What free usually means for consent tools
Search for a free cookie consent tool and you will find a lot of hosted platforms with a free plan. The plan is real, but it tends to come with a cap on monthly visits, a link to the vendor in your banner, a scan limited to a few pages or a missing feature that turns out to be the one regulators care about. The script is also loaded from their servers, which means one more third party on every page and a dependency on their uptime.
cookieowl takes a different trade. It is a library, not a service: one file you load from a public CDN or host yourself, with every feature in it, under the MIT license. There is no dashboard and no account, and nothing to pay as your traffic grows.
What a consent script has to do
Whatever you pick, these are the parts that matter, roughly in the order regulators check them:
- Block before consent. Analytics, advertising and embeds must not run until their category is accepted.
- Offer a real choice. Accept and Reject with equal weight on the first screen, plus a choice per purpose.
- Make withdrawal easy. A link or button on every page that reopens the choices, and cleanup when consent is withdrawn.
- Keep proof. A record of when and to what the visitor agreed, tied to a policy version.
- Talk to Google tags. Consent Mode v2 if you use Google Analytics or Ads.
- Be usable. Keyboard and screen reader support, the visitor's language and no layout that hides content.
cookieowl does all six, and you can check each one in the live demo with its network monitor.
The whole setup
Paste one tag at the top of the head of every page. It is pinned to a version, so the file never changes under you:
<script src="https://cdn.jsdelivr.net/npm/cookieowl@0.1.0/dist/cookieowl.js"
data-lang="auto"
data-policy-url="/privacy"
data-consent-mode
data-auto-block></script>Then mark the trackers you control so they wait for their category:
<script type="text/plain" data-cookieowl="analytics" src="/js/analytics.js"></script>
<script type="text/plain" data-cookieowl="marketing" src="https://ads.example.com/pixel.js"></script>
<iframe data-cookieowl="marketing" data-cookieowl-src="https://player.vimeo.com/video/123" title="Video"></iframe>Prefer npm? npm install cookieowl gives you ES modules, CommonJS, TypeScript types and the React and Vue helpers. You can also copy dist/cookieowl.js into your own static files to avoid any third party request at all.
Small enough to load first
A consent script has to run before every tracker, synchronously, which makes its size part of your page speed. cookieowl is one file of about 15 kB with gzip, including the banner, the preferences dialog, the stylesheet, five languages, the blocker and Consent Mode. It has no dependencies, loads no fonts or images and makes no requests of its own. The size is checked on every build, and the build fails if it grows past the budget.
npm run buildWhat it does not do
Being honest about limits is part of being free. cookieowl does not scan your site for cookies; you list your services, and auto mode knows the common trackers. It does not store consent on a server; the onConsent hook lets you log records yourself. It does not implement the IAB Transparency and Consent Framework, which programmatic ad publishers may need. And it does not give legal advice: it gives you the mechanics that LGPD and GDPR guidance describes, and your counsel decides the rest.
Questions
Is cookieowl really free?
Yes. It is open source under the MIT license: free for personal and commercial sites, with no account, no page view limit, no branding requirement and no paid tier.
Where is the data stored?
Only in the visitor's browser, in a first party cookie on your domain. cookieowl has no server and sends nothing anywhere. If you want a central log, the onConsent callback hands each record to your own endpoint.
Does it include a cookie scanner?
No. You declare your categories, services and cookies yourself, and auto mode recognizes the most common trackers. Scanning tools and your browser developer tools help you build the list.
Does it support the IAB TCF?
No. cookieowl does not implement the IAB Transparency and Consent Framework, so it is not a fit for publishers that need TCF strings for programmatic advertising. It does support Google Consent Mode v2.
Keep reading
Chapter IIA cookie consent banner for the LGPD, in Portuguese, that really blocksAdd an LGPD cookie banner in Portuguese that blocks trackers before consent, follows the ANPD cookie guide and lets visitors revoke consent at any time.8 min read
Chapter IIIWhat makes a cookie banner GDPR compliantWhat makes a cookie banner GDPR compliant: prior blocking, Reject on the first layer, no pre-ticked boxes, easy withdrawal and proof. With a free, open source setup.9 min read
Chapter VICookie consent in React, without a provider mazeAdd cookie consent to a React app: start cookieowl early, render embeds and analytics with ConsentGate, read choices with the useConsent hook, and block trackers.7 min read