The differentiator
We ask first. That is not a policy — it is where the code stops.
Any vendor can write a paragraph about respecting privacy. The question worth asking is whether their script can run before the visitor is asked. Ours cannot.
Why the timing is the whole argument
The website-tracking litigation wave is not primarily about what was collected. It is about when. In Javier v. Assurance IQ, the Ninth Circuit held that California Penal Code § 631(a) requires prior consent, and that consent obtained after the fact does not cure a prior interception.
That holding makes architecture matter more than policy. A privacy policy that discloses tracking, on a page whose trackers already fired before anyone read it, does not fit the requirement the court described. Which is why "consent-first" here means a control in the pipeline, not a sentence in a document.
A second line of cases advances a "pen register" theory under § 638.51 — that scripts collecting IP addresses and similar routing information can qualify as pen registers, and that the service-provider exception is a question of fact rather than an automatic defense. We cover both, with the appropriate caution about docket dates, on CIPA & website tracking.
The commitments
Six things we will not build
We never fire before consent
Not on a reduced-fidelity path, not to hold an anonymous profile in case they say yes later, not in a state you believe exempts you. The identification logic cannot execute until the gate opens.
We never treat silence as consent
A visitor who ignores the banner is a visitor who declined. Undecided is denied, and there is no setting that changes it.
We never buy or rent a list to backfill
Everything we hand you came from someone who visited your site and said yes. If you want purchased data, that is a different vendor.
We never sell supporter data
There is no data broker relationship, no cooperative, no second market. Your supporters are yours, and there is nothing to opt out of because there is nothing being shared.
We never send an ad conversion for a declined visitor
Even with an ad platform connected, no event is generated for a visitor who denied ad consent. This is the one place we will not build a configuration option.
We never make an unconsented number textable
A phone number on a supporter record is a phone number. Consent to be texted is a separate field, collected separately, or it does not exist.
The honest cost of all six: we identify fewer visitors than a vendor who fires first and asks later. If you are comparing proposals on identified-visitor count alone, we lose. We would rather say that here than have you discover it in a bake-off.
Signals we consume
Your consent platform is the source of truth. We just obey it.
We do not maintain a competing record of what a visitor agreed to. We read your consent management platform's own state, normalize it into one internal object, and gate on that. If your CMP is silent, we treat it as denied.
The audit trail
Four fields, on every record, in every export, in every push:
consentTimestamp— ISO 8601, UTC, the moment of the affirmative act.consentVersion— the version string of the language in force at that moment.consentSource— the exact page URL where consent was captured.consentCategories— the categories granted, normalized from your CMP.
There is no configuration that strips them. When someone asks where a name came from, the answer is a row with a date on it.
We run this on our own site
The banner at the bottom of this page is real. Decline it and this site loads no analytics at all — not a reduced version, none. Your choice is stored in a first-party cookie with the categories, a timestamp and a policy version, which is the same record shape we build for our customers' supporters.
Open the network tab and check. A vendor selling consent infrastructure who does not practice it on their own marketing site is telling you something.
The integration layer
Works with your stack
53 platforms across eight categories, each carrying an honest status label — including the ones that say "coming soon" and "partner-only."
Text wordmarks only — we do not display partner logos without written permission, and a badge here never implies an endorsement or a native connector. The status on each partner page is the claim; this wall is just the map. Not seeing yours? Request an integration.
Questions people actually ask
How do I verify the gate actually holds?
Open a private window, decline consent, reload the page and watch the network tab. There should be no request to our infrastructure. Then accept and confirm one appears. Do this after every significant site change — this is exactly the kind of thing that regresses when somebody reorders scripts.
What counts as 'granted'?
The consent categories you configured as required, reported as granted by your consent management platform. By default that is marketing. We will not run on functional or strictly-necessary consent alone.
What happens when someone withdraws consent?
Your CMP emits an update event, we re-read state immediately and stop. A consent-revoked event is written to the supporter record and a suppression signal is sent to destinations that support one. We cannot delete what is already inside your CRM — that is your controller-side action, and our docs name the field to filter on.
Does this work with server-side rendering and page caching?
Yes, and it is a real concern. On WordPress our plugin reads the WP Consent API state server-side as well as client-side, so a cached page cannot serve a consented state to an unconsented visitor.
Does consent carry across our subdomains?
No. Consent state does not travel across domains. Your donate subdomain and your ad landing pages each need their own correct implementation, and each produces its own records.
See what your own website already knows.
Book a 20-minute walkthrough. We will look at your site's current consent posture first — that part is useful whether or not you buy anything.