The generated script does four things a consent tool has to do: it does not set anything non-essential before the visitor chooses; it records an actual choice (accept-all, reject-all, or per-category) with a timestamp; it re-asks when that record expires; and it only then runs the scripts whose category was granted. Scripts are gated by being marked up as type="text/plain" with a data-cookiecategory, which stops the browser running them until the visitor agrees.

Three honest limits. First, a banner is a user-interface component: whether your specific analytics, ad or embed tags are lawful is a policy question, not a code question — read the ICO or EDPB guidance for your region. Second, consent lives in localStorage on that one browser, so the same person on another device is asked again; that is the correct model for GDPR, which wants consent per device and per purpose. Third, this stores no record of the choice on a server, so if you need provable consent for a regulator you must log the cookieConsentChange event yourself.

The code is deliberately plain and dependency-free so you can read it. It makes no third-party request, which is the one thing a hosted CMP cannot say about itself.