Consent for trackers and AI, from one pixel

ConsentPixel is a consent management platform delivered as a single JavaScript pixel. It holds non-essential third-party trackers — and now AI chat widgets — until a visitor gives affirmative consent, shows the correct banner by jurisdiction, honors Global Privacy Control, and records every decision in an append-only, hashed, externally anchored log. It handles CIPA, GDPR and CCPA from one install, generates your privacy documents from your actual scan results, and gives developers a one-line gate for their own AI features. This is general information, not legal advice.

Yes. AI chat widgets — including Intercom Fin, Drift, Crisp, Ada, Tidio, Zendesk AI, LivePerson and Forethought — are held before consent, from the first byte of the page, the same way session-recording tools are held. Nothing loads and nothing is typed into an AI until the visitor chooses. While a widget is held, a small "Chat · AI-powered" placeholder stays in the corner; one click opens a dialog that is both the disclosure and the choice, with Enable AI chat and Not now options.

It's a dedicated consent purpose — alongside analytics, advertising and the rest — covering AI use: "Your messages, inputs or on-site activity may be processed by an AI service." It has its own toggle in the preferences panel and its own line in the consent record. It's opt-in in every jurisdiction, meaning it's off by default even in US opt-out states and is treated like session recording under CIPA. Accept all grants it; Reject all and Global Privacy Control deny it.

For EU and EEA visitors, the AI chat dialog carries the Article 50 notice — "you are about to interact with an AI system" — along with an EU AI Act badge, and returning visitors who already consented get a brief, non-blocking notice the first time they open the chat. Every notice is logged. This helps you, as the deployer, give visitors a clear, logged notice that they're interacting with AI; Article 50's primary obligations sit with the AI provider. This is information, not legal advice.

Yes. A chat box that posts to your server and calls a model looks like ordinary traffic to any consent tool — only your code can gate it. ConsentPixel gives you a one-line gate, await ConsentPixel.consent("ai_processing"), which resolves when the visitor has agreed to AI processing and rejects when they've declined, so your model is never called without consent. It works with plain fetch, React, the Vercel AI SDK and LangChain.js, and the full guide is in the portal.

Every consent decision and AI disclosure notice lands in an append-only log, and each row is individually hashed. On top of that, each night every site's day of records is summarized into a single root, stored append-only, and written once to an external write-once store — then printed on consent receipts and CSV exports. The Consent Logs page shows "Integrity verified through {date} · externally anchored," so you hold evidence that can be verified independently. Records are only ever removed by the documented account-lifecycle purge.