Features · organised by the job, not the layer
Everything consent asks of you, done per site.
Ten jobs. Each one is a sentence to your agent, or a screen in the dashboard, with the same result.
Bring your existing AI agent
Connect our integration in Claude or ChatGPT and send your first prompt. Or point your coding agent to our MCP server URL to let it edit code directly.
Lovable and Bolt cannot reach outside servers directly. For those build tools, set up the site in the dashboard and copy the auto-generated prompt, which already includes your real script tag.
By job
Ten jobs. A sentence to your agent, or a screen in the dashboard.
Job 1
Put consent on a site
- Tell your agent: “Set up cookie consent on mysite.com.”
- What happens: Your agent creates the site with three categories, scans it for trackers, and files what it finds. It places the script tag in the head where it can reach the site, or hands you the tag and names the field. Once the site is live, it checks the page and reports a score out of 100.
- On the site: A working banner, and trackers that do not fire before the visitor chooses.
- Without an agent: Sites, New site, then Run scan, then copy the snippet from the install panel. The dashboard verifies the install too.
Job 2
Find out what the site is loading
- Tell your agent: “Scan mysite.com and tell me what is on it.”
- What happens: Your agent runs the scanner. It reads the pages, matches what it finds against a library of known services, and lists the cookies each one sets. Anything it does not recognise goes to a review queue instead of being guessed at. Each run is compared with the last, so new trackers stand out. Scans run on demand on every plan, weekly from Solo, and daily on Agency.
- On the site: Nothing yet. The list is usually the moment a site owner understands why this matters.
- Without an agent: Scanner, Run scan, then work the review queue with Allow, Block, or Categorise.
Job 3
Hold trackers until the visitor agrees
- Tell your agent: “Block everything non-essential until they accept.”
- What happens: Your agent turns on script and content blocking. The banner runtime loads first, in the head, and holds tracking scripts until the matching category is granted, including scripts injected later by other scripts. Built-in rules cover the common analytics and advertising trackers, and your agent adds a rule for anything else. Embeds such as video and maps show a click-to-load placeholder until consent.
- On the site: A page that loads no pixel before the visitor chooses, and embeds that wait for a click.
- Without an agent: Site settings, Blocking. Toggle script blocking and content blocking, and add custom rules.
Job 4
Make it look like the site
- Tell your agent: “Match the banner to the site: navy buttons, bottom left, the logo from the header.”
- What happens: Your agent changes the layout, position, colors, text, logo, and which buttons show. ConsentLayer republishes the banner, and the tag on the site stays the same. Layouts cover a small floating card, a full-width bar, and a centre modal, placed anywhere on the page. A preferences button can stay after the banner closes.
- On the site: The site’s banner, not ours. Every paid plan removes our branding.
- Without an agent: Banner, Design, with a live preview.
Job 5
Serve the right rules per region
- Tell your agent: “The business is in the US and gets EU visitors. Set the rules.”
- What happens: Your agent adds region groups from the built-in templates. GDPR: opt-in for EU and EEA visitors with blocking on. CCPA/CPRA: opt-out default for California visitors, Global Privacy Control honored, Do Not Sell shown. LGPD: opt-in for Brazil. Groups can be ordered, and custom groups can target a continent, a country, or a US state. Region rules start on the paid plans. A Free site serves one banner to everyone.
- On the site: A visitor in Munich sees a different banner from a visitor in Sacramento.
- Without an agent: Site, Geolocation. Add from template, drag to reorder.
Job 6
Handle California
- Tell your agent: “Turn on Do Not Sell for mysite.com and give me the footer link.”
- What happens: Your agent enables the opt-out, sets the link label and the request-form wording, and returns the footer link. There is an embeddable form too. Requests arrive in an inbox with a pending count. You mark each one processed once it is honored, and processed requests auto-delete on a window you set. An email goes out for each new request. Paid plans.
- On the site: The “Do Not Sell or Share My Personal Information” link, with a form behind it that works.
- Without an agent: Site, Privacy choices. Configure, then work the inbox.
Job 7
Keep the proof in one place
- Tell your agent: “How is mysite.com doing? Send me the numbers.”
- What happens: Your agent returns the compliance score out of 100 with the missing items named, and the consent totals with accept and reject rates. The log records every decision: categories chosen, the region rule that applied, banner version, user agent, and a salted hash of the IP address. Raw IP addresses are never stored. Filter by date, country, decision, or banner version. Trends and breakdowns by country, device, locale, layout, and GPC signal are on Studio and above, as is CSV export. Retention runs from 30 days on Free to two years on Agency.
- On the site: A number the site owner understands, and a log that exists if anyone asks.
- Without an agent: Site, Overview for the score. Consent log for the records and the CSV button. Analytics for the trends.
Job 8
Publish the cookie policy
- Tell your agent: “Publish the cookie policy for mysite.com and link it from the banner.”
- What happens: Your agent turns on the hosted policy page, built from the categories, services, and cookies that are declared. ConsentLayer rebuilds it when they change, and the banner links to it. If the policy should live on the site itself, the agent gives you an embed snippet, or a raw HTML fragment for a build step. Every plan, including Free.
- On the site: A cookie policy that stays true after the site changes.
- Without an agent: Site settings, Cookie policy. Toggle on, copy the embed.
Job 9
Run the whole portfolio
- Tell your agent: “Re-scan all my sites and tell me what changed. Or: copy the setup from mysite.com to the new site.”
- What happens: Your agent lists every site in your organization, scans each one, and compares it with its last scan. It exports a tuned configuration as a snapshot and imports it onto the next site: categories, services, cookies, translations, and region groups. Pageviews pool across the sites in your plan, and usage against limits is one question away. Team members can be invited into the organization.
- On the site: Nothing on the sites. This one is for you.
- Without an agent: Sites list, per-site scan, and the export and import buttons in site settings.
Job 10
Speak the visitor's language
- Tell your agent: “Dutch and German visitors. Turn those on.”
- What happens: Your agent enables the languages. The banner ships with written copy for the common European languages and picks from the visitor’s browser. Any string can be overridden per language, and any other language added with your own wording. Free serves one language. Paid plans serve as many as you turn on.
- On the site: A banner in the visitor’s language.
- Without an agent: Site settings, Languages.
Reference
Every capability, in one list.
One script tag gives you a banner, a cookie scanner, region rules, and a consent log, all from the same configuration, and all of it your agent can drive.
Script blocking
Blocks tracking scripts until visitors consent. Built-in rules for Google, Meta, TikTok and more, plus custom per-site rules.
Content blocking
Consent-gate embeds and iframes per service, with a click-to-load placeholder until the visitor opts in.
Banner builder
Banner layouts that match the site, placed anywhere on the page. Full color, text and logo theming with per-button toggles. A preferences button can stay after the banner closes, with a choice of icon.
Google Consent Mode v2
Granular ad_storage, analytics_storage, ad_user_data and ad_personalization signals mapped from your categories.
Global Privacy Control
The GPC browser signal is detected, honored (configurable) and recorded on the consent record.
Microsoft Clarity consent mode
A built-in toggle drives Clarity in consent mode so heatmaps and recordings respect the visitor’s choice.
Cookie scanner
Scans your pages, detects known services and flags unrecognized scripts into a review queue for one-click categorizing, with scan-to-scan diffs.
Geo consent rules
GDPR, CCPA/CPRA and LGPD templates apply the right behavior by region, or build custom, priority-ordered geolocation groups.
Consent log with CSV export
Every decision is recorded: categories, jurisdiction, banner version, salted IP hash (never raw IPs). Filterable and exportable to CSV.
Do Not Sell workflow
Track CCPA/CPRA “Do Not Sell” requests with a status workflow, ready for the opt-out signals regulators expect.
Compliance score
A 0–100 score in the dashboard grades how complete your setup is, so you always know what’s left to configure.
Multi-language banner
Written banner copy for the common European languages, any other language with your own wording, and per-string overrides. One language on Free, as many as you turn on from Solo up.
JS + React SDK
The @consentlayer/sdk exposes hasConsent(), onConsentChange() and more, plus React useConsent() and <ConsentGate>.
REST API & API keys
A typed REST API (OpenAPI) with create/revoke API keys lets you script sites, scans and banner config from your own tooling.
AI agent connector
Claude and ChatGPT in chat, Claude Code and Cursor in your editor, or any MCP client: 60 tools that create the site, run the scanner, configure the banner, and return the install snippet. On every plan.
Developer reference
For the developer on the project.
A script tag or a typed SDK, a REST API you can script, and the same connector your agent uses. Works in your existing stack.
SDK
Script tag or typed SDK
Drop in the script tag, or install @consentlayer/sdk for a typed API. React gets useConsent() and <ConsentGate> out of the box.
API
Typed REST API & keys
An OpenAPI-described REST API lets you manage sites, scans and banner config from your own tooling. Create and revoke API keys from the dashboard.
FAQ
Frequently asked about the product
The questions we hear most about the product. For billing or plan questions, see the pricing page.
How much can I customize the banner?
A lot. Pick a layout that suits the site, a small floating card, a full-width bar, or a centre modal (the modal is Solo and up), place it anywhere on the page, then set colors, text and logo, with per-button visibility toggles. For deeper control, the JS SDK lets you drive consent state yourself with hasConsent(), onConsentChange() and showPreferences().
How does ConsentLayer block trackers before consent?
The banner runtime intercepts tracking scripts as the page loads — both static tags and dynamically injected ones — and holds them until the visitor consents. It ships built-in rules for services like Google, Meta and TikTok, plus custom per-site rules, and can consent-gate embeds and iframes too.
What languages does the banner ship with?
Written banner copy ships for the common European languages, and you can add any other language with your own wording, with per-string overrides everywhere. Free serves one language. Every paid plan serves as many as you turn on.
Which plans include the API, SDK and MCP server?
All of them, including Free. The typed REST API, the @consentlayer/sdk (JS + React) and the MCP server for AI agents are available on every plan — no upgrade required to build against them.
What gets recorded in the consent log?
Each decision stores the categories chosen, the jurisdiction, the banner version, the user agent and a salted hash of the IP — raw IPs are never stored. You can filter by country, decision or date and export the log to CSV. Retention runs from 30 days on Free up to two years on Agency.
Can an AI agent set ConsentLayer up for me?
Yes. Add the ConsentLayer connector in Claude or ChatGPT and sign in through your browser, or point Claude Code, Cursor, or any MCP client at our server. Then say what you need: set up a site, re-scan it, restyle the banner, set region rules, pull the log. Every screen in the dashboard has a matching tool.
Which of this can my agent do?
All of it. Every job above lists the dashboard route too, so any step can be done by hand and the rest handed to the agent.
How does region detection work without storing IPs?
ConsentLayer reads the visitor’s country from a CDN request header, including EU/EEA and UK detection. No raw IP is stored client-side and there’s no third-party geo provider. Built-in templates cover GDPR (opt-in), CCPA/CPRA (opt-out + GPC) and LGPD (opt-in), and you can add custom geolocation groups on paid plans.
Do the next site in one sentence
Start free on one site, with no card. Connect your agent when you are ready, or stay in the dashboard.
No credit card required
Free plan forever
Works with the AI you already use
