Banner builder

Banner Management lists every domain with its banner status. Open one to edit. The left side has the tabs; the right side is a live preview you can switch between desktop and mobile and between a light and a dark host page. Clicking a piece of text in the preview focuses the field that sets it.

Save draft keeps your work without changing the live site. Publish saves the draft and makes it live in one step; there is no need to save first. The compliance chip next to the buttons re-scores the draft after every save.

Banner → Start exists because the alternative is a blank builder with forty fields. Nothing on the tab saves anything: each control loads something into the builder, which you then change and save with the ordinary buttons.

Templates

10 banners that already say something — plain, warm, formal, for a shop, for a publisher, one written out in three languages. Every one of them publishes with nothing to fix: no blocked rules and no warnings, in every language it ships. They arrive with a policy link and a starting set of blocking rules for that reason.

Match my brand

Fetches your home page once, server-side, and reads the colours and font it already declares — a theme colour, brand variables in the stylesheet, a Google Font it loads. It respects your robots.txt, and it tells you where each value came from so you can disagree with a reason. It proposes; it never applies.

Describe it instead

Say how the banner should look in a sentence and get a style back, with a preview and an Apply button. It sets colours, layout, corners, shadow and font — and never a word of the banner.

If the brand reader finds nothing. Plenty of sites declare no theme colour and no CSS variables we recognise, and a domain that has not been pointed anywhere yet will not load at all. It says which, rather than guessing — a confidently wrong brand colour is worse than an empty field, because the empty field gets filled in correctly.

The Content tab holds the title, message, the three button labels, the “Customize” link and the privacy policy link. The policy link is worth setting: the compliance score flags a banner without one, and visitors are entitled to read what they are agreeing to.

Languages. The bar above the fields shows the default language and any you have added. Add language offers 26 EU/EEA languages with starter text already translated; pick one and edit it. The site asks for the page’s own language first (its lang attribute), then the browser’s, and falls back to the default; exactly one language is ever sent to a visitor, so a banner in ten languages costs nothing extra on the page.

The notices follow the language too. The US opt-out notice and the “Tell only” button on Banner → Targeting are per language, like everything on this tab. A language you add from the list now arrives with the opt-out notice already translated. One you add by hand, and any language that was on the banner before notices became per-language, shows the default language’s wording until it is given its own.

Layout

Bar (full width at the bottom), Modal (centred, dims the page) or Popup (a card in the corner). Only the modal blocks clicks on the page behind it.

Colours and type

Background, text and accent colours, the font family, title and body sizes, corner radius on the panel and the buttons, and the shadow.

Custom CSS

Professional and above. Applied after our stylesheet, inside the banner only. Anything script-bearing or loading from another origin is refused when you save.

Branding

The small “Powered by CMPStack” mark. Paid plans can hide it; the demo cannot.

The accent colour also colours the small round preferences control that stays on the site after a decision, so it matches the banner.

The Targeting tab sets the geo mode. With all visitors everyone sees the banner. With a regional mode, visitors outside the region are not asked: the server tells the tag to imply consent for the categories the banner offers, records nothing, and still shows the preferences control so they can opt out.

Google Consent Mode only constrains Google’s tags. Every other vendor has no consent API, so the only way to honour a rejection is to stop its script running. The Blocking tab is where you say which scripts belong to which category.

URL rules. A rule is a fragment of the script’s URL and a category. Common vendors are one click from the presets list; anything else, paste the domain its script loads from. Matching scripts are held from the moment the tag runs, released the instant the visitor allows the category, and kept held for the whole page if they refuse it, including scripts a tag manager injects seconds later.

Marking. A script hard-coded in the page above our tag has already run before we load, and no rule can undo that. Change those in the page to:

<script type="text/plain" data-cmp="marketing" src="https://…"></script>

The browser will not execute an unknown type, so the script provably has not run; the tag swaps it back when the category is allowed.

Verify it works. Open the site in a private window with DevTools → Network. Reject all. A blocked script shows as type="text/plain" with no request; accept and it loads.

The same banner behaves differently depending on where the visitor is, because the law does. Banner → Targeting has one setting per regime, and the decision is made on our side — the tag never looks up a location itself.

Europe (EEA + UK)

Always asks, and nothing non-essential runs until the visitor agrees. Not a setting: consent there is opt-in because the law says so.

United States

Honour opt-outs (most processing runs until the visitor objects, which is what US state laws expect), Ask first (treat Americans like Europeans — stricter than required, always compliant), or No banner (imply consent; only if you do not sell or share personal information).

Everywhere else

Ask first; tell only — the banner's text with one button that closes it, consent implied and Customize still there to change it; or no banner, consent implied silently. Most countries have no requirement of this kind; asking anyway is always compliant.

Sensitive data

A category marked sensitive on the Content tab stays opt-in for American visitors even when you are honouring opt-outs — US state laws carve health, precise location and biometrics out of the “runs until told to stop” default.

Banners saved before these settings existed keep behaving exactly as they did: the old EEA + UK choice means ask Europeans and imply consent everywhere else, and Worldwide means ask everyone.

With Banner → Targeting → United States set to Honour opt-outs, an American visitor is not asked for permission. Everything except your sensitive categories runs from the first page view, which is what the state laws allow. What those laws do require is that the visitor is told, and given a way to stop it that is not buried in a privacy policy. That is two things, and they are different.

The notice

A short message saying what is happening, shown once. Its prominent button opts the visitor out of everything optional; the quiet one dismisses it and changes nothing. It never locks the page and never treats a scroll as agreement — there is nothing to agree to.

The link

Stays on every page after the notice is gone, in place of the round preferences control. This is the part the law actually asks for, and in California the wording is close to statutory — set it exactly as your counsel gives it.

Sensitive categories

Still off until the visitor turns them on, whichever button they press. Dismissing the notice does not grant them.

Previewing it. The preview under the banner has a Shows switch when this rule set is on, so you can see the European question and the American notice side by side. They are not variants of one screen: one asks before anything runs, the other says what is already running.

In more than one language. Which rule set applies depends on where the visitor is; which language they get depends on the page they are reading. So a Spanish page read in California gets this notice, and it should be in Spanish. When your banner has more than one language, a row of language buttons appears above the wording: pick one and the five fields below it are that language’s. A language with no wording of its own is marked with a warning sign: it shows the default language’s, to you and to visitors, and follows the default when you edit it. While American visitors are on Honour opt-outs, it also counts as a compliance warning that names the language: it lowers the score, and never stops you publishing. It gets its own the moment you type in it, or press Use our translation where we have one, and from then on it no longer follows. The same row sits above the Tell only button under Everywhere else.

European visitors never receive any of this. The wording is sent only to a visitor the US rule set actually applies to, so a page view from Berlin carries none of it.

In Consent Logs, an American visitor’s receipt records this notice’s title and text, in the language they read it in, because that is what they answered. A visitor elsewhere on the same site gets a receipt with the banner’s wording.

Some browsers — Firefox, Brave, DuckDuckGo and several extensions — let a visitor turn on Global Privacy Control, a standing instruction that says “do not sell or share my personal information”. California, Colorado and Connecticut require a business to honour it exactly as it would honour a click on the opt-out link. Nothing to configure: if your US rule set is Honour opt-outs, we honour it.

What happens

Everything optional is denied before any of it runs. No banner and no opt-out notice is shown — there is nothing left to ask, and asking a visitor to confirm a setting they already chose would be its own dark pattern.

What the visitor sees

One dismissible line saying we honoured the signal. A signal honoured invisibly cannot be told apart from one ignored, and Californian regulators expect a business to be able to show that it acted.

A stored acceptance does not survive it

Someone who accepted last month and has since turned GPC on has told you something newer than their cookie says. The older decision is replaced rather than honoured.

Where it does nothing

Europe, where consent is opt-in and the banner asks anyway, and any region where your rule set implies consent — there is no opt-out right there for the signal to exercise.

In the log. These decisions appear in Consent Logs with a GPC badge beside the choice, and can be filtered on. They carry no banner wording, because no banner was shown — that is the honest record rather than a gap.

In the numbers. Counted separately from accept, reject and custom, and never added to them. A GPC opt-out has no banner impression behind it, so including it would push the consent rate past a hundred per cent on a site with enough of this traffic. The total-consents tile names them on its own line.

Server-rendered integrations get it too: the config response carries gpc when the visitor sent the Sec-GPC header, for themes that fetch it on the server where there is no browser to ask.

Delay

Seconds to wait before showing the banner, up to 60.

Scroll trigger

Show once the visitor has scrolled a quarter of the page. Combined with a delay, whichever comes first wins; a visitor who never scrolls is still asked after the delay, or after 15 seconds.

Exit intent

Show when the pointer leaves the page at the top. Touch devices cannot do this, so the same backstop applies.

Block scrolling

Lock the page behind the banner until a choice is made.

Scroll as consent

Treat scrolling as acceptance. The server only allows it for visitors outside GDPR; inside, it is ignored and the compliance score warns.

Ask again after

How long a decision is honoured before the banner returns, from 1 to 24 months. Twelve is the regulators' guidance and the default. The lifetime is written onto the visitor's record at the moment they decide, so changing this setting does not cut short a decision somebody has already made — it applies to the next one.

Remember rejections for 6 months

Off by default. A visitor who rejects is not asked again for six months, even where consent expires sooner — the lifetime is fixed on their record, so a later change of setting does not take the promise back. Anticipates the EU proposal on refusals; it is not law yet, which is why it is optional. It can only lengthen a rejection, never shorten one.

Keyboard. The banner is a proper dialog: when it opens, focus moves onto its first control, and when it closes, focus goes back to wherever it was. In the modal layout Tab and Shift+Tab stay inside the banner, because the page behind it is dimmed and cannot be clicked either. In the bar and popup layouts the page stays usable, so focus is free to leave. Escape steps back from the category list; if the visitor opened the banner from the preferences control, a second Escape closes it without changing their decision. A first-visit banner never closes on Escape — there is no decision yet to fall back on. Nothing to configure: this is how every banner behaves.

Publish in the builder, or Publish on a row in Banner Management, saves the current draft and makes it live. A domain that has never been opened in the builder publishes the default banner. Each publish increments the version, and every consent decision records the version it was made under, so an audit can show exactly which banner a visitor saw.

Owners, admins and editors are emailed when a banner goes live for the first time. After that, further publishes are emailed at most once a day per domain, so an afternoon of edits is one email, not ten. The activity feed in the panel lists every publish regardless.

Four things cannot be published at all. A banner with no “Reject all” button, one with optional categories switched on by default, one with no way to choose categories individually, and one with scroll-as-consent switched on. These are the dark patterns regulators fine for, so they are refused rather than scored: the message names the rule, and “Take me to it” opens the control that needs changing. The other compliance checks — a missing policy link, low contrast, an untranslated language, nothing blocked — still publish and only lower the score.

After a decision, and on every later visit, the site shows a small round control in the bottom-left corner in your accent colour. Pressing it opens the banner on the category list with the visitor’s current choices ticked, so they can change one thing rather than start over. It is required by GDPR Article 7(3), and it is the only route back to a stored decision, so it cannot be turned off.

It sits bottom-left on purpose: chat widgets, back-to-top buttons and baskets live bottom-right.