Case Studies Konsentra: a privacy-first cookie consent plugin
Konsentra: a privacy-first cookie consent plugin
TL;DR Most cookie banners ask for consent but load the tracking scripts anyway. Konsentra blocks scripts by category until the visitor opts in, so consent actually means something. It runs on your own site with no third-party consent service in the loop.
Cookie banners have a credibility problem. A lot of them are theater: the banner appears, the visitor clicks accept or ignores it, and the tracking scripts were already running either way. That is not consent, it is a formality. I built Konsentra because I wanted a banner that actually does what it claims.
The problem
Under the GDPR and similar rules, non-essential cookies need consent before they are set. The catch is timing. If your analytics and marketing scripts load on the first page view, the tracking has already happened by the time the visitor sees the banner. Clicking decline afterwards does not undo it.
Plenty of consent plugins get this wrong. They manage the banner UI but not the scripts, so the site stays non-compliant under the surface. Others solve it by handing the whole flow to a third-party consent service, which means your visitors' choices, and often their identifiers, travel to yet another company.
The approach
I set two rules for Konsentra.
- Block first, load on consent. Scripts in a non-essential category must not run until the visitor opts into that category. Consent has to come before the cookie, not after.
- Keep it on your site. No external consent platform in the middle. The banner, the categories, and the decision all live in your WordPress install.
What shipped
Konsentra groups scripts by category and holds the non-essential ones until the visitor makes a choice. Accept analytics and only the analytics scripts release. Decline marketing and those stay blocked. The visitor can change their mind later, and the site respects it without a page of fine print.
Because it runs on your own site, there is no third-party consent vendor collecting the interaction. That is a smaller privacy footprint and one less processor to name in your policy.
What I learned building it
The interesting engineering was the blocking, not the banner. You have to intercept scripts before they execute and re-release them cleanly once consent lands, without breaking the ones that depend on load order. Getting that right, across the range of ways themes and plugins inject scripts, was most of the work.
The lesson that stuck: a consent tool is only worth anything if the "decline" path is real. A banner that tracks you anyway is worse than no banner, because it launders non-compliance as compliance. Konsentra is free on WordPress.org.
FAQ
Do cookie banners actually block tracking?
Many do not. They show a banner and set a flag, but the analytics and ad scripts still load on the first visit. Real compliance means the scripts do not run until the visitor agrees. Konsentra holds the scripts back per category and releases them only on consent.
What does per-category blocking mean?
Cookies get grouped, for example necessary, analytics, and marketing. A visitor can accept some and decline others. Per-category blocking means an analytics script loads only if the analytics category is accepted, independent of the marketing one.
Does Konsentra rely on an external service?
No. It runs on your WordPress site. There is no third-party consent platform receiving your visitors' choices, which keeps the data on your side and removes one more external dependency from your privacy story.