The consent banner built for US health-data sites that aren't HIPAA-covered.
Washington's My Health My Data Act (MHMDA) and Nevada SB 370 require opt-in consent for consumer health data — including quiz answers, symptom data, and behavior that infers a health status. Generic CMPs don't handle this out of the box. CookieGuard does.
- Telehealth funnels and DTC pharma intake (including GLP-1 weight-loss flows)
- Mental health and behavioral apps marketing to consumers
- Fitness, nutrition, sleep, and recovery products with health claims
- Femtech, fertility, and reproductive-health services
- Symptom-checker quizzes and triage tools that profile users
A fifth consent category that is never pre-checked. Accept All never grants it. Reject All denies it. Audit logs record whether it was granted, when, and for which regulation.
Visitors from WA and NV automatically see the banner in explicit opt-in mode for the sensitive category — regardless of the site's default consent model.
Every consent decision writes mhmda_applies, nv_sb370_applies, and sensitive_granted columns. Unlimited retention on the Healthcare plan. Exportable for regulator response.
window.cookieguard.on('change', fn), getConsent(), and a cookieguard:consent DOM event. Works cleanly with @nuxt/scripts, Next.js, Astro, and other frameworks that load pixels on demand.
Pushes gtag('consent', 'default' | 'update', …) for Google. The JS API lets you gate Meta Pixel, Mixpanel, PostHog, Sentry, Everflow, and FirstPromoter when they load outside GTM.
We meter on monthly pageviews where the banner script loads — the same unit Iubenda and CookieYes use. No per-domain surprises, no per-event bills. Healthcare-tier traffic is scoped to your funnel.
Gate third-party scripts on consent without rewriting tag attributes. The same pattern works for GA4, Mixpanel, PostHog, Sentry, and affiliate pixels (Everflow, FirstPromoter).
// Anywhere in your app — e.g. plugins/cookieguard.client.ts
const init = (consent) => {
if (!consent) return
if (consent.categories.analytics) {
// GA4
useScript('https://www.googletagmanager.com/gtag/js?id=G-XXX')
}
if (consent.categories.marketing) {
// Meta Pixel
useScript('https://connect.facebook.net/en_US/fbevents.js')
}
}
// Drain queued handlers + listen for future changes
window.cookieguard = window.cookieguard || { q: [], on(...a) { this.q.push(['on', a]) } }
window.cookieguard.on('ready', init)
window.cookieguard.on('change', init)CookieGuard manages consent for cookies, pixels, and client-side tracking scripts. We push Google Consent Mode v2 signals, expose a JS API for direct-loaded pixels, and write server-normalized, exportable consent evidence for review and regulator response.
We do not gate server-side data flows, the contents of your quiz / form submissions, or data you share downstream with affiliates, CRMs, or warehouses. MHMDA and SB 370 apply to those flows too, and honoring them is your responsibility.
CookieGuard is not a DPO, not legal advice, and not HIPAA-certified. If you're a HIPAA covered entity or business associate, you need additional controls beyond a CMP.
Healthcare plan: custom-quoted, starting at $299/mo or $2,990/yr. Includes MHMDA & SB 370 controls, sensitive category, and exportable consent evidence. Final pricing depends on traffic and compliance scope.