The GDPR cookie banner that’s done
in one command. With proof to back it up.

Change script tags to type="text/plain" with a data-category attribute, or let the CookieCrumbs snippet rewrite known trackers automatically. Blocked scripts, iframes and pixels execute only after the matching category is accepted. In Next.js, React, Astro and Nuxt the SDK wraps tags in a consent-aware component, and Google Tag Manager triggers fire on consent events.

It can. A render-blocking CMP script with a short cache TTL can add seconds to LCP and cause layout shift on every visit. CookieCrumbs loads one 21 kB gzipped file asynchronously with long cache lifetimes, makes no third-party requests of its own, and the bar and ribbon layouts reserve their space before paint so they cause no layout shift.

Not on every page view. The CNIL recommends respecting a refusal for at least six months, and the proposed EU Digital Omnibus Article 88a would make a six-month no-re-ask period law across the EU. CookieCrumbs stores the refusal, suppresses the banner for a period you set, six months by default, and only re-asks when your purposes change.

No. They generate the analytics and pixel scripts you ask for and nothing that blocks them. Asking the builder for a banner usually produces a cosmetic box that shows a choice and blocks nothing, which does not meet GDPR or the ePrivacy Directive. CookieCrumbs adds a banner that holds those scripts until consent, through one script tag or through its MCP server from Cursor or Claude Code.

The free scan reads your homepage HTML once and matches script and iframe hosts against the tracker database, without an account. The full scan in the dashboard loads every page in a real browser, in each consent state, records every cookie, script, pixel, iframe and storage key with the page and script that set it, and re-runs on a schedule. Only the full scan can see what a tag manager injects after load.

In the EU, analytics still needs consent unless your regulator exempts a restricted setup; standard GA4 sends data to a third party and does not qualify. In the UK, PECR Schedule A1 (5 February 2026) exempts low-risk statistics with information and an objection route, under the ICO guidance of 29 April 2026. CookieCrumbs ships both rule sets.

Consent Mode v2 is how a cookie consent banner tells Google tags what the visitor allowed, through ad_storage, analytics_storage, ad_user_data and ad_personalization. Defaults must be denied for EEA, UK and Swiss visitors. Since 15 June 2026 Google uses ad_storage as the controlling signal for Ads data. CookieCrumbs sets the defaults, updates on consent and supports basic and advanced mode.

For AdSense, Ad Manager and AdMob, yes: since 16 January 2024 Google requires a CMP from its CMP Partner Program for EEA and UK traffic, integrated with IAB TCF. Google Ads and GA4 require Consent Mode v2 signals but not a certified CMP. CookieCrumbs is Consent Mode v2 ready and is not yet part of the Google CMP Partner Program, so it is not the right choice for AdSense, Ad Manager or AdMob until that certification is in place.

You must be able to show who consented, when, to what, and what they were shown. A usable log stores a timestamp, pseudonymous ID, banner version and texts, categories chosen and withdrawals. GDPR sets no fixed period; keep records while you rely on the consent plus the limitation period in your country. CookieCrumbs keeps records 12 months on Free and 5 years on every paid plan.

In practice, yes. The CNIL requires a one-click refusal on the first layer and fined Google €325m and SHEIN €150m in September 2025; EDPB Guidelines 03/2022 treat hidden or faded reject options as dark patterns. CookieCrumbs layouts ship equal-prominence buttons and a persistent control to reopen the banner; you can change colours, not demote the button.

Run npx cookiecrumbs init. The CLI detects the framework, installs the integration, writes cookiecrumbs.config.ts, sets Consent Mode v2 defaults and links the site to your workspace. Static sites, WordPress, Shopify and Webflow use one script tag or a plugin. With the MCP server in Claude Code or Cursor, the agent runs the same steps and opens a pull request.

Yes, if it has the tools. The CookieCrumbs MCP server exposes scanning, banner configuration, publishing and the consent log to Claude Code, Cursor, Windsurf, Zed and VS Code. Writes are proposed as a diff first and confirmed on a second call, and every action is logged with the token that made it.

In Frankfurt, Germany, on infrastructure inside the EU. Consent records never leave the EU, no IP address or user agent is stored beside a record, and every record can be exported as signed CSV or JSON, including after you cancel.