Consenti, What-Why-How ?

Consenti is an open-source Consent Management Platform (CMP). This page covers what that means in practice, why it's built the way it is, and how the project plans to keep its compliance coverage current as laws change.

What Consenti is

Consenti is a consent layer for your site: it shows a banner shaped by the regulation that applies to each visitor, blocks non-essential cookies and tracking scripts until consent is given, records what the visitor chose, and exposes that choice everywhere else on the page — your tag manager, analytics, ad pixels, and your own code — through a single API. It ships as two independent npm packages: @consenti/ui, the browser widget, and @consenti/api, an optional Node.js backend for durable storage, an admin dashboard, and an append-only audit log. Apache 2.0, zero external runtime dependencies on either side.

The part that matters most: nothing non-essential loads until consent says it can. Blocking is the point — a banner that only displaysa choice without gating what runs isn't doing the compliance work, it's decoration.

Why Consenti

Most open-source cookie banners run entirely in the browser and stop there — you get a banner, not jurisdiction awareness. Most hosted SaaS CMPs do detect jurisdiction, but the detection, the banner logic, and your consent data all live on the vendor's servers behind a monthly fee.

Consenti's position: jurisdiction detection happens in the browser itself, by default, with no backend required. The widget reads the visitor's timezone and navigator.language, matches them against an embedded map of 190+ countries, and picks the correct compliance group — GDPR-shaped opt-in for an EU timezone, CCPA-shaped opt-out for California, and so on — before the banner ever renders. No IP lookup service, no server round-trip, no vendor in the middle. When you do add the optional backend, that same decision upgrades to real IP-based geo-resolution for higher accuracy, but the browser-only baseline is already jurisdiction-correct on its own. See How Auto-Detection Works for the exact resolution logic.

On top of that, Consenti tries to give developers close to everything they'd need to integrate consent into an existing stack rather than a fixed accepted/rejected flag: a getConsent(type?) method with built-in mappers for GTM/Google Consent Mode v2, Meta, Adobe, and Segment; a full DOM event lifecycle (consenti:consentSubmitted and friends); framework subpath exports for React, Vue, and Angular; and a plugin system on the backend with lifecycle hooks so a BigQuery, Segment, or Snowflake sink — or your own custom destination — is a few lines, not a fork.

Based on public documentation as of Jan 2026. Product names mentioned elsewhere on this site are trademarks of their respective owners; Consenti is not affiliated with or endorsed by any of them. See the full homepage comparison table for a feature-by-feature breakdown against named products.

How Consenti aims to stay compliant

Privacy law doesn't hold still, and a CMP that goes stale is worse than no CMP — it gives a false sense of coverage. The intended cadence:

1. Quarterly review. An aggressive scan of regulatory changes across every jurisdiction Consenti maps — new laws, amendments, regulator guidance — and a check of what that means for the existing compliance groups and defaults.
2. Draft an implementation plan. Turn findings into a concrete plan: which compliance group needs a default change, whether a new group is needed, what config or profile fields have to move.
3. Publish it for public comment. The plan goes up publicly — GitHub Discussions is the intended venue — for roughly a month, so other developers and anyone with legal context on that jurisdiction can flag issues before anything ships.
4. Implement and publish. Once the comment window closes, the plan gets built and shipped, with the outcome recorded in the changelog.
5. Lighter interim scans between quarters. A quarterly cycle is too slow for an urgent change — a regulator deadline or a fast-moving amendment — so the plan includes shorter, targeted scans between full reviews to catch anything time-sensitive.

Planned or in-flight work already tracked this way shows up on Upcoming Features. The mechanism behind steps 1–2 — the research brief, the 10-jurisdiction registry, and the report template — lives in compliance-docs/ in the repo, alongside the quarterly reports it has produced so far.

Frequently asked questions