# CookieGuard

> Consent management platform with configurable, jurisdiction-scoped controls that support privacy compliance, plus Healthcare-plan controls for MHMDA and Nevada SB 370.

CookieGuard is a SaaS platform that provides configurable cookie-consent controls for websites subject to privacy regulations. It is designed for website owners, digital agencies, and e-commerce businesses that need to collect, enforce, and document visitor choices. The core differentiator is flat-rate pricing per visitor tier — unlike tools such as Cookiebot that charge per domain, CookieGuard includes multiple websites within a single plan price.

The platform uses maintained, location-scoped rules to choose consent behavior. These controls support, but do not certify, a customer's compliance program. MHMDA and Nevada SB 370 are available on the Healthcare plan and add a sensitive / health-data category with explicit opt-in for eligible WA and NV requests.

## Product Overview

CookieGuard supports the cookie-consent lifecycle: scanning for cookies, displaying a configurable consent banner, recording normalized decisions, and allowing visitors to update or withdraw their preferences.

Key capabilities:

- **Jurisdiction-scoped controls** — maintained mappings for 12 country/state consent regimes, plus Healthcare-plan controls for Washington MHMDA and Nevada health-data requirements. These controls support but do not certify compliance.
- **Sensitive / health-data category** — separate consent category that is never pre-checked and is required by MHMDA (Washington) and Nevada SB 370. Available on the Healthcare plan.
- **Public JS API** — `window.cookieguard.on('change'|'ready', fn)`, `getConsent()`, and a `cookieguard:consent` DOM event for dynamic script loaders such as `@nuxt/scripts`.
- **Cookie scanning** — automatic detection of cookies present on a website for complete transparency and accurate categorization.
- **Customizable consent banners** — design and style banners to match brand identity using a built-in editor. All paid plans include advanced customization.
- **Consent analytics** — track opt-in and opt-out rates, banner interactions, and consent trends across your domains.
- **Consent records and audit logs** — server-normalized, exportable decision history with banner, policy, region, signal, and category evidence, subject to client-delivery limitations.
- **Multi-user access and roles** — team permissions management across organizational accounts, available on Enterprise plans.
- **Multi-site management** — manage multiple domains from a single dashboard without separate logins or per-domain billing surprises.
- **Re-consent** — automatically prompt visitors to re-consent when your cookie policy changes.

## Pricing

All prices are in USD. Paid plans include a 14-day free trial. Annual billing saves up to 20%.

### Basic — Free (forever)
- 1 website
- 1 consent banner per site
- Up to 2,000 monthly pageviews
- All global regulations included (GDPR, CCPA, LGPD, and 8 more)
- Customizable banner
- Free forever, no credit card required

### Essential — $8/month (or $88/year)
- 1 website
- 2 consent banners per site
- Up to 10,000 monthly pageviews
- All global regulations included
- Advanced customization
- Priority support
- 14-day free trial

### Professional — $18/month (or $180/year) — Most Popular
- 3 websites
- 3 consent banners per site
- Up to 30,000 monthly pageviews
- All global regulations included
- Advanced customization
- Priority support
- 14-day free trial

### Enterprise — $68/month (or $680/year)
- 10 websites
- 3 consent banners per site
- Up to 100,000 monthly pageviews
- All global regulations included
- Advanced customization
- Dedicated support
- Consent records and audit logs
- Multi-user access and roles
- 14-day free trial

### Healthcare — custom-quoted, from $299/month (or $2,990/year)
- 3 websites
- 3 consent banners per site
- Up to 50,000 monthly pageviews
- MHMDA (Washington) + Nevada SB 370 support
- Sensitive / health-data consent category, opt-in only, never pre-checked
- Forced explicit consent mode for WA / NV visitors regardless of site default
- Server-normalized, exportable consent evidence with unlimited retention (`mhmda_applies`, `nv_sb370_applies`, `sensitive_granted` columns)
- For telehealth funnels, DTC pharma, mental-health apps, fitness with health claims, and femtech that are not HIPAA-covered
- Contact for a tailored quote (custom traffic volumes and compliance scope available)

### Custom / High-Volume — contact for quote
- Custom visitor volume — 200k, 500k, or millions per month
- Unlimited or high domain count
- Configurable, jurisdiction-scoped consent controls
- Consent records and audit logs
- Multi-user access and roles
- Dedicated onboarding and support
- SLA-backed uptime
- Flat-rate quote, no per-domain surprises

## Supported Privacy Regulations

CookieGuard covers all of the following on every plan, including the free tier. Banners automatically adapt to the visitor's location.

### EU and UK
- **GDPR** (General Data Protection Regulation) — European Union, 2018. Requires explicit opt-in consent before setting non-essential cookies. Granular consent categories required. Equal prominence for Accept and Reject. Fines up to €20M or 4% of global revenue.
- **UK GDPR and ePrivacy Directive** — United Kingdom, post-Brexit. Similar to EU GDPR, enforced by the ICO. Explicit consent required for cookies.

### Americas
- **CCPA/CPRA** (California Consumer Privacy Act / California Privacy Rights Act) — California, USA, 2020/2023. Opt-out model. Requires "Do Not Sell My Personal Information" link. Rights to access, delete, and correct personal data. Fines $2,500–$7,500 per violation.
- **LGPD** (Lei Geral de Proteção de Dados) — Brazil, 2020. GDPR-inspired. Explicit consent required. Data subject rights: access, deletion, portability. Fines up to 2% of Brazil revenue (max R$50M).
- **PIPEDA** (Personal Information Protection and Electronic Documents Act) — Canada. Consent required for collection, use, and disclosure of personal information.

### Asia-Pacific and Others
- **PIPL** (Personal Information Protection Law) — China, 2021. GDPR-like framework with Chinese regulatory characteristics.
- **PDPA** (Personal Data Protection Act) — Singapore (2012) and Thailand (2019). Consent and purpose limitation. Data breach notification. Rights to access and correct.
- **POPIA** (Protection of Personal Information Act) — South Africa, 2020. Eight conditions for lawful processing. Fines up to R10M or imprisonment.
- **DPDP / DPDPA** (Digital Personal Data Protection Act) — India, 2023. India's first comprehensive data protection framework.
- **PIPA** — South Korea. Personal information protection law.
- **Privacy Act / APPs** (Australian Privacy Principles) — Australia. Strengthened privacy protections.
- **APPI** (Act on Protection of Personal Information) — Japan. Amended 2020 with mandatory breach notifications and stronger data subject rights.

## Consent API & Integrations (for developers)

This section is for engineers wiring third-party scripts, tag managers, or analytics tools to respond to CookieGuard consent. The reference page with copy-paste recipes is https://cookieguard.co/docs/integrations.

### Consent categories

CookieGuard groups cookies/scripts into five categories. A consent decision is an object with a boolean per category:

| Category | Key | Default before decision | Notes |
|---|---|---|---|
| Strictly necessary | `necessary` | always `true` | Cannot be disabled by the visitor. |
| Preferences / functionality | `preferences` | `false` under GDPR (opt-in), `true` under opt-out regimes | |
| Analytics | `analytics` | same as above | Gate GA4, Mixpanel, PostHog, etc. |
| Marketing / advertising | `marketing` | same as above | Gate ad pixels, Meta Pixel, affiliate pixels. |
| Sensitive / health data | `sensitive` | always `false` | Never pre-checked. Only present on the Healthcare plan when MHMDA or Nevada SB 370 is enabled; forced explicit opt-in for WA/NV visitors. |

Whether a brand-new visitor starts opt-in (`false`) or opt-out (`true`) for the non-necessary categories depends on the visitor's region and the site's enabled regulations. GDPR-style regions default everything except `necessary` to denied until the visitor accepts.

### The consent object

Every API surface below hands you the same shape:

```js
{
  decisionId: "uuid",
  action: "customize",
  categories: {
    necessary: true,
    preferences: false,
    analytics: false,
    marketing: false,
    sensitive: false
  },
  decidedAt: "2026-08-23T12:00:00.000Z",
  bannerId: "uuid",
  bannerVersion: "version"
}
```

It is persisted in a first-party cookie named `cookieguard_consent` (JSON). `getConsent()` returns `null` until the visitor has made a decision.

### Public JavaScript API

CookieGuard exposes `window.cookieguard`. It is safe to queue handlers before the script loads using the standard async stub — queued calls are drained on load:

```js
// Place this before the cookieguard <script> tag, e.g. in <head>:
window.cookieguard = window.cookieguard || { q: [], on(...a) { this.q.push(['on', a]) } }
```

Methods and events:

- `cookieguard.on('ready', fn)` — fires once when consent state is settled (existing decision loaded, or banner shown to a new visitor). `fn` receives the consent object or `null`. If `ready` already fired, a newly-attached handler is replayed immediately.
- `cookieguard.on('change', fn)` — fires on every consent change (accept, reject, customize, GPC opt-out, reset). `fn` receives the new consent object.
- `cookieguard.off('ready'|'change', fn)` — remove a handler.
- `cookieguard.getConsent()` — returns the current consent object, or `null` if no decision yet.
- `cookieguard.openPreferences()` — opens the preferences/customize modal (wire this to a "Manage cookies" / "Cookie settings" link).
- `cookieguard.reset(options?)` — clears the stored decision, applies denied signals, notifies listeners/DOM events with `null`, records reset, and reloads only when configured or requested.
- `cookieguard.registerIntegration(category, { grant, revoke })` — registers isolated, idempotent vendor lifecycle callbacks.
- `cookieguard.activateTaggedScripts()` — reruns activation for currently eligible tagged scripts.
- `cookieguard.diagnostics()` — returns privacy-safe runtime, rule, Google-ordering, tagged-script, and audit-delivery state.
- DOM event: `document.addEventListener('cookieguard:consent', (e) => { /* e.detail is the consent object */ })` — dispatched on every change. Preferred by some frameworks.
- Back-compat: assigning `window.cookieguard.onConsent = fn` also works; it is called with the consent object on every change.

Minimal example — gate a script on consent:

```js
window.cookieguard = window.cookieguard || { q: [], on(...a) { this.q.push(['on', a]) } }
window.cookieguard.on('change', (decision) => {
  if (decision?.categories.analytics) loadAnalytics()
  if (decision?.categories.marketing) loadAdPixels()
})
```

### Google Consent Mode v2 (recommended for GA4 / Google Ads / GTM)

Enable it in the dashboard: **Settings → Integration → Google Consent Mode**. When enabled, CookieGuard talks to `gtag`/`dataLayer` for you and maps categories to Consent Mode signals:

```js
// Pushed by CookieGuard once a decision is made:
gtag('consent', 'update', {
  analytics_storage:       decision.categories.analytics   ? 'granted' : 'denied',
  ad_storage:              decision.categories.marketing   ? 'granted' : 'denied',
  ad_user_data:            decision.categories.marketing   ? 'granted' : 'denied',
  ad_personalization:      decision.categories.marketing   ? 'granted' : 'denied',
  functionality_storage:   decision.categories.preferences ? 'granted' : 'denied',
  personalization_storage: decision.categories.preferences ? 'granted' : 'denied',
})
```

CookieGuard's site-specific parser-blocking bootstrap pushes the default-denied state (with `security_storage: 'granted'` and `wait_for_update: 500`) before it loads the runtime. Install it as the first script in `<head>`; the runtime sends updates for decisions and returning consent:

```html
<!-- First thing in head, before GTM/gtag/GA4/Ads -->
<script src="https://cookieguard.co/api/v1/bootstrap/YOUR_SITE_ID?key=YOUR_PUBLISHABLE_SITE_KEY&language=auto"></script>
```

With the Google Consent Mode setting enabled, CookieGuard will then push the matching `update` when the visitor decides. You do not need to write the `update` call yourself. In GTM, also set your tags to honor consent (Tag → Consent Settings).

### Tagged Script Blocking (data attributes)

Enable **Settings → Advanced → Tagged Script Blocking**. Then deliberately mark a `<script>` you want gated by changing its `type` to `text/plain` and adding `data-cookieguard="<category>"`. CookieGuard does not discover or block untagged scripts:

```html
<script type="text/plain" data-cookieguard="analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
<script type="text/plain" data-cookieguard="marketing">
  /* inline marketing snippet */
</script>
```

When the visitor grants that category, CookieGuard activates the script (it re-inserts it as a live `<script>`). Use `analytics`, `marketing`, or `preferences` as the category value; necessary scripts should load normally. (Re-blocking on revocation happens on the next page load.)

### Vendor recipes (summary)

- **GA4 / Google Ads / GTM** — use Google Consent Mode v2 (above).
- **Meta Pixel (direct)** — initialize `fbq` inside an `on('change')` handler gated on `decision.categories.marketing`. For health-data visitors (MHMDA / NV SB 370) without `decision.categories.sensitive` consent, also call `fbq('dataProcessingOptions', ['LDU'], 1, 1000)`.
- **Mixpanel / PostHog** — use their built-in opt-in/opt-out APIs (`mixpanel.opt_in_tracking()` / `opt_out_tracking()`, `posthog.opt_in_capturing()` / `opt_out_capturing()`) inside `on('change')` gated on `decision.categories.analytics`.
- **Sentry** — usually classified `necessary`; if breadcrumbs capture PII, gate it under `analytics` via `beforeSend` reading `cookieguard.getConsent()`.
- **Affiliate pixels (Everflow, FirstPromoter)** — gate under `marketing`. Attribution intentionally breaks for visitors who reject marketing.
- **Nuxt 3 / dynamic loaders (`@nuxt/scripts`)** — call `useScript(...)` inside `on('ready')` and `on('change')` handlers, branching on the consent object.

Full copy-paste versions of every recipe: https://cookieguard.co/docs/integrations

## Platform Integrations

CookieGuard installs via a single JavaScript snippet that works with direct script installs, storefront themes, CMS templates, and custom-built sites.

Supported platforms:
- Shopify
- WordPress
- WooCommerce
- Webflow
- Wix
- Squarespace
- BigCommerce
- Magento
- Any custom HTML/JavaScript site

## CookieGuard vs Cookiebot

CookieGuard is a direct alternative to Cookiebot with key differences:

| Feature | CookieGuard | Cookiebot |
|---|---|---|
| Starting price | Free (permanent) | Free (limited to 50 subpages) |
| Paid plans from | $8/month | ~$16/domain/month |
| 10 domains | $68/month (Enterprise plan) | $160+/month |
| Pricing model | Flat-rate per visitor tier | Per-domain, session-based |
| Jurisdiction-scoped consent controls | All plans including free | Varies by plan |
| Customizable banners | All paid plans | Premium plans only |
| Predictable billing | No per-domain charges | Documented complaints about automatic tier upgrades |

Primary reasons users switch from Cookiebot to CookieGuard:
1. Predictable flat-rate pricing — no per-domain billing, no session counting surprises
2. Jurisdiction-scoped consent controls on every plan
3. Multi-site support — agencies managing 10 client sites pay $68/month total, not per domain
4. Support that scales — Enterprise customers get dedicated support, not a ticket queue

## Who CookieGuard Is For

- **Individual website owners** who want compliance without complexity
- **Digital agencies** managing consent across multiple client sites
- **E-commerce brands** on Shopify, WooCommerce, BigCommerce, or Magento
- **High-traffic websites** requiring custom volume plans and SLA agreements
- **Organizations with multi-jurisdiction requirements** — operating across EU, US, Brazil, India, China, and more simultaneously

## How to Get Started

1. Sign up at https://cookieguard.co/signup — free plan available, no credit card required
2. Add your website domain in the dashboard
3. Install the CookieGuard script on your site (one line of JavaScript)
4. Configure your banner appearance and regulation settings
5. Go live — validate that visitors receive the configured location-scoped consent controls and that every optional tag is gated

For enterprise or migration inquiries, contact the team at https://cookieguard.co/contact. Custom quotes are typically scoped within one business day.

## Key URLs

- Homepage: https://cookieguard.co/
- Sign up: https://cookieguard.co/signup
- Pricing: https://cookieguard.co/#pricing
- Cookiebot alternative: https://cookieguard.co/cookiebot-alternative
- Enterprise: https://cookieguard.co/enterprise
- Regulations guide: https://cookieguard.co/regulations
- Contact: https://cookieguard.co/contact