Features
What works today — and what doesn't yet
This page keeps the two apart. A feature only moves to the upper list once it is actually implemented.
Available
Banner and detail view
Four layouts (banner bottom, banner top, modal, slide-in), a second level with categories, services and cookie tables, fully keyboard operable, rendered in the Shadow DOM.
Script blocking
Declarative via type="text/plain" data-consented="…" and pattern-based via a MutationObserver that already starts in the stub — before the runtime is loaded.
Google Consent Mode v2
Default signals are set in the stub, before GTM. Once the visitor decides, a consent update follows with the category → signal mapping.
Multiple languages
32 languages in the catalogue, complete texts for German and English, a fallback chain across browser language, HTML lang and the default language.
Service management
A searchable catalogue with provider, purpose, cookies and blocking patterns, plus any number of your own services with a full form.
Design editor
Colours, radii, layout and custom CSS with a live preview in a sandboxed iframe and an automatic WCAG contrast check.
Consent log
Every decision with a timestamp, config version, language and an HMAC-pseudonymised IP. Changes never overwrite anything, they are appended.
Versioning
Every publish freezes the configuration as an immutable snapshot — so you can trace which visitor saw which version.
Domain verification
Via DNS TXT or file upload. Unverified domains are restricted when the banner is served.
Roles and invitations
Owner, admin, editor and viewer with a documented permission matrix, invitations by e-mail, changes recorded in the audit log.
Data subject rights
A public lookup by consent ID: see the stored record and have it deleted on request — no account needed.
Self-hosting
The same source code, PHP and MariaDB, no build step, no Node on the server.
In progress
IAB TCF v2.2 planned
TC string encoder, GVL sync, vendor layer and publisher restrictions. Requires a CMP registration with IAB Europe — see the note below.
Cookie scanner planned
A headless crawler that measures before and after consent and exposes tracking that fires too early.
Analytics planned
Consent rates by domain, language, country and layout, over time.
A/B tests planned
Up to three banner variants with a traffic split and deterministic assignment.
GPP and US regions planned
The __gpp API, state sections and “Do Not Sell or Share”.
Two-factor authentication planned
TOTP with recovery codes for dashboard accounts.