Pre-consent blocking
Scripts are intercepted at the execution layer before the visitor sees your banner — not paused, not deferred. No temporary data collection, no 200ms window where GA4 or a pixel fires before the dialog renders.
Full Feature Set
Not a banner tool. A consent infrastructure layer.
Six capabilities that work as one: pre-consent blocking, jurisdiction-aware UI, immutable audit logs, geo-targeted rules, a consent rate dashboard, and a REST API for your reporting stack.
Six capabilities. One consent record of truth.
Audit logs
Every consent decision stored with visitor ID, IP region, timestamp, banner version, and regulation applied. Retention ranges from 30 days on Starter to unlimited on Business — with CSV and REST API export.
Geo-targeted rules
Visitor location resolved at IP level. EU/EEA gets GDPR. California gets CCPA. Every other region gets a notice-only banner. As new state-level privacy frameworks pass, the ruleset updates automatically.
Consent UI builder
Set your brand colors, logo, and primary consent copy once. Consentpane generates compliant banner variants for each jurisdiction. Button hierarchy and opt-out language adapt to regulatory requirements — no designer or template editing required.
Consent rate analytics
Acceptance rates broken down by region, banner version, and time period. Spot which jurisdiction is driving opt-out spikes and whether a banner copy change affected conversion — before your DPO asks the question.
Webhooks and REST API
Push consent events to your data warehouse in real time via webhook. Pull audit logs or consent summaries via REST API for integration with legal reporting tools or internal compliance dashboards.
Pre-consent blocking
Most CMPs collect the click. Consentpane blocks before it.
The exposure gap isn't the banner — it's the window between page load and banner render. In that interval, analytics scripts initialise, ad pixels fire, and data collection begins before any consent decision exists. Regulators have named this a GDPR Article 5 violation.
Consentpane's SDK wraps the browser's script execution context on first load. Non-essential third-party scripts cannot initialise until the visitor makes a choice — accept, reject, or manage preferences. The consent record is clean from the first byte.
Consentpane is not a legal replacement for a Data Processing Agreement with your analytics vendors. It does not provide legal advice. It gives your DPO and legal team the technical evidence that pre-consent blocking was in place.
See how it works
Audit logs
The audit log a DPA inquiry expects.
Data protection authorities need to verify the event, not just the outcome: who gave or withdrew consent, when, under which regulation, via which specific banner version. Consentpane stores all seven data points as a structured event record — automatically, without any manual logging steps.
When a DPA inquiry or internal audit arrives, you export CSV or query the REST API. The log has been writing since your first deployment. You are not reconstructing records from server logs after the fact.
audit_record.json
Single event
{ "event_id": "evt_4821A", "visitor_id": "#4821A", "ip_region": "Frankfurt, DE", "decision": "accept_all", "regulation": "GDPR", "banner_version": "v2.4.1", "timestamp": "2025-09-14T11:23:07Z" }
Geo-targeted rules
One site. Multiple regulatory frameworks. Zero duplicate configuration.
Consentpane resolves the visitor's jurisdiction at the IP level and applies the corresponding consent model: GDPR for EU/EEA visitors, CCPA opt-out for California residents, notice-only for all other regions. No manual per-market setup. No duplicate banner configurations.
US state privacy law is expanding — Virginia, Colorado, Connecticut, and Texas all have active frameworks. As new laws take effect, Consentpane updates the geo-ruleset automatically. You don't file a support ticket each time a state passes a bill.
Try every feature free for 14 days.
No credit card. No setup fee. Pre-consent blocking active from your first script tag. Cancel anytime.