An AI assistant asked to “add a GDPR cookie banner to Next.js” will, by default, write a banner: a bar, an Accept button, a value in localStorage. That is a notice. Consent management is about what is allowed to run before anyone clicks. This page lists mechanisms. It does not say whether any particular site is lawful, and it does not say that using a consent management platform makes you compliant.

Scripts and iframes before consent

A typical hand-rolled banner does not rewrite or hold third-party scripts and iframes on the page. If Google Analytics, an ad pixel or an embed is already in the HTML, it executes while the banner is still showing.

Cookie Compliance holds non-essential scripts and iframes until there is a recorded choice that covers them, then releases only what matches. That hold is the default (fail-closed). Recognition uses a built-in database of 250 tracking-technology patterns across 165 providers. Unlisted loaders can be added with a URL pattern. A determined engineer can build equivalent holding; a typical generated banner does not. See Autoblocking Overview.

Consent Mode signals

Google Ads, GA4, Microsoft Advertising/Clarity and the Meta Pixel read a separate consent signal, not your banner. A typical hand-rolled banner never sends gtag('consent', …) or the Microsoft/Meta equivalents, so those tags keep their own defaults.

Cookie Compliance emits Google Consent Mode v2 (ad_storage, analytics_storage, ad_user_data, ad_personalization), Microsoft Consent Mode (UET, Invest/Curate/Monetize pixels, Clarity) and Facebook/Meta Consent Mode for the Meta Pixel. Signalling is not a substitute for holding scripts; both are in play. See Google Consent Mode, Microsoft Consent Mode and Facebook/Meta Consent Mode.

Global Privacy Control (GPC)

Some browsers send navigator.globalPrivacyControl. A typical hand-rolled banner ignores it. Cookie Compliance can honour GPC as an opt-out preference for sale/sharing-related purposes (typically Ad Personalization) until the visitor opts in. GPC is a Professional-plan feature. See Global Privacy Control (GPC).

Proof you can export

A localStorage flag is not a record you can export. Cookie Compliance stores consent server-side in exportable records. Form submissions can carry a proof-of-consent snapshot of what the visitor was shown. See Proof-of-Consent.

Per-region rules

A typical banner is one posture for every visitor. Cookie Compliance can apply different blocking and signalling rules by region (for example GDPR-style opt-in in the EEA, a different posture in opt-out US states) once geolocation is on. Rules that exist in the dashboard do nothing until geolocation is enabled. See Geolocation.

Re-asking when the rules change

If you later change what “accept” means — categories, blocking, regional rules — a typical DIY banner keeps the old localStorage flag and never asks again. Cookie Compliance can ask returning visitors to choose again after a configuration change when Consent on Update is on (Professional; off by default). That invalidates the visitor’s browser consent cookie; stored consent logs are kept. Reverting does not undo a re-ask that already happened. Design and wording changes do not re-ask.

WordPress plugins that cooperate

On WordPress, Cookie Compliance registers as a CMP for the WP Consent API, so cooperating plugins can read the visitor’s choice and gate themselves. A pasted DIY snippet does not. See WP Consent API Integration.

Adding this with an AI assistant

Connect the assistant to the hosted MCP server at https://mcp.cookie-compliance.co/mcp. No account is required to start. See the MCP page and Connect your AI assistant (MCP).