Consenti
Consenti: The developer-first open-source Consent Management Platform

The Cookie Consent Platform
You Actually Own

Maintained for GDPR/UK-GDPR, CCPA/CPRA + US state laws, and LGPD — plus DPDPA and more, supported and in active development.
Admin dashboard, an append-only audit log, and every consent record stays on your own infrastructure. Open source, no monthly fee.

$npm install @consenti/ui·optional backend:npm install @consenti/api
Live Demo →See Compliance CoverageTutorials

Building it yourself? Jump to the developer docs → or guides →

Apache 2.0Node 20+ES2020+TypeScript StrictZero Runtime Deps
Frontend-only mode

Just the widget? You still get the full widget.

Most open-source cookie consent tools are frontend-only by design — a script, a banner, done. Run @consenti/ui the same way, with zero backend, and you still get the parts most banner-only tools leave you to hand-roll.

A documented API, not a black box

Every method is typed and documented — open(), close(), getConsent(type?), and friends — so you're never reverse-engineering a minified bundle to find the behavior you need.

Framework-native, not a wrapped script tag

Real React hooks, Vue composables, and Angular services ship as subpath exports — idiomatic in your framework from the first line, not a <script> tag you build a wrapper around.

Your UI reacts, it doesn't poll

A full DOM event lifecycle (consenti:consentSubmitted and friends) fires on every consent change, so custom banners, gates, and analytics stay in sync without checking state on a timer.

Analytics mapped for you

Built-in mappers for Google Consent Mode v2, Meta, Adobe, and Segment translate a consent decision into the right vendor call — no hand-rolled dataLayer plumbing to keep in sync.

See the full frontend-only guide →

Everything you need. Nothing you don't.

Start with just the UI widget — no backend required. Add the backend module only if you need server-side records or an admin dashboard. Both ship zero runtime dependencies.

Framework Agnostic

Any Stack
Works with Vanilla JS, React, Vue, Angular, Next.js, Nuxt. ESM + UMD + subpath exports included. Hooks for React, composables for Vue, services for Angular.

Backend Powered

@consenti/api
Optional backend module records consent to SQLite (built-in), MongoDB, MySQL, or PostgreSQL. Append-only audit log. GDPR right-to-erasure endpoint. Rate limiting included.

Admin Dashboard

Included
Built-in Preact SPA served directly from the API package. Manage profiles, view consent records, audit logs, RBAC roles, and configure your CMP — zero extra setup.

Fully Customisable

Themeable
Every label, colour, position, and button is configurable via CSS custom properties or JS config. BEM class names throughout. No Shadow DOM — your styles apply directly.

Accessibility-Focused

A11Y
Focus trap, ARIA roles, keyboard navigation, screen reader announcements. Targeting WCAG 2.x AA — because consent must be accessible to everyone.

Privacy by Design

Secure
IPs stored as SHA-256 hashes only. Passwords via scrypt (native). JWT via HMAC-SHA256 (native). Signed consent cookies. Consent receipts on demand. No raw PII stored.

Plugin System

Extensible
Extend the backend with lifecycle hooks. Official plugins for BigQuery, Segment, Snowflake, webhooks, and Slack. Community plugins welcome under any package name.

Zero Runtime Dependencies

@consenti/ui
UI uses only browser built-ins (crypto.subtle, BroadcastChannel, document.cookie). API uses only Node built-ins (node:sqlite, node:crypto) by default. Extra storage drivers (Mongo/Postgres/MySQL) and spec-correct IAB TCF encoding are available as optional peer dependencies — not needed unless you opt in.

Maintained Compliance Coverage

Compliance
GDPR/UK-GDPR, CCPA/CPRA + the US state-law cluster, and LGPD are actively maintained and tracked as law changes. DPDPA, and more are supported and in active development. TCF v2.3 and GPP both offer spec-correct binary encoding when configured with their respective optional peer dependencies, simplified format otherwise. Every country is pre-mapped to the right compliance group — most as Routing-only UX-template defaults, not individually legal-maintained. GPC auto-honour and COPPA age gates included.
Google Consent Mode v2

Auto-wired — not just a mapping helper

Consenti fires gtag('consent', 'default', …) before any tag loads and gtag('consent', 'update', …) on every consent change — correct GCM keys, configurable dataLayer name, no manual wiring.

Required for Google Ads/Analytics tags to keep working under GDPR once Consent Mode v2 is in effect.

How Consenti implements Consent Mode v2 →
1

Page loads — before any tag fires

gtag('consent', 'default', …)

ad_storagedenied
analytics_storagedenied
ad_user_datadenied
ad_personalizationdenied
2

Visitor chooses (example: analytics only)

gtag('consent', 'update', …)

ad_storagedenied
analytics_storagegranted
ad_user_datadenied
ad_personalizationdenied

By default functionality_storage and security_storage are granted and personalization_storage is denied.

Gate your own scripts and SDKs the same way

ConsentScript loads a script only while a parameter is granted and removes it on revoke. ConsentAction calls an SDK's own opt-in / opt-out. Both check consent immediately and re-check on every change.

ConsentScript, ConsentAction and the other gating helpers →
gating.ts
ts
import { ConsentScript, ConsentAction } from '@consenti/ui'

// Load a script only while analytics_storage is granted
new ConsentScript({
  cookieId: 'analytics_storage',
  widget,
  src: 'https://cdn.example.com/analytics.js',
})

// Or call an SDK's own opt-in / opt-out
new ConsentAction({
  id: 'analytics_storage',
  widget,
  onGrant: () => analyticsSdk.optIn(),
  onDeny: () => analyticsSdk.optOut(),
})
Why Consenti

Built different from every other CMP

Most hosted SaaS CMPs own your consent data and charge monthly. Most open-source alternatives are UI-only — no backend, no audit log. Consenti ships the full stack instead.

What is Consenti, and why is it built this way? →

No SaaS fees — ever

Most paid CMPs charge a monthly fee, and enterprise tiers can run into the thousands. Consenti is Apache 2.0 — free to run on your own infra, forever.

Your data, your servers

Hosted CMPs phone home with every consent event. Consenti records consent in your own database — SQLite by default, Mongo/Postgres when you need scale. Zero third-party data transfer.

Privacy by design, not by checkbox

IPs stored as SHA-256 hashes. Passwords via scrypt. JWT via native HMAC. Signed consent cookies. Consent receipts on demand. Built in, not bolted on.

190+ countries mapped to 8 consent UX groups

An embedded map of every country and territory routes visitors to the right compliance group in code — see which laws are actively maintained vs. in development on the Jurisdiction Coverage Map.

Extend it without forking it

A plugin system with lifecycle hooks and official BigQuery, Segment, and Snowflake integrations. Add your own webhook or data pipeline in a few lines.

The browser-only category's ceiling

Most open-source cookie consent widgets are banner-only, running entirely in the browser. Consenti works the same way standalone — plus an optional content-gating mode for jurisdictions that need it — and adds an optional backend when you want it: audit-grade consent records, dashboard-authored profiles with no redeploy, spec-correct IAB TCF/GPP encoding for programmatic ad monetization (self-registration included, not needed at all for first-party-only sites), and consent that follows a user across devices. Zero dependencies by default, optional peer dependencies only for what you opt into.
SaaS / HostedOpen Source
Feature
ConsentiOpen Source
CookiebotOneTrustCassieKlaroorestbidaConsentStack
Open source
Self-hosted paid paid
Zero runtime deps
Built-in backend + audit log paid
Admin dashboard
GDPR + CCPA + TCF v2.3 TCF partial partial partial partial
GPC auto-honour paid unclear unclear
TypeScript strict partial
Framework hooks (React / Vue / Ng)
WCAG 2.x AA accessible unclear unclear unclear partial unclear unclear
No cross-origin script frontend only frontend only frontend only
Data sovereignty paid paid frontend only frontend only frontend only
Free to use limited frontend only frontend only frontend only
Based on public documentation as of Jan 2026. "Paid" = available on paid tiers only. "Limited" = free tier with domain/pageview caps. "Partial" = basic support, not full spec coverage. Cookiebot, OneTrust, Cassie, Klaro, orestbida/cookie-consent, and ConsentStack are trademarks of their respective owners. Consenti is not affiliated with, endorsed by, or sponsored by any of them; see Terms of Use.
The table above compares Consenti's consent-widget & backend app features. It's not the same product category as the privacy suites some competitors sell alongside their CMP. Read more →

Quick Start

Frontend OnlyBoth Frontend & Backend
1Install
npm install @consenti/ui
2Add to your appmain.ts
import { ConsentiSetup } from '@consenti/ui'

// Auto-detects compliance from browser locale — GDPR, CCPA, etc.
new ConsentiSetup({})
3Gate code on consentmain.ts
const widget = new ConsentiSetup({})

widget.onReady(() => {
  if (widget.isCookieGranted('analytics')) initAnalytics()
})
Full UI docs →

Compliance Coverage

Compliance groups routed automatically — see what's actively maintained vs. still evolving below.

🇪🇺
GDPREU / EEA

Opt-in consent, legitimate interest, erasure, admin export

Full
🇬🇧
UK GDPRUnited Kingdom

Post-Brexit equivalent of EU GDPR; ICO-enforced; same opt-in model

Full
🇺🇸
CCPA / CPRACalifornia, USA

"Do Not Sell" link, GPC auto-honour, CPRA corrections, opt-out records

Full
🇺🇸
VCDPAVirginia, USA

Opt-out rights, consent records, appeal mechanism, data access

Full
🇺🇸
CPAColorado, USA

Universal opt-out via GPC, consent audit log, revocation support

Full
🇺🇸
CTDPAConnecticut, USA

Opt-out UI, signed consent cookies, audit trail, controller config

Full
🇧🇷
LGPDBrazil

Opt-in, 10 lawful bases, ANPD-enforced, under-12 parental consent gate

Full
🇿🇦
POPIASouth Africa

Opt-in, 8 lawful processing conditions, Information Regulator-enforced

Full
🇨🇦
PIPEDA / Law 25Canada

Federal PIPEDA + Quebec Law 25 (stricter, GDPR-aligned); explicit opt-in

Full
🌐
GPCGlobal signal

Auto-detects navigator.globalPrivacyControl with three honour modes

Full
🌐
TCF v2.3 / GPPIAB / Global

Only relevant if you monetize via programmatic/RTB ads — self-registration with IAB Europe/MSPA fully supported. Real binary encoding available via optional peer dependencies; simplified format otherwise

Partial
🇺🇸
COPPAUSA (children)

Age gate widget included; parental verification requires your backend

Partial
🇮🇳
DPDPAIndia

Opt-in, fiduciary disclosure, grievance officer in notice, Inline with India's phased 2025–2027 rules/compliance rollout

Partial
🇹🇭
PDPAThailand

Consent & legitimate interest bases; cross-border transfer rules apply

Partial
🇯🇵
APPIJapan

Opt-in for sensitive data and foreign transfers; opt-out for general third-party sharing

Partial
🇹🇷
KVKKTurkey

GDPR-inspired opt-in; explicit consent for sensitive data; KVK Board enforces

Partial

Full = actively maintained, tracked as the law changes. Partial = infrastructure provided; your legal team (or, for TCF, your own config + an optional dependency) finishes the specifics. In development = supported today, rollout still being finished — see each regulation's guide for current status.

This is a sample — see the full Jurisdiction Coverage Map (190+ countries/territories mapped) →

Works with your stack

No migration required. Consenti adapts to whatever you're already running.

Vanilla JS
React
Vue
Angular
Next.js
Nuxt
Express
Fastify
Hono
Node HTTP
@consenti/scanner

Find what your site actually fires — not just what you declared

Profiles declare trackers; real sites drift — tag managers, forgotten pixels, new third-party scripts. The scanner is a local, offline CLI that crawls your site in a real browser and reports every cookie, request and script it saw, and in which consent state it fired.

  • Three passes per page: no consent, reject-all and accept-all
  • Flags anything that fires before consent, and trackers missing from your profile
  • Exits non-zero on findings, so it works as a CI/CD gate
  • No account, no hosted service — everything runs on your machine
Explore the scanner →
scan
bash
# crawl under no-consent, reject-all and accept-all
node apps/scanner/dist/cli.js \
scan https://example.com --depth 2 --output-dir ./scan-results

# writes, per scan:
#   ./scan-results/<scan-id>/scan-results.json
#   ./scan-results/<scan-id>/scan-results.html
#   ./scan-results/<scan-id>/screenshots/<page>/{state}.png