Cookie Consent Banner Generator
Build a cookie consent setup with Google Consent Mode v2 defaults, per-category tag blocking and a consent API. Free, self-hosted, no CMP subscription.
Last reviewed by the Radiatus Cloud team
Cookie Consent Banner Generator
Generate a lightweight HTML/JS code snippet for a cookie consent banner.
Going for ISO 27001, SOC 2, HIPAA or GDPR?
Radiatus runs end-to-end compliance & GRC programs.
Consent is a signal, not a popup
The visible banner is the smallest part of a consent implementation. What matters is what happens to your tags. This tool generates the consent plumbing: the default state your tags start in, the mechanism that blocks scripts until permission arrives, and the events your other code can listen for when a visitor changes their mind.
Google Consent Mode v2
If you run Google Analytics 4, Google Ads or the Floodlight tags, Consent Mode v2 is effectively mandatory for EEA and UK traffic. Rather than blocking Google tags outright, Consent Mode has them load in a restricted state and adjust behaviour based on four signals: analytics_storage, ad_storage, ad_user_data and ad_personalization. The critical detail is ordering. The default command must run before the gtag.js library loads, otherwise the tag briefly operates in granted state and the implementation is invalid. The generated snippet places the default call in the correct position and sets everything except security storage to denied.
Blocking non-Google tags
Consent Mode only governs Google's own tags. A Meta pixel, a LinkedIn insight tag, a Hotjar recording script or an intercom widget will each fire regardless unless you block them yourself. The generated approach converts those into inert script blocks with type="text/plain" and a data-consent-category attribute; the consent library swaps the type and re-inserts the node once its category is granted. That is the same technique commercial CMPs use, without the subscription.
The consent API
The output exposes a small global. window.rdtConsent.get() returns the current category state, window.rdtConsent.open() reopens the preference panel for a withdrawal link, and a rdt:consent-change event fires on the document whenever the state changes so your own code can react without polling.
Test it properly
Load the site in a private window, open developer tools, and check the Application panel before touching the banner. If any non-essential cookie already exists, your blocking is not working. Then accept only analytics and confirm marketing cookies stay absent. Most broken implementations pass a visual inspection and fail this two-minute test.
Related tools
- SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
- Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
- Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
- Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.
Frequently Asked Questions
What is the difference between Consent Mode and blocking tags?
Blocking prevents a script from executing at all. Consent Mode lets Google's tags load but run in a restricted mode that sends cookieless pings and models conversions. They solve different problems: use Consent Mode for Google tags, and blocking for everything else. Most correct setups use both.
Where exactly does the Consent Mode default command go?
In the head, before the gtag.js script tag loads. If the default runs after the library, the tag has already initialised in granted state and the implementation is non-compliant. The generated snippet is ordered correctly, so paste it as one block rather than splitting it.
Does Consent Mode alone make me GDPR compliant?
No. Consent Mode governs how Google tags behave once a signal exists. You still need a banner that collects the signal lawfully, blocking for non-Google tags, and a cookie policy that discloses what you set. Consent Mode is one component of a compliant setup, not the whole of it.
How do I verify tags are actually blocked?
Open a private window with developer tools on the Application or Storage panel. Load the page without interacting with the banner. If any non-essential cookie appears, blocking has failed. Then grant one category and confirm only that category's cookies appear.
What happens to visitors who ignore the banner?
They stay in the denied default state, which is the correct behaviour: silence is not consent under GDPR. Do not treat scrolling or continued browsing as acceptance, as that has been explicitly rejected by EU regulators.
Privacy & Security
Local generation.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
SOC 2 Evidence Readiness
ComplianceInteractive checklist to gauge your SOC 2 evidence readiness.
Privacy Policy Checker
ComplianceCheck if your policy covers standard requirements (GDPR/CCPA basics).
Compliance Req Finder
ComplianceFind which standards (ISO, SOC2, HIPAA) apply to your industry/region.