Candor provides equally prominent accept and reject buttons, category preferences, and controls for tagged scripts.
Visitors can accept or reject from the same screen, with both choices given equal prominence.
Mark third-party scripts type="text/plain" data-candor="analytics" and Candor keeps them inert until that category is granted — so trackers genuinely don't run before consent, not just "after the fact".
Candor reads Cloudflare's CF-IPCountry header at the edge — free, no third-party IP lookup, no extra latency — so you can prompt where consent is required and stay quiet where it isn't.
Optional categories start unselected. The necessary category is always on and clearly labelled, and button text describes each choice without shaming visitors.
When enabled, the log stores a hashed identifier, category choices, country code, site, action, and timestamp. The consent record excludes names, email addresses, and raw IP addresses.
Pure HTML/CSS/JS in a Shadow-DOM bubble — zero dependencies, ~18 KB on the wire, no build step, no framework. Drop it on WordPress, a static site, Webflow, anything that renders a <script> tag.
One <script> tag in your <head>, with optional data-* attributes for your site name, accent color, and policy link.
Change type="text/javascript" to type="text/plain" data-candor="analytics" on any script that sets cookies. Candor holds them until consent.
Accept all, reject all, or open preferences and pick categories. Their choice persists in a first-party cookie + localStorage — no re-prompting on every page.
Candor swaps the inert tags to live ones the moment a category is allowed, and fires a candor:consent event your code can hook.
Free includes the banner and category controls. A license adds geo-targeting, the consent log, and multi-site scale.
Candor provides accept and reject buttons, unselected optional categories, controls for tagged scripts, and consent records when enabled. Installing the banner alone does not establish compliance; review your site's scripts, configuration, and disclosures against the requirements that apply to it.
You change a tracker's tag from type="text/javascript" to type="text/plain" data-candor="analytics". The browser won't execute a text/plain script, so it stays inert. When the visitor grants that category, Candor swaps it for a live <script> and it runs — not before. That's what "prior consent" means in practice.
No. The free tier includes parity buttons, per-category blocking, theming, and persisted choice. You only need a license for geo-targeting, the server-side consent log, Google Consent Mode, and multi-site use.
When logging is enabled, each consent record contains a hash derived from the IP address, User-Agent, and day, plus category choices, country code, site, action, and timestamp. The record does not contain the raw IP, name, email, or page content. Records are configured to expire after 400 days. The identifier is pseudonymous; review retention and access as part of your privacy practices.
It's pure vanilla JS in a Shadow DOM, ~18 KB, zero dependencies, served from Cloudflare's edge. Geo-detection uses a request header that's already there — no blocking third-party IP lookup. The banner renders before paint so there's no flash of un-consented trackers.
Depends on the plan: Single = 1 domain, Agency = 10, Unlimited = unlimited. Domains bind automatically the first time the widget verifies. Need to move a site? Contact us to unbind a slot.