blog
Cookie consent,
written down properly
Long reads on the rules, the enforcement and the engineering of consent. Every claim carries a date and a source, and every piece ends with something you can check on your own site today.
Vibe coding and GDPR: the pre-launch checklist for AI-built apps
Twelve checks before you share your Lovable, Bolt, v0 or Replit app with people in the EU: region, processor agreements, Row Level Security, trackers, AI APIs and the pages you need.
ReadDoes Supabase auth need cookie consent? What it stores, and the one case that does
The login session in your Lovable, Bolt or v0 app is strictly necessary in most cases. What Supabase writes to the browser, the persistent-login caveat, and how to fix it in a few lines.
ReadDigital Omnibus and cookies: where the EU cookie reform stands in October 2026
The Commission moved cookie consent into GDPR Article 88a, the Council moved it back. What was proposed, what the Council texts changed, and what still applies to your banner today.
ReadDoes GA4 need cookie consent? The answer for the EU, the UK, the US and Switzerland
In the EU, yes, because GA4 sets cookies. Here is how the answer changes for the UK, the US and Switzerland, and what Consent Mode and the Data Privacy Framework do and do not change.
ReadLovable cookie banner: what yours has to block, and a five-minute test that proves it does
Lovable does not add a cookie banner, and the one it writes when you ask cannot stop a single tracker. What a banner on a Lovable app has to do, three ways to get one, and a test you can run in DevTools.
ReadHow to add a cookie banner to a Lovable app that actually blocks trackers
Lovable ships your app without a cookie banner, and asking it for one gets you a box that blocks nothing. Here is the ten-minute route to a banner that holds every tracker until people agree, with the checks that prove it.
ReadReject all, on the first layer: what the 2025 CNIL decisions changed for every cookie banner
Two decisions in September 2025 turned an EDPB guideline into a price tag. Here is what the regulator counted, and what a compliant first layer looks like in 2026.
ReadGoogle Consent Mode v2 for people who ship: the seven signals, basic against advanced, and the June 2026 change
Consent Mode is not a cookie blocker. It is a message your banner sends to Google’s tags. Get the message wrong and you either break the law or lose your Ads measurement. Here is the whole thing in one page.
ReadProof of consent under Article 7(1): what a consent record has to contain, and what ours does
A regulator or an enterprise customer asks how you got consent. “We have a banner” is not an answer. A file is. This is what has to be in it.
ReadDo cookie banners hurt Core Web Vitals? Where the cost really comes from
Yes, a banner can wreck your scores. No, it does not have to. The damage comes from three specific behaviours, and each has a fix.
ReadUK cookie rules after 5 February 2026: the statistics exemption, explained
The UK loosened one corner of its cookie rules and tightened the penalty for everything else. Here is what the Data (Use and Access) Act changed, and what it did not.
Readstay current
Regulation changes; the banner follows
The regulation watch on the home page tracks what changed and what is proposed. The newsletter in the footer sends the same, a few times a month.