A separate product next to server-side tracking. A client can have Tracking, Consent or both (chosen when the client is created, changeable in Setup wizard → step 1). Consent-only clients use no server container: everything is served by Edge from the client's tracking host.
tabs *Consent · Details · About*, four categories (necessary, preferences, statistics, marketing), cookie declaration table per category, consent ID + date, floating cookie icon to change the choice later.
bc_consent cookie on the site's domain + localStorage;re-asked when the banner version is bumped in the dashboard.
trigger *Consent Initialization – All Pages*. Sets setDefaultConsentState per region rows (ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage, security_storage, wait_for_update), url_passthrough, ads_data_redaction, then loads <host>/bc/consent.js.
gtag('consent','update', …) on every choice (statistics → analytics_storage; marketing → ad_storage + ad_user_data + ad_personalization). functionality_storage / personalization_storage are always granted by default (eMAG style: Deny affects only the 4 ads/analytics signals); the dashboard option "follow the Preferences category" ties them to the Preferences toggle (Cookiebot style). The GTM template defaults follow the same rule.
Cookiebot style with inline unchecked category boxes. The Details tab always has Allow selection.
<script src="https://<host>/bc/consent.js"> as the first script sets the defaults itself.bc_consent_shown, bc_consent_ready (returning visitor), bc_consent_update, bc_consent_preferences, bc_consent_statistics, bc_consent_marketing — plus Cookiebot-compatible aliases cookie_consent_ready/update/preferences/statistics/marketing, so a site migrated from Cookiebot keeps its triggers.
<script type="text/plain" data-bc-consent="marketing" src="…">, <iframe data-bc-consent="marketing" data-src="…"> (placeholder with "Accept and show" button). data-cookieconsent is accepted too.
document.createElement so scripts fromknown analytics/ad domains inserted by JavaScript are held until the category is granted. Best effort — keep it off when everything runs through GTM with Consent Mode.
POST <host>/bc/consent (sendBeacon) → Edge writes (cale internă) (consent ID, timestamp, action, categories, banner version, language, country, anonymised IP, hashed UA, URL). Separate from the 7-day event logs; included in the nightly backup and restored by restore.sh. Dashboard: 30-day stats, last choices, CSV export (12 months).
Enable/disable · region · renew interval · language · privacy URL · decline button · widget · GPC · categories · appearance (position, colours, radius, logo, overlay) · Consent Mode options · auto-block · texts EN/RO · cookie declaration (presets library: Bigconvert, GA4, Google Ads, Meta, TikTok, Microsoft, ChatGPT Ads, LinkedIn, Pinterest, Snapchat, Hotjar, Clarity, YouTube, reCAPTCHA, PrestaShop, WooCommerce, Shopify, Stripe, Cloudflare; Scan website detects services + server cookies + a competing CMP) · cookie list starts prefilled (Ecommerce standard pack: Bigconvert, GTM, GA4, Google Ads, Meta, Instagram, TikTok, Pinterest, Microsoft, reCAPTCHA, YouTube + presets matching the tracking platforms; packs Ecommerce / Ecommerce RO (Criteo, RTB House, Profitshare, 2Performant, Gemius, PHP session, shop UX) / Lead generation / Minimal; 38 presets incl. AppsFlyer, Firebase, Crazy Egg, DataDome, Google Maps, Mapbox, Salesforce chat, Gomag, Magento, OpenCart; purposes EN + RO, RO shown when the banner is in Romanian; each provider has a "More details" privacy link) · re-consent (version bump) · install instructions (GTM / plain HTML / footer link) · preview via the demo page.
/signup?product=consent → the new-client form is preselected consent-only.https://gtm.bigconvert.ro/downloads/bigconvert_consent.tpl (also templates/consent/bigconvert_consent.tpl, built by node templates/build_consent_template.js): one field (the client's host), inject_script allowed for https://*.gtm.bigconvert.ro/*. Custom CNAME hosts need the personalised template from the dashboard. Ready for the GTM Community Template Gallery (add the GitHub repo + sha to metadata.yaml).forceChoice): hard overlay, page scroll locked, no widget until Accept / Deny / Allow selection. Keep the Deny button on (cookie walls without a real choice are frowned upon by several DPAs).Plan Consent (€11.99/month or €119.90/year, 1 site, no tracking). The banner is included in Growth, Business and Enterprise; Free and Pro are tracking only. A consent-only plan cannot enable the tracking product (dashboard refuses, Edge tracking=false).
consent.migrateTexts); edited texts are left alone.https://business.safety.google/privacy/ is always shown on the first screen and in About, together with an auto-generated list of all providers from the cookie declaration with their policy links.<head>.bc_consent_* triggers, manual attributes for hard-coded scripts, optional auto-block. The Consent tab shows a checklist with the status per finding./bc/consent.js (window.bcConsent.off=true), POST /bc/consent answers 404, no Consent Mode signals; settings, cookies and the log are kept. Remove or pause the GTM tag too, otherwise the tag's denied defaults remain.Per client, config.privacy.googleMode ('basic' | 'advanced'), set in Consent -> Consent Mode & blocking (since 2026-10-07; Settings -> Security & privacy shows it read-only, and edits it only for clients without the Bigconvert banner). Missing = advanced (every client created before 2026-10-03, unchanged behaviour); new clients are created with 'basic'.
| Basic | Advanced | |
|---|---|---|
| SDK -> our server before consent | nothing; events wait in memory (max 50) and go out with the current state when the banner emits bcconsent with consent, are dropped on refusal | sent at once, ephemeral id, signals denied |
| Edge -> server container (GA4 + Google Ads tags) | skipped unless analytics_storage or ad_storage is granted (consent mode basic: no analytics or ads consent) | forwarded with gcs/gcd denied |
| Google Ads gtag in the browser (SDK) | only with ad_storage | follows Consent Mode itself |
| Banner auto-block (when on) | also blocks gtag.js, google-analytics.com, doubleclick.net, googleadservices.com | never blocks Google measurement tags |
| Dashboard guidance | require consent on every tag, Google included | Google tags without additional consent, every other vendor requires it |
Non-Google platforms (Meta, TikTok, Microsoft, ChatGPT) need ad_storage in both modes, in the browser and on the server. Why both: Google's CMP Partner Program asks for "support for conversion modelling" (= advanced must be possible), while the EDPB (Guidelines 2/2023, adopted 2024-10-07) reads ePrivacy art. 5(3) as requiring consent for tracking pixels even without cookies. The site owner (controller) chooses; basic is the conservative default.
Per client switch consent.shopify (Consent tab -> Google Consent Mode & blocking -> *Shopify store*, ON|OFF, default OFF), passed to the banner as CFG.shopify. OFF + window.Shopify present -> one console warning per page saying the sync is off. edge/static/consent.js -> shopifySync(s), called from apply() (so: stored choice on load, implied consent outside the EU, every click, withdraw). If window.Shopify exists it loads consent-tracking-api 0.1 when needed and calls setTrackingConsent({analytics, marketing, preferences, sale_of_data}) (sale_of_data = marketing, false under Global Privacy Control). It skips the call when currentVisitorConsent() already matches, so Shopify's cookie is not rewritten on every page. If window.Shopify is not there yet it retries once on load; on other sites it does nothing. Replaces the Custom HTML tag with {{CMP - ... granted}} variables that Shopify guides suggest. Verified 2026-10-05 in a browser against a fake window.Shopify that records calls: no call before a choice, accept -> all true, withdraw -> all false, GPC -> sale_of_data false, same choice again -> no call, returning visitor -> stored choice sent. Not yet tried on a real Shopify store. Checkout *tracking* (purchase events) is a separate topic: the Shopify app.