Everything your site needs.
One script tag.

ConsentPixel — Privacy · Verified uses a MutationObserver intercept to rewrite any non-essential script's type attribute from text/javascript to text/plain before the browser can execute it. It also monkey-patches window.fetch and XMLHttpRequest to block outbound network requests to tracker domains at the API level. Scripts cannot fire — not deferred, not slowed — completely prevented. When a visitor consents, blocked scripts are restored per category in under 50ms with no page reload.

The named CIPA blocklist covers Hotjar, FullStory, Microsoft Clarity, Lucky Orange, Inspectlet, LogRocket, Mouseflow, Smartlook, SessionCam, and Crazy Egg — the exact tools that plaintiff firms Kind Law and Swigart Law Group scan for using BuiltWith data. The blocklist also covers Meta Pixel, TikTok Pixel, and LinkedIn Insight Tag under the §638.51 pen register provisions. Over 2,000 trackers total across all categories.

Starter plan: weekly automated Playwright scan. Agency Lite and Pro: daily automated scan plus unlimited on-demand scans. Each scan visits your homepage plus up to 3 internal pages (checkout, contact, landing pages) as a fresh visitor with zero cookies and zero localStorage — exactly how plaintiff firms scan. It records every network request, every cookie set, every script that fires, and produces a risk grade from A (clean) to F (critical CIPA risk).

Yes — ConsentPixel — Privacy · Verified is a Google CMP Partner certified for Consent Mode v2. It automatically injects all four v2 signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) into the dataLayer as denied before GTM or GA4 loads, then fires the update signal when the visitor consents. No additional configuration required. Properly implemented Consent Mode v2 preserves up to 65% of ad conversion intelligence that a poorly configured CMP throws away.

Yes — the privacy policy generator reads your actual scan results and lists every tracker found by name, with its category, data sharing details, and retention period. This is far more defensible than a generic template because it reflects what your site actually does. The generated policy is hosted at a permanent URL that never changes, auto-updates when new trackers are detected, and includes GDPR rights language for EU visitors and CCPA rights for California visitors auto-served by geography.

The badge is served dynamically from badge.consentpixel.com and validated against your domain on every request using HMAC-SHA256. It cannot be faked — if someone copies the badge image URL onto a different domain, the badge automatically renders as a red fraud indicator. The badge colour reflects your most recent scan result in real time: green when clean, amber when action is needed, red on domain mismatch.

Agency Lite and Pro plans include a white-label portal at your own subdomain (compliance.youragency.com), portfolio dashboard for all client sites, branded PDF compliance reports with your logo, client read-only access (Agency Pro), webhook alert delivery to Slack or PagerDuty (Agency Pro), team roles and permissions (Agency Pro), and a 30% recurring referral commission for agencies you refer. The white-label badge can also show your agency name instead of ConsentPixel.

Yes — ConsentPixel — Privacy · Verified implements the full IAB TCF 2.2 specification including the __tcfapi() stub, Global Vendor List integration, TC String generation, and Purpose consent handling. This is required for publishers running Google AdSense, Google Ad Manager, or any IAB-compliant advertising stack in the EU. TCF 2.2 mode is available on all plans.