Compare · CMPStack vs an AI build
CMPStack vs building it with AI.
A coding model will hand you a cookie banner in an afternoon, and it will probably work. This page is about everything after the afternoon: the parts a banner has to keep doing for years, on every client site, while the rules change.
| Dimension | AI-generated banner | CMPStack |
|---|---|---|
| Day one | A working banner in an afternoon. Impressive. | A working banner in ten minutes. Less impressive, same result |
| Consent Mode v2 | Easy to get the call in. Easy to get the order wrong, so gtag fires before the default is set | Denied-first defaults set synchronously before any Google tag, updated on decision, unit tested |
| Script weight | Whatever the model produced, plus the framework it reached for | 4,085 bytes gzipped. The build fails above 4,096 |
| Layout shift | Nobody measures it until Search Console complains | 0.000, checked by headless Chrome on every build, fails above 0.10 |
| Proof of consent | A row in your database with a timestamp, if you remembered to write one | Append-only receipts with per-category grants, salted IP hash, and a snapshot of the exact banner text and version shown |
| Knowing what cookies the site sets | You ask the model. It guesses from the code it can see | A headless browser loads the live site, waits for third-party scripts, and lists what was actually set |
| Dark patterns | The model builds what you describe, including a hidden Reject | A rule engine scores every banner 0 to 100. GDPR on with no Reject button is refused with a 400 |
| Geo rules | Hard-coded list of EU countries from training data | EEA plus UK resolved from the CDN header per visitor. Unknown region shows the banner |
| Returning visitors | Depends on how the cookie was scoped. Often re-asked per subdomain | One cookie on the registrable root domain, 12 months, zero requests on load |
| When the law changes | You re-prompt, re-test, redeploy to every client site | We ship it once. Every domain picks it up on next load |
| Multiple clients | One codebase per client, or one codebase with client conditionals | A workspace per client on its own subdomain, five roles, one login |
| Who is accountable | You, for code nobody reviewed | Us. Cyber Essentials Plus, ICO registered, tested against cross-tenant isolation |
The left column describes a typical result from asking a coding assistant for a GDPR cookie banner. Yours may be better. The point is that nothing in that column is checked by anything except you.
Where the cost actually lands
The banner is the cheap part
The evidence
A regulator or a client's lawyer asks what a specific visitor was shown on a specific date. A banner does not answer that. A receipt with the banner snapshot does.
The drift
Marketing adds a pixel. The banner still says three categories. Nobody rescanned, so nobody knows the declaration is wrong until someone else does.
The fleet
Twelve client sites, twelve slightly different copies. The Consent Mode fix takes twelve pull requests and twelve deploys.
Fair warning
When building it yourself is right
One site, no third-party tags beyond analytics, a developer who owns it long term, and no client to answer to. In that case a small hand-written banner with Consent Mode wired correctly is fine, and you should weigh it with the checker to make sure it stayed small.
Use CMPStack when there is more than one site, more than one person, or anyone who might one day ask you to prove what a visitor agreed to.
What we do with AI ourselves
- Unknown cookies from a scan are queued for AI categorisation; you confirm before it counts
- Nothing the model says reaches a visitor's browser without passing the same rule engine as everything else
Keep the afternoon. Skip the years.
Seven days, every feature, unlimited domains, no card.
GDPR · UK-GDPR · CCPA · Google Consent Mode v2