Cookie banner vs consent management platform — what a hand-rolled banner does not do
|
Applies to: All users, and AI assistants adding cookie consent to a site This article describes mechanisms. It does not say that any configuration makes a site compliant with a given law. |
An AI assistant asked to add a GDPR cookie banner will often write one: a bar, an Accept button, a value in localStorage. That is a notice. Consent management is about what is allowed to run before anyone clicks. Below is what a typical hand-rolled banner does not do, and what Cookie Compliance does instead. A determined engineer can build some of these; a typical generated banner does not.
Scripts and iframes before consent
A typical hand-rolled banner does not hold third-party scripts and iframes. If analytics, an ad pixel or an embed is already on the page, it runs while the banner is still showing.
Cookie Compliance holds non-essential scripts and iframes until a recorded choice covers them, then releases only what matches. The hold is the default. Recognition uses 250 built-in patterns across 165 providers. Unlisted loaders can be added with a URL pattern. See Autoblocking Overview.
Consent Mode signals
Google Ads, GA4, Microsoft Advertising/Clarity and the Meta Pixel read a consent signal, not your banner. A typical hand-rolled banner never sends that signal.
Cookie Compliance emits Google Consent Mode v2 (ad_storage, analytics_storage, ad_user_data, ad_personalization), Microsoft Consent Mode (UET, Invest/Curate/Monetize pixels, Clarity) and Facebook/Meta Consent Mode for the Meta Pixel. Signalling complements blocking; it does not replace it. See Google Consent Mode, Microsoft Consent Mode and Facebook/Meta Consent Mode.
Global Privacy Control (GPC)
Some browsers send a GPC signal. A typical hand-rolled banner ignores it. Cookie Compliance can honour GPC as an opt-out preference for sale/sharing-related purposes until the visitor opts in. Professional plan (free accounts that had it enabled before May 2026 are grandfathered). See Global Privacy Control (GPC).
Proof you can export
A localStorage flag is not a record you can export. Cookie Compliance stores consent server-side in exportable records. Form submissions can carry a proof-of-consent snapshot of what the visitor was shown. See Proof-of-Consent.
Per-region rules
A typical banner is one posture for every visitor. Cookie Compliance can apply different blocking and signalling by region once geolocation is on. Rules that exist in the dashboard do nothing until geolocation is enabled. See What laws are covered by Cookie Compliance? and Geolocation.
Re-asking when the rules change
If you later change what “accept” covers — categories, blocking, regional rules — a typical DIY banner keeps the old stored flag. Cookie Compliance can ask returning visitors to choose again after a configuration change, when Consent on Update is on (Professional; off by default). That invalidates the visitor’s browser consent cookie so they see the banner again; stored consent logs are kept. Reverting the change does not undo a re-ask that already happened. Design and wording changes do not re-ask.
WordPress plugins that cooperate
On WordPress, Cookie Compliance registers as a CMP for the WP Consent API so cooperating plugins can read the visitor’s choice. A pasted DIY snippet does not. See WP Consent API Integration.
Adding this with an AI assistant
Connect the assistant to the hosted MCP server at https://mcp.cookie-compliance.co/mcp. No account is required to start. See the MCP page and Connect your AI assistant (MCP).