CookieGate
Start free trial

Trackers wait for consent.

Non-essential scripts are held until the visitor decides. The right law applies by location. Every decision prints a receipt.

Start free trial See how it holds

15 days. Card required. Nothing is charged before day 15.

  • Arrivals
  • Mumbai dpdpa opt-in Blocking
  • gtag/js?id=G-XXXX held
  • pixel.gif held
  • embed/VIDEO_ID held
  • Wait here
  • Mumbai

Illustrative scene.

dpdpa<<<<reject_all<<<<<2026-10-03T13:14:25Z
gpc<false<hash<9c1e4d7a0bf3e2c118a7d9<<<<<<<

The right law for every visitor.

Resolved on the server on every request: your site’s country by default, or each visitor’s location when you switch it on. Where laws overlap, the strictest wins.

How CookieGate handles each regulation

COUNTER 1 · JURISDICTION
Which rules visitors see
Visitor from

Global Privacy Control is a browser signal. CookieGate records it in every receipt and applies it per regulation.

The Banner Log row CookieGate would write

Mumbai, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
IN
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, India.
Consent model
opt-in
regulation_applied
dpdpa

Mumbai, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
IN
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
This visitor’s location, India.
Consent model
opt-in
regulation_applied
dpdpa

Munich, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
GDPR
Language
EN
Visitor country
DE
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, Germany.
Consent model
opt-in
regulation_applied
gdpr
Overlap
Applied together with the ePrivacy Directive for visitors in the EU and EEA.

Munich, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Honoured GPC signal
Rules applied
GDPR
Language
EN
Visitor country
DE
GPC
Yes · denied by default; the visitor still confirms
Page
https://example.com/
Resolved from
This visitor’s location, Germany.
Consent model
opt-in
regulation_applied
gdpr
Overlap
Applied together with the ePrivacy Directive for visitors in the EU and EEA.

London, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
UK_GDPR
Language
EN
Visitor country
GB
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, United Kingdom.
Consent model
opt-in
regulation_applied
uk_gdpr
Overlap
UK visitors are resolved separately from the EU.

London, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Honoured GPC signal
Rules applied
UK_GDPR
Language
EN
Visitor country
GB
GPC
Yes · denied by default; the visitor still confirms
Page
https://example.com/
Resolved from
This visitor’s location, United Kingdom.
Consent model
opt-in
regulation_applied
uk_gdpr
Overlap
UK visitors are resolved separately from the EU.

San Jose, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
CCPA
Language
EN
Visitor country
US
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, United States (California).
Consent model
opt-out
regulation_applied
ccpa

San Jose, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Honoured GPC signal
Rules applied
CCPA
Language
EN
Visitor country
US
GPC
Yes · opted out automatically
Page
https://example.com/
Resolved from
This visitor’s location, United States (California).
Consent model
opt-out
regulation_applied
ccpa

São Paulo, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
LGPD
Language
EN
Visitor country
BR
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, Brazil.
Consent model
opt-in
regulation_applied
lgpd

São Paulo, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
LGPD
Language
EN
Visitor country
BR
GPC
Yes · recorded, not applied under LGPD
Page
https://example.com/
Resolved from
This visitor’s location, Brazil.
Consent model
opt-in
regulation_applied
lgpd

Johannesburg, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
POPIA
Language
EN
Visitor country
ZA
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, South Africa.
Consent model
hybrid
regulation_applied
popia

Johannesburg, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
POPIA
Language
EN
Visitor country
ZA
GPC
Yes · recorded, not applied under POPIA
Page
https://example.com/
Resolved from
This visitor’s location, South Africa.
Consent model
hybrid
regulation_applied
popia

Toronto, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
PIPEDA
Language
EN
Visitor country
CA
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, Canada.
Consent model
hybrid
regulation_applied
pipeda
Overlap
Quebec’s Law 25 tightens this to opt-in for visitors in Quebec.

Toronto, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Honoured GPC signal
Rules applied
PIPEDA
Language
EN
Visitor country
CA
GPC
Yes · treated as an opt-out
Page
https://example.com/
Resolved from
This visitor’s location, Canada.
Consent model
hybrid
regulation_applied
pipeda
Overlap
Quebec’s Law 25 tightens this to opt-in for visitors in Quebec.

Bangkok, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
PDPA
Language
EN
Visitor country
TH
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, Thailand.
Consent model
opt-in
regulation_applied
pdpa

Bangkok, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
PDPA
Language
EN
Visitor country
TH
GPC
Yes · recorded, not applied under PDPA
Page
https://example.com/
Resolved from
This visitor’s location, Thailand.
Consent model
opt-in
regulation_applied
pdpa

Tokyo, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
APPI
Language
EN
Visitor country
JP
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, Japan.
Consent model
opt-in
regulation_applied
appi

Tokyo, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
APPI
Language
EN
Visitor country
JP
GPC
Yes · recorded, not applied under APPI
Page
https://example.com/
Resolved from
This visitor’s location, Japan.
Consent model
opt-in
regulation_applied
appi

Shanghai, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
PIPL
Language
EN
Visitor country
CN
GPC
No
Page
https://example.com/
Resolved from
This visitor’s location, China.
Consent model
opt-in
regulation_applied
pipl

Shanghai, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
PIPL
Language
EN
Visitor country
CN
GPC
Yes · recorded, not applied under PIPL
Page
https://example.com/
Resolved from
This visitor’s location, China.
Consent model
opt-in
regulation_applied
pipl

Mumbai, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
IN
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Mumbai, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
IN
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Munich, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
DE
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Munich, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
DE
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

London, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
GB
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

London, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
GB
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

San Jose, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
US
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

San Jose, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
US
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

São Paulo, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
BR
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

São Paulo, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
BR
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Johannesburg, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
ZA
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Johannesburg, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
ZA
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Toronto, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
CA
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Toronto, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
CA
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Bangkok, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
TH
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Bangkok, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
TH
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Tokyo, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
JP
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Tokyo, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
JP
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Shanghai, Global Privacy Control off

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
CN
GPC
No
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Shanghai, Global Privacy Control on

When
4 Oct 2026, 10:19
Event
Banner shown
Rules applied
DPDPA
Language
EN
Visitor country
CN
GPC
Yes · recorded, not applied under DPDPA
Page
https://example.com/
Resolved from
Your site’s country, India. Every visitor sees its rules.
Consent model
opt-in
regulation_applied
dpdpa

Illustrative. Values as the engine resolves them.

On a typical page, this happens before anyone clicks.

Analytics, pixels and session recorders load as the page parses; the banner asks afterwards. Opt-in regimes do not ask whether you showed a notice. They ask whether anything loaded first.

t (ms) request sets
0 GET /
118 googletagmanager.com/gtag/js _ga
162 connect.facebook.net/en_US/fbevents.js _fbp
241 static.hotjar.com/c/hotjar-*.js _hjSession
380 banner shown
1,840 visitor clicks Reject

Three cookies were set 1.7 s before the answer.

Illustrative. Real hosts, representative timings.

Nothing non-essential crosses the line.

The SDK loads first. Tags marked with data-cg-purpose stay inert: the browser never requests them. Accept restores them. Reject keeps them out and deletes cookies set on earlier visits.

How enforcement works

European Union · GDPR Blocking

We value your privacy

We use cookies and similar technologies to provide you with a better experience, personalize content, and analyze our traffic. Please choose your cookie preferences below.

Manage Preferences

Cookie Preferences

Choose which types of cookies you want to allow. You can change these settings at any time.

Privacy PolicyCookieGate · by Comply Ark

COUNTER 2 · CONSENT
t (ms) method request status purpose
0 GET api.cookiegate.io/api/v1/public/sdk/<site-key>.js 200 sdk
12 ---GETgoogletagmanager.com/gtag/js?id=G-XXXXheldrestored analytics
12 ---GETexample.com/pixel.gifheldrestored marketing
13 ---GETyoutube.com/embed/VIDEO_IDheldrestored marketing
380 banner shown
later GET any later request to a held host 204 worker
Rows print here after the decision.
1,912 GET googletagmanager.com/gtag/js?id=G-XXXX 200 analytics
1,914 GET example.com/pixel.gif 200 marketing
1,919 GET youtube.com/embed/VIDEO_ID 200 marketing
cookie _ga (earlier visit) deleted analytics 
gdpr<<<<<accept_all<<<<<2026-10-04T10:21:07Z
gpc<false<hash<fc970473c12e27bc2969e2<<<<<<<
gdpr<<<<<reject_all<<<<<2026-10-04T10:21:07Z
gpc<false<hash<cae92ddf8f077d461d87e2<<<<<<<
gdpr<<<<<custom<<<<<<<<<2026-10-04T10:21:07Z
gpc<false<hash<7d52c4041b932a1549807e<<<<<<<

Illustrative. Real hashes are computed on the server.

Every decision, written down and signed.

Each receipt is signed on CookieGate’s servers and chained to the one before, with the law frozen as it stood. Any receipt can be checked at the public verification endpoint.

Download a sample receipt (JSON, 1 KB)

Evidence in detail

COUNTER 3 · RECEIPT
timestamp
2026-10-03T13:17:40.882Z
anonymous_id
cg_f973a68d-7765-487f-9180-6549759ca034
domain
example.com
regulation_applied
ccpa
consent_action
gpc_opt_out
gpc_signal
true
consents
necessary trueanalytics truemarketing falsefunctional falsesocial falsepersonalization false
consent_hash
fcd26e52a63e30477dae2806c59832cbbf9d56de14e877ad2bb72d68b80e018f
receipt_id
7bea9e8b-d67a-4b97-a30f-ff0bcba18042
ip_anonymized
192.0.2.xxx
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0

receipt fields

receipt_number
CR-1791033460882-6c0282e4
data_hash
c2182ae765ef9913d7bc9dd86db48d825a6cb44412613e30c0b1316e422db543 (SHA-256 of the record)
signature
6efcdf844cd01514529aa1bcc5727d078ac14fdc366d5b939c78144148c99318 (HMAC-SHA256, server key)
prev data_hash
031457a534d6230ce7534b648c604ad7052a78def157fb31b7646e092ea102c3 (the chain link)
  1. 2026-10-03T13:16:02Z gdpr custom prev 37ac
  2. 2026-10-03T13:14:25Z dpdpa reject_all prev GENESIS

Illustrative. Live receipts carry full hashes and timestamps.

Before the doors open.

Set up in the portal before the first visitor arrives: scanner, banner studio, rights desk.

Scanner

A headless browser walks your site and classifies every cookie and script. Below 85 percent confidence, an item waits for your review.

Provider Item / URL Type Category Confidence Status
Google Tag Manager googletagmanager.com/gtag/js Script Analytics & Performance 96% confirmed
Cloudflare Web Analytics static.cloudflareinsights.com/beacon.min.js Script Analytics & Performance 100% auto
example.com example.com/app.js Script Strictly Necessary 41% needs review

Illustrative. Rows in the product’s columns; values representative.

Scanner

Banner studio

Three skins. Accept and Reject at identical weight. Banners in 86 languages, including all 22 scheduled Indian languages.

Banner studio

Rights desk

Thirteen request types, each law with its own set and response window.

  • Access
  • Correction
  • Erasure
  • Portability
  • Objection
  • Nomination
  • Grievance
  • Restriction
  • Withdraw consent
  • Opt out of sale
  • Opt out of sharing
  • Limit sensitive data
  • Automated decisions

Rights desk

One tag, first in the head.

The tag goes first in the head so it can hold what follows. Everything else is configured in the portal and published as a numbered version.

<script src="https://api.cookiegate.io/api/v1/public/sdk/<site-key>.js"
        data-cg-sw="/cookiegate-sw.js"></script>

Select the code to copy it.

Replace <site-key> with the key on your Integration page. data-cg-sw is optional and points at the service worker hosted on your own domain.

  • First script in the head no async, no defer
  • Region-aware; one tag
  • Service worker data-cg-sw optional

Six steps in the portal

  1. 1 Websites
  2. 2 Scanner
  3. 3 Banner Builder
  4. 4 Consent Categories
  5. 5 Translations
  6. 6 Integration (Review & Publish) Publish v2

Questions, answered plainly.

Anything else: write to the desk.

Contact

Does CookieGate block trackers, or only show a banner?

It blocks them. The tag loads first in the head and stops non-essential tags running before consent. Tags marked with data-cg-purpose have no URL until the visitor consents to that category, so the browser never requests them. A service worker on your own domain can answer any remaining tracker request with an empty 204. On reject, held tags stay held and cookies set on earlier visits are deleted.

Which regulations are covered, and how is the right one chosen?

Eleven: GDPR, ePrivacy, UK GDPR, CCPA/CPRA, LGPD, DPDPA, POPIA, PIPEDA with Quebec’s Law 25, Thailand PDPA, APPI and PIPL. The applicable law is resolved on the server on every request: your site’s country by default, or each visitor’s location when you switch it on. Where laws overlap, the strictest rule is kept. A Global Privacy Control signal is recorded in every receipt and applied per regulation: as an automatic opt-out under the CCPA, as a pre-set denial the visitor still confirms under the GDPR, ePrivacy and the UK GDPR, and as an opt-out under PIPEDA.

What evidence do I get if a regulator asks?

A receipt per decision: the timestamp, the anonymised visitor id, the domain, the regulation applied, the action, the Global Privacy Control signal, the choice per category and a hash. Each receipt carries a receipt number, a SHA-256 hash of the record, an HMAC signature made with a key held on CookieGate’s servers, and the hash of the receipt before it. The regulation is frozen into the record at decision time. Any receipt can be checked at a public verification endpoint. The banner log separately records when a banner was shown, which rules applied and in which language. Both export from the portal.

Is CookieGate a Google-certified or IAB-registered CMP?

Not yet. CookieGate is not on Google’s certified CMP list and is not an IAB-registered CMP. Its TCF v2.2-compatible API activates with a registered CMP id; registration is on the roadmap. If your ad stack requires a certified CMP today, write to us before you buy. Enforcement, resolution and receipts do not depend on either programme.

How does the trial work, and what does it cost after?

Every paid plan starts with a 15-day trial. A card is required to start it and nothing is charged until the trial ends; cancel before then and pay nothing. After that, Starter is ₹2,499 a month and Professional ₹7,499 a month, billed in INR through Razorpay, with yearly billing costing ten months. Enterprise is priced by conversation.

Built by a data protection lawyer and a full-stack engineer.

  • Navaneeth SS, Founder and CEO. Former data protection lawyer.
  • Midhun MP, Co-founder and CPO. Full-stack engineer.

Comply Ark is a regulatory infrastructure company: DPIIT-recognised (DIPP217248), a KSUM Idea Grant recipient, and in the ISB iVi programme.

Questions before you install? Ask the people who built it.

A founder or an engineer reads every message.

We respond within one business day.

Start free trial Talk to sales

15 days. Card required. Nothing is charged before day 15.

Starter ₹2,499 a month. Professional ₹7,499 a month. Enterprise by conversation.