Cookies about 30 minutes
Make analytics wait for cookie consent
Stop Google Analytics, the Meta Pixel and other trackers loading before a visitor says yes, with a banner that makes Reject as easy as Accept.
Skip to the promptWho needs this
- People in the EU, the UK or another opt-in country can use your site, even if you're based elsewhere.
- Your site loads analytics, advertising pixels, session recording, chat widgets, embedded YouTube or Maps, or anything else that stores or reads data on the visitor's device and isn't needed to run the service.
Why it matters
- In the EU and UK, storing or reading non-essential data on someone's device needs their consent first (ePrivacy Directive Art. 5(3), UK PECR reg. 6). Consent has to meet the GDPR standard: freely given, specific, informed and unambiguous, and as easy to withdraw as to give (GDPR Art. 4(11) and Art. 7(3)).
- Regulators enforce the design, not just the presence of a banner. France's CNIL fined Google €150 million and Facebook €60 million in 2022 because refusing cookies took more clicks than accepting them, and the UK regulator has written to major websites about banners without an equally easy Reject option.
- Apps built with AI tools often fail this because the analytics snippet and the banner are added separately and nothing connects them: the banner shows while the trackers have already run.
- Less obvious trackers count too. A German court ruled in 2022 that loading Google Fonts from Google's servers sent visitors' IP addresses to Google without a legal basis.
Before you paste
- A list of the tracking tools you use (look in your index.html, layout file and Google Tag Manager container).
- Whether you use Google tags (Analytics, Ads, Tag Manager), because they have their own consent settings.
- The URL of your cookie policy, or a note to create one.
The prompt
Copy it into your AI builder. Fill in anything in [brackets] first, and review every change before you ship it.
Prompt · paste into Lovable, Cursor, Claude Code or any AI builder
You are reviewing this app's cookies and tracking so it meets EU and UK consent rules. Work in this order.
STEP 1: INVENTORY (no code changes yet)
List every script, pixel, iframe, font or SDK that loads from a third party or sets cookies or local storage, including:
- analytics and tag managers (Google Analytics, Google Tag Manager, PostHog, Plausible, Mixpanel, Amplitude, Hotjar, Microsoft Clarity)
- advertising pixels (Meta Pixel, Google Ads, LinkedIn Insight, TikTok, X)
- chat and support widgets (Intercom, Crisp, Tawk.to)
- embeds (YouTube, Vimeo, Google Maps, social posts) and web fonts loaded from Google Fonts or other CDNs
For each, give the file and line, whether it's essential (needed to deliver what the user asked for: sign-in, security, load balancing, the consent choice itself, a shopping cart) or non-essential, and what it stores.
STEP 2: CONSENT BANNER
1. Show a banner on first visit with Accept all and Reject all buttons of the same size, style and prominence on the first layer, plus Manage choices for per-category toggles (Analytics, Advertising, Functional). Categories start switched off.
2. Explain in one or two plain sentences what each category does, with a link to the cookie policy.
3. Don't block the page behind the banner, and don't count scrolling or closing the banner as consent.
4. Store the choice with its date and the banner version. Ask again after 12 months or when the list of trackers changes.
5. Add a Cookie settings link in the footer of every page that reopens the banner, so people can change or withdraw their choice at any time.
STEP 3: GATE EVERYTHING NON-ESSENTIAL
1. No non-essential script, pixel or cookie loads until its category is accepted. Inject scripts only after consent; don't load them and hide them.
2. If Google tags are used: before any Google tag runs, set Consent Mode v2 defaults to "denied" for ad_storage, analytics_storage, ad_user_data and ad_personalization, and update only the categories the visitor accepts. Prefer not loading Google tags at all until consent ("basic" consent mode).
3. Replace embeds with a click-to-load placeholder ("This video is hosted by YouTube. Load video"), or use youtube-nocookie.com, so they don't load until the visitor chooses.
4. Self-host web fonts instead of loading them from Google Fonts.
5. Single-page apps: make sure route changes don't fire page-view tags while consent is denied.
6. Rejecting or withdrawing consent deletes the cookies those tools already set (for example _ga, _gid, _fbp) where the browser allows.
STEP 4: COOKIE POLICY
Create or update the cookie policy page with a table: name, provider, purpose, category, duration, and whether it's essential.
Don't remove any tracking: only make it wait for consent. When you're done: list every file you changed, explain each change in one line, and give me a step-by-step test for each numbered item above. Don't change anything unrelated.Builder tips
Lovable
Lovable often adds Google Analytics to index.html. Ask it to move the snippet into a consent-aware loader component instead of deleting it.
Cursor
@-mention index.html (or app/layout.tsx in Next.js) and any analytics.ts helper, since that's where tags are usually injected.
Claude Code
Ask it to grep for googletagmanager, gtag, fbq, clarity and posthog first, so the inventory is complete before it edits.
Common mistakes
- Reject hidden behind Manage choices or styled as a faint text link while Accept is a big button.
- Pre-ticked categories, or 'legitimate interest' toggles switched on for advertising.
- Google Tag Manager or Consent Mode 'advanced' sending data before the choice, on the assumption that it's cookieless and therefore fine.
- Embeds and Google Fonts forgotten because they don't look like trackers.
- No way to change your mind after the first visit.
Check it worked
- 1Open the site in a private window. Open DevTools (right-click → Inspect) → Network and tick Preserve log. Don't touch the banner.
- 2Filter the Network tab for google, facebook, doubleclick, clarity, hotjar, posthog and fonts.gstatic. Nothing should appear except essential requests.
- 3Open DevTools → Application → Cookies: no _ga, _gid, _gcl_au, _fbp or similar cookies yet.
- 4Click Reject all, browse three more pages including a route change: still nothing.
- 5Open Cookie settings in the footer, accept Analytics only: analytics requests start, advertising requests don't.
- 6Withdraw consent: the analytics cookies are gone after a reload.
What a SafeLaunch scan adds
A SafeLaunch audit opens your site in a real browser in clean sessions, records every cookie and request before a choice, after Reject and after Accept, checks whether Reject sits next to Accept, and tells you which of your 54 markets each finding breaks the rules of.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
Questions
Often not, if the tool truly stores nothing on the device and doesn't build profiles, but rules differ by country and by configuration. Check your provider's documentation and your main markets' regulator guidance before dropping the banner.
Advanced mode loads Google tags before the choice and sends cookieless pings. Many privacy professionals treat that as still needing consent in the EU and UK. Basic mode, where Google tags don't load until consent, is the safer default.
Yes, if people in the EU or UK use your site. The rules follow the visitor, not where the company is.
Sources
General guidance for common problems, not legal advice. Whether a rule applies depends on where you operate, who your users are and the size of your business.