# ConsentLayer

> Cookie consent management for GDPR, CCPA, and LGPD: consent banner, script/tracker blocking, cookie scanner, geo rules, and a consent log. Built to be set up end-to-end by AI coding agents via an MCP server — or with one script tag.

## For AI agents — canonical install path

If you are an AI agent or coding assistant setting up ConsentLayer for a user, **use the MCP server**. Do NOT paste a script tag with a placeholder project key — that produces a non-functional integration. The MCP server provisions the project, configures it, and returns the real install snippet in one session.

**1. Add the MCP server (one-time per dev environment):**

```
claude mcp add consentlayer --transport http https://api.consentlayer.com/mcp
```

For Cursor, Windsurf, or any other MCP client, add to the MCP config:

```json
{ "mcpServers": { "consentlayer": { "url": "https://api.consentlayer.com/mcp" } } }
```

**2. Authenticate:** browser-based OAuth opens automatically on the first tool call. No API keys needed.

**3. Call `setup_site` with the user's domain:**

```
setup_site({ domain: "example.com" })
```

That single call provisions the site, scans it for trackers, auto-configures consent categories, and returns the install snippet with the real project key embedded. Add the returned snippet to the user's `<head>` — no `defer`, no `async`, so it runs before trackers.

For Next.js or React, pass `framework: "next"` or `framework: "react"` for a framework-specific snippet.

## MCP server

- URL: `https://api.consentlayer.com/mcp`
- Transport: MCP Streamable HTTP
- Auth: OAuth 2.0 with PKCE (browser-based, automatic)
- OAuth discovery: `https://api.consentlayer.com/.well-known/oauth-authorization-server`
- npm package: `@consentlayer/mcp` — https://www.npmjs.com/package/@consentlayer/mcp

## MCP tools — high-level first

**setup_site** — Install ConsentLayer on a domain end-to-end: provision, scan for trackers, auto-configure categories, and return the install snippet with the real project key. Idempotent — re-running for a domain returns the existing site. *This is the tool for "add ConsentLayer to my site".*

**get_started** — Show the recommended workflow and any sites already set up. For context, not for installing.

Lower-level tools, grouped:

- **Sites:** list_sites, create_site, update_site, delete_site
- **Scanner:** scan_site, list_scans, get_scan, get_scan_diff, configure_from_scan, get_scan_schedule, update_scan_schedule
- **Cookie library:** search_library, get_library_service, import_service
- **Site services & cookies:** list_site_services, add_custom_service, update_service, remove_service, add_service_cookie, update_service_cookie, delete_service_cookie
- **Unrecognized scripts:** list_unrecognized_scripts, approve_unrecognized_script, dismiss_unrecognized_script
- **Banner:** get_banner_config, update_banner_config
- **Categories:** list_categories, create_category, update_category, delete_category
- **Geo rules:** list_geolocation_groups, create_geolocation_group, update_geolocation_group, delete_geolocation_group, reorder_geolocation_groups, add_geolocation_group_from_template, list_geolocation_templates
- **Consent log & policy:** list_consent_records, get_compliance_score, get_cookie_policy, regenerate_cookie_policy, set_cookie_policy_enabled
- **Config & usage:** get_setup_snippet, export_site_config, import_site_config, get_site_behavior, update_site_behavior, get_organization_usage

## REST API (for programmatic, non-agent integrations)

- Base URL: `https://api.consentlayer.com/api/v1`
- Auth: `Authorization: Bearer <api-key>` (create an API key in the dashboard)
- OpenAPI spec: `https://api.consentlayer.com/api/v1/openapi.json`

## SDK packages

- `@consentlayer/sdk` — JS + React helpers to read consent state and gate code on user consent. Pairs with the banner script. https://www.npmjs.com/package/@consentlayer/sdk
- `@consentlayer/mcp` — MCP server CLI for one-line install in Claude Code. https://www.npmjs.com/package/@consentlayer/mcp

## Manual integration (only if MCP is unavailable)

If the user cannot use an MCP-compatible agent:

1. Sign up at https://app.consentlayer.com and create a site.
2. Copy the project key from the dashboard.
3. Add to `<head>` (no `defer`, no `async`):
   ```html
   <script src="https://b.consentlayer.com/<your-key>/banner.js"></script>
   ```

This requires manual steps and cannot be automated without the MCP server.

## Links

- Dashboard: https://app.consentlayer.com
- Documentation: https://docs.consentlayer.com
- AI agent guide: https://docs.consentlayer.com/docs/guides/ai-agents
- Quickstart: https://docs.consentlayer.com/docs/quickstart
- Full LLM docs: https://consentlayer.com/llms-full.txt

---

## Sitemaps

- [XML Sitemap](https://consentlayer.com/sitemap.xml): Contains all public & indexable URLs for this website.

## Posts

- [Choosing a Consent Management Platform for Client Sites](https://consentlayer.com/consent-management-platform/) - How to pick a consent management platform for client sites: price models, laws, Consent Mode, GPC, and a setup you can check in minutes.
- [Add a cookie banner to your Replit app in about a minute](https://consentlayer.com/replit-cookie-banner/) - We built an app with Replit Agent, and then we pointed our own scanner at it. The scanner found Google Analytics, with thirteen cookies declared for that one service, and no banner in front of it. That is the normal state of a new Replit app, and it is the reason we shipped the connector.
- [Do Not Sell My Personal Information: the link, the signal, and which one to build first](https://consentlayer.com/do-not-sell-my-personal-information-link-and-signal/) - Do Not Sell is two mechanisms: a link visitors click and an opt-out signal their browser sends. Here is what the CCPA and its regulations say about each, why a cookie banner is not one of them, and which one to build first.
- [Add consent management to your site by telling your coding agent to do it](https://consentlayer.com/add-consent-management-to-your-site-by-telling-your-coding-agent-to-do-it/) - If you build with a coding agent, you can set up consent management the same way you built the site: connect one MCP server, describe what you want, review the diff. This post walks through the full flow, including what the scanner found when I ran it on my own site.
- [CIPA demand letters: why ordinary websites are getting them, and how to check yours](https://consentlayer.com/cipa-demand-letters-what-triggers-them-how-to-check-your-site/) - Thousands of businesses have received letters claiming their analytics or ad pixels violate a 1967 California wiretapping law. Here is what actually triggers those claims, how to check your own site in about ten minutes, and what the courts are saying.
- [Introducing ConsentLayer: Do Not Sell Requests Without a Dashboard](https://consentlayer.com/introducing-consentlayer-do-not-sell-requests-without-a-dashboard/) - If you sell to anyone in California, you owe them a real way to opt out of the sale or sharing of their personal information. That means a conspicuous "Do Not Sell or Share" link, at least one interactive way for someone to actually submit the request, and a person on your end who honors
- [Global Privacy Control: is your site ignoring people who opted out?](https://consentlayer.com/global-privacy-control-gpc/) - Our demo store is set up to honor Global Privacy Control. Its consent log had five records in it, and every one of them said the signal was absent. Nothing was broken. It took me a minute to work out why, and the answer is the most useful thing I know about GPC. All five
- [Introducing ConsentLayer: consent management built for the AI-first web](https://consentlayer.com/introducing-consentlayer/) - Meet ConsentLayer: banner, blocking, scanner, geo rules, and a consent log, set up from your editor via MCP. Free to start with full API access.

## Pages

- [Home](https://consentlayer.com/) - Tell Claude or ChatGPT to add cookie consent to a site. Your agent sets it up, scans for trackers, holds them until consent, and records every decision. Free on one site.
- [For web professionals](https://consentlayer.com/for-web-professionals/) - Set up cookie consent, Google Consent Mode, and tracking rules for client sites using your AI agent. Free plan available with no credit card needed.
- [Pricing](https://consentlayer.com/pricing/) - Choose a plan based on your site count. Every tier includes script blocking, Google Consent Mode v2, and full AI agent support. Save 20% yearly.
- [Features](https://consentlayer.com/features/) - Customizable banner, script and content blocking, cookie scanner, geo rules, consent log with CSV export, plus a full API, SDK, and MCP server.
- [Cookie Inspector Privacy Policy](https://consentlayer.com/privacy-policy/cookie-inspector/) - Legal Cookie Inspector Privacy Policy Version Date: September 2, 2026 The Cookie Inspector extension runs entirely in your browser. It does notcollect, store, or transmit any personal data. It makes no network requestsof its own and contains no analytics or telemetry. The extension reads the cookies, Set-Cookie response headers, and storage ofone website at a
- [Blog](https://consentlayer.com/blog/) - Product news and guides on consent management, cookie compliance, and building privacy into AI-agent workflows with ConsentLayer.
- [MCP](https://consentlayer.com/mcp/) - ConsentLayer's hosted MCP server works with Claude Code, Cursor, and any MCP client. One prompt scans your site, configures consent categories, and returns your install snippet — free plan included.
- [Cookie Preferences](https://consentlayer.com/cookie-preferences/) - Legal Cookie Preferences Version date: July 2, 2026 When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information
- [Privacy Policy](https://consentlayer.com/privacy-policy/) - Legal Privacy Policy Version Date: July 2, 2026 Purpose ConsentLayer is a product of WPConsent, LLC, located at 400 Executive Center Drive, West Palm Beach, FL 33401, US. At ConsentLayer, protecting privacy is a key priority. The purpose of this document is to set out how ConsentLayer and its affiliates (“us,” “our,” or “we”) collect,
- [Terms of Use](https://consentlayer.com/terms-of-use/) - Legal Terms of Use Last updated on: July 2, 2026 ConsentLayer SITES & SERVICES TERMS AND CONDITIONS IMPORTANT NOTICE: THESE ConsentLayer SITES AND SERVICES TERMS AND CONDITIONS (the “TERMS”) CONTAIN A BINDING ARBITRATION PROVISION AND WAIVER OF JURY TRIALS AND CLASS ACTIONS GOVERNING DISPUTES ARISING FROM USE OF THE ConsentLayer SITE AND SERVICES. IT AFFECTS
- [Cookie Notice](https://consentlayer.com/cookie-notice/) - Legal Cookie Notice Version Date: July 2, 2026 This Cookie Notice explains how WPConsent, LLC (“ConsentLayer”, “we”, “us”, and “ours”) use cookies and similar technologies to recognize you when you visit our websites, such as www.consentlayer.com ("Website"). It explains what these technologies are and why we use them, as well as your rights to control
- [Processor Policy](https://consentlayer.com/processor-policy/) - Legal Processor Policy Version date: July 2, 2026 Processor Policy Effective Date: September 1, 2024 PART I: INTRODUCTION This Processor Policy (“Processor Policy”) establishes ConsentLayer’s approach to compliance with applicable data protection laws (and, in particular, European laws) when processing personal information on behalf of a third-party controller. Scope of this Processor Policy This Processor
- [Privacy Request Portal](https://consentlayer.com/privacy-request/) - Legal Privacy Request Portal Exercise your rights over your personal data. ConsentLayer, a product of WPConsent, LLC, respects your privacy in accordance with applicable privacy and other data protection laws. This portal is provided by ConsentLayer to process your privacy request. The information requested below is required so that your request may be promptly and
- [Contact](https://consentlayer.com/contact/) - Questions about ConsentLayer, plans, or a setup for many client sites? Send us a message and the team will get back to you.