Question 1

What is Consenti?

Accepted Answer

Consenti is an open-source, GDPR-compliant Cookie Consent and Consent Management Platform (CMP). It ships as two npm packages: @consenti/ui (browser widget) and @consenti/api (Node.js backend). Both have zero external runtime dependencies.

Question 2

Does Consenti support GDPR?

Accepted Answer

Yes. Consenti fully supports GDPR with opt-in consent mode, legitimate interest handling (Art. 6(1)(f)), right-to-erasure endpoint, immutable audit logs, and signed consent receipts.

Question 3

Does Consenti support CCPA?

Accepted Answer

Yes. Consenti fully supports CCPA and CPRA with opt-out consent mode, GPC signal detection, and configurable do-not-sell/share flows.

Question 4

How do I install Consenti?

Accepted Answer

Install the UI widget with: npm install @consenti/ui. Then import and initialise: import { ConsentiSetup } from '@consenti/ui'; new ConsentiSetup({ compliance: { type: 'opt-in' } }). No CSS import needed — styles are injected automatically. For the backend: npm install @consenti/api. Both packages have zero external runtime dependencies.

Question 5

Does Consenti work with React?

Accepted Answer

Yes. Consenti provides a useConsent() React hook via the subpath export @consenti/ui/react. It also works with Next.js, Vue, Angular, Nuxt, and any JavaScript framework.

Question 6

Does Consenti require a backend?

Accepted Answer

No. The UI widget (@consenti/ui) works standalone without any backend. The backend module (@consenti/api) is optional and only needed if you want server-side consent records, audit logs, or the admin dashboard.

Question 7

What database does Consenti use?

Accepted Answer

By default Consenti uses SQLite via the built-in node:sqlite module (Node.js 24+) — no external database package required. It also supports MongoDB, PostgreSQL, and MySQL via the StorageAdapter interface.

Question 8

Is Consenti free and open source?

Accepted Answer

Yes. Consenti is released under the Apache 2.0 license. It is free to use, modify, and distribute. It is a self-hosted alternative to commercial CMPs like OneTrust and Cookiebot.

Question 9

Does Consenti support PDPA (Thailand)?

Accepted Answer

Yes. Consenti fully supports the Thai Personal Data Protection Act (PDPA). Configure it with compliance: { type: 'pdpa-th' } or use type: 'auto' to detect Thai visitors automatically and apply PDPA opt-in consent requirements. The consent banner, preference modal, and audit logs all meet PDPA requirements.

Question 10

Does Consenti support APPI (Japan)?

Accepted Answer

Yes. Consenti supports Japan's Act on the Protection of Personal Information (APPI). Use compliance: { type: 'appi' } or type: 'auto' for geo-based detection. Consenti handles APPI opt-in consent with proper audit trails.

Question 11

What is an open source CMP?

Accepted Answer

An open-source Consent Management Platform (CMP) is a tool that manages cookie consent and privacy compliance, where the source code is publicly available for inspection, modification, and self-hosting. Consenti is an open-source CMP licensed under Apache 2.0, offering the same features as commercial CMPs (GDPR, CCPA, TCF v2.2, admin dashboard, consent records) without licensing fees or vendor lock-in.

Question 12

Does Consenti work without importing CSS?

Accepted Answer

Yes. The @consenti/ui widget automatically injects its styles into the page when ConsentiSetup initialises — no separate CSS import is required. You only need to import the CSS explicitly if you want to preload it to avoid flash of unstyled content, or if you set core.disableCssTemplate: true to provide your own styles.

Requirement	Detail
Consent model	Law 25: explicit opt-in for sensitive data; meaningful opt-in for all; PIPEDA: opt-in for sensitive, implied for others
Purpose limitation	Must collect only what is necessary for a stated purpose
Privacy notice	Law 25: must publish a privacy policy and disclose data use before collection
Data minimisation	No excessive collection; consent to each category individually
Withdrawal	Individuals may withdraw consent at any time with reasonable notice
Minors	Law 25: under-14 requires parental consent
Privacy Officer	Must designate a Privacy Officer (name must be public)
Enforcer (federal)	Office of the Privacy Commissioner of Canada (OPC)
Enforcer (Quebec)	Commission d'accès à l'information du Québec (CAI)

	GDPR	Law 25 (Quebec)
Opt-in for all non-essential	Yes	Yes (since Sept 2023)
Lawful bases beyond consent	6	Fewer — consent-first model
Minor threshold	16 (States may lower to 13)	14
Privacy officer disclosure	DPO (mandatory for some)	Privacy Officer (always mandatory, name public)
GPC / browser signals	Optional	Not recognised

PIPEDA / Law 25 Compliance Guide

Official references

Key requirements

Law 25 vs. GDPR

Enabling PIPEDA / Law 25 mode

Frontend widget

Profile configuration (dashboard)

Right to access and erasure