What runs behind the banner

Cookie consent is a runtime compliance system on your website — not a WordPress plugin that drops a modal. This page explains the moving parts and why a simple dialog is not enough.

Why not just a dialog?

A dialog that only records "OK" does not stop Google Analytics, Meta Pixel or ad tags from firing. Regulators expect equal reject, category control, blocking before consent, and proof you can export. Nerd Consent implements that pipeline — the dialog is just the visible tip.

Architecture (simplified)

Visitor browser
  │
  ├─► nerd-consent.min.js (loads first)
  │     ├─ Fetches site config + cookie list (API)
  │     ├─ Blocks scripts/cookies by category
  │     ├─ Renders banner / preference panel
  │     ├─ Updates Google Consent Mode v2
  │     └─ Posts consent event (optional log)
  │
  └─► Your site (GA4, Ads, pixels) — only after consent

Nerd Consent Host (EU-owned)
  ├─ Portal (banner, scripts, cookies, logs)
  ├─ Config + licence API
  └─ Consent log + export

JS runtime on your site

A small TypeScript bundle intercepts script tags, reads stored consent, and only unlocks marketing/statistics after choice. The banner is the UI layer on top.

Config and licence API

The host serves banner copy, colours, categories and script mapping per siteId. Licence is validated online with a grace cache.

Consent ingest

Choices are posted to /api/v1/consent with policy version and locale. The portal provides search and CSV export for documentation.

Cookie inventory

A categorised list (name, purpose, lifetime) appears in the preference panel and links to your public cookie policy.

What happens on each page load

7. Snippet loads

The browser fetches nerd-consent.min.js. It runs before third-party tags in GTM or manual install.

7. Config fetch

Site config and cookie list are fetched (cached). Invalid licence may limit production.

7. Blocking

Scripts mapped to marketing/statistics are held back — not merely hidden in the DOM.

7. Banner or revisit

New visit or expired consent → banner. Existing choice is reused locally.

7. Choice and GCM

Accept, reject or customise categories. Consent Mode v2 updates for Google tags.

7. Log and release

Choice may be logged server-side. Approved scripts activate — the page behaves as expected.

EU-owned hosting

The control plane (config API, consent ingest, portal, logs) runs on European-owned infrastructure. We do not run on Amazon AWS or Microsoft Azure — an EU region on AWS or Azure does not remove US legal exposure (CLOUD Act, executive orders, vendor policy changes).