Your files never leave your device. All processing happens locally in your browser.
How do I make a free GDPR cookie-consent banner for my website?
Configure the banner in the GDPR Consent Generator — pick a bottom/top bar, floating box or center modal, a granular opt-in model (Accept all · Reject all · Manage with per-category toggles for Necessary, Preferences, Analytics and Marketing) or a simple Accept/Reject, plus your brand colours, copy and policy links. Watch the live preview, then copy the self-contained HTML, CSS and vanilla JS. The runtime stores the choice in a first-party cookie or localStorage, prior-blocks any script you tag with type="text/plain" data-cc="analytics" until opt-in, exposes a window.CookieConsent API, and can wire Google Consent Mode v2. Everything is generated in your browser; nothing is uploaded.
Three layouts (bar / box / modal) and two consent models (granular opt-in or simple Accept/Reject)
Granular categories: Necessary always-on, plus Preferences, Analytics, Marketing — all optional ones start off
Prior-blocks tags: type="text/plain" data-cc="category" scripts stay inert until consent
Self-hosted, dependency-free HTML + CSS + JS; stores consent in a first-party cookie or localStorage
window.CookieConsent API, a re-open button to withdraw consent, and optional Google Consent Mode v2
100% client-side code generation — not legal advice, and not a substitute for an audited CMP
What is
Cookie-consent banner (CMP)
A cookie-consent banner is the interface a website shows visitors to request permission before setting non-essential cookies or running tracking tags, as required by the EU GDPR and ePrivacy Directive. A compliant banner offers clear categories, makes rejecting as easy as accepting, defaults every optional category to off, blocks non-essential tags until the visitor opts in (“prior blocking”), and lets them withdraw consent later. This tool generates a self-hosted banner plus the gating JavaScript that enforces those rules on your own pages; it is a functional consent UI, not certified legal compliance.
No. The banner code is generated entirely in your browser and the visitor’s consent choice stays on their own device.
The generator is pure client-side code generation — your title, message, links, colours and settings are just strings turned into HTML, CSS and JavaScript locally, with no upload, no server, no CDN and no third-party CMP in the path. The banner it produces is self-hosted: it runs from your own pages, and each visitor’s consent choice lives only in a first-party cookie or localStorage on their device, never sent to us or anyone else. It works offline once cached, and closing the tab discards your configuration.
Yes, but only for the scripts you tag — give each non-essential tag type="text/plain" data-cc="category" and it stays blocked until opt-in.
The runtime uses the standard prior-blocking pattern: any script you mark with type="text/plain" and a data-cc="analytics" (or preferences/marketing) attribute will not execute until the visitor opts that category in, at which point the script is activated. It can also emit Google Consent Mode v2 signals (gtag consent default all-denied, then update on choice). The catch is that it only governs tags you actually wrap — any script you forget, and most third-party plugins/embeds, will still run before consent unless you gate them too. That is why a real setup needs a full cookie audit.
It gives you a functional, best-practice banner, but a banner alone is not compliance and this is not legal advice.
This produces a working consent UI and gating layer tuned to your inputs, with reject as easy as accept (no dark patterns) and optional categories defaulted off — the technical foundation regulators look for. But full GDPR/ePrivacy compliance also requires auditing every cookie and tag, prior-blocking all non-essential ones, honouring withdrawal (a script that already ran cannot be un-run without a reload, and cookies it set may need clearing), keeping server-side consent records as proof, and using wording correct for your jurisdiction (EU, UK, Switzerland and US state laws differ). For complex sites, ad networks or IAB TCF, use an audited CMP and have a lawyer review your setup.
Yes — enable the floating preferences button, or call CookieConsent.showPreferences() from any link.
The generated runtime exposes a window.CookieConsent API with showPreferences(), acceptAll(), rejectAll(), allowed(category), onChange(callback) and reset(). You can turn on a persistent floating pill so visitors can re-open the preferences panel at any time, or wire a footer link to CookieConsent.showPreferences(). Withdrawal updates the stored record and Google Consent Mode signals immediately; because a tag that already executed cannot be truly un-run, you can optionally have the page reload when someone rejects after previously accepting, and you should clear any cookies those tags set.
Detailed Explanation
📖How It Works
What the GDPR Consent Generator Produces
The GDPR Consent Generator is a 100% client-side tool that builds a self-hosted cookie-consent banner and the JavaScript that enforces it. You configure the layout (bottom/top bar, floating box, or center modal), the consent model (granular Accept all · Reject all · Manage with per-category toggles, or a simple Accept/Reject), the cookie categories (Necessary always-on, plus Preferences, Analytics and Marketing), brand colours, copy and policy links, storage method and behaviour. It then emits dependency-free HTML, CSS and vanilla JS — as separate parts or a single one-paste bundle — that you host on your own site. A pure engine (gdprConsentEngine.ts) performs all the string generation; nothing is uploaded.
Three layouts (bar / box / modal) and two consent models
Outputs self-contained HTML + CSS + vanilla JS, ~5 KB, no dependencies
Live interactive preview with a working preferences panel
Pure code generation — runs entirely in the browser
🔧Technical Details
Prior Blocking and the Consent Gate
Under the ePrivacy Directive and GDPR, non-essential cookies and tracking tags must not run before the visitor opts in — this is called prior blocking. The generated runtime implements it with the widely-used text/plain pattern: any tag you write as <script type="text/plain" data-cc="analytics"> is inert (browsers do not execute unknown script types), and the runtime only activates it — by re-inserting it with a valid type — once the visitor grants that category. Necessary is always allowed; every optional category defaults to off and requires an explicit positive action. The tool honestly notes that this governs only the tags you actually wrap, so a complete setup still needs a full cookie/tag audit.
Tags marked type="text/plain" data-cc="category" stay blocked until opt-in
On consent, the runtime re-inserts the script with a valid type to run it
Necessary always on; Preferences/Analytics/Marketing default off
Only wrapped tags are governed — unwrapped third-party scripts still run
Reject is kept exactly as prominent as Accept (no dark patterns)
⚙️Methodology
Storage, API and Google Consent Mode v2
The visitor’s choice is written to a first-party cookie (SameSite=Lax, configurable name and expiry) or to localStorage, together with a small client-side consent record (timestamp, per-category decision, and a config version so the banner re-asks if you change the categories). The runtime exposes window.CookieConsent with showPreferences(), acceptAll(), rejectAll(), accept(list), allowed(category), getConsent(), onChange(callback) and reset(), plus an optional floating button so consent can be changed or withdrawn at any time. When enabled, it also emits Google Consent Mode v2 signals — gtag('consent','default',…) denying ad_storage, analytics_storage, ad_user_data and ad_personalization until an update fires on the visitor’s choice.
Stores consent in a first-party cookie (SameSite=Lax) or localStorage
Keeps a client-side record: timestamp, decisions, config version
Optional Google Consent Mode v2 default/update signals
Floating re-open button supports withdrawal of consent
⚠️Limitations
Honest Limitations
This tool generates a functional, best-practice consent UI and gating layer, but it is not legal advice and not certified compliance. The gate only blocks tags you explicitly mark, so any script you forget to wrap — and most third-party embeds and plugins — will still fire before consent. The client-side consent record is a convenience, not audit-grade proof; regulators expect server-side records. A tag that has already executed cannot be truly un-run when consent is withdrawn (hence the optional reload-on-reject), and cookies it set may need clearing separately. Correct legal wording and required categories differ by jurisdiction (EU/EEA, UK, Switzerland, US state laws). For complex sites, ad networks or IAB TCF, an audited consent management platform and a lawyer review are required.
Not legal advice; a working banner is necessary but not sufficient
Only tags you wrap are blocked — audit every cookie and third-party script
Client-side record is not audit-grade; keep server-side consent proof
Withdrawal can’t un-run an already-executed tag without a reload
For ad networks / IAB TCF use an audited CMP and legal review
🔒Privacy & Security
Private by Design
The generator itself never touches the network for your data. Your configuration — title, message, links, colours, category choices and behaviour — is transformed into HTML, CSS and JavaScript entirely in the browser, with no upload, no server round-trip, no CDN and no third-party CMP in the path. The banner you get is self-hosted: it runs from your own pages, and each visitor’s consent choice is stored only in a first-party cookie or localStorage on their own device and is never transmitted to us. The tool works offline once cached, supports dark mode and a mobile-first responsive layout, and has no analytics or telemetry; the only optional network use anywhere on the site is consent-gated ads.
Code generation runs locally — no upload, no server, no CDN
Generated banner is self-hosted; consent stays on the visitor’s device
Choice stored in a first-party cookie or localStorage only
Works offline once cached; dark mode and mobile-first
No analytics or telemetry; only optional network use is consent-gated ads
Consent models and layouts this generator produces
Choice
Options
Best for
Notes
Model
Granular opt-in (Accept · Reject · Manage)
Sites with analytics and/or ads
Per-category toggles; GDPR-expected
Model
Simple Accept / Reject
Minimal sites, few tags
No categories; reject stays as prominent as accept
Layout
Bottom / top bar
Most sites
Full-width, unobtrusive
Layout
Floating box (any corner)
Lighter footprint
Compact card, optional overlay
Layout
Center modal
Explicit interruptive consent
Dim overlay, focus on the choice
Storage
First-party cookie / localStorage
Your preference
SameSite=Lax cookie or on-device key; configurable expiry
All options are best-practice defaults, not certified compliance. Optional categories always start off and reject is kept as easy as accept. Everything is generated locally in the browser; nothing is uploaded. As of July 2026.
