Agentic Consent management solution

Make any website compliant with one prompt

Tell Cursor, Claude Code, Codex, Replit, or Lovable to add ConsentLayer — our MCP runs the install. Prefer manual? Drop one <script> tag in your <head>. Either way, GDPR / CCPA / LGPD ready in seconds.

Get Started Now — it’s FREE

No credit card required Install in seconds GDPR / CCPA / LGPD ready

cursor · /northwind-app MCP

> add ConsentLayer to my site

→ calling consentlayer.install
✓ snippet added to app/layout.tsx
✓ banner configured · GDPR + CCPA
✓ policy at /.well-known/consent.json
✓ MCP endpoint live · receipts signed

▸ done in 9.2s · open dashboard

northwind.app

LIVE

MCP-native — install from any AI coding agent below

The platform

Everything you need to ship compliant consent.

Drop in a script. Get a banner, a policy API, a scanner, and an audit log, all wired to the same source of truth.

Policy file

Every site publishes a signed, machine-readable consent policy at /.well-known/consent.json.

Versioned and cached at the edge
Human and agent readable
Cryptographically signed

northwind.app/.well-known/consent.json

{
  "version": "1.0",
  "site": "northwind.app",
  "regions": ["EU", "US-CA", "BR"],
  "categories": {
    "necessary": true,
    "analytics": false,
    "marketing": false
  },
  "mcp": "https://northwind.app/mcp/consent",
  "signed_by": "cl_live_a7f3…2b91"
}

MCP server

One prompt. Your agent does the rest. Any MCP-aware coding agent installs ConsentLayer, configures the banner, and wires the policy end to end.

>add ConsentLayer to my site

✓ installed in 9.2s

✓ banner, policy + audit log live

Consent UI

A banner that meets every regulation, branded to your site.

northwind.app

Scanner

Every deploy is scanned. New trackers arrive as a queue.

LILinkedIn InsightMarketing

SGSegment.jsAnalytics

?vital-pixel.io

Audit ledger

Every decision is signed and exportable for any regulator.

14:02:50banner.publish

14:02:46scan.complete

14:02:11agent.fetch

Edge loader

Under 3 KB, served from 280+ PoPs. Zero Core Web Vitals impact.

cl.js38ms

LCP420ms

ga4.js+204

Regions

GDPR, CCPA, LGPD applied by IP. Right rules, every visitor.

European UnionGDPR

CaliforniaCCPA

BrazilLGPD

Get started See all features

In motion

See it in action.

From the install prompt to the audit log — pick a tab to see how the moving parts fit together.

One prompt. ConsentLayer installs itself.

Tell Cursor, Claude Code, Codex, Replit, or Lovable to add ConsentLayer. Our MCP server runs the install — snippet, banner, policy, audit endpoint — in under 10 seconds.

Works in any MCP-aware coding agent
No copy-paste, no framework guessing
Same prompt for every site you own

cursor · /northwind-app MCP

> add ConsentLayer to my site

→ calling consentlayer.install
✓ snippet added to app/layout.tsx
✓ banner configured · GDPR + CCPA
✓ policy at /.well-known/consent.json
✓ MCP endpoint live · receipts signed

▸ done in 9.2s · open dashboard

One <script async> tag in your <head>.

Framework presets for Next, Vue, WordPress, and GTM. The loader is sub-3 KB and serves from the edge, so there’s no impact on Core Web Vitals.

Auto-detects framework on first install
TypeScript types ship with the SDK
Runs before any third-party script

app/layout.tsx · Next.js (App Router)

// One tag. Every framework.
import type { Metadata } from 'next';

export default function RootLayout({ children }) {
  return (
    <html>
      <head>
        <script
          async
          src="https://cdn.consentlayer.dev/v1/cl.js"
          data-key="cl_live_a7f3…2b91"
        />
      </head>
      <body>{children}</body>
    </html>
  );
}

Every deploy triggers a fresh scan.

The scanner crawls your site and classifies every cookie and third-party request. New scripts get an “unassigned” badge until you (or an agent) categorize them.

One-click “Block / Allow / Categorize” per finding
Surfaces marketing-team additions before your DPO does
Public markup only, no crawling behind auth

scanner · 2 unreviewed Live

LinkedIn Insight Tag

first-seen 12m ago · suggested: Marketing

Hotjar Recording

first-seen 1h ago · suggested: Analytics

Google Analytics 4

categorized: Analytics · approved

Live

Stripe.js

categorized: Necessary · approved

Live

Agents read the rules. And honor them.

The .well-known/consent.json file is auto-generated from your settings. The MCP server lets Claude, Operator, and Perplexity record signed decisions on the visitor’s behalf.

Verified agent tokens map to per-user consent
Default policy (Strict / Standard / Permissive) for unverified agents
Same audit log as your human visitors

GET /.well-known/consent.json 200 OK · 248 ms

{
  "version": "1.0",
  "site": "northwind.app",
  "mcp": "https://northwind.app/mcp/consent",
  "categories": {
    "necessary":  true,
    "analytics":  false,
    "marketing":  false
  },
  "agent_default": "strict",
  "signed_by": "cl_live_a7f3…2b91",
  "signature": "sha256=4f1b…"
}

Every event, signed and stored.

Every settings change, banner decision, and agent fetch is logged with a signed receipt. Export a compliance bundle for any auditor in one click.

7-year retention, queryable by API
HMAC-SHA256 webhook signatures
Stream to your warehouse via the firehose

Audit log · last 24h

Rohan Mehta updated banner copy · EU

“We value your privacy” → “Cookies on northwind.app”

12:48 UTC

signed

Claude (Anthropic) fetched policy · receipt issued

decision: reject analytics · jwt: eyJhbGciOi…

12:31 UTC

signed

Sasha Kim approved LinkedIn Insight · Marketing

via scanner queue · auto-categorized

11:09 UTC

signed

Jamie Vu rotated webhook secret

env: production · key id: whsec_8ad…

09:42 UTC

signed

Why ConsentLayer

Why engineering teams ship ConsentLayer.

Shipping compliance isn’t luck. It’s a system.

/ frameworks

One snippet. Every framework.

A single <script async> tag works in Next.js, Remix, Nuxt, Astro, WordPress, or plain HTML. Framework-specific install pages give you copy-paste snippets with the right hydration strategy already chosen.

Read the install guide

“Replaced our OneTrust integration in an afternoon. The Next.js snippet just worked, including Server Components.”

[NAME], [Title], [Company] Placeholder

app/layout.tsx

// 1 · Drop this in your <head>. That's the install.
<script
  async
  src="https://cdn.consentlayer.dev/v1/cl.js"
  data-key="cl_live_a7f3…2b91"
  data-region="auto"
/>

// 2 · Optional — react to consent changes
window.consentlayer.on('change', (state) => {
  analytics.toggle(state.analytics);
  ads.toggle(state.marketing);
});

// Same two steps in every framework.

/ agents

Agents are first-class users.

ConsentLayer publishes a signed, machine-readable policy at /.well-known/consent.json, exposes an MCP server, and mints portable consent receipts. AI browsing agents read the rules and honor them, so there's no broken automation and no privacy lawsuits.

View the MCP spec

"We treat ConsentLayer's MCP server like an internal tool. Operator respects the policy automatically."

[NAME], [Title], [Company] Placeholder

Human view

Necessary

Analytics

Marketing

→ logged · receipt: jwt

Agent view · MCP

$ curl northwind.app/.well-known/consent.json

{
  "necessary": true,
  "analytics": false,
  "marketing": false,
  "region": "EU",
  "mcp": "…/mcp/consent",
  "signed_by": "cl_live…2b91"
}

→ same decision · same receipt

/ scanner

The scanner is the input, not the chore.

Every deploy triggers a fresh scan. New 3rd-party scripts surface in your inbox with a suggested category and a one-click "accept" or "block". You're not auditing cookies; you're approving a queue.

See a sample scan

"We discovered three trackers our marketing team had added without telling us. The scanner caught it the same day."

[NAME], [Title], [Company] Placeholder

Inbox · 5 new trackers deploy 1284

LinkedIn Insight Tag

added by deploy · suggested Marketing

Hotjar Recording

added by deploy · suggested Analytics

Google Analytics 4

added by deploy · suggested Analytics

Segment.js

added by deploy · suggested Analytics

vital-pixel.io

unknown vendor · suggested Review

/ type safety

Type-safe, signed, validated.

Every API call is fully typed in TypeScript. Every webhook payload is HMAC-SHA256 signed. Every receipt is a verifiable JWT. Zod schemas ship with the SDK so you fail at compile time, not in production.

Open the SDK reference

"I bound the webhook to a Zod schema and the rest wrote itself. No 'undefined is not a function' at 2am."

[NAME], [Title], [Company] Placeholder

webhook.ts · TypeScript ✓ typechecked

import { verify } from '@consentlayer/sdk';
import type { ConsentDecision } from '@consentlayer/sdk';
import { z } from 'zod';

const schema = z.object({
  decision: z.enum(['accept', 'reject', 'custom']),
  receipt:  z.string(),
  agent:    z.string().optional(),
});

export async function POST(req) {
  const body = await verify(req); // HMAC-SHA256
  const data: ConsentDecision = schema.parse(body);
  // data.decision is narrowed. typed. signed. done.
}

/ audit

Audit log auto-generated.

Every settings change, banner interaction, and agent decision is recorded with a cryptographic signature. Generate a regulator-ready bundle in one click. No spreadsheet exports, no last-minute scrambling.

View a sample export

"Our SOC 2 auditor accepted ConsentLayer's export bundle as-is. First time that's happened with any consent vendor."

[NAME], [Title], [Company] Placeholder

Audit log · last 24h

Rohan Mehta updated EU banner copy

v4.2 → v4.3 · diff: 2 strings