Saltbox CMP

Geo-aware cookie consent, Google Consent Mode v2

One snippet. Resolves the visitor's location, applies the right consent defaults for their jurisdiction, and renders a fully namespaced banner you can style with a single CSS block.

Live status on this page

The banner below is running live. These values were resolved from your request:

Country…

Region…

Matched rule…

Consent profile…

GPC signal…

Saved choice…

Geo lookup…

GTM container

Loads GTM-K5LPNKVM by default. Enter a different container id and hit Reload — it's stored in a session cookie and used on every reload until you close the browser or reset to the default.

Currently loaded: …

dataLayer console

Live dataLayer pushes — consent defaults, GTM, and the CMP's own events. 0 captured.

Waiting for dataLayer activity…

1 · Install the snippet

Paste this into the <head> of every page, as high as possible and before your Google tags / GTM. It's a blocking load on purpose: the script sets denied-by-default consent synchronously the moment it runs, so consent defaults are guaranteed to be in place before any tag fires. The file is tiny and the geo lookup, rules, and banner render happen asynchronously after — so it won't hold up your page.

<script src="https://saltbox-cmp.saltbox-solutions.com/cmp.js"></script>

That's it — geo lookup, jurisdiction routing, the banner UI, and consent persistence are all handled. Configure copy, links, and theme in cmp-config.json on the CMP host; no code change or re-deploy on the customer site is needed.

2 · Style it (optional)

Every element is namespaced under the sbcmp- prefix and themed through --sbcmp-* CSS variables, so it can't collide with your site. Drop this block into your own stylesheet and change the values:

/* Saltbox CMP theme overrides */
.sbcmp-root {
  /* Keep --sbcmp-fg and --sbcmp-muted at >=4.5:1 contrast against --sbcmp-bg (WCAG AA) when overriding. */
  --sbcmp-font: inherit;
  --sbcmp-bg: #ffffff;
  --sbcmp-fg: #161b26;
  --sbcmp-muted: #475569;          /* secondary text — ~7.6:1 on white (AA) */
  --sbcmp-border: #d9dee7;
  --sbcmp-accent: #0b6e4f;          /* primary button + toggles */
  --sbcmp-accent-fg: #ffffff;
  --sbcmp-secondary-bg: #f2f4f8;
  --sbcmp-secondary-fg: #1a1f2b;
  --sbcmp-radius: 14px;             /* panel corners */
  --sbcmp-btn-radius: 10px;
  --sbcmp-shadow: 0 12px 40px rgba(16,24,40,.18);
  --sbcmp-overlay: rgba(16,24,40,.45);
  --sbcmp-max-width: 460px;         /* banner width */
  --sbcmp-z: 2147483000;
}

/* Need finer control? Target namespaced classes directly, e.g.: */
.sbcmp-panel { /* the banner / modal container */ }
.sbcmp-title { /* heading */ }
.sbcmp-btn-primary { /* accept button */ }
.sbcmp-btn-secondary { /* reject / continue button */ }

3 · Reopen link for "Your privacy choices"

A floating shield button appears bottom-left. To trigger the preferences modal from your own footer link instead:

<a href="#" onclick="SaltboxCMP.openPreferences(); return false;">Your privacy choices</a>

How the routing works

On load, denied-by-default consent is set synchronously (tags wait via wait_for_update).
Geo is fetched from geo-cmp.saltbox-solutions.com; the rule set is consent-jurisdiction-rules.json.
The resolved location + profile are cached in a first-party functionality cookie (sbcmp_geo, a session cookie by default). Reloads within the session reuse it and never re-call geo; a new browsing session re-checks, so staleness is bounded if the visitor moves or switches networks. (Set geoCacheScope: "ttl" + geoCacheHours for a persistent window instead.)
The banner carries a collapsible "Which privacy rules apply to me?" disclosure listing the matched jurisdiction, consent model, and the exact laws driving the defaults — each with citation, official-source link, and a required by law vs conservative baseline flag. Useful for an auditor who VPNs into a specific state or country.
Rules are evaluated by ascending priority, first match wins → a consent profile (e.g. STRICT_OPT_IN, US_OPT_OUT).
The profile decides the default consent state and which first-layer buttons show (opt-in shows Accept/Reject; opt-out shows Continue/Opt-out).
A Global Privacy Control signal merges the profile's gpcOverride on top and locks advertising/personalization off.
A valid saved choice (same policy version, within the re-consent window) is honored without re-prompting.
If geo lookup fails, it falls back to the strict global profile — never silently to US opt-out.

Implementation baseline, not legal advice. Confirm jurisdiction applicability, sector rules, and sensitive-data handling with counsel.