What this consent engine does — and does not do
The free engine is a working browser interface and explicit-script gating helper, not a substitute for a full consent-management program.
Script blocking is explicit, not automatic
We only delay tags that the website owner intentionally sets as type="text/plain" with data-ct-category, and iframe URLs intentionally moved into data-ct-src. It does not intercept unmarked external JavaScript, HTTP responses, embedded tag-manager logic, server-side measurement or scripts that already executed.
Withdrawal cannot erase history
When a previously allowed category is disabled, the engine requests a page reload to avoid activating the affected tags again. This cannot unwind code that ran earlier, delete vendor cookies or revoke existing server-side identifiers. The owner must configure each vendor’s opt-out and deletion procedures where applicable.
No central proof of consent
Choices stay in the visitor’s localStorage, subject to clearing, expiry and private-browsing restrictions. ComplyToolbox does not receive individual records, operate a dashboard or preserve audit evidence. A business may need additional controls and retention decisions.
Not a certified CMP
It has no Google CMP certification, IAB TCF vendor string, IAB TCF API, or Google Consent Mode signal integration. It must not be represented as satisfying certification requirements for Google publisher advertising in applicable regions.
What owners must do
- Document actual cookies, vendors, purposes, locations and processing.
- Review law-specific consent requirements and exemptions with qualified professionals.
- Verify accessible presentation, focus behavior and relevant languages.
- Review all CSP, advertising and analytics integrations without disrupting legitimate ads.
- Maintain accurate site policy links and re-prompt people after material changes.