# CookieGuard

> Consent management platform with configurable, jurisdiction-scoped controls that support privacy compliance, plus Healthcare-plan controls for MHMDA and Nevada SB 370.

CookieGuard is a SaaS platform that provides configurable cookie-consent controls for websites subject to privacy regulations. It is designed for website owners, digital agencies, and e-commerce businesses that need to collect, enforce, and document visitor choices. The core differentiator is flat-rate pricing per visitor tier — unlike tools such as Cookiebot that charge per domain, CookieGuard includes multiple websites within a single plan price.

The platform uses maintained, location-scoped rules to choose consent behavior. These controls support, but do not certify, a customer's compliance program. MHMDA and Nevada SB 370 are available on the Healthcare plan and add a sensitive / health-data category with explicit opt-in for eligible WA and NV requests.

## Product Overview

CookieGuard supports the cookie-consent lifecycle: scanning for cookies, displaying a configurable consent banner, recording normalized decisions, and allowing visitors to update or withdraw their preferences.

Key capabilities:

- **Jurisdiction-scoped controls** — maintained mappings for 12 country/state consent regimes, plus Healthcare-plan controls for Washington MHMDA and Nevada health-data requirements. These controls support but do not certify compliance.
- **Health-data categories** — separate, never-prechecked choices to collect health data (`sensitive`) and to share it with partners (`sensitive_sharing`, which needs `sensitive`), for sites subject to Washington MHMDA, Nevada SB 370 or Connecticut's CTDPA health-data rules. Where health rules apply, marketing can only be granted with the sharing choice (and optionally analytics with the collection choice). Available on the Healthcare plan.
- **Public JS API** — `window.cookieguard.on('change'|'ready', fn)`, `getConsent()`, and a `cookieguard:consent` DOM event for dynamic script loaders such as `@nuxt/scripts`.
- **Cookie scanning** — automatic detection of cookies present on a website for complete transparency and accurate categorization.
- **Customizable consent banners** — design and style banners to match brand identity using a built-in editor. All paid plans include advanced customization.
- **Consent analytics** — track opt-in and opt-out rates, banner interactions, and consent trends across your domains.
- **Consent records and audit logs** — server-normalized, exportable decision history with banner, policy, region, signal, and category evidence, subject to client-delivery limitations.
- **Multi-site management** — manage multiple domains from a single dashboard without separate logins or per-domain billing surprises.
- **Re-consent** — automatically prompt visitors to re-consent when your cookie policy changes.

## Pricing

All prices are in USD. Paid plans include a 14-day free trial. Annual billing saves up to 20%.

### Basic — Free (forever)
- 1 website
- 1 consent banner per site
- Up to 2,000 monthly pageviews
- All global regulations included (GDPR, CCPA, LGPD, and 8 more)
- Customizable banner
- Free forever, no credit card required

### Essential — $8/month (or $88/year)
- 1 website
- 2 consent banners per site
- Up to 10,000 monthly pageviews
- All global regulations included
- Advanced customization
- Priority support
- 14-day free trial

### Professional — $18/month (or $180/year) — Most Popular
- 3 websites
- 3 consent banners per site
- Up to 30,000 monthly pageviews
- All global regulations included
- Advanced customization
- Priority support
- 14-day free trial

### Enterprise — $68/month (or $680/year)
- 10 websites
- 3 consent banners per site
- Up to 100,000 monthly pageviews
- All global regulations included
- Advanced customization
- Dedicated support
- Consent records and audit logs
- 14-day free trial

### Healthcare — custom-quoted, from $89/month (or $890/year)
- 1 website (more by quote)
- 3 consent banners per site
- Up to 100,000 monthly pageviews (higher limits by quote)
- Washington MHMDA, Nevada SB 370 and Connecticut (CTDPA) health-data rules, switched on per site
- Separate health-data choices: collect (`sensitive`) and share with partners (`sensitive_sharing`), opt-in only, never pre-checked
- Opt-in banner for visitors where health rules apply: WA / NV / CT visitors, optionally all US visitors or everyone, and visitors whose location is unknown
- Health-data mode: marketing can only be granted with consent to share health data (and optionally analytics with consent to collect it), so Accept All doesn't start ad tracking or grant Google ad signals
- A Consumer Health Data Privacy Policy link shown where health rules apply
- Server-normalized, exportable consent records (`mhmda_applies`, `nv_sb370_applies`, `ct_health_applies`, `sensitive_granted`, `sensitive_sharing_granted` columns), kept while the site is active
- For telehealth funnels, DTC pharma, mental-health services, fitness with health claims, and femtech that are not HIPAA-covered. CookieGuard does not sign BAAs.
- Contact for a tailored quote (custom traffic volumes and compliance scope available)

### Custom / High-Volume — contact for quote
- Custom visitor volume — 200k, 500k, or millions per month
- Unlimited or high domain count
- Configurable, jurisdiction-scoped consent controls
- Consent records and audit logs
- Dedicated onboarding and support
- SLA-backed uptime
- Flat-rate quote, no per-domain surprises

## Supported Privacy Regulations

CookieGuard covers all of the following on every plan, including the free tier. Banners automatically adapt to the visitor's location.

### EU and UK
- **GDPR** (General Data Protection Regulation) — European Union, 2018. Requires explicit opt-in consent before setting non-essential cookies. Granular consent categories required. Equal prominence for Accept and Reject. Fines up to €20M or 4% of global revenue.
- **UK GDPR and ePrivacy Directive** — United Kingdom, post-Brexit. Similar to EU GDPR, enforced by the ICO. Explicit consent required for cookies.

### Americas
- **CCPA/CPRA** (California Consumer Privacy Act / California Privacy Rights Act) — California, USA, 2020/2023. Opt-out model. Requires "Do Not Sell My Personal Information" link. Rights to access, delete, and correct personal data. Fines $2,500–$7,500 per violation.
- **LGPD** (Lei Geral de Proteção de Dados) — Brazil, 2020. GDPR-inspired. Explicit consent required. Data subject rights: access, deletion, portability. Fines up to 2% of Brazil revenue (max R$50M).
- **PIPEDA** (Personal Information Protection and Electronic Documents Act) — Canada. Consent required for collection, use, and disclosure of personal information.

### Asia-Pacific and Others
- **PIPL** (Personal Information Protection Law) — China, 2021. GDPR-like framework with Chinese regulatory characteristics.
- **PDPA** (Personal Data Protection Act) — Singapore (2012) and Thailand (2019). Consent and purpose limitation. Data breach notification. Rights to access and correct.
- **POPIA** (Protection of Personal Information Act) — South Africa, 2020. Eight conditions for lawful processing. Fines up to R10M or imprisonment.
- **DPDP / DPDPA** (Digital Personal Data Protection Act) — India, 2023. India's first comprehensive data protection framework.
- **PIPA** — South Korea. Personal information protection law.
- **Privacy Act / APPs** (Australian Privacy Principles) — Australia. Strengthened privacy protections.
- **APPI** (Act on Protection of Personal Information) — Japan. Amended 2020 with mandatory breach notifications and stronger data subject rights.

## Consent API & Integrations (for developers)

This section is for engineers wiring third-party scripts, tag managers, or analytics tools to respond to CookieGuard consent. The reference page with copy-paste recipes is https://cookieguard.co/docs/integrations.

### Consent categories

CookieGuard groups cookies/scripts into six categories (two of them Healthcare-only). A consent decision is an object with a boolean per category:

| Category | Key | Default before decision | Notes |
|---|---|---|---|
| Strictly necessary | `necessary` | always `true` | Cannot be disabled by the visitor. |
| Preferences / functionality | `preferences` | `false` | Pre-filled as on in the preferences form under opt-out regimes. |
| Analytics | `analytics` | `false` | Gate GA4, Mixpanel, PostHog, etc. |
| Marketing / advertising | `marketing` | `false` | Gate ad pixels, Meta Pixel, affiliate pixels. Where health rules apply (Healthcare plan), only granted together with `sensitive_sharing`. |
| Health data (collect) | `sensitive` | `false` | Never pre-checked. Offered only on the Healthcare plan where health rules apply (WA / NV / CT visitors when that rule is on, optionally all US visitors or everyone). |
| Health data (share) | `sensitive_sharing` | `false` | Never pre-checked; needs `sensitive`. Consent to share health data with partners, separate from consent to collect it (MHMDA / SB 370). |

Before a visitor decides, `getConsent()` returns `null` and tagged scripts stay blocked in every region. Under opt-out regimes (for example US-CA), the preferences form is pre-filled with the non-necessary categories on, and dismissing the banner (where the site allows it) records those defaults. GDPR-style regions keep everything except `necessary` denied until the visitor chooses.

### The consent object

Every API surface below hands you the same shape:

```js
{
  decisionId: "uuid",
  action: "customize",
  categories: {
    necessary: true,
    preferences: false,
    analytics: false,
    marketing: false,
    sensitive: false,
    sensitive_sharing: false
  },
  decidedAt: "2026-08-23T12:00:00.000Z",
  bannerId: "uuid",
  bannerVersion: "version"
}
```

It is persisted in a first-party cookie named `cookieguard_consent` (JSON). `getConsent()` returns `null` until the visitor has made a decision.

### Public JavaScript API

CookieGuard exposes `window.cookieguard`. It is safe to queue handlers before the script loads using the standard async stub — queued calls are drained on load:

```js
// Place this before the cookieguard <script> tag, e.g. in <head>:
window.cookieguard = window.cookieguard || { q: [], on(...a) { this.q.push(['on', a]) } }
```

Methods and events:

- `cookieguard.on('ready', fn)` — fires once when consent state is settled (existing decision loaded, or banner shown to a new visitor). `fn` receives the consent object or `null`. If `ready` already fired, a newly-attached handler is replayed immediately.
- `cookieguard.on('change', fn)` — fires on every consent change (accept, reject, customize, GPC opt-out, reset). `fn` receives the new consent object.
- `cookieguard.off('ready'|'change', fn)` — remove a handler.
- `cookieguard.getConsent()` — returns the current consent object, or `null` if no decision yet.
- `cookieguard.openPreferences()` — opens the preferences/customize modal (wire this to a "Manage cookies" / "Cookie settings" link).
- `cookieguard.reset(options?)` — clears the stored decision, applies denied signals, notifies listeners/DOM events with `null`, records reset, and reloads only when configured or requested.
- `cookieguard.registerIntegration(category, { grant, revoke })` — registers isolated, idempotent vendor lifecycle callbacks.
- `cookieguard.activateTaggedScripts()` — reruns activation for currently eligible tagged scripts.
- `cookieguard.diagnostics()` — returns privacy-safe runtime, rule, Google-ordering, tagged-script, and audit-delivery state.
- DOM event: `document.addEventListener('cookieguard:consent', (e) => { /* e.detail is the consent object */ })` — dispatched on every change. Preferred by some frameworks.
- Back-compat: assigning `window.cookieguard.onConsent = fn` also works; it is called with the consent object on every change.

Minimal example — gate a script on consent:

```js
window.cookieguard = window.cookieguard || { q: [], on(...a) { this.q.push(['on', a]) } }
window.cookieguard.on('change', (decision) => {
  if (decision?.categories.analytics) loadAnalytics()
  if (decision?.categories.marketing) loadAdPixels()
})
```

### Google Consent Mode v2 (recommended for GA4 / Google Ads / GTM)

Enable it in the dashboard: **Settings → Integration → Google Consent Mode**. When enabled, CookieGuard talks to `gtag`/`dataLayer` for you and maps categories to Consent Mode signals:

```js
// Pushed by CookieGuard once a decision is made:
gtag('consent', 'update', {
  analytics_storage:       decision.categories.analytics   ? 'granted' : 'denied',
  ad_storage:              decision.categories.marketing   ? 'granted' : 'denied',
  ad_user_data:            decision.categories.marketing   ? 'granted' : 'denied',
  ad_personalization:      decision.categories.marketing   ? 'granted' : 'denied',
  functionality_storage:   decision.categories.preferences ? 'granted' : 'denied',
  personalization_storage: decision.categories.preferences ? 'granted' : 'denied',
})
```

CookieGuard's site-specific parser-blocking bootstrap pushes the default-denied state (with `security_storage: 'granted'` and `wait_for_update: 500`) before it loads the runtime. Install it as the first script in `<head>`; the runtime sends updates for decisions and returning consent:

```html
<!-- First thing in head, before GTM/gtag/GA4/Ads -->
<script src="https://cookieguard.co/api/v1/bootstrap/YOUR_SITE_ID?key=YOUR_PUBLISHABLE_SITE_KEY&language=auto"></script>
```

With the Google Consent Mode setting enabled, CookieGuard will then push the matching `update` when the visitor decides. You do not need to write the `update` call yourself. In GTM, also set your tags to honor consent (Tag → Consent Settings).

### Tagged Script Blocking (data attributes)

Enable **Settings → Advanced → Tagged Script Blocking**. Then deliberately mark a `<script>` you want gated by changing its `type` to `text/plain` and adding `data-cookieguard="<category>"`. CookieGuard does not discover or block untagged scripts:

```html
<script type="text/plain" data-cookieguard="analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
<script type="text/plain" data-cookieguard="marketing">
  /* inline marketing snippet */
</script>
```

When the visitor grants that category, CookieGuard activates the script (it re-inserts it as a live `<script>`). Use `analytics`, `marketing`, or `preferences` as the category value; necessary scripts should load normally. (Re-blocking on revocation happens on the next page load.)

### Vendor recipes (summary)

- **GA4 / Google Ads / GTM** — use Google Consent Mode v2 (above).
- **Meta Pixel (direct)** — initialize `fbq` inside an `on('change')` handler gated on `decision.categories.marketing`. On the Healthcare plan with health-data mode on, `marketing` is only granted together with `sensitive_sharing` where health rules apply, so the pixel waits for consent to share health data there.
- **Mixpanel / PostHog** — use their built-in opt-in/opt-out APIs (`mixpanel.opt_in_tracking()` / `opt_out_tracking()`, `posthog.opt_in_capturing()` / `opt_out_capturing()`) inside `on('change')` gated on `decision.categories.analytics`.
- **Sentry** — usually classified `necessary`; if breadcrumbs capture PII, gate it under `analytics` via `beforeSend` reading `cookieguard.getConsent()`.
- **Affiliate pixels (Everflow, FirstPromoter)** — gate under `marketing`. Attribution intentionally breaks for visitors who reject marketing.
- **Nuxt 3 / dynamic loaders (`@nuxt/scripts`)** — call `useScript(...)` inside `on('ready')` and `on('change')` handlers, branching on the consent object.

Full copy-paste versions of every recipe: https://cookieguard.co/docs/integrations

## Platform Integrations

CookieGuard installs via a single JavaScript snippet that works with direct script installs, storefront themes, CMS templates, and custom-built sites.

Supported platforms:
- Framer (native plugin: https://cookieguard.co/docs/framer)
- Shopify
- WordPress
- WooCommerce
- Webflow
- Wix
- Squarespace
- BigCommerce
- Magento
- Any custom HTML/JavaScript site

## CookieGuard vs Cookiebot

CookieGuard is an alternative to Cookiebot with key differences. Cookiebot figures are from https://www.cookiebot.com/en/pricing/ (Core plans, EUR excl. VAT), checked October 2026.

| Feature | CookieGuard | Cookiebot |
|---|---|---|
| Free plan | 1 website, 2,000 pageviews/month | 1 domain, up to 50 subpages |
| Paid plans from | $8/month | €7/month (Premium Lite: 1 domain, under 50 subpages) |
| 10 websites | $68/month (Enterprise plan) | From €150/month (€15 per domain on Premium Small) |
| Pricing model | One plan covers all its websites; tiers by sites and monthly pageviews | Per domain, by subpage count; subdomains billed separately |
| Jurisdiction-scoped consent controls | All plans including free | Paid plans |
| Customizable banners | All paid plans | Paid plans |
| IAB TCF / Google-certified CMP | Not supported | Supported on paid plans |

Cookiebot (or another Google-certified CMP) is the better fit for sites that run Google AdSense, Ad Manager, or AdMob for visitors in the EEA, UK, or Switzerland, because Google requires IAB TCF there.

Primary reasons users switch from Cookiebot to CookieGuard:
1. Predictable multi-site pricing — no per-domain billing and no subpage counting
2. Jurisdiction-scoped consent controls on every plan
3. Multi-site support — agencies managing 10 client sites pay $68/month total, not per domain
4. Support that scales — Enterprise customers get dedicated support, not a ticket queue

## Who CookieGuard Is For

- **Individual website owners** who want compliance without complexity
- **Digital agencies** managing consent across multiple client sites
- **E-commerce brands** on Shopify, WooCommerce, BigCommerce, or Magento
- **High-traffic websites** requiring custom volume plans and SLA agreements
- **Organizations with multi-jurisdiction requirements** — operating across EU, US, Brazil, India, China, and more simultaneously

## How to Get Started

1. Sign up at https://cookieguard.co/signup — free plan available, no credit card required
2. Add your website domain in the dashboard
3. Install the CookieGuard script on your site (one line of JavaScript)
4. Configure your banner appearance and regulation settings
5. Go live — validate that visitors receive the configured location-scoped consent controls and that every optional tag is gated

For enterprise or migration inquiries, contact the team at https://cookieguard.co/contact. Custom quotes are typically scoped within one business day.

## Key URLs

- Homepage: https://cookieguard.co/
- Sign up: https://cookieguard.co/signup
- Pricing: https://cookieguard.co/#pricing
- Cookiebot alternative: https://cookieguard.co/cookiebot-alternative
- Enterprise: https://cookieguard.co/enterprise
- Regulations guide: https://cookieguard.co/regulations
- Contact: https://cookieguard.co/contact