Your Only First Party Consent Manager

How the DataCops consent manager works, step by step

Most consent tools stop at the banner. They ask the question, store the answer in the browser, and hope every tag on the page listens. DataCops treats consent as part of the whole data path. The same answer decides what the browser loads, what Google tags do, what the server sends to your ad platforms, and what you can prove later. Here is each part, in the order a visitor meets it.

1. The banner loads from your own domain

The banner is part of the DataCops script, served from your own subdomain, for example datacops.yourshop.com. To the browser it is part of your site, not a third-party widget. Ad blockers and privacy browsers that strip third-party consent tools are much less likely to remove it, so more visitors see the question and more of them answer it.

Your banner settings are written straight into the page with the script. There is no extra round trip to fetch them, so the banner appears fast. If the settings cannot load in time, the page falls back safely instead of hanging.

2. Location decides who sees it

When the script loads, DataCops reads the visitor's country from Cloudflare, with our own IP service as a quick backup. The visitor is placed in one of three regions: EU, USA or global. By default the banner shows only where GDPR applies, which means the EU, the UK and Switzerland. Visitors elsewhere are tracked without a banner, so you do not lose data in markets that do not ask for one.

If you prefer a banner for everyone, one switch in the Consent Console turns on the global audience. The Console has three tabs: Report, CMP for the look and wording, and Google Consent.

3. Google Consent Mode v2 starts as denied

Before the banner and before Google Tag Manager, DataCops sets the Consent Mode v2 defaults. All four signals start as denied: ad_storage, analytics_storage, ad_user_data and ad_personalization. When the visitor chooses, the signals update. Google tags then follow the choice on their own, and Google can model the conversions it cannot observe.

A returning visitor's saved choice is applied straight away, so there is no flash of denied on every page view. DataCops also turns on Google's TCF support, ads data redaction and URL passthrough, and warns you in the browser console if Google Tag Manager loads before the DataCops tag. Consent Mode v2 is on by default and runs in advanced mode.

4. A real TCF v2.2 string for the rest of your ad tech

The banner is built to the IAB TCF v2.2 standard. It writes a standard consent string, uses the Global Vendor List, and answers the standard __tcfapi call. Any tool on your page that reads TCF can read the visitor's choice without extra wiring. The DataCops script and the ad pixels it loads also listen to __tcfapi, so they follow the same answer.

5. The server checks consent again before every send

This is the step most setups miss. A server-side tracking setup that ignores the banner is not a consent setup, because the server can send data the browser was told to hold back.

DataCops checks consent on the server before any conversion leaves for Meta, Google Ads, TikTok, LinkedIn, Microsoft Ads, Reddit, Pinterest or X. GDPR is treated as applying when the TCF string says so, when the visitor's country is in the EU, EEA, UK or Switzerland, or when Cloudflare places them in the EU, which also catches many VPN cases. In those places nothing is sent until the visitor opts in. Anywhere in the world, an explicit reject stops the send.

Every blocked send is written to your delivery rows with the reason consent_rejected. You can open the delivery report and see exactly which conversions were held back for consent, and which reached each platform.

6. A late yes still keeps the ad click

EU visitors often land from an ad and take a few seconds to answer the banner. In a basic setup that first page view, the one carrying the click ID, is lost. DataCops keeps data from before and after consent apart. The moment the visitor accepts, it sends their landing page view with its click ID to your ad platforms, so the ad that brought them still gets the credit.

Nothing that identifies the visitor long term is created before consent. The 400-day first-party cookie, which you can switch on per site to remember returning visitors, is only issued once consent allows it.

Proof, reports and deletion requests

Getting consent is half the job. Regulators and partners also ask you to show it, measure it and act on requests. DataCops covers all three in the same dashboard.

Consent audit log for GDPR Article 7(1)

Article 7(1) of the GDPR says that where you rely on consent, you must be able to show the person gave it. DataCops writes a consent record the first time a visitor chooses and every time the choice changes. Each record maps the choice to five purposes: strictly necessary, performance, targeting, functional and social media, each marked accepted or rejected. The log is append-only and linked to your site, with no expiry. If someone asks how a visitor's data reached Meta, you can show the choice that allowed it.

Consent report by region

The consent report shows how visitors answer your banner. Each day is split into accept all, partial and reject, by region (EU, USA and global) and by source. Bots are left out, so a crawler hitting your banner thousands of times does not drag your accept rate down. You also see counts for each purpose, so you know how many people allow targeting but not social media, for example.

The report is rebuilt from the consent log, so any day can be recalculated. Use it to test banner wording, compare regions, and explain to your team why EU conversions look lower than US ones.

Self-serve data deletion form

DataCops gives you a ready-made "delete my data" form for your privacy page. It is one embed line from your own DataCops subdomain. The visitor enters their email and gets a confirmation link. Nothing is deleted until they click it, which proves they own the inbox. The reply is the same whether or not the email is known, so the form cannot be used to find out who is in your data, and each email can make one request per site per day.

Once confirmed, the person's email, name and phone are wiped from their sessions, identified-user records are deleted, and any held CRM conversions for them are removed. They get a proof page with their email masked. You see every request under Consent, Privacy Requests, with a log, actions and a completion email. Requests are tracked and completed within 30 days, and the request record is kept as your proof.

If your own systems receive deletion requests, your server can send them to DataCops through the data deletion API with your API key. DataCops also meets Meta, TikTok and LinkedIn data deletion requirements: when a person removes the app on those platforms, the platform tells DataCops and the linked data is deleted.

Facts for your privacy policy

Your privacy policy has to say which tools receive visitor data. DataCops shows you your consent settings, whether returning-visitor memory is on, and every ad platform and destination you have connected, so the policy matches what your site really does. The banner links to your privacy policy and to each vendor's own policy.

One consent answer across your whole stack

A separate consent tool, a separate server-side container and a separate bot filter each hold a different idea of who agreed to what. DataCops is one tool, so one answer flows through tracking, server-side delivery, bot filtering and CRM sales. A visitor who rejects is not sent to Meta by the server. A bot is left out of your consent rates. A deletion request clears held CRM conversions too.

What happens after the visitor answers

Consent is the first check in a longer chain, and every step after it reads the same answer:

• 8 ad platforms. Conversions go server-side to Meta, Google Ads, TikTok, LinkedIn, Microsoft Ads, Reddit, Pinterest and X, each one checked against consent first.
• Delivery log with reasons. A conversion stopped by consent is written down with the reason "consent rejected", next to everything that was sent, skipped or failed. You can show exactly why a platform did not receive a visitor.
• Real people only. A per-platform switch, off by default. When it is on, bots and datacenter traffic are kept out of what that platform receives. VPN, proxy and Tor can be added.
• Counted once. Each conversion carries an event ID, and sales carry the order ID, so the browser and the server never count the same sale twice.
• CRM sales back to ads. Leads that turn into sales in your CRM go back to the ad platforms, with the same consent rules applied.
• Click fraud tools on Organization. Block bot IPs at the Cloudflare edge and export refund evidence for Google's Click Quality form, covering the last 60 days. Google decides the refund.

Because the banner and the tracking live together, you also skip the usual wiring work. There is no tag to fire on consent update, no trigger to map in Google Tag Manager, and no second vendor to keep in sync when you add a new ad platform.

Good to know before you start

• Load the DataCops tag before Google Tag Manager, so Consent Mode v2 defaults are set first. The console warns you if the order is wrong.
• The banner shows in the EU, UK and Switzerland by default. One switch shows it to every visitor.
• The consent report updates daily, which keeps the numbers stable and bot-free.
• Everything on this page is included on every plan, Free included, and hosted on OVHcloud in Europe.