Consent management platform· by Finstein.ai
Cookie consent, done right.
ConsentKit holds third-party trackers before they run, asks each visitor the question their jurisdiction actually requires, and keeps a receipt you can produce on demand. One line of code, set once.
<script>first in the head — nothing else- GDPR · CCPA/CPRA · TCF v2.2 · GPC
Regulation resolved
GDPR opt-inVisitor in the EEA · decided server-side
Held before load
299 trackersAcross four categories
GPC honoured
Why it is different
Three things a consent banner has to get right
Most implementations manage one of them. ConsentKit is built so that all three hold at the same time, on every page view.
Consent, end to end3 entries · all must hold
- No retagging, no rewriting your tag manager
Block before it runs
Scripts are intercepted the moment they are created, not cleaned up afterwards. 299 known trackers across four categories are held until their category is consented to, and cookie writes are guarded the same way.
- One-click CSV export for your audit trail
Prove exactly what you asked
Every choice writes a receipt: the timestamp, the policy and configuration version the visitor actually saw, the regulation applied, the action taken, the GPC signal, and the answer per category.
- Optional Subresource Integrity pinning
Ship one line, never touch it again
Paste one script tag first in the head and deploy. Copy, categories, languages and fixes are published from the dashboard as versioned releases — the page itself never changes again.
Miss any one of the three and the other two stop counting for much.
How it works
The consent stack
Four things have to happen in order, on every page view, for consent to mean anything. ConsentKit does all four.
Step 1Block
Nothing runs before you allow it
Script creation and cookie writes are patched at the top of the page, so a tracker is stopped before the browser ever requests it.
- 299 known third-party trackers recognised out of the box
- Four categories: necessary, analytics, marketing and other
- Held scripts are released the instant consent is given — no reload
googletagmanager.com/gtm.jsHeld · marketing
connect.facebook.net/en_US/sdk.jsHeld · marketing
google-analytics.com/analytics.jsHeld · analytics
cdn.your-site.com/app.jsAllowed · necessary
Intercepted at creation — nothing was fetched or executed.
Step 2Ask
The right question for the right visitor
The regulation is resolved server-side from the visitor’s country, then the notice is rendered in their language with the flow that law requires.
- EEA, UK and Switzerland get a GDPR opt-in flow
- The United States gets a CCPA/CPRA opt-out flow
- Unknown country falls back to the strictest rule · 11 languages
Country IEEEAGDPR opt-inEnglish
The notice is rendered in whichever of the 11 languages the visitor’s browser asks for
We ask before anything loads
Non-essential cookies stay switched off until you agree.
Reject is given equal prominence by default
Step 3Record
Every answer becomes a receipt
A record is written the moment a visitor decides, capturing what they were shown as well as what they chose — and nothing more.
- Policy and configuration version the visitor actually saw
- Regulation applied, action taken and the GPC signal state
- IPs stored as daily-rotating keyed pseudonyms, never raw
recorded_at2026-03-14T09:21:04Z
policy_versionv4 · config v12
regulationGDPR · opt-in
actionsave_preferences
gpc_signalabsent
analyticsgranted
marketingdenied
Step 4Prove
Produce the evidence in one click
When someone asks what you asked and when, the answer is an export rather than an investigation.
- Filter and export the full record set as CSV
- Receipts stay accurate across publishes because each stores its version
- Withdrawal records evidence of erasure, not a claim of it
1,482 records · last 30 daysCSV export
| Recorded | Regulation | Action | GPC |
|---|---|---|---|
| 14 Mar 09:21 | GDPR | save_preferences | absent |
| 14 Mar 09:19 | CCPA | opt_out | present |
| 14 Mar 09:14 | GDPR | withdraw | absent |
Withdrawals store evidence that the data was erased, not a claim that it was.
Features
Everything the job actually needs
Not a banner with a checkbox — the blocking, the record keeping and the operational parts that make a consent programme survive an audit.
Automatic tracker blocking
Known third-party trackers are recognised and held at script creation — not cleaned up after they have already run.
Preference centre in 11 languages
Visitors can review each category and change their mind, in the language their browser asks for.
Versioned publish and rollback
Stage a change, compare it with what is live, publish when ready, and roll back instantly if it lands badly.
Consent records and CSV audit trail
Receipts carry the timestamp, versions, regulation, action, GPC state and answer per category — exportable as CSV.
Geo-resolved regulation
Decided per visitor from their country, server-side: opt-in for the EEA, opt-out for the US, strictest when unknown.
Signed, SSRF-safe webhooks
Consent events reach your systems with signed payloads, and outbound requests are guarded against SSRF.
Cookie scanner
A command-line scanner audits a site and prints a ready-to-paste category block for your configuration.
Consent Mode v2 and GPC
Consent Mode v2 signals stay in step with the visitor’s choice, and a GPC header counts as a valid CCPA opt-out.
Try it
The banner, as your visitors would meet it
Switch the visitor’s regulation and the layout preset, then accept or reject. This is the real logic ConsentKit applies — the notice, the defaults and the record all change together.
What the page is doing
liveregulationGDPR
flowopt-in
actionawaiting_choice
analyticsdenied
marketingdenied
trackers held299 vendors
Reject is rendered at the same size, weight and contrast as accept — the equal-prominence default regulators look for.
Security and privacy
The compliance tool should not become the tracking problem
A consent platform sees every visitor of every page it runs on. That is exactly why ConsentKit is built to keep as little as it can get away with, and to prove the rest.
IPs become rotating pseudonyms
Never stored raw, and never as a naive hash. Keyed pseudonyms that rotate daily, so records cannot be linked across days or reversed with a precomputed table.
ip_pseudonym: pz_2f9a…c41 (rotates daily)
Minimised by default
User agents are reduced to something a human can read, URLs are truncated to origin and path, and product telemetry records hostnames only — never anything about the people visiting them.
user_agent: Chrome 141 on macOS
Webhooks signed and SSRF-guarded
Every delivery is signed so you can verify it came from us, and outbound destinations are validated to stop request forgery against internal networks.
Strict tenant isolation
Every query is scoped to a single tenant. One customer’s configuration, records and exports are never reachable from another’s session.
Subresource Integrity pinning
Lock the embed to an exact build with SRI, and the browser refuses to run the script unless its hash matches what you pinned.
integrity="sha384-…" crossorigin="anonymous"
Data minimisation is not a setting you switch on later. It is how the records are written in the first place — which is why an export can be handed to a regulator without a second thought about what else is in it.
Why ConsentKit
The difference is in what happens before the click
A comparison against how consent is usually implemented — a typical consent tool bolted on late, or tags managed by hand.
| Capability | ConsentKit | A typical CMP or hand-tagging |
|---|---|---|
| Blocking before the tracker runs | Intercepted at script creation, so nothing is fetched or executed while the notice is on screen. | Cleaned up after the fact, or only works once every script tag has been rewritten by hand. |
| Reject given equal prominence | The default on every layout preset: same size, same weight, same contrast as accept. | Often an extra click behind “manage”, or styled quietly enough to be missed. |
| What a consent record contains | Timestamp, policy and configuration version the visitor saw, regulation, action, GPC state, per-category answer. | A boolean and a timestamp — which does not show what was on screen at the time. |
| Personal data held by the tool itself | IPs stored as daily-rotating keyed pseudonyms; user agents and URLs minimised before storage. | Raw IP addresses and full user agents retained, turning the compliance tool into another dataset. |
| Changing the banner | Versioned publish, staged preview and instant rollback to any earlier version. | Edit in place and hope, with no way back if the change lands badly. |
| Proving it months later | Filter and export the record set as CSV; a withdrawal stores evidence of erasure. | Reconstruct the answer from server logs, if they still exist. |
No product names, because the point is not who else is in the market — it is that consent only counts when the blocking happens first and the record survives the change.
ConsentKit by the numbers
299
Known third-party trackers recognised and held before they run
11
Languages in the banner and preference centre, auto-detected
360
Automated checks the product has to pass on every change
4+
Frameworks covered: GDPR, CCPA/CPRA, TCF v2.2, Consent Mode and GPC
Figures describe the ConsentKit product as it ships today.
FAQ
Questions worth a straight answer
What ConsentKit does, what it does not do, and where the line between the two sits.
What is a consent management platform?
A consent management platform (CMP) is the software a website uses to ask visitors for permission before non-essential cookies and trackers run, to act on that answer, and to keep a record of it. ConsentKit does all three: it holds trackers until their category is consented, shows the right notice for the visitor’s jurisdiction, and stores a receipt of what was asked and answered.
Does ConsentKit support GDPR and CCPA?
Yes. ConsentKit resolves the applicable regulation per visitor from their country, server-side. Visitors in the EEA, the UK and Switzerland get a GDPR opt-in flow where nothing non-essential runs until they agree. Visitors in the United States get a CCPA/CPRA opt-out flow. When the country cannot be determined, ConsentKit applies the strictest rule rather than the most permissive one.
How does auto-blocking work without changing my tags?
ConsentKit intercepts third-party scripts at the moment they are created, before the browser fetches or executes them, and matches them against a catalogue of hundreds of known trackers grouped into four categories. Anything in a category the visitor has not consented to is held, and released the instant consent is given. Cookie writes are guarded the same way. You do not retag your site or rewrite script tags by hand.
Does it work with Google Consent Mode?
Yes. ConsentKit implements Google Consent Mode v2, so Google tags receive the visitor’s consent state — including ad_user_data and ad_personalization — and adjust their behaviour instead of being blocked outright. Consent Mode signals are updated immediately when the visitor changes their preferences.
How are consent records stored?
Every choice produces a receipt containing the timestamp, the policy and configuration version the visitor actually saw, the regulation applied, the action taken, whether a Global Privacy Control signal was present, and the per-category decision. Records are exportable as CSV in one click. A withdrawal is recorded as evidence that data was erased, not merely as a claim that it was.
Is ConsentKit a certified IAB CMP?
ConsentKit supports IAB TCF v2.2. Certification is a separate process run by IAB Europe with its own registration and validation steps, so we describe ConsentKit as supporting TCF v2.2 rather than as a certified CMP.
How much data does ConsentKit itself collect?
As little as possible. IP addresses are stored as keyed pseudonyms that rotate daily, so records cannot be joined across days or reversed with a rainbow table. User agents are minimised to a readable form such as “Chrome 141 on macOS”. URLs are truncated to origin and path, dropping query strings and fragments. Product telemetry records hostnames only. A compliance tool should not become a tracking dataset.
Does ConsentKit honour Global Privacy Control?
Yes. When a browser sends a Global Privacy Control signal, ConsentKit treats it as a valid CCPA opt-out for that visitor, applies it without requiring any further interaction, and records that the signal was present on the resulting receipt.
How do I install it?
Paste one script tag first in the head of your pages and deploy. That is the whole integration. Configuration, categories, copy and languages are managed from the dashboard and published as versioned releases, so fixes and changes ship without anyone editing the page again. Subresource Integrity pinning is available if you want the embed locked to a specific build.
How do I find out which cookies my site sets?
ConsentKit ships a cookie scanner you run from the command line. It audits a site and outputs a ready-to-paste category block for your configuration. It is a manual tool you run when you want a fresh picture — there is no scheduled background crawling of your site.
Something here not covered? Email us at hello@finstein.ai — a person answers.
One line today, an audit trail from tomorrow
Paste the embed, publish your categories, and let ConsentKit hold the trackers until your visitors have actually said yes.
<!-- first in <head>, before every other script -->
<script src="YOUR_CONSENTKIT_EMBED_URL" async></script>Free, Pro and Business plans available · no credit card to start