Help centre

Enter your email address on the sign-in page and we send you a sign-in link. There is no password to create. The link works once and expires after 10 minutes. Your first sign-in creates your workspace, with you as its owner.

Yes, when the Google button is shown on the sign-in page. Otherwise sign in with the emailed link.

In the dashboard, choose Add site and enter the domain, for example example.com, plus an optional name. A leading "www." is removed. The new site starts with a default banner that asks for opt-in in the EEA, the UK, Switzerland, Brazil and Quebec, uses opt-out in the US, and shows a notice everywhere else. You can change all of this before you publish.

Copy the script tag from your site's Install page and paste it as the first tag inside the head of every page. Don't add async or defer to it. It has to run before any other script so it can hold back trackers until the visitor chooses. Then publish the banner and press Verify on the Install page.

The dashboard walks you through five steps. Publish the banner. Install it and pass the install check. Scan your cookies. Put every cookie in a category, so none are left as unknown. Then check Google Consent Mode until no checks fail.

A workspace can hold up to 50 sites. The Free plan covers one site per workspace. Other sites on Free can't be published or scanned until they have a paid plan. Agency covers 25 sites on one subscription.

Any website where you can add a script tag to the head. There are step-by-step guides for WordPress, Shopify, Wix, Webflow, Squarespace, Google Tag Manager and plain HTML on the Install guides page.

Yes. Each rule picks a consent model, opt-in, opt-out or notice, for a list of countries or regions such as US-CA, with a fallback rule for everyone else. Three presets work on every plan, global, strict opt-in everywhere and US opt-out everywhere. Your own custom rules need Starter or higher.

The banner uses the strictest rule, opt-in. Until the location is known, every optional category stays blocked.

Yes, on by default for every region rule. In an opt-out region, a browser that sends GPC has marketing turned off without the banner being shown, and the consent log records it as a GPC choice. You can switch this off per rule.

You can choose a box, a bar or a popup and where it sits, a modal or sidebar for the preferences panel, a light, dark, automatic or custom theme, the accent, background and text colours, and the corner radius. Every text can be rewritten, for each language.

Seven are built in, English, German, French, Spanish, Italian, Dutch and Portuguese. The banner uses the page's own language first, then the browser's, then your site's default. You can override any text in any language.

Yes, on Starter and higher. On Free the line stays on.

The banner script runs first and watches for scripts and iframes as the page loads, including ones added later by other scripts. Anything that matches a known tracker or one of your rules is held back until the visitor allows its category. For the strongest blocking, mark a tag yourself with type="text/plain" and data-cchq="analytics", "marketing" or "functional", so the browser never fetches it before consent.

A blocked iframe is replaced by a placeholder with a button to allow it and load it. Pressing it records the choice for that category.

Yes. You can add up to 500 rules, each matching part of a script or iframe address and assigning it to a category. Scans also suggest rules for third-party scripts they find.

365 days by default. In the banner editor, Ask again after (days) takes anything from 1 to 395 days. After that the visitor sees the banner again.

Yes. Turn on Share consent across subdomains in the site's Settings, so a choice made on your main domain also applies on its subdomains.

On Growth and higher you can run a second banner, variant B, against your live one. Variant B can change the layout, position, accent colour and texts, and you choose how traffic is split. The result is shown once each variant has 30 decisions. When you stop the test you can make B your live banner.

The banner and its tracker blocking never switch off. There are no overage fees and no automatic upgrade. You get an email, and the dashboard suggests a plan that fits your traffic.

All of them. Marketing controls ad_storage, ad_user_data and ad_personalization. Analytics controls analytics_storage. Functional controls functionality_storage and personalization_storage. security_storage is always granted. A default is set for each region before Google tags run, and an update is sent when the visitor chooses.

Advanced is the default. Google tags load straight away and follow the consent signals the banner sets. In basic mode the banner blocks Google tags completely until the visitor allows them. Which one fits depends on your own legal advice.

On Starter and higher, every scan checks four things. A consent default is set before Google tags run, all four v2 signals are present, no ad storage happens before consent, and an update is sent when the visitor accepts. It reads the consent parameters Google tags send with each hit.

Yes. Microsoft UET, Microsoft Clarity, Meta and HubSpot receive the visitor's choice through their own consent settings. These are on by default.

No to both. CookieConsentHQ is not a Google-certified CMP and doesn't support IAB TCF or GPP. If you serve Google ads to visitors in the EEA or UK and need a certified CMP, it isn't the right tool for that site yet.

Free scans up to 50 pages once a month. Starter scans up to 150 pages every week. Growth, Business and Agency scan up to 150 pages every day.

Yes, with Scan now on the site's Cookies page. After a scan you can start another one 24 hours later on Free, or one hour later on a paid plan.

It visits your pages as a new visitor who hasn't chosen anything, then again after accepting all cookies. It reports cookies set before consent, tracker tags written straight into the page, other consent tools on the page, a missing banner, and cookies it can't identify.

Each cookie is first looked up in our own database of known cookies. Only if it isn't there are its name and domain sent to Claude, from Anthropic, for a suggested category. No visitor data, cookie values or page content are sent. Names that don't look like real cookie names are never sent. You can change any category yourself.

On Growth and higher, yes. Each scan is compared with the last one, and the workspace owners get an email listing new cookies that aren't strictly necessary.

The checker at /check loads one page of any site as a first-time visitor and reports cookies set before consent, hardcoded tracker tags and Google Consent Mode defaults, with a grade from A to F. It needs no account. It allows a few checks per visitor each hour and reuses a recent result for the same site for 24 hours. It is a quick diagnostic, not an audit.

A consent ID, the time, the choice and categories, the banner version and A/B variant, the region rule, country and region, a shortened IP address, a hashed browser identifier, the page path and whether GPC was sent.

No. IPv4 addresses are shortened to the first three parts and IPv6 addresses to the first 48 bits before anything is stored. The full address never leaves our edge servers. The browser identifier is stored only as a hash, and page addresses are stored without query strings. This keeps less personal data, but the records are still personal data, not anonymous.

One year on Free, three years on Starter and five years on Growth, Business and Agency. If a paid plan ends, its longer retention keeps applying for 90 more days.

Yes, on every plan, as a CSV file with every record, newest first. Values that a spreadsheet could run as formulas are made safe in the export.

Your site can read the visitor's consent ID with CCHQ.getConsent()?.id, for example to save it with an order. Look that ID up in the Consents page of your dashboard to see the full record.

In a Postgres database in Frankfurt, Germany (Neon, on AWS eu-central-1). The dashboard runs in Frankfurt too. The banner script and the consent endpoint run on Cloudflare's network.

Records are only accepted from your site's registered domains, and each visitor network can send only a few records per site per minute. That limits fake records without affecting real visitors.

Free is $0 for 25,000 pageviews a month. Starter is $8 a month for 150,000. Growth is $18 for 750,000. Business is $39 for 5 million. Agency is $79 for 25 sites sharing 10 million pageviews. Each plan covers one site except Agency.

Yes. Paying yearly costs ten times the monthly price, so two months are free. For example Starter is $80 a year.

The banner samples one pageview in every hundred and the total is estimated from that, so the dashboard figure is an estimate, not an exact count.

Paddle.com is our merchant of record. It processes the payment, adds any sales tax or VAT at checkout and sends the invoice. Prices are in US dollars.

Yes, within 14 days of your first payment for a paid plan, monthly or yearly. Renewals aren't refunded, and partial periods aren't refunded when you cancel. The refund policy has the details.

Yes, from the Billing page. An upgrade or downgrade is charged or credited for the rest of the current period straight away. If you cancel, the plan stays active until the end of the period you paid for, then the site moves to Free.

Your sites, cookies and consent records stay. Features the new plan doesn't include stop. Custom region rules fall back to the global preset, a running A/B test stops but its results stay visible, and consent records keep the old plan's retention for 90 days.

Paddle retries the payment, and your paid features stay on while it does. If the subscription ends up cancelled, the site moves to Free.

Pageviews from every site on the Agency subscription are added together and compared with the 10 million allowance. New sites join the pool automatically while there are free places, up to 25 sites.

Yes, in Account, Security. You scan a code with an authenticator app and get backup codes, each of which works once. After that, every sign-in, including email links and Google, also asks for the 6-digit code. After 5 wrong codes in 15 minutes, code entry is locked for a while.

Yes. You get an email when your account is signed in to from a browser and network we haven't seen in the last 90 days. From the Account page you can also sign out every other session.

Yes. The workspace owner can invite people as Editors, who can change sites, or Viewers, who can only look. Invites expire after 7 days. The number of seats comes from your highest plan in the workspace, from 1 on Free up to 10 on Agency, and pending invites count as seats.

Yes. If you are invited to other workspaces you can switch between them from the dashboard menu.

On Mondays, workspace owners get a summary of each site's decisions and consent rate. Turn it off in Account, Emails, or with the unsubscribe link in the email itself. Security emails can't be turned off.

Email support@cookieconsenthq.com from the address you sign in with and we'll delete it. You can delete individual sites yourself from each site's Settings page, which also unpublishes the banner.

It gives you the tools, a banner that blocks trackers until consent, region rules, Consent Mode and a consent log, but no tool can make a site compliant on its own, and nothing here is legal advice. How you configure it, and what your site does, decide that. Check your setup with your own legal adviser.

Yes. The DPA is part of our Terms, so it applies as soon as you use the service. It includes the EU Standard Contractual Clauses and a 72-hour breach notice. You can read it on the legal pages.

Cloudflare, Vercel, Neon, Paddle, Resend for email, and Anthropic for classifying unknown cookie names. The DPA lists each one with what it does and where, and we give 30 days' notice before adding a new one.

No. CookieConsentHQ holds neither certification and has no bug bounty program. The security page explains how the service is protected. Send security reports to support@cookieconsenthq.com.

Necessary cookies for signing in and security, the banner's own cookie that stores your choice, and Google Analytics only if you allow analytics. The privacy policy lists them.

Yes. Download the plugin ZIP from your site's Install page, upload it under Plugins, Add New, Upload Plugin, then paste your snippet in Settings, CookieConsentHQ. It needs WordPress 6.0 or newer and PHP 7.4 or newer. It adds the banner script before everything else in the page head and tells caching and optimisation plugins not to delay it.

Yes. The plugin registers with the WP Consent API, and the banner reports the visitor's choice for functional, preferences, statistics and marketing, so plugins that read the API respect it.

Yes. On WordPress, add the [cchq_cookie_table] shortcode to the page and the banner fills it with your site's cookies.

Yes, with our Consent Mode template, imported into your container and fired on the Consent Initialization trigger. Loaded that way, the banner can only hold back tags inside GTM, so tags hardcoded in your pages aren't blocked. Load the banner one way only, either the script tag or GTM.

Yes, with one script tag in your theme. The visitor's choice is also passed to Shopify's Customer Privacy API. The banner doesn't run on Shopify's checkout pages.

On Wix, trackers added through Wix's own marketing integrations can't be blocked by any script. Squarespace needs a Core, Plus or Advanced plan for code injection, and checkout pages don't run it. On Webflow the code goes before the closing head tag, so make sure nothing else loads before it. The install guides cover each step.

The script that runs on every page is small, with a size budget of 5,250 bytes compressed, and is served from Cloudflare's network. The banner's interface loads only when there is something to show.