The platform
Everything between
the visitor and the tracker.
Cookie Gate sits in front of every cookie your site would like to set — deciding what applies, enforcing it in the browser, and writing down what happened. These are the six systems that do it.
Banner studio
Correct by default, yours by design.
A visual wizard builds the banner with regulation-aware presets — a GDPR opt-in and a CCPA opt-out are both right before you touch anything. Then make it yours: three modern skins, full color and copy control, live preview at every step.
- Sleek floating card, minimal slim bar, or frosted glass panel
- Accept and Reject always carry identical visual weight
- Shadow-DOM isolation — your site's CSS can't break it, and it can't break your site
Compliance engine
The law of the land, per visitor.
Every request is geo-resolved server-side — the SDK never decides the regulation, so it can't be tampered with. Country and sub-region map to the applicable laws; where several apply, they merge strictest-wins. Your enforcement preferences can tighten the result, never loosen it.
- 11 regulations modelled: consent model, banner rules, deadlines, authority
- Sub-regional overrides — Quebec Law 25 layers over federal PIPEDA
- Global Privacy Control honoured: auto opt-out under CCPA, pre-set denial under GDPR
Enforcement
Consent before cookies. Literally.
The SDK loads first and intercepts what follows: script tags, iframes, tracking pixels, cookie writes. Nothing non-essential runs until the visitor decides. On reject, blocked resources never load — and cookies that already existed are deleted.
- Intercepts createElement, document.cookie, fetch and XHR; a MutationObserver watches the DOM
- Blocked iframes park at about:blank; pixels collapse to a transparent gif
- Unknown scripts default to blocked under opt-in regimes
Scanner
An auditor that reads the whole page.
A headless browser visits your site the way a person would, then goes further: network requests, inline scripts, iframes, and recursive shadow-DOM traversal. Every cookie found is classified against a global database that learns from confirmations across all tenants.
- On-demand, on onboarding, by API — or scheduled weekly / daily by plan
- Confidence-scored classification; low-confidence finds queue for review
- New trackers on your site trigger an email to your admins
Evidence
A ledger, not a logfile.
Consent receipts chain by SHA-256 — each one carries the hash of the one before it — and are HMAC-signed with a per-tenant key. The regulation in force is frozen into the receipt at decision time, so your evidence stays valid even when mappings change later. Platform audit logs are chained the same way.
- Tamper-evident: any edit invalidates every signature downstream
- Export as JSON, CSV or PDF; retention is tenant-configurable
- Public endpoints verify any receipt or a whole website's chain
Rights & reach
Requests with deadlines. Banners in 86 languages.
Visitors file data-protection requests through an OTP-verified form — no account needed. Thirteen request types appear conditionally per regulation, each with its statutory deadline computed on arrival: 30 days under GDPR and DPDPA, 45 under CCPA, 15 under LGPD. Assign, respond, and close with every step audit-logged.
- Access, erasure, portability, objection, opt-outs, grievance and more
- Banner auto-translation pipeline covering 86 languages, with strong Indic coverage
- Google Consent Mode v2 signals on every plan, including Free