How to use CMPStack
A complete walkthrough — from signing up and scanning cookies to auto-blocking trackers, configuring regulations, installing on 18+ platforms, and reviewing consent logs. Built-in tags and webhooks unlock on Starter+.
Getting started
Create your account and add your first website.
- 1
Create a free account
Open Get started, then create an account with your email and password. You start on the Free plan with one domain, GDPR/CCPA/LGPD/PIPEDA or global mode, English banner, and core CMP features. Already registered? Use Sign in instead.
Create account → - 2
Add a domain
After signing in, open the Dashboard and click "Add domain". Enter your hostname without https:// — for example example.com or shop.example.com.
Open dashboard → - 3
Open your domain workspace
Click the domain card to open Overview. From there you can reach Settings, Compliance, Customize, Integrations, and Consent Logs from the sidebar. Account pages — Billing, Profile, MCP, Notifications, Support, and Reports — are available from the main sidebar.
Verify your domain
Confirm domain ownership with a DNS TXT record before the banner loads on your live site.
- 1
Open domain Settings
Go to Dashboard → your domain → Settings. The DNS verification card shows the TXT host and value you need to add.
- 2
Add the DNS record
In your DNS provider (Cloudflare, Namecheap, Route 53, etc.), create a TXT record with the host and value shown in the dashboard. DNS propagation can take a few minutes.
- 3
Click Verify domain
After the record is live, click "Verify domain" in Settings. Once verified, the banner can load on your production site and you will receive an in-app notification.
Tip: Unverified domains still work in preview, but production embeds require verification.
Compliance settings
Configure regulations, languages, blocking, webhooks, and legal links.
- 1
Choose a regulation mode
In Compliance, pick GDPR (EU), CCPA (US), LGPD (Brazil), PIPEDA (Canada), or Global — available on every plan. Geo-targeting on Starter+ maps EU → GDPR, US → CCPA, Brazil → LGPD, and Canada → PIPEDA automatically.
- 2
Add legal URLs
Enter your Privacy Policy URL, Cookie Policy URL, and Do Not Sell / opt-out URL (for CCPA, LGPD, and PIPEDA). These appear as links inside the consent banner.
- 3
Set consent renewal
Choose how many days before visitors are asked again (default 365). Set to 0 to never renew automatically.
- 4
Enable languages
Select which languages your banner supports. Free includes English only; Starter and above unlock all 20 preset translations. CMPStack auto-detects the visitor browser language.
Tip: Includes European, Japanese, Korean, Arabic, Turkish, Nordic, and Central European languages.
- 5
Blocking & privacy options
Enable auto-block for known trackers (GA, Meta, Hotjar, etc.), manual script blocking via data-cmpstack-category (legacy: data-consently-category), YouTube/Vimeo iframe blocking, GPC signal honoring, and subdomain consent sharing as needed.
- 6
Add a consent webhook (Starter+)
On Starter and above, paste a webhook URL to receive JSON POST requests whenever a visitor accepts, rejects, or saves custom consent preferences.
Customize the banner
Edit copy, colors, layout, and positions with live preview.
- 1
Open the Customize page
Go to Dashboard → your domain → Customize Banner. Use the tabs: Initial Banner, Consent Manager, and Cookie Button.
- 2
Edit banner copy
Change the title, description, button labels, manager title, and category names/descriptions. On Free, a powered-by line appears unless you upgrade to Starter to remove branding.
- 3
Set colors
Pick primary and text colors. CMPStack automatically adjusts contrast so text stays readable on the banner background.
- 4
Choose positions
Place the initial banner at bottom-left, bottom-center, bottom-right, top corners, or center modal. Set the floating cookie button to one of six positions.
- 5
Configure responsive layout
In the Responsive section, choose mobile sheet or card layout, row or stacked buttons per breakpoint, and manager sheet or centered style. Preview at 375px, 768px, and desktop widths.
Tip: Changes save to the API instantly — you do not need to edit the embed code again.
- 6
Switch designs with the Banner Gallery
Open Dashboard → your domain → Banner Gallery to save multiple named banner designs and pick which one is live. Apply a curated template or one of your saved designs; only one is active at a time, and Customize edits the active one.
- 7
Run a banner A/B test (Starter+)
Open Dashboard → your domain → Consent Logs. Enable Banner A/B test to send a share of visitors a Variant B title/description/buttons. Variant A uses your Customize settings. Assignment sticks in localStorage; consent logs record A vs B so you can compare accept rates.
Integrations (GA4, GTM, Hotjar, Meta, TikTok & more)
Connect analytics and marketing tags that respect cookie consent (Starter+).
- 1
Open Settings
Go to Dashboard → your domain → Settings → Analytics Integration. All built-in integrations require Starter or a higher plan.
- 2
Pick a statistics provider
Choose Google Analytics 4 or Google Tag Manager — only one statistics provider at a time. These load after Statistics consent.
- 3
Add marketing integrations
Optionally enter Meta Pixel, Microsoft UET, LinkedIn Insight Tag, TikTok Pixel, Pinterest Tag, or Snapchat Pixel IDs. These load only after Marketing consent.
- 4
Add statistics integrations
Optionally enter Hotjar Site ID or Microsoft Clarity Project ID. These load only after Statistics consent, alongside GA4 or GTM if configured.
- 5
Save and verify
Click Save analytics. Google Consent Mode v2 defaults are denied on page load. Microsoft UET Consent Mode and Clarity consent signals also default to denied until marketing/statistics consent. Use browser devtools → Network (and Tag Assistant) to confirm tags fire only after the matching category is accepted.
Tip: Free HTML scan: /tools/consent-mode-checker. Auto-blocking also catches many third-party scripts even without built-in integration IDs.
Free compliance tools
Policy drafts, Consent Mode checker, DSAR form, and regulations map.
- 1
Generate legal drafts
Use the Privacy Policy, Cookie Policy, and Terms generators to produce a starting template for your site. These are not legal advice — have counsel review before publishing.
Privacy policy generator → - 2
Check Consent Mode signals
Paste a URL into the Consent Mode checker for a quick HTML scan of gtag/GTM and consent default markers.
Consent Mode checker → - 3
Handle data subject requests
Visitors and account holders can submit access, deletion, correction, export, or opt-out requests via the DSAR form.
DSAR form → - 4
Review regulations coverage
See how GDPR, CCPA/CPRA, US state laws, LGPD, PIPEDA, Google Consent Mode, Microsoft Consent Mode, and the TCF/Google CMP roadmap map to product features.
Regulations →
Claude / Cursor MCP server
Manage domains, banners, and scans from Claude, Cursor, or VS Code.
- 1
Enable MCP access
Sign in as the workspace owner and open Dashboard → MCP. Turn on MCP access. Team members cannot enable this.
MCP settings → - 2
Create a personal access token
Name the token (for example Claude or Cursor), create it, and copy the secret immediately. We store a hash only and cannot show it again. Disabling MCP access revokes every token.
- 3
Connect your client
Point Claude Code, Cursor, or VS Code at /api/mcp with an Authorization: Bearer header. Connection snippets are on Dashboard → MCP and the MCP docs page. CMPStack is not yet listed in Claude’s connector directory.
MCP docs → - 4
What the assistant can do
Read-only tools list domains, fetch embed code, check banner/install status, return scan counts, and summarize compliance flags. Write tools can change live banner colors or position and trigger a cookie scan (scan quota still applies). Consent logs, cookie values, billing, and legal copy are never returned.
Tip: Keep tool-approval prompts on for write calls. This is a configuration check, not legal advice.
Install the embed script
Add CMPStack to your live website in one step.
- 1
Copy the snippet
In Settings, copy the embed code shown under Installation. It includes your domain ID. If you use the Cloudflare CDN, the snippet also sets data-api-origin so banner APIs still hit your app.
- 2
Paste in <head>
Add the script as the first tag inside <head> on every page — before Google Analytics, GTM, or other third-party scripts. Platform-specific steps: Integrations page.
Platform integrations →embed.html<script src="https://your-app.com/consent.js" data-domain-id="YOUR_DOMAIN_ID" ></script> - 3
Using WordPress?
Install the official WordPress plugin — it injects the script in <head> automatically. Download from Dashboard → Integrations.
WordPress install guide → - 4
Load order matters for blocking
CMPStack must load before other scripts in <head> so auto-blocking catches trackers. Tag custom scripts with data-cmpstack-category (legacy: data-consently-category) when needed.
Tip: After publishing, open your site in a private window to test the first-visit banner.
WordPress integration
Install the official plugin on WordPress — no theme file edits required.
- 1
Open the Integrations page
Go to Dashboard → your domain → Integrations for your live Domain ID, Script URL, and step-by-step WordPress setup with copy buttons.
Platform integrations → - 2
Download the plugin zip
Click Download plugin on the Integrations page or use the link below.
Download WordPress plugin → - 3
Upload and activate
In WordPress admin, go to Plugins → Add New → Upload Plugin. Choose cmpstack-wordpress.zip, click Install Now, then Activate.
- 4
Configure Settings → CMPStack
Paste your Domain ID and Script URL from the dashboard Integrations page into WordPress Settings → CMPStack, then save.
Tip: Each WordPress site must use the domain ID that matches the hostname you added in CMPStack.
- 5
Verify and test
Verify DNS in CMPStack Settings, then visit your WordPress site in a private browser window. Dashboard changes apply automatically without reinstalling the plugin.
Open dashboard →
Platform integrations (18+)
Install CMPStack on WordPress, Shopify, Webflow, and other platforms.
- 1
Open the Integrations hub
Go to Dashboard → your domain → Integrations for your live Domain ID, Script URL, and platform-specific setup steps with copy buttons.
Browse all integrations → - 2
Pick your platform
Guides cover WordPress, WooCommerce, Shopify, Magento, PrestaShop, BigCommerce, Webflow, Framer, Wix, Squarespace, Bubble, Ghost, Joomla, Drupal, Next.js, React, Nuxt, plain HTML, and Cloudflare.
- 3
Place the script in <head>
Every guide uses the same rule: paste consent.js as the first script inside <head>, before GA4, GTM, or other third-party tags. The WordPress plugin does this automatically.
Tip: Dashboard → Settings also shows the embed snippet with a head placement comment.
Block scripts & embeds
Auto-block known trackers or manually tag scripts and iframes.
- 1
Auto-block known trackers
With auto-block enabled (default), CMPStack intercepts known tracker scripts as they are added to the page — Google Analytics, Meta Pixel, Hotjar, HubSpot, LinkedIn, TikTok, and more — and holds them as type="text/plain" until consent. Place the embed first in <head> so the interceptor is installed before other tags.
- 2
Tag scripts by category
For scripts not in the auto-block database, add data-cmpstack-category (or the legacy data-consently-category). Use necessary, preferences, statistics, or marketing.
embed.html<script src="https://example.com/pixel.js" data-cmpstack-category="marketing" async ></script> - 3
Block video embeds
YouTube and Vimeo iframes are blocked until Marketing consent when iframe blocking is enabled in Compliance. The embed placeholder restores after consent.
- 4
Built-in integrations
GA4, GTM, Hotjar, Clarity, Meta Pixel, Microsoft UET, LinkedIn, TikTok, Pinterest, and Snapchat added through Settings are gated on the correct consent category automatically.
Consent logs & analytics
Review visitor choices and measure opt-in rates.
- 1
View consent events
Open Dashboard → your domain → Consent Logs. Each accept, reject, or custom action is listed with timestamp and browser info.
- 2
Check overview stats
The domain Overview page shows total events and accept/reject/custom rates. Consent rate analytics require Starter or above.
- 3
Export logs (Pro)
Pro plans can export consent logs as CSV from the Consent Logs page for audits and compliance records.
- 4
What is logged server-side
CMPStack records the action, category preferences, a unique consent ID, language, region, user agent, and IP address for your audit trail. Retention depends on your plan: 14 days (Free), 90 days (Starter), or 1 year (Pro).
Tip: Preferences are also stored in the visitor browser via localStorage for instant reloads.
In-app notifications
Stay on top of setup tasks, billing, and domain limits.
- 1
Open the notification bell
Click the bell icon in the dashboard header to see recent alerts. Unread count appears as a badge.
- 2
What triggers notifications
You receive alerts when domains are added or verified, plans change, billing updates, domain limits are reached, or domains need verification.
- 3
Mark as read
Open Dashboard → Notifications for the full inbox. Click any notification to jump to the related page, or use "Mark all read" to clear unread items.
Open notifications →
Plans & billing
Understand plan limits and manage your subscription.
- 1
Compare plans
Free ($0) includes one domain, GDPR/CCPA/LGPD/PIPEDA or global mode, English banner, auto-blocking, and Consent Mode v2 defaults. Starter ($5/month) adds geo-targeting, declaration editor, branding removal, A/B testing, scan email alerts, 10 built-in tag integrations, 20 languages, consent webhooks, and analytics. Pro ($29/month) adds up to 5 domains, team seats, weekly digest, agency PDF report, auto-rescan, CSV export, and IAB TCF 2.2 widget mode (CMP ID pending). Business has no flat fee — it is quoted from your domain list ($5/domain/month) and includes unlimited domains, volume reporting, and priority support.
View pricing → - 2
Setup wizard & agency report
Use Dashboard → Setup wizard to add a domain, verify DNS, scan cookies, and live-check that consent.js is installed. Pro+ accounts can open Agency report and print to PDF for client delivery.
Open setup wizard → - 3
Upgrade from the dashboard
Open Dashboard → Billing to see your current plan, compare tiers, and start checkout for Starter or Pro. Business is quoted from the domains on your list — contact sales to activate it. Toggle weekly digest from Profile on Pro+.
Open billing → - 4
Manage subscription
After upgrading, use the billing page to open the Paddle customer portal for invoices, payment method updates, or cancellation.
Get support
Contact the team with plan-based response times.
- 1
Open the Support page
Go to Dashboard → Support to see your plan's support tier, response time, and available channels.
Open support → - 2
Submit a request
Use the contact form on the Support page or the public Contact page. Paid plans tag requests with priority for faster handling.
Contact form → - 3
Support tiers by plan
Free: community (3–5 business days). Starter: email (1–2 days). Pro: priority (within 24 hours).
Manage multiple websites
Run separate banners for each domain from one account.
- 1
Add more domains
From the main Dashboard, add each website as a separate domain. Every domain has its own settings, compliance rules, embed code, and logs.
- 2
Use the correct domain ID
Each embed snippet contains a unique data-domain-id. Never reuse one domain's snippet on another site.
- 3
Plan limits
Free and Starter include 1 domain. Pro includes up to 5 domains. Upgrade in Billing when you need more.
View pricing →
Troubleshooting
Fix common issues when the banner or analytics does not behave as expected.
- 1
Banner not showing
Confirm the embed snippet is on the live page, the domain is verified, the domain ID matches the dashboard, and the browser has not already stored consent. Check the console for blocked API requests.
- 2
Banner shows but styles are old
The widget fetches the latest config from the API on each load. Hard-refresh the page or clear localStorage keys starting with cmpstack_ (legacy installs may still use cookieconsent_) to simulate a first visit.
- 3
GA4/GTM not firing
Verify you are on Starter or above, Statistics cookies were accepted, the correct ID is saved in Settings, and no ad blocker is interfering. Consent Mode defaults stay denied until consent is granted.
- 4
Script still runs before consent
Confirm auto-block known trackers is enabled in Compliance. Place CMPStack as the first script in <head>. If the script is not in the auto-block database, add data-cmpstack-category (legacy: data-consently-category) and ensure CMPStack loads before it.
- 5
YouTube embed plays before consent
Enable block marketing iframes in Compliance. The iframe src is removed until Marketing cookies are accepted.
- 6
Webhook not firing
Consent webhooks require Starter or above. Verify the webhook URL in Compliance is correct and accepts POST JSON. Check your endpoint logs — CMPStack sends the payload after the consent log is saved.
- 7
Still stuck?
Contact support with your domain name, domain ID, page URL, and a screenshot of the issue.
Contact support →