What works today — and what doesn't yet

Banner and detail view

Four layouts (banner bottom, banner top, modal, slide-in), a second level with categories, services and cookie tables, fully keyboard operable, rendered in the Shadow DOM.

Script blocking

Declarative via type="text/plain" data-consented="…" and pattern-based via a MutationObserver that already starts in the stub — before the runtime is loaded.

Google Consent Mode v2

Default signals are set in the stub, before GTM. Once the visitor decides, a consent update follows with the category → signal mapping.

Multiple languages

32 languages in the catalogue, complete texts for German and English, a fallback chain across browser language, HTML lang and the default language.

Service management

A searchable catalogue with provider, purpose, cookies and blocking patterns, plus any number of your own services with a full form.

Third-country watch

For services whose participation in the EU-US Data Privacy Framework is on record, we hold the status against the U.S. Department of Commerce participant list every week. If a certification lapses or is withdrawn, the operator gets a message. Five catalogue entries carry that record (as of 14 August 2026) — it is made editorially, not by matching names, and every other entry visibly reads “not recorded”.

Design editor

Colours, radii, layout and custom CSS with a live preview in a sandboxed iframe and an automatic WCAG contrast check.

Consent log

Every decision with a timestamp, config version, language and an HMAC-pseudonymised IP. Changes never overwrite anything, they are appended.

Hash chain over the log

Every entry in the consent log carries the hash of the one before it, and every finished day is condensed into a Merkle root as defined by RFC 6962. A row changed, deleted or slipped in afterwards therefore shows up when the sums are redone; bin/verify-chain ships with the project. For now the seals live only in the instance's own database — the chain shows a change, it does not prevent one.

Analytics

Acceptance rates by domain, language, country and layout, over time. Plus a pseudonymous export of the consent record as CSV or JSON — the IP only as an HMAC, the page URL only as a SHA-256.

A/B tests

Up to three banner variants with traffic split and deterministic assignment — the same visitor always sees the same banner. Each variant gets the full design editor including banner texts, previews side by side, and an analysis that only claims a difference from 100 decisions per variant and p < 0.05.

Versioning

Every publish freezes the configuration as an immutable snapshot — so you can trace which visitor saw which version.

Domain verification

Via DNS TXT or file upload. Unverified domains are restricted when the banner is served.

Roles and invitations

Owner, admin, editor and viewer with a documented permission matrix, invitations by e-mail, changes recorded in the audit log.

Data subject rights

A public lookup by consent ID: see the stored record and have it deleted on request — no account needed.

Two-factor authentication

TOTP per RFC 6238 with ten recovery codes. The secret is stored encrypted, and the same code cannot be used twice.

Self-hosting

The same source code, PHP and MariaDB, no build step, no Node on the server.

IAB TCF v2.3 planned

The TC string encoder/decoder is done and tested against the official IAB test vectors. Still open: GVL sync, vendor layer, publisher restrictions — and above all the CMP registration with IAB Europe, without which no TC string may be emitted. See the note below.

Cookie scanner planned

A headless crawler that measures before and after consent and exposes tracking that fires too early.

GPP and US regions planned

The __gpp API and six sections (USNat, California, Virginia, Colorado, Utah, Connecticut) are done and tested against the official IAB test vectors. Still open: the USNat section requires Multi-State Privacy Agreement signatory status per the specification — a business decision, not a technical gap. See the note under settings.