Candor is a GDPR/CCPA cookie banner built on one principle: compliance shouldn't require dark patterns. Real accept/reject parity. No pre-ticked boxes. Per-category script blocking. Edge geo-detection. Compliant and trustworthy.
Reject all is exactly as prominent as Accept all — same size, same step, same screen. No buried link, no "manage preferences" maze standing in for a refusal. That parity is what makes consent legally valid.
Mark third-party scripts type="text/plain" data-candor="analytics" and Candor keeps them inert until that category is granted — so trackers genuinely don't run before consent, not just "after the fact".
Candor reads Cloudflare's CF-IPCountry header at the edge — free, no third-party IP lookup, no extra latency — so you can prompt where consent is required and stay quiet where it isn't.
No pre-ticked optional categories. No confirm-shaming. "Strictly necessary" is always-on and clearly labeled as such. The whole product is built so a regulator and a visitor both read it the same way: honest.
The paid consent log stores only a salted hash of the visitor, the category booleans, and a coarse country — never an email, name, or raw IP. Compliance evidence without becoming a privacy liability yourself.
Pure HTML/CSS/JS in a Shadow-DOM bubble — zero dependencies, ~18 KB on the wire, no build step, no framework. Drop it on WordPress, a static site, Webflow, anything that renders a <script> tag.
One <script> tag in your <head>, with optional data-* attributes for your site name, accent color, and policy link.
Change type="text/javascript" to type="text/plain" data-candor="analytics" on any script that sets cookies. Candor holds them until consent.
Accept all, reject all, or open preferences and pick categories. Their choice persists in a first-party cookie + localStorage — no re-prompting on every page.
Candor swaps the inert tags to live ones the moment a category is allowed, and fires a candor:consent event your code can hook.
Free covers a real, compliant banner. A license adds geo-targeting, the consent log, and multi-site scale.
Candor gives you the tools compliance requires: genuine accept/reject parity, no pre-ticked optional categories, prior blocking of non-essential scripts, and a consent record (paid). Compliance is ultimately about how you configure and disclose it — Candor is built so the honest configuration is the default one, rather than something you have to fight the tool to achieve.
You change a tracker's tag from type="text/javascript" to type="text/plain" data-candor="analytics". The browser won't execute a text/plain script, so it stays inert. When the visitor grants that category, Candor swaps it for a live <script> and it runs — not before. That's what "prior consent" means in practice.
No. The free tier is a real, compliant banner forever — parity buttons, per-category blocking, theming, and persisted choice. You only need a license for geo-targeting, the server-side consent log, Google Consent Mode, and multi-site use.
Only a salted hash of (IP + user-agent + day), the category booleans, and a coarse country code from Cloudflare's edge. No email, no name, no raw IP, no page content. It's enough to evidence consent without turning your compliance tool into a privacy liability of its own.
It's pure vanilla JS in a Shadow DOM, ~18 KB, zero dependencies, served from Cloudflare's edge. Geo-detection uses a request header that's already there — no blocking third-party IP lookup. The banner renders before paint so there's no flash of un-consented trackers.
Depends on the plan: Single = 1 domain, Agency = 10, Unlimited = unlimited. Domains bind automatically the first time the widget verifies. Need to move a site? Contact us to unbind a slot.