Cookies & Consent (CMP)

A CMP (Consent Management Platform) is a cookie consent banner plus the machinery that actually blocks third-party scripts until the visitor clicks “Accept”. A bar at the bottom of the screen is not enough for the GDPR: before consent, analytics and advertising pixels must not run at all.

Our CMP works both on our storefront and on your own website — with the same code.

Where to configure it:

• Marketing → “My Website” → the “Cookies & Consent” card (for an external site);
• or Website → “Configure site” → the “Cookies & Consent (CMP)” section (for our storefront).

Turning it on#

1. Paste the install code from My Website — the cookie banner loads first among the widgets so that the other scripts see the decision already applied.
2. Switch the widget on.
3. Run the scanner so it collects the cookies your site actually sets.
4. Publish a “Cookie Policy” page or point to your existing one.

The banner detects the page language and shows itself in it — translations for 45 languages are built in.

What it costs#

The banner itself and tracker blocking are free on every plan — both on our storefront and on your own site. Legal compliance is not sold in pieces: 45 languages, auto-blocking, Consent Mode v2, the preference center and the hosted “Cookie Policy” page come with the platform.

Sold separately is the “Cookies Pro” level — the “Cookies and consent” card in the App Store, $9 per month or $90 per year per location. It is not access to the section but the scale of the service: deeper and more frequent site scans (including pages behind a login), a long consent log with proof export, your own per-country rules, full design control and per-language text overrides, and removal of the “Powered by Cenaly” badge. The current contents and price are on the card itself in the store.

AI labelling of unrecognised cookies is not part of the level and is not sold separately: it is available on any level, and each call is paid from the account’s AI balance. Brands hosted in Yandex Cloud (cenaly.ru) have no scanner and no consent log (see below), so that part of the level does not work there.

Categories and what is blocked before consent#

Four standard categories:

Until consent is given, scripts and iframes in these categories do not load: their addresses are matched against a built-in tracker registry, and you can add your own patterns. A blocked iframe (a YouTube video, for example) shows a placeholder with an “allow” link.

Consent signals are also passed to ad platforms: Google Consent Mode v2 (cookieless mode before consent), Microsoft UET, Meta (fbq) and the Clarity Consent API. Browser signals GPC and Do Not Track are respected.

Consent lifetime is configurable (365 days by default), after which the banner asks again. A refusal is remembered — we will not re-ask on every visit. You can also share consent across subdomains and link to a list of the sites it covers.

Per-country modes#

A mode is the behaviour of the banner before the visitor has pressed anything. It is chosen in this order:

1. your rule for the visitor's country (if you set one),
2. your default mode,
3. our built-in country map,
4. a browser-timezone heuristic.

The visitor's country is detected by IP. ⚠️ This selects the behaviour you configured; it is not a conclusion about which law applies to you.

Five modes#

Separately from the modes there is an add-on, “notice instead of a consent request”: you allow it, and if the scanner report proved that nothing outside the "necessary" category is present, the first layer informs instead of asking. It does not lift the blocking: if a new tracker appears, it stays blocked until the visitor allows it.

The built-in country map#

It applies when you have set neither a rule for the country nor your own default:

• opt-in — 32 countries: the 27 EU member states plus Iceland, Liechtenstein and Norway (together, the EEA), the United Kingdom and Switzerland;
• opt-out — the United States;
• every other country — no rule: your default mode applies, and if you have not set one, the browser-timezone heuristic does (Europe/* → opt-in, America/* → opt-out, otherwise opt-in). The safe default is opt-in.

⚠️ The map is our default setting, not a legal classification of countries. Countries where asking for consent is customary but which are not in the map (Türkiye, Russia, Brazil and dozens of others) fall under your default or under the heuristic. If a specific mode in a specific country matters to you, set it as a rule instead of relying on the map.

⚠️ IP-based country detection is not available everywhere. On brands hosted in Yandex Cloud (cenaly.ru) there is no geo endpoint, so the widget falls back to the timezone heuristic straight away — and that is coarser: a visitor from the EU travelling in the US gets America/* → opt-out. If that matters, set the default mode explicitly. For seven timezones the widget still infers the country (Moscow → RU, Istanbul → TR, Tbilisi → GE, Kyiv → UA, London → GB, Yerevan → AM, Tirana → AL): your rule for that country applies even when a default mode is set.

Where to configure it: the “Cookies and consent” card → gear → “Default consent mode” and “Per-country rules” (ISO-2 country code → mode).

What a mode does NOT do#

• it does not pick a jurisdiction for you — which mode to enable in which country is your decision (and your lawyer's);
• it does not change document texts: the set of legal pages and their wording is a separate tool with its own countries, see Legal documents;
• it does not cover mobile apps — this is a script for web pages;
• it does not produce an IAB Europe TCF string: if an ad partner requires a certified CMP from the TCF framework, our banner is not it. We pass consent signals directly — Google Consent Mode v2, Microsoft UET, Meta, Clarity.

Where the market's expectations come from#

⚖️ These are reference points, not legal advice, and not a statement that a given rule applies to you. We list the primary sources we rely on ourselves; check their currency and their applicability to your business with a lawyer.

There are more countries in the world than rows in this table: the list is deliberately incomplete — we list only what we use ourselves when configuring the product.

Appearance and texts#

• Layout: bar, card or modal; six position options along an edge or corner.
• Preference centre: expanded inside the card, or a sliding side panel.
• Per-element palette for light and dark themes, your logo, custom CSS (up to 10 KB).
• Button toggles: close “×”, “Reject all”, “Customise”. “Accept” cannot be hidden, and in opt-in mode the dashboard warns you about the risk of removing “Reject”.
• Categories can be shown as checkboxes on the banner's first layer.
• Any banner text can be overridden per language on top of our translations.
• The preview switches between desktop, tablet and mobile widths.
• A floating “Cookie settings” button (left/right/off) and a list of pages where the banner is not shown are configured separately.

Cookie scanner and Cookie Manager#

⚠️ There is no scanner on brands hosted in Yandex Cloud (cenaly.ru). There you keep the cookie list for the declaration by hand in the same table below — the policy page stays live — while the notice instead of a consent request and the AI labelling, which both rely on a scan report, are not available.

The scanner opens your site in a browser and collects the real cookies and third-party services:

• crawling via sitemap.xml and links from the starting pages, with a page limit;
• schedule: monthly or weekly, with the next scan date shown in the dashboard;
• scan history with a “new / disappeared cookies” diff;
• scanning behind a login — for account pages;
• an AI classifier: unknown cookies get a suggested category with an explanation, and you confirm or change it. Each call is paid from the account’s AI balance, on any level.

Cookie Manager is the table of all cookies by category: name, provider, retention, purpose. You can add your own entries and edit descriptions and translations. The same table feeds the banner's declaration and the policy page.

Don’t confuse the scanner with the public Site check page: that one needs no sign-in, but it only reads the source HTML of a single page — it shows trackers in the code, whether a consent banner is installed and whether our tag is there, and it cannot see real cookies or anything scripts load later in the browser. It is the “show me what my site is doing” magnet; the full declaration is built by the scanner above.

The “Cookie Policy” page#

The banner link points either to your existing page or to a document we generate and host: it is assembled from scan results, published in 45 languages and updated together with the declaration — so the cookie table on it is always current.

If you need the other legal pages too (privacy policy, terms, returns, delivery), see Legal documents.

Consent log and reports#

⚠️ On brands hosted in Yandex Cloud (cenaly.ru) the consent log is not collected yet: visitors’ decisions reach neither the log nor the trends nor the CSV export. Visitors still make their choice, and the banner still honours it.

The log is your proof of consent in case of an inspection:

• date, anonymous identifier, chosen categories, policy version, country and language;
• CSV export and export of a single record;
• trends: accepted / rejected / partial per day and per country;
• banner impression counter.

The “Re-collect consent” button bumps the policy version — after material changes the banner asks everyone again.

Install check and debugging#

• Check installation — we read the source HTML of your page and tell you whether the code is there. What this method cannot show (GTM, another page, an SPA) — “What the installation check does not see”.
• Send the code to a developer — an email with a ready snippet and instructions.
• Google Tag Manager guide — how to deploy the banner as a GTM tag.
• Debug mode: open your site with ?cenaly_consent_debug=1 and Consent Mode events (default/update) are logged to the console, so you can see exactly what Google and others receive.
• Consent Mode diagnostics — a check that the signals really reach your site's dataLayer.

Related topics#

• My Website — install code and the other widgets
• Legal documents — privacy policy, terms, returns
• Analytics — what you see after consent

FAQ#

Is the banner mandatory? That is a question for your lawyer rather than for us: it depends on where you operate, where your visitors come from and which scripts run on your site. On the product side the answer is this — our banner has five modes; by default strict opt-in is used in the 32 EEA countries, the UK and Switzerland, opt-out with “Do Not Sell” in the US, and elsewhere the behaviour is whatever you set. Reference points and primary sources are collected above, in Per-country modes.

Will the CMP block my own analytics? Before consent — yes, that is its job. Platform analytics keeps counting visits in the cookieless mode of Consent Mode v2.

What happens to old consents after I edit the policy? Nothing, until you press “Ask everyone again now” or republish the policy — then the version is bumped and the banner asks again.

Does this work if my site is not on your platform? Yes, that is the main scenario. One tag on any site.