CookieConsentHQ

Loading the banner

• The first tag in the page's head loads the site's script from cdn.cookieconsenthq.com: the loader with the site's settings built in.
• If the site uses region rules, one call to the edge Worker returns the visitor's country and region from Cloudflare.
• The interface loads asynchronously and renders in a Shadow DOM root, so the host site's CSS cannot restyle it.

Recording a choice

• The banner posts each choice to the edge Worker, which rate-limits it and puts it on a Cloudflare queue.
• The queue consumer writes batches of up to 100 records to Neon Postgres. Each message is retried on its own, up to five times.
• A record that keeps failing goes to a dead-letter queue, and the rest of its batch is still stored.

Regions and languages

• Default rules: opt-in for the EEA, the UK, Switzerland, Brazil and Quebec, opt-out for the US, and a notice elsewhere.
• From Starter, custom rules by country, US state or Canadian province. The most specific rule wins.
• Banner texts are built in for English, German, French, Spanish, Italian, Dutch and Portuguese, and each can be edited.

How a scan works

• Each page is loaded as a first-time visitor, then the first few are loaded again after Accept all, to find cookies that only appear with consent.
• Cookies are matched against a built-in cookie database and domain rules. Only names it does not know go to Claude Haiku, one domain per request, and no visitor data is sent.
• Scheduled scans run monthly on Free, weekly on Starter and daily from Growth, which also emails when a new tracker appears.

SSRF guard

• Every request the headless browser makes is held until the Worker checks it. Private, loopback, link-local and reserved ranges are refused.
• Host names are resolved and every address checked. A failed lookup is refused too.
• Top-level navigation must stay on the site's own host, with at most 20 redirects.

Stored identifiers

• The edge removes the last octet of an IPv4 address and cuts IPv6 to a /48 before a record is stored.
• User agents are stored as SHA-256 hashes instead of raw strings.
• The site calls this data minimisation rather than anonymisation, because truncated identifiers can still count as personal data.

Where it runs

• Consent records live in Neon Postgres in Frankfurt (AWS eu-central-1), and the app runs on Vercel functions in Frankfurt.
• Customers sign in with emailed links or Google and keep no password with the service.
• The internal admin sits behind Cloudflare Access, an email allowlist and an authenticator code, with an audit log.

Plans

• Paddle checkout has been live since 20 October 2026, with Paddle as merchant of record and signed webhooks.
• Five plans by monthly pageviews: Free to 25,000, Starter at $8 to 150,000, Growth at $18 to 750,000 and Business at $39 to 5 million.
• Agency, at $79, covers 25 sites and 10 million pooled pageviews. A year costs ten months.

Automated

• 721 test cases in the repository: unit tests across the apps and packages, and Playwright browser tests for the banner.
• A heavier playground suite on a separate CI machine: strict CSP, hostile CSS, single-page apps, document.write, failing APIs and blocked cookies.
• It also runs the edge Worker in workerd against 2,000 fuzzed requests, a full WordPress install with the WP Consent API, and the whole dashboard journey.
• It runs in desktop Chrome, Firefox and Safari plus Android and iPhone emulation, with automated axe accessibility checks.

Size budget

• The build fails when the gzipped loader passes 5,250 bytes or the interface passes 15 KB.
• On the 6 November 2026 build the loader was about 5 KB gzipped and the interface under 10 KB.