Documentation

Installing the banner, and what you need to mark

One line to paste, and we tell you what to fix. Here is exactly what the script does, and what it cannot do on its own.

1. The line to paste

At the very top of your <head>, before any other <script> tag:

<script src="https://orbeconsent.com/c/YOUR-KEY.js"></script>

No async and no defer: the script has to run before the others so it can hold them back. It weighs about 18 KB compressed and already contains your settings (a single request, cached for 5 minutes).

2. What gets blocked automatically

scripts added by other scripts (tag managers, plugins, createElement('script'), document.write, innerHTML);
pixels (new Image()) and dynamically inserted iframes;
network calls (fetch, XMLHttpRequest, sendBeacon) to known services;
Google Consent Mode v2: the default “denied” state is set before any Google tag runs.

3. What you need to mark yourself: hard-coded tags

To be straight with you: a <script src> or <iframe src> tag written directly in your HTML is picked up by the browser’s preload scanner and downloaded before our script has even run. The script then stops it from executing, but the request has already gone out: the third party has received the visitor’s IP address and the page they were on, and its response can read or set its own cookies if the browser allows them. No script, ours included, can prevent that. To stop the request from going out at all, mark the tag:

Script: add type="text/plain" and the category.

<!-- before -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
<!-- after -->
<script type="text/plain" data-consent="mesure" async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>

Inline script: same thing.

<script type="text/plain" data-consent="marketing">
  fbq('init', '1234'); fbq('track', 'PageView');
</script>

Iframe (video, map): replace src with data-consent-src. A “Load content” placeholder is shown in its place until the visitor has accepted.

<iframe data-consent="social" data-consent-src="https://www.youtube.com/embed/ID" width="560" height="315"></iframe>

Categories (these identifiers stay as they are, whatever the language of your site): mesure (audience measurement / analytics), marketing (advertising), social (external content). Once the script is in place, run the verification scan from your dashboard: it visits your pages with the script installed and lists any tags that still fire, with the fix for each one.

4. Consent Mode v2

By default (“basic” mode), Google tags are blocked until the visitor consents. In “advanced” mode (a banner setting), they load in denied mode, without cookies, and receive the update when the visitor consents.

5. Reopening the banner and reading the choice

A round “Manage cookies” button stays at the bottom of the page once a choice has been made. You can also add a link to your footer:

<a href="#" onclick="Consent.open();return false">Manage cookies</a>

Consent.get()            // { decided, choices: { mesure, marketing, social }, … }
Consent.on('change', s => { /* new choice */ })
window.addEventListener('consent:change', e => console.log(e.detail))

6. Invisible mode

If your site only uses services that are exempt from consent, no banner is shown. Undeclared services stay blocked. You decide whether a service is exempt: an audience measurement tool only qualifies if it meets the conditions set by the CNIL, the French data protection authority (used solely to measure your own site’s audience on your behalf, anonymous statistics, no cross-referencing or sharing with third parties, trackers limited to 13 months and data to 25 months). You must still tell your visitors about these trackers, for example in your privacy policy.

7. The proof

Each choice is sent to https://orbeconsent.com/api/v1/consent (only from your declared domain). The IP address is never stored in clear. The log is hash-chained and, depending on your plan, sealed every night (RFC 3161 timestamp and OpenTimestamps). CSV export and PDF evidence file from your dashboard. This sealing proves that the log has not been altered after the fact and that it existed on a given date; it is not a qualified timestamp within the meaning of the eIDAS Regulation, and on its own it does not prove that your banner is compliant. The log is kept for as long as the site is in your account: it is up to you to decide how long you keep your records.

8. Cookie policy

An up-to-date cookie policy page is hosted for each site: https://orbeconsent.com/politique/YOUR-KEY. The banner links to it by default; you can point to your own page in the settings.