CookieGate sits in front of every cookie your site would like to set. Six stations, in the order they run: two before the doors open, four while the visitor is in the hall.
A headless browser opens your site and reads what a visitor never sees: every network request, inline script, iframe and shadow DOM. Each item is matched against a shared database; below 85 percent confidence it waits for your review.
Last scan: Found: 5 items Next scheduled: weekly
All 5 Auto-Classified 2 Classified 2 Needs Review 1 Ignored 0 Scan History
| Provider | Item / URL | Type | Category | Confidence | Status |
|---|---|---|---|---|---|
| Google Tag Manager | googletagmanager.com/ | Script | Analytics & Performance | 98% | confirmed |
| Meta Pixel | connect.facebook.net/ | Script | Marketing & Advertising | 96% | auto |
| Hotjar | static.hotjar.com/ | Script | Analytics & Performance | 91% | auto |
| example.com | example.com/ | Script | Strictly Necessary | 100% | confirmed |
| (unknown) | cdn.example-vendor.net/ | Script | (unset) | 41% | needs review |
Illustrative. Real vendor hosts; representative rows and counts.
Scheduled weekly or daily by plan, on demand from the portal, or by API.
On every request, the server picks the law: your site’s country by default, read from your sitemap and page language, or each visitor’s location when you switch it on. Where laws overlap, the strictest value is kept for each dimension.
Where your site is from
https://example.com/sitemap.xml2026-10-03 05:30| Visitor from | Rules applied | Model | GPC |
|---|---|---|---|
| Mumbai | DPDPA | opt-in | recorded |
| Munich | DPDPA | opt-in | recorded |
| San Jose | DPDPA | opt-in | recorded |
| Montréal | DPDPA | opt-in | recorded |
| São Paulo | DPDPA | opt-in | recorded |
| Visitor from | Rules applied | Model | GPC |
|---|---|---|---|
| Mumbai | DPDPA | opt-in | recorded |
| Munich | GDPR + ePrivacy | opt-in | pre-set deny, recorded |
| San Jose | CCPA/CPRA | opt-out | auto opt-out, recorded |
| Montréal | PIPEDA + Quebec’s Law 25 | opt-in | recorded |
| São Paulo | LGPD | opt-in | recorded |
Order of precedence
Illustrative. Example site; the engine’s own resolutions.
A Global Privacy Control signal is read first and written into every receipt; what it does depends on the law applied.
The tag loads first in the head. Three surfaces hold what follows: the markup you rewrite, the runtime interceptor, and an optional service worker on your own domain. Nothing non-essential is requested until the visitor decides.
<script src="https://api.cookiegate.io/api/v1/public/sdk/<site-key>.js"
data-cg-sw="/cookiegate-sw.js"></script>Select the code to copy it.
<head>, no async or defer. data-cg-sw is optional (surface 3).A page with a notice-only banner
| t (ms) | request | sets |
|---|---|---|
0 | / | |
118 | googletagmanager.com/ | _ga |
162 | connect.facebook.net/ | _fbp |
241 | static.hotjar.com/ | _hjSession |
380 | banner shown | |
1,840 | visitor clicks Reject |
Three cookies were set before the answer, the first 1.7 s before it.
Illustrative. Hosts are real; timings are representative.
The same page with CookieGate
| t (ms) | method | request | status | purpose |
|---|---|---|---|---|
0 | GET | api.cookiegate.io/ | 200 | sdk |
12 | --- | googletagmanager.com/ | held | analytics |
12 | --- | connect.facebook.net/ | held | marketing |
13 | --- | static.hotjar.com/ | held | analytics |
380 | banner shown | |||
worker | any later request to a held host | 204 | ||
| Wait here: rows below are after the decision | ||||
1,840 | visitor presses Reject Optional | |||
cookies | _ga | deleted | ||
Cookies set on earlier visits by held tags are deleted.
Illustrative. Hosts are real; timings are representative.
The tag above stops a tracker running, not the browser requesting it: a src downloads at once, carrying the visitor’s IP address. Rewrite the tag and there is nothing to fetch until the visitor consents to its data-cg-purpose category.
<!-- Before: fetched at once, even though it will not run -->
<script src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
<!-- After: nothing is requested until the visitor consents to analytics -->
<script type="text/plain"
data-cg-src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"
data-cg-purpose="analytics"></script>
<!-- Works for pixels and embeds too -->
<img data-cg-src="https://example.com/pixel.gif" data-cg-purpose="marketing" width="1" height="1" alt="">
<iframe data-cg-src="https://www.youtube.com/embed/VIDEO_ID" data-cg-purpose="marketing"></iframe>Select the code to copy it.
Inside the page the SDK watches for anything added after load. Tags that match a known provider are held under their category; unknown scripts are held or allowed by your setting.
Watched after load
fetch callsBrowsers refuse a worker from another origin, so the file lives on your domain. It answers held tracker requests with an empty 204 and honours live consent, including expiry. It never touches navigations or first-party requests.
A worker takes control only after it has installed, so it cannot cover a visitor’s first-ever page load; it complements the markup, it does not replace it.
# 1. Download the worker file and host it at your web root:
curl -o cookiegate-sw.js https://api.cookiegate.io/api/v1/public/sdk/cookiegate-sw.js
# serve it as https://your-site.com/cookiegate-sw.js
<!-- 2. Add data-cg-sw to your existing CookieGate tag: -->
<script src="https://api.cookiegate.io/api/v1/public/sdk/<site-key>.js"
data-cg-sw="/cookiegate-sw.js"></script>
<!-- 3. Verify: DevTools > Application > Service Workers shows the worker,
and blocked tracker requests return an empty 204. -->Select the code to copy it.
| Surface | Covers | Runs | Cannot |
|---|---|---|---|
| Markup | the request itself; nothing is fetched | in your HTML | tags you did not rewrite |
| Interceptor | scripts, iframes, pixels, cookie writes, fetch and XHR added at runtime | in the page, from the first byte of the tag | a request made before the SDK runs |
| Service worker | any later request to a held host, answered 204; live consent, including expiry | on your domain, after first install | a visitor’s first-ever page load |
Also sent with the decision: Google Consent Mode v2 signals.
See how it holdsEach decision becomes a receipt, chained to the one before and signed with a key held on CookieGate’s servers, with the law frozen as it stood. Edit a record and its hash fails; rewrite the hash and the signature fails.
ccpa Illustrative. Synthetic records; live hashes print in full.
GET /api/v1/public/consent/verify/7bea9e8b-d67a-4b97-a30f-ff0bcba18042signatureValid: true contentHashValid: false chainSignatureValid: false | When | Event | Rules applied | Language | GPC |
|---|---|---|---|---|
2026-10-04 09:07 | Banner shown | GDPR | EN | No |
2026-10-04 08:51 | No banner required | none | EN | No |
2026-10-03 19:44 | Banner shown | GDPR | EN | Yes |
Illustrative. Synthetic rows; country and page columns omitted.
Anyone holding a receipt id can check it.
Download a sample receipt (JSON, 1 KB)A public form takes each request, verified by a one-time code; no account needed. Each law shows its own set of the thirteen types, with CookieGate’s response window computed on arrival. Assign, respond and close, every step logged.
Submit a data protection request
We’ll verify your email, then route your request to our team.
Request received
Reference: 5f0c2a9e…
We’ll respond within 30 days under GDPR.
Illustrative. Fields and copy as the SDK renders them.
| Regulation | Types shown | Window |
|---|---|---|
gdpr | 8 | 30 days |
eprivacy | 8 | 30 days |
uk_gdpr | 8 | 30 days |
ccpa | 6 | 45 days |
lgpd | 7 | 15 days |
dpdpa | 5 | 30 days |
popia | 5 | 30 days |
pipeda | 3 | 30 days |
pdpa | 7 | 30 days |
appi | 4 | 30 days |
pipl | 9 | 15 days |
The window is the one CookieGate applies and prints on the request’s confirmation. Statutory periods differ by law.
| Language | Strings | Status |
|---|---|---|
| Hindi | 44 / 44 | verified |
| Tamil | 44 / 44 | verified |
| Bengali | 41 / 44 | auto-translated |
| Malayalam | 44 / 44 | verified |
Banners in 86 languages, including all 22 scheduled Indian languages.
Illustrative. Translation rows are representative.
The thirteen request types:
Every paid plan starts with a 15-day trial. A founder or an engineer reads every message.
We respond within one business day.
15 days. Card required. Nothing is charged before day 15.
Starter ₹2,499 a month. Professional ₹7,499 a month. Enterprise by conversation.