One script tag adds a consent banner that applies opt-in rules in the EU, UK and Switzerland and opt-out rules in California, honours Global Privacy Control and sends Google Consent Mode v2 signals. Free for one site.
Under the EU's ePrivacy Directive and the UK's PECR, non-essential cookies — analytics, advertising, most embeds — may only be set after the visitor agrees. Consent has to meet the GDPR standard: an active, informed choice, with refusing as easy as accepting and withdrawal possible at any time. A banner that sets cookies first and asks later does not meet it.
California works the other way round. The CCPA lets a business process data by default but gives consumers the right to opt out of the sale or sharing of their personal information — and the regulations require you to treat a browser's Global Privacy Control signal as that opt-out. One banner serving both audiences has to know which rule applies to which visitor.
Google adds its own requirement. Since March 2024, advertisers measuring or personalising ads for users in the European Economic Area are expected to pass consent signals through Consent Mode v2 — including ad_user_data and ad_personalization — or lose those features for that traffic.
Every behaviour below is on the free plan; paid plans add sites, documents and team features.
The visitor's country decides the model: opt-in across the EU, EEA, UK and Switzerland, opt-out in California, and opt-in by default everywhere else.
A denied default is sent before anything else loads, then updated when the visitor chooses — analytics_storage, ad_storage, ad_user_data and ad_personalization included.
When a browser sends a GPC signal, advertising categories are denied automatically, before the visitor touches the banner.
Tag a script with its category and the banner releases it only once that category is allowed. Necessary scripts run as normal.
Each choice is logged with its categories, region and a keyed hash of the IP — never the raw address — and deleted automatically after 13 months.
Accept and reject carry equal weight, a one-line call lets you add a cookie-settings link so visitors can change their mind, and the banner comes in bar, corner and modal layouts.
The banner uses four categories — necessary, preferences, analytics and marketing — and the cookie scanner and cookie policy use the same four. Scan your site to see what loads, tag those scripts with the matching category, and publish a cookie policy that describes the same categories your visitors are asked about.
Installation is one script tag in your site's head, whatever it runs on. For your own code, the banner exposes a small JavaScript API so you can check a category or react when consent changes. The free plan covers one site with a small "Powered by MostlyPrivacy" badge; the Agency plan removes it.
It does not block scripts automatically: only the scripts you tag are held back, so a tag you forget will still run. Use the scanner to find them. The banner does not implement the IAB Transparency and Consent Framework, by design, so it is not the right tool for publishers whose ad partners require TCF strings.
The banner's built-in text comes in 36 languages and follows each visitor's language; text you customise is shown as you wrote it. A banner is necessary but not sufficient: whether your site complies also depends on what it loads, how you configure it and what your policies say.
Yes, for one site. The free plan includes the geo-aware banner, Google Consent Mode v2, Global Privacy Control support and the consent record, with a small "Powered by MostlyPrivacy" badge. Paid plans add sites and documents.
Yes. It sends a denied default before other scripts load and an update when the visitor chooses, covering analytics_storage, ad_storage, ad_user_data and ad_personalization.
It uses the visitor's country, read on our server: opt-in for the EU, EEA, UK and Switzerland, opt-out for California, and opt-in by default elsewhere.
It holds back every script you tag with a consent category until that category is allowed. It does not discover and block untagged scripts on its own, so scan your site and tag what you find.
Yes. When a browser sends a GPC signal, the banner denies the advertising categories automatically, which is how California expects a business to treat that signal.
The decision, the categories, the visitor's region and language, the page address without its query string, and a keyed hash of the IP address — never the raw IP. Entries are deleted automatically after 13 months.
Yes, a lightweight one: a geo-aware banner, Google Consent Mode v2, Global Privacy Control and a stored record of every choice, exportable as CSV on Pro and Agency. It is not an IAB TCF-registered CMP — it is built for businesses and SaaS rather than ad-funded publishers, so if your ad partners require TCF strings, choose a TCF-certified platform.
Add one script tag to your site's head. Then tag non-essential scripts with their category so the banner can hold them back until consent.
Weighing up other tools? Read our honest comparison: MostlyPrivacy vs CookieYes
One site, the consent banner and one generated document — free, with no card. Upgrade when you need more sites or documents.