business is. Most US state privacy laws only cover businesses above a certain size. Under today's rules every US state law applies to every site. From the 2026.09.3 update, the state rules use your answers, and until you answer we assume every law covers you. - **See every place** lets you choose what happens in a single country or state. Your choice there overrides every other setting. ## When the law changes We keep these rules up to date. When a new law has a start date, the banner switches over by itself on that day. See [How we keep you compliant](/docs/compliance/). ## Asking again The banner remembers a choice, yes or no, for six months and then asks again. You can change this under **Ask again after (days)** in the Banner tab's Advanced settings. Visitors are also asked again whenever you save a change to the banner's settings, for example after adding an ad pixel. ## Scheduled changes Each update spends a week on trial and 48 hours on 5% of sites before it reaches everyone (see [How we keep you compliant](/docs/compliance/)). **2026.09.3, rolling out now** (currently on 5% of sites): - US state laws apply only to the businesses they cover, using your answers under **About your business**. Until you answer, every law applies as before. - In the UK, Switzerland, Brazil and South Africa, statistics that qualify run from the start. If there is nothing else to ask about, visitors there see a small notice with a way to turn statistics off. - Israel and Singapore get a small notice. Statistics and preferences run, and advertising waits until the visitor agrees. - Canada outside Quebec and Mexico get a notice that says what the site uses and lets visitors turn it off, while everything runs. Canada keeps its “Your privacy choices” link. - Chile (until its new law starts in December) and Argentina ask first. - Delaware's law covers more businesses from 1 January 2027. **2026.09.4, starting on 5 October 2026:** - Egypt asks first from 1 November 2026. **2026.09.5, starting on 15 October 2026:** - In France (and its overseas regions), Spain, Italy and the Netherlands, statistics that qualify run without asking. If there is nothing else to ask about, visitors there see no banner. - Each of these countries adds conditions. France and Spain require analytics cookies to last 13 months at most, which we check from outside. France and Italy require visitors’ IP addresses to be shortened. We can’t see that from outside, so if your tool can do it, the Banner tab asks you to confirm one setting and tells you where to find it. France also expects your privacy policy to offer a way to turn statistics off, so link to your cookie settings there (see [Footer link](/docs/footer-link/)). Wherever statistics run from the start, the banner says they are on, and visitors can turn them off at any time. --- # How we keep you compliant How the rules are kept current as laws change, and how changes reach your site without breaking it. Privacy laws change often. New US state laws start on fixed dates, regulators publish new guidance, and courts change what counts as consent. We keep the rules your banner follows up to date, so you don't have to track any of this yourself. ## What we do - **We watch the law.** Every week we reread the official pages behind each rule: statutes, regulator guidance and enforcement notices. When a page changes, a person reads what changed. - **We update the rules.** Changes go into a new release of the rules, with a plain note of what changed and why. - **Dated laws switch on by themselves.** When a law has a start date, the rule ships ahead of time and your banner changes on that day. If your visitors there will see something different, we email you two weeks before. - **We tell you what changed.** When a release goes live, owners whose visitors will see something different get an email that lists the changes for each site. ## How a change reaches your site Every change is tested before it reaches your site, and the tests make sure checkout keeps working. 1. **Trial.** For a week, a new release runs on paper only. We work out what would change for every site and how many visitors that affects. 2. **Checkout rehearsal.** We load real sites that the change affects in a real browser twice, once under the current rules and once under the new ones, as a visitor from the place that changes. We compare the home page and a cart or checkout page. If the banner fails to start, new errors appear or a payment provider stops loading, the release is stopped. 3. **5% of sites for 48 hours.** After that comes a second rehearsal, and the release goes to everyone only if it passes. 4. **Instant rollback.** Any release can be undone for every site within a minute. ## What is never blocked Whatever a rule, list update or setting says, the banner never holds back payment, checkout, fraud-prevention, bot-protection or sign-in services, such as Stripe, PayPal, Shopify checkout, Adyen, Klarna, Apple Pay, Google Pay, reCAPTCHA and Cloudflare Turnstile. Scripts the banner does not recognise keep running. If our servers cannot be reached, your site and its checkout carry on working. On Shopify, the banner passes visitors’ choices to Shopify’s own privacy settings, so Shopify’s checkout and pixels follow them too. ## What we don’t promise We follow published law and regulator guidance. Where the law is unclear, we take the stricter reading and say so. This is not legal advice, and we do not guarantee that you won't be fined or sued. If your site does something unusual, such as selling health data, ask a lawyer what else applies. ## Every response says which rules applied Each record in your consent log includes where the visitor was (for example `US-CA`) and the version of the rules in force, so you can show what they were offered at the time. --- # Categories The four kinds of cookies and what goes where. | In the dashboard | In the banner | What it means | |---|---|---| | Required | Necessary | The site does not work without it: logins, carts, security, and the stored consent choice itself. Always on. | | Preferences | Preferences | Remembers a setting, such as language, region, a closed pop-up or the state of a chat widget. | | Statistics | Analytics | Measures how the site is used, for example Google Analytics, Hotjar and Clarity. Cookieless tools such as Plausible need no consent and run for everyone. | | Advertising | Marketing | Shows or measures ads, or tracks visitors across sites, for example Meta Pixel, Google Ads, LinkedIn, TikTok, and embedded YouTube videos and Maps. | The banner's second layer shows one switch per category, each with a short description. The cookie list page groups cookies by the same categories. If you disagree with how something was categorised, change **Used for** on the site's Cookies tab. Your choice is kept in future checks, and the banner, the cookie list page and the rules for what is held back update straight away. Labelling an ad pixel as Required is the most common thing regulators fine, so when in doubt, pick the stricter category. --- # Wording and design What the banner says and how it looks. ## The words The banner says two things: what runs anyway, and what would run with permission. The second sentence names only the categories your site uses, so on a site with analytics and no ads, the banner never mentions ads. The banner speaks 35 languages. These are every official EU language except Irish and Maltese (whose readers also have English), plus Norwegian, Icelandic, Catalan, Brazilian Portuguese, Indonesian, Korean, Vietnamese, Thai, Turkish, Chinese (simplified and traditional), Arabic and Hebrew. Arabic and Hebrew are shown right to left. Between them they cover every place where the banner asks first. The banner uses your page's language (the `lang` on your `` tag) first, then the visitor's browser languages, then your site's default language. If your visitors often read a different language from the one your pages are written in, turn on **Show the banner in each visitor's own language** (Banner tab, under Advanced). The banner then follows the visitor's browser first and your page's language second. On the Banner tab, you can pick a language and write your own title and text in it. The buttons keep our translation, and languages you haven't written in use our translation throughout. As you type, we check that your text still says the site uses cookies and what they're for, doesn't push visitors to accept, and is in the language you picked. If it doesn't, you'll see a note, but it never stops you saving. Under **Buttons**, the plain wording option replaces the button labels with ones that say what happens: "Allow tracking" and "Continue without tracking". Research shows that wording like this raises the number of considered choices. ## The design - **Position**: bottom left by default. You can also choose bottom right, bottom centred or the middle of the page. In the middle, the banner covers the page and gets fewer interactions, so we don't recommend it. - **Colours**: button, button text, background, text and muted text. They are set from your site automatically, and you can change them with the pickers. - **Font**: your site's font, so the banner looks like part of the page. - **Corners**: matched to the roundness of your buttons. **Match my site’s colours** on the Banner tab rereads the latest check and applies what it found. If your button text would be hard to read on your button colour, we switch the text to black or white and tell you. ## Contrast and accessibility Text always meets WCAG AA contrast. The banner works with a keyboard, keeps focus inside it while it is open, has 44px touch targets, respects reduced-motion settings, and makes sure it never hides the page element that has focus. --- # Footer link and floating button How visitors change their mind from any page, and how we keep that out of their way. Visitors need a way to change their mind from any page. We make that as unobtrusive as the law allows. ## Your own footer link (recommended) ```html Cookie settings ``` Clicking any element with `data-cmp="settings"` opens the settings. If your page has one, the banner adds nothing else. ## Where the law requires a link Under the rules in force today (release 2026.09.2), visitors from these places must see a “Your privacy choices” link: California, Colorado, Connecticut, Oregon, Montana, Delaware, New Hampshire and Minnesota, Canada outside Quebec, and South Korea. Vermont joins them on 1 January 2028. For visitors from those places: 1. If your page has a `data-cmp="settings"` link, the banner uses it. 2. Otherwise we add a small “Your Privacy Choices” link at the end of your page’s footer. It uses your footer’s own style and text colour, with California’s opt-out icon beside it. 3. Only if the page has no footer at all does a small button float in the bottom corner. In California, visitors whose browser sends Global Privacy Control see a short “Opt-out request honored” message. As California requires, the same status also appears next to the link and in the settings. If the visitor later chooses to allow tracking, the status is removed. ## The floating button elsewhere The floating button is off by default. If your pages have no footer link and you want a button on every page, turn on **Floating “Cookie settings” button** under **Advanced** on the Banner tab. ## Scheduled changes The 2026.09.3 update, rolling out now on 5% of sites, changes where the link appears in two ways: - US state laws apply only to the businesses they cover, based on your answers under **About your business** on the Banner tab. If a state's law doesn't cover your business, visitors from that state don't get the link. Until you answer, every law applies as before. - In Canada outside Quebec, visitors also see a small notice that says what the site uses and lets them turn it off. The “Your privacy choices” link stays. The updates starting on 5 October 2026 (2026.09.4) and 15 October 2026 (2026.09.5) don't change where the link appears. See [Where the banner shows](/docs/regions/#scheduled-changes) for everything they change. --- # Google and Microsoft Consent Mode v2 and Microsoft UET consent, with no changes to your tags. Google requires sites in Europe to tell it about consent before its tags run. We do this with Consent Mode v2: the banner sets default signals before your tags load and sends an update as soon as a visitor chooses. Google Analytics, Google Ads and Tag Manager need no changes. Microsoft Advertising works the same way (UET consent), and it is on by default. Consent Mode passes the visitor's choice to Google's tags. It doesn't decide what the law asks of your site; the banner's rules for each country do that. Google's own guides: [Consent Mode for developers](https://developers.google.com/tag-platform/security/guides/consent) and [About Consent Mode](https://support.google.com/google-ads/answer/10000067). ## What the banner sends - Before your Google tags run, `ad_storage`, `analytics_storage`, `ad_user_data` and `ad_personalization` start as denied. - When a visitor accepts or rejects, the banner sends an update. Rejecting everything sends all four as denied; accepting everything sends all four as granted. Advertising sets the three ad signals, analytics sets `analytics_storage`. - Where your rules show no banner (for example most US states), the banner sends granted, so your measurement there carries on. - On later pages the defaults stay the same and the banner sends the visitor's saved choice as an update. It is on for every new site. To turn it off, switch off **Tell Google Ads and Analytics about each choice (Consent Mode)** in the Banner tab's Advanced settings. ## Basic and advanced Google describes two ways to run Consent Mode. - **Basic (our default).** Google gets nothing until a visitor says yes. The banner holds Google's tag (`gtag.js`) until the visitor agrees to analytics, and holds the cookieless "no consent" requests of Google tags loaded through Tag Manager, including requests sent through your own address. - **Advanced.** Google's tags load straight away. While consent is denied they send cookieless requests, which Google uses to estimate ("model") conversions. Turn on **Let Google's tags send cookieless data before visitors agree (Advanced)** in the Banner tab's Advanced settings. Switch it off to go back to basic. Where the law asks first, regulators haven't settled whether advanced mode is allowed. ## What this means for your reports - After consent, Google's tags work normally. - If your site has enough traffic, Google can model some of the missing conversions. For Ads that takes about 700 ad clicks a week per country, and for Analytics about 1,000 daily visitors. Smaller sites see only the data that was observed. We mention this because the idea that modelling will recover lost data is often overpromised. ## Tag Manager Our script must run before the Tag Manager snippet, so put it above the snippet in your page's ``. The install check confirms this ("Google tags wait for consent"). If you load Meta, TikTok or other pixels through Tag Manager, either gate them on the consent state with a trigger or let our automatic blocking hold them. It does this for known pixel hosts. ## Checking your setup - **Install check.** Press **Check my site** on the Install tab. It loads your homepage and tells you whether Google tags wait for consent or a Google tag loads first. The monthly email repeats the result. - **Tag Assistant.** Open [Google Tag Assistant](https://tagassistant.google.com/), connect your site, and open the Consent tab on the first event. The defaults should be denied before any tag fires, and an update should follow when you choose in the banner. If a Google tag loads first, move our script line above it. If it still loads first, check whether the tag comes through Google tag gateway (below). ## Google tag gateway [Google tag gateway for advertisers](https://developers.google.com/tag-platform/tag-manager/gateway) serves Google's tag from your own domain, through your CDN (such as Cloudflare), load balancer or web server. When it is switched on with one click at the CDN, the CDN adds the tag to your pages itself, so you can no longer choose whether it loads before or after our script. Consent then arrives late. **How to tell if a tag uses it:** - In Google Ads, Analytics or Tag Manager, open the Google tag's settings and then **Google tag gateway**. A domain marked **Active** or **First-party** uses it. - In your browser's developer tools, open the Network tab and reload. A gateway tag loads from a path on your own domain instead of `googletagmanager.com`. - In Cloudflare, look for Google tag gateway under your domain's settings. **If the install check says a Google tag loads first and the tag uses the gateway**, do one of these: - Use advanced mode (above). Google recommends it for gateway tags, because advanced mode works when the tag loads before the consent signal. Review the consent defaults and data controls in your Google tag's settings to match what you need. - Move your Google tags into a Tag Manager container and serve that container through the gateway, with our script above it. - Set up the gateway by hand ([Google's setup guide](https://developers.google.com/tag-platform/tag-manager/gateway/setup-guide)) so you control the order of scripts on the page. ## Server-side tagging Consent Mode signals only reach Google tags. Server-side integrations for Meta and TikTok need their own consent check, which can read the visitor's choice from the JavaScript API or the `cmp:consent` event. ## Getting help If Google's tags aren't getting consent signals, email us first at hello@flatconsent.com, not Google support. The signals come from our banner, and Google's support asks you to check with your consent provider before contacting them. --- # Embeds and custom scripts YouTube, Maps, chat widgets and your own scripts. ## Embedded videos and maps A browser requests an iframe's content as soon as it reads the tag, before any script can stop it. To hold an iframe back, give it `data-cmp-src` instead of `src`, and a category: ```html ``` Until the visitor accepts that category, the frame shows a placeholder with a "Load content" button. The banner also catches iframes that JavaScript adds to the page later. ## Fonts from Google If your pages load fonts from `fonts.googleapis.com` or `fonts.gstatic.com`, each visitor's browser sends its IP address to Google as the page opens. A banner can't hold this back without your text showing in the wrong font, and in January 2022 a Munich court ordered a site owner to pay a visitor damages over it ([LG München I, 3 O 17493/20](https://www.gesetze-bayern.de/Content/Document/Y-300-Z-GRURRS-B-2022-N-612)). The fix is to serve the same font files from your own site. Visitors see no difference. | Platform | How | |---|---| | WordPress | Many themes and page builders have a "load Google Fonts locally" setting (Elementor: Settings > Performance). Otherwise a plugin that downloads the fonts to your site does it. | | Webflow | Upload the font files under Site settings > Fonts instead of adding them as Google Fonts. | | Hand-built sites | Download the files (for example from fontsource.org or the font's own repository), put them on your server, and point your CSS `@font-face` at them. | Shopify and Wix serve their built-in fonts from their own servers. Our check flags any page that still calls Google's font servers. ## Your own scripts Mark a script with the category it needs, and it waits until the visitor accepts that category: ```html ``` For a script that must always run, add `data-cmp="ignore"`. ## Automatic blocking The banner holds known tracker scripts automatically, whether they are in your HTML, injected by Tag Manager or added by a plugin. The list includes Google Analytics, Google Ads and Tag Manager's gtag, Meta, LinkedIn, TikTok, Pinterest, Microsoft, Hotjar, Clarity, HubSpot and Intercom, plus YouTube, Vimeo, Maps and Spotify embeds. Rules from your site check are added to this list. To add your own, use **Other services to keep off until visitors agree** under Advanced on the Banner tab: one per line, the host followed by `analytics`, `marketing` or `functionality`. --- # Cookie list page The page that tells your visitors which cookies your site uses. Regulators expect you to tell visitors which cookies you use, what they are for and how long they last. We build that page from your site check and host it at: ``` https://cdn.flatconsent.com/declaration/YOUR_SITE_ID ``` The page uses your banner colours, lists every cookie by category with the company, purpose and how long it lasts, and has a button that opens the settings. The banner links to it automatically, and you should link to it from your privacy policy too. The page updates every time you run a check. If you prefer to use your own page, enter its address in **Cookie list link** under Advanced on the Banner tab, and the banner links there instead. --- # Records and proof What is stored about each response and how to find it. We record every response a visitor gives the banner: an anonymous ID, the time, the choice for each category, the banner version, the country, where the visitor was (the country, or in the US and Canada the state or province, such as `US-CA`), the version of the rules in force, and the browser type. We don't record IP addresses. These records are what you show if a regulator or a visitor asks for proof. ## The Responses tab Each site in the dashboard has a **Responses** tab. It shows: - How many responses came in over the last 30 days, split into Accepted all, Chose some and Rejected all. - The same numbers by place, on a map that draws each US state separately or as a table. Click a place to see its latest responses. - Browser opt-outs (Global Privacy Control), counted separately. - The latest responses, described in plain words. We keep every choice a visitor makes, so a later change shows as **Changed** and turning something off shows as **Withdrew consent**. - An ID for every response. The table shows the first 8 characters, and clicking copies the full ID. **Find by ID** accepts either. A developer can get a visitor's own ID in their browser with `cmp.getConsentId()`. - **Download consent log**, which exports everything as a CSV file for proof. For each response, the `event` column says what it meant compared with the visitor's previous response: first choice, changed, withdrew consent or GPC opt-out. For US visitors who opted out of the sale or sharing of their data, it also includes the record California's regulations (§7101) ask for: the request, how it was made (GPC signal or the site's privacy choices) and the response, in `optout_request`, `optout_method` and `optout_response`. `event_id` identifies each response, and `id` identifies the visitor and is the same on all their responses. On sites with ad networks (IAB TCF) turned on, `tc_string` holds the TC string ad partners were given after the choice and `ac_string` holds Google's Additional Consent string; both are empty for every other response, and both are part of the response's fingerprint when present. ## What they saw Every time your banner is published, we keep an exact copy of it, including the wording in every language, the colours, the layout and the links. Each copy is identified by a fingerprint of its content, so any later change to it would show. Each response records which copy the visitor saw, the version of the banner code, where the visitor was and the rules in force. We also take screenshots of every published version, on desktop and on a phone. They are drawn from that copy by the same code that renders the live banner. The fingerprints of each pair of screenshots are timestamped by independent timestamp authorities, following CNIL's advice to keep timestamped screenshots of each version. Open **What they saw** to see them. Click **What they saw** on any response to see the banner redrawn exactly as that visitor saw it, in their language and with those details. ## Tamper-evident Every night we seal the previous day. Each response gets a fingerprint (a SHA-256 hash of its fields). Your site's fingerprints are combined into one site fingerprint, and the fingerprints of all sites are combined into one for the day. Each day is then chained to the day before, so no past day can be rewritten without breaking every day after it. We publish the sealed days, as hashes only, at [cdn.flatconsent.com/proof](https://cdn.flatconsent.com/proof). This follows the French regulator CNIL's recommendation to publish a timestamped hash as proof. Two independent timestamp authorities, DigiCert and Sectigo, also timestamp each day's chained fingerprint under the RFC 3161 standard. Their signed tokens prove that the day existed in that form by the signed time, without relying on us or our clock. We publish the tokens with each day. You can check your own records without trusting us. Download your consent log (each response's fingerprint is in the `leaf` column) and run: ```bash curl -O https://flatconsent.com/verify-proof.mjs node verify-proof.mjs responses.csv YOUR_SITE_ID 2026-09-22 ``` The script recomputes every fingerprint from the data, rebuilds your site's fingerprint for that day, finds it in what we published, and checks the day's timestamps with OpenSSL, which is installed on macOS and most Linux systems. ## Proof of consent, signed For any response, open **What they saw** and download its **proof of consent**, either as a one-page PDF for people or as JSON for machines. It states what the visitor chose and what that meant (first choice, change, withdrawal or US opt-out), where they were and which rules were in force, exactly which banner they saw, and where the response sits in the sealed and timestamped records. Flat Consent signs it with Ed25519, and our public key is at [cdn.flatconsent.com/proof/key](https://cdn.flatconsent.com/proof/key). You can also get the consent log export signed: after **Download consent log**, choose **Signature for this file**. The signature states the file's SHA-256 hash, how many responses it holds and its cut-off time. You can check either kind of signature without trusting us: ```bash node verify-proof.mjs --signed responses-example.com-1790000000000.csv responses-example.com-1790000000000.csv.sig.json node verify-proof.mjs --proof proof-example.com-1a2b3c4d.json ``` ## Change history We record every change to a site's settings: who made it, whether it came through the dashboard, an API key or our own site check, and each setting's value before and after. Open **Change history** at the bottom of the Banner tab. ## How long records are kept Under **Keeping records** on the Responses tab, choose 1, 2, 3 or 5 years. The default is 2 years, which covers California's requirement to keep opt-out records for 24 months. Older responses are deleted automatically each night, and each cleanup is logged. **Hold** stops all deletion until you turn it off, for example during a complaint or an investigation. If a cleanup would delete far more than on a usual night (after you shorten the period, for example), it waits a week first. Everyone on your account gets an email saying how many responses will be deleted, from before which date and on which day, with a link to download them first. The same notice shows under **Keeping records** until then. Choosing a longer period or turning on Hold during that week cancels the cleanup. ## Who accessed the records The Responses tab lists everyone who viewed, looked up, downloaded or deleted responses, with the time and whether they used the dashboard or an API key. Viewing is logged once an hour per person, and downloads, proofs and deletions are logged every time. ## Deleting a visitor's responses on request If a visitor asks for their data to be deleted, find their response by ID, open **What they saw** and choose **Delete this visitor's responses**. This permanently removes every response with their ID. We keep only a note that responses were deleted on request, along with each one's fingerprint, so days that were already sealed still verify. --- # Data and privacy Where things are stored and what is never stored. - Consent records are written to a Cloudflare database restricted to EU jurisdiction. - We store no IP addresses, not even in hashed form, and no raw browser strings. We use the IP address only to work out the visitor's country and state, then discard it. - The banner sets one cookie, `cmp_consent`, which holds the visitor's choice and contains no personal data. - The site check stores a screenshot of your homepage for the preview, and the list of cookies and services it found. - You sign in with an emailed link or your company's single sign-on. We keep your email address and your role in each workspace. If you turn on two-factor sign-in, we also keep its secret (encrypted) and your recovery codes (hashed). - Everyone who processes data for us is on the [subprocessor list](/subprocessors/). The [security page](/security/) explains how we protect it. - The banner script is served from our edge network. The line from your Install tab is cached for five minutes so fixes reach your site quickly, and pinned versions are cached for a year. The script sends one request for your site's settings and one when a visitor makes a choice. On about one page view in ten it also sends a short report of the outside services the page contacted and the names of the cookies it can read (never their values, and nothing that identifies the visitor). We count these per day, keep them 30 days, and use them only for the [Seen on real visits](/docs/check/#seen-on-real-visits) list. --- # For agencies Many client sites in one dashboard. - **Add a site by typing its domain.** A check runs in the background and sets the colours, wording, rules and cookie list. - **Copy settings from another site.** When you add a site, choose one of your existing sites under **Copy settings from**, and its banner text, colours, where-it-shows settings, rules and signals carry over. - **One invoice.** Pro covers 10 sites, and Agency covers 50, then $1 for each extra site. - **Client logins and your own branding** come with the Agency plan. See [Your branding](#your-branding) for exactly what that covers. - **Move from Cookiebot** in one click. See [Cookiebot](/docs/cookiebot). - **Proof for clients**: show them the Responses tab, the install check and the cookie list page. ## Your branding On the Agency plan, your branding is the look you save under **Client reports**, in **How your reports look**: a name, a logo and an accent colour. Admins and owners can change it. Until you save it once, the dashboard looks like ours. Once it's saved, it shows in these places: - **The dashboard header.** Everyone in your workspace, clients included, sees your logo and name at the top in place of ours, and your name in the browser tab. - **The menu.** Your accent colour marks the current page, used exactly as you set it, but only when it has a contrast of at least 4.5:1 against the header. If it's lighter than that, we don't adjust it, and the marker uses the dashboard's dark text colour instead. - **Invites.** Invites to your workspace come from your name, with your name in the subject and the message. - **Login links.** People whose only workspace is yours get login links under your name. Someone who is also in another workspace gets ours. - **Client reports.** They show your name, logo, colour and closing message, with no mention of Flat Consent. Flat Consent's name stays in these places: - A small "Powered by Flat Consent" line at the foot of the Team, Security, API and Billing pages. The Sites pages and Client reports don't have it. - The dashboard's address (app.flatconsent.com), the login page, and the address emails come from (login@flatconsent.com). - The **Docs** link in the menu, which goes to flatconsent.com. - Buttons and links in the dashboard, which keep our colours. - Monthly compliance reports and notice emails, such as new rules or a new tracker found on a site. - Places where the dashboard describes itself, for example our own cookie in a site's cookie list. The banner and the cookie list page on your clients' sites never show Flat Consent's name. --- # Moving from Cookiebot Import the banner texts, colours and cookie list, then swap the tag. 1. In the dashboard, choose **Import from Cookiebot** and enter the site's domain. We read the site's public Cookiebot configuration, including the texts, colours, cookie table and the tracker rules Cookiebot had. 2. Review the imported settings on the site's Banner tab. You can edit all of them. 3. Install our line and press **Check my site**. When we confirm our banner is working, remove the Cookiebot tag so visitors see one banner. 4. Existing visitors are asked once more, because their earlier choice was recorded by another tool. If Cookiebot is loaded through Tag Manager, we may not find its ID on the page. In that case, paste the domain group ID from your Cookiebot script tag into the **Cookiebot ID** field. --- # JavaScript API For developers who want to react to choices or open the banner. `window.cmp` is available once the `cmp:ready` event has fired. | Call | What it does | |---|---| | `cmp.show()` | Opens the banner. `cmp.show(2)` opens the settings. | | `cmp.hide()` | Closes the banner. | | `cmp.getConsent()` | Returns the current choices, or `null` if the visitor hasn't chosen yet. | | `cmp.getConsentId()` | Returns the visitor's anonymous record ID. | | `cmp.setConsent({ analytics: true })` | Sets the categories you pass. | | `cmp.acceptAll()` / `cmp.rejectAll()` | Does the same as the banner's buttons. | | `cmp.withdraw()` | Clears the stored choice and rejects everything. | | `cmp.runScripts()` | Checks `text/plain` scripts again, for use after client-side navigation. | | `cmp.state()` | Returns which rules this visitor got: `{ regime, place, rulebook }`. | | `cmp.on('consent', fn)` | Calls `fn` with `{ choice, id, regime, place, rulebook }` every time the visitor decides. Returns a function that unsubscribes. | Events on `document`: `cmp:ready`, with `{ regime, country, place, rulebook, lang }`, and `cmp:consent`, with the same details as `cmp.on('consent')`. Attributes: `data-cmp="settings"` on any element makes it open the settings, `data-cmp="ignore"` exempts a script from blocking, and `data-cmp-src` on an iframe holds it back until its category is allowed. --- # Troubleshooting The problems people run into most often, and how to fix each one. **The banner does not appear.** You may be somewhere that no law asks for a banner, so it stays out of the way. In some US states it shows only a “Your privacy choices” link. The preview on the Banner tab shows the banner as a visitor from any place you pick under **Visitor from**. If the banner is still missing, press **Check my site** on the Install tab. **The check says the banner is not running.** A Content Security Policy is blocking the script. Allow `cdn.flatconsent.com` in `script-src` and `connect-src`. **Google Analytics still loads before consent.** Our line has to come before the Tag Manager or gtag snippet. Move it to the top of the head. **Two banners.** Remove the previous tool's tag, or turn off your platform's built-in banner (Framer, Shopify, Squarespace and Wix all have one). **An embedded video is blank.** That is the placeholder working as intended. Use `data-cmp-src` so it shows a "Load content" button, or accept the Advertising category. **A chat widget or form stopped working.** A rule is too broad. On the Cookies tab, switch that service to **Runs**, or edit the rule under **Other services to keep off until visitors agree** in the Banner tab's Advanced settings. Infrastructure such as reCAPTCHA is never blocked. **Visitors are asked again after a save.** Saving a change to the banner's settings starts a new version, and every visitor is asked again, including after changes to colours or wording. Saving without changing anything does not. --- # Plans and billing Flat monthly or yearly prices, with nothing metered. | Plan | Price | Sites | Records kept | |---|---|---|---| | Starter | $9 a month, $90 a year | 1 | 12 months | | Pro | $29 a month, $290 a year | 10 | 12 months | | Agency | $79 a month, $790 a year | 50, then $1 a site | 12 months | Every plan includes unlimited pages, visitors, subdomains and checks, the cookie list page, and rules that we keep up to date as privacy laws change. ## Free trial A new workspace gets 14 days of the plan you signed up for, with no card needed. Choose a plan on the Billing page before it ends and the banner keeps running. If you don't, it stops showing after the 14 days; your settings and records are kept, and choosing a plan later turns it back on. We email you 4 days and 1 day before the end. You can change or cancel your plan on the Billing page. Stripe handles payment and sales tax as the merchant of record, so VAT for your country is calculated at checkout. If you cancel, your plan runs to the end of the period you paid for, then the banner stops showing. Your settings and records are kept, so you can come back. ## Money back and our update promise Paid plans come with 30 days’ money back. If Flat Consent isn’t right for you in the first 30 days of a paid plan, email hello@flatconsent.com and we refund it in full. We test every banner update on live sites before it reaches yours. If an update still breaks your checkout, tell us: we roll the update back and refund that month’s fee.