Integrate consent in minutes

Quickstart

Add one async script tag to your site and Cookie Panda handles consent end to end. Drop it in your <head> ahead of any analytics or advertising tags so trackers stay blocked until the visitor decides.

<!-- Add to your <head>, before any tracking scripts -->
<script
  src="https://sdk.cookiepanda.app/cookiepanda.min.js"
  data-cp-token="cp_xxx"
  data-cp-api="https://edge.cookiepanda.app"
  async
></script>

What happens automatically

• Geo-detects the visitor and applies the right jurisdiction (GDPR, CCPA/CPRA, LGPD and more).

• Renders your consent banner using the copy, colours and layout configured in the dashboard.

• Blocks cookies and tracking scripts before consent, then unblocks the moment a visitor opts in.

• Emits Google Consent Mode v2 signals and the IAB TC and GPP strings as choices change.

Install

Cookie Panda ships native SDKs for every surface, all sharing one consent record. Pick your platform below, then follow the platform guide for the full setup.

Web — script tag (guide)

<script
  src="https://sdk.cookiepanda.app/cookiepanda.min.js"
  data-cp-token="cp_xxx"
  data-cp-api="https://edge.cookiepanda.app"
  async
></script>

iOS — Swift Package Manager (guide)

// Package.swift
dependencies: [
  .package(
    url: "https://github.com/cookiepanda/cookiepanda-ios.git",
    from: "1.0.0"
  )
]

Android — Gradle (guide)

// build.gradle.kts (app)
dependencies {
  implementation("app.cookiepanda:sdk:1.0.0")
}

Flutter — pub (guide)

flutter pub add cookie_panda

Connected TV

Native consent SDKs and TV-optimised banners for Apple tvOS, Android TV, Roku and Amazon Fire TV — remote-friendly and IFA-aware, sharing the same consent record as web and mobile. Guides: tvOS · Android TV · Roku

Configuration

The web loader takes two data attributes. Everything else — banner copy, colours, layout and theme — is managed visually in the dashboard, so you rarely need to touch code again after install.

• data-cp-token (required) — your public site token (cp_…). Identifies the site so the right configuration loads. Safe to expose in client-side code.

• data-cp-api (optional) — consent edge endpoint. Defaults to https://edge.cookiepanda.app; override only for a custom domain.

Banner text, languages, colours, layout and light / dark / system theme are all edited in the dashboard and served to the SDK at runtime — no redeploy needed when you tweak the banner.

Frameworks & signals

Cookie Panda applies the right privacy framework per visitor and emits the standard consent signals the ad-tech and analytics ecosystem expects.

Regulations covered

• GDPR — EU — prior consent, granular purposes, easy withdrawal

• UK GDPR — United Kingdom post-Brexit regime

• CCPA / CPRA — California — opt-out of sale / sharing

• US state laws — Virginia, Colorado, Connecticut, Utah, Texas and more

• LGPD — Brazil — consent and data-subject rights

• PIPL — China — separate consent for sensitive data

• COPPA — US — protections for users under 13

Standards & signals

• IAB TCF v2.3 — Registered CMP, TC strings via the __tcfapi locator

• Google Consent Mode v2 — Emitted automatically — ad_storage, analytics_storage and more

• Google Additional Consent — AC string for Google's non-TCF ad partners

• IAB GPP — Global Privacy Platform — US national + state section strings

• GPC — Global Privacy Control browser signal honored automatically

Full compliance overview →

Consent API

Cookie Panda registers the standard CMP interfaces, so the tools and tags you already use can read consent the way they expect.

• window.__tcfapi — the IAB TCF v2.3 CMP API for TC strings and per-purpose consent.

• window.__gpp — the IAB Global Privacy Platform API for US national and state strings.

• The SDK exposes the visitor's current consent and a method to reopen the preferences UI, so a "Cookie settings" link can let users change their mind at any time.

• getAdParams() — one call returns ad-server-ready signals (TC string, GPP, Google AC, plus derived npa/ltd/rdp) for GAM, IMA, Prebid and OpenRTB.

• knownAge / setAge() — profile-aware COPPA: pass a known age to skip the gate and auto-block advertising & analytics for children.

// The IAB TCF v2.3 CMP API is available on window.__tcfapi
window.__tcfapi("getTCData", 2, (tcData, success) => {
  if (!success) return;

  // Standard TC string + per-purpose consent
  console.log(tcData.tcString);
  console.log(tcData.purpose.consents); // { "1": true, "2": false, ... }
});

// Reopen the preferences UI at any time (e.g. a "Cookie settings" link)
window.CookiePanda?.showPreferences();

// Ad-server-ready signals from the live consent state
const p = window.CookiePanda.getAdParams();
// → { gdpr, gdpr_consent, addtl_consent, gpp, gpp_sid,
//     us_privacy, npa, ltd, rdp }

// Drop straight into a Google Ad Manager / IMA tag, Prebid or OpenRTB:
// &gdpr=${p.gdpr}&gdpr_consent=${p.gdpr_consent}
// &gpp=${p.gpp}&gpp_sid=${p.gpp_sid.join(",")}&npa=${p.npa}&ltd=${p.ltd}

// Profile-aware COPPA: pass a known age and no gate is shown.
// Under 13 → consent is locked to essential-only, ads/analytics blocked.
window.cookiePanda = { token: "cp_xxx", knownAge: 8 }; // or child: true

// On a profile switch (kid <-> adult), re-apply live — no reload:
window.CookiePanda.setAge(8);   // child  → blocked
window.CookiePanda.setAge(34);  // adult  → normal banner

Data subject requests

Privacy laws give people the right to access, delete or opt out of the sale of their data — and you have to give them a way to ask.

Every site gets a public, no-login data-subject-request (DSAR) intake form. Link it from your privacy policy and visitors can file access, deletion and opt-out requests without an account. Submissions land in a dashboard workflow with SLA timers, so requests never go overdue.