We built cookie consent before we had a single cookie

This site sets no cookies. It runs no analytics, no advertising, no third-party trackers. Two preferences are stored in your browser’s local storage: which cookie choice you made, and whether you asked the site to stop animating.

We shipped a consent mechanism anyway. Here is why, and what we think most implementations get wrong.

Why now, when there is nothing to consent to

Because of the order things normally happen in.

The usual sequence is: install analytics, notice later that you need a consent banner, add one, and in the gap between those two events collect data you had no permission for. The gap is rarely deliberate. It is just that the tool is a five-minute job and the banner is not.

Building the mechanism first inverts that. When we add analytics, the setting a visitor already chose applies to it immediately, and there is no window where the default is “collect”.

It also forced us to write down exactly what is stored, which turned out to be a shorter list than we assumed, and worth publishing as-is.

The part that is usually wrong

Most consent banners fail on one specific thing, and it is not a technicality.

Reject has to be as easy as accept. Not present somewhere. As easy. An accept button styled as the primary action next to a reject styled as a small grey link is the defect regulators have been most consistent about, and it is entirely avoidable.

Ours are the same component, the same size, side by side. We have a test that asserts the two buttons have identical CSS classes, which sounds pedantic and is the only way this stays true through a redesign.

Three more that follow from the same principle:

Nothing is pre-ticked. Silence is not consent, and a pre-ticked box is a way of collecting silence.

Withdrawal is as easy as granting. A control in the footer of every page reopens the panel. If it is easier to give permission than to take it back, the permission is not worth much.

The default is denied, and it is set before anything could act on it. Our consent defaults are inline in the document head, ahead of every other script. A deferred module runs too late: by then a tag could already have fired and made the decision for us.

The detail we enjoyed most

We store the decision in local storage rather than a cookie.

This means the site genuinely sets zero cookies, including the one that remembers you declined cookies. A consent banner that has to set a cookie to record your refusal is a small joke at the visitor’s expense, and it is avoidable in about four lines.

We also honour Global Privacy Control automatically. If your browser sends that signal we record the refusal and never show the banner at all, because you have already answered.

What this is not

It is not a claim to be more principled than anyone else. The cost of doing this was one afternoon, and it was cheap precisely because we have no existing analytics to migrate and no revenue depending on tracking.

The point is narrower: the reason most consent implementations are bad is that they are retrofitted onto something already collecting data, at which point every correct choice costs someone a metric. Doing it before there is a metric to lose makes the correct choices free. We had the window, so we used it.