CookieFort helps you collect consent choices and properly activate/deactivate your marketing & analytics scripts, while keeping proof evidence you can export.
Paste as the first script in <head> (or before </body>).
<script src="https://cookiefort.com/api/v1/widget.js?id=YOUR_PROPERTY_ID" async></script>Endpoints used by the widget and dashboard integrations.
# Widget config
GET /api/v1/config/{propertyId}
# Widget ingest
POST /api/v1/visit
POST /api/v1/consentSection 1
Installation flow
Example copied from dashboard Step 2 (replace IDs with your property).
<!-- Google tag (gtag.js) — GA4 config applied by widget after consent -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
</script>
<script src="https://cookiefort.com/api/v1/widget.js?id=YOUR_PROPERTY_ID" async></script>GTM-…, G-…, or for Matomo the server URL and site ID). Matomo is injected by the widget: the visit is measured on page view without cookies, and Matomo cookies are set only after analytics consent. No Google Consent Mode.gtag('config') in HTML — the widget applies it after consent).data-category
<script src="https://example.com/tag.js" data-category="ANALYTICS"></script><head>, or near the end of <body> depending on your CMS.Section 2
The CMP activates/deactivates tags based on consent categories. Use the data-category attribute to associate each script with a category.
<script type="text/javascript" data-category="MARKETING" src="https://example.com/pixel.js"></script>Section 3
denied, they send cookieless pings.cmp@cookiefort.com, Contact page). Google support asks for proof of that contact before it answers.Section 3c
consent default. That is a late consent signal.Section 4
The widget shows the banner (and its configuration view) and records user choices. In Advanced, Google tags may already be loaded and gated by Consent Mode. In Basic, they start only after an analytics or marketing choice.
If you disable the floating “Manage cookies” button, add a footer/menu link to /#cookiefort-manage-cookies (legacy: /#kookitrust-manage-cookies) so users can reopen preferences.
/#cookiefort-manage-cookiesSection 4a
Section 4b
document.documentElement.lang, then navigator.language) and shows the matching country link when set.privacyUrl) is shown — historical fallback behavior.Section 6
Proof of consent
The dashboard stores consent proofs: modal version, browser info, and a modal snapshot. Each row is one recorded decision (accept all, reject all, or customized choices). Export this log as CSV from “Consents”. Billing is based on the number of visits (browser session), not the number of decisions.
Section 7
A visit is an active browser session on your site: it starts when the page loads and ends when the tab or browser is closed. On first arrival, the visitor must make a consent choice; each new page load counts as a new visit. If the visitor accepted or customized preferences, their visitor ID is reused across visits; if they refused, a new ID is assigned on each visit. Changing preferences during the same browser session does not create an additional visit. Visits are counted on the site covered by your subscription over the current billing period. Mini, Starter, Growth, and Pro tiers include a monthly quota, a 7-day free trial, and overage billed in blocks. See the Pricing page and FAQ for details.
Are you an agency? See the Partner agency program chapter.
Section 8
GET /api/cron/daily-stats (or POST) with secret via Authorization: Bearer, x-cron-secret, or ?secret=.GET /api/cron/daily-stats?health=1 to compare latest aggregated date vs expected date.?backfill=7 (or N) to recompute previous days with idempotent behavior.npm run cron:daily-stats:smoke (uses APP_URL and CRON_SECRET from .env).GET /api/cron/daily-stats
Authorization: Bearer $CRON_SECRET
GET /api/cron/daily-stats?health=1
GET /api/cron/daily-stats?backfill=7