5.7k stars · MIT · v3.1.0 (2025-02-04) · Track this in Rising ↗
Vanilla-JS GDPR consent with real script blocking — the banner that becomes necessary the day analytics goes live.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 23 Jul 2026, 3 months before this check.
Latest release v3.1.0 on 4 Feb 2025.
Public since July 2020, a little over 6 years.
5,719 stars and 508 forks.
0 commits and 2 new issues in the last 90 days.
29 contributors. No pull requests merged in 90 days; changes go in directly.
No security policy file says how to report a problem. No published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 27 Oct 2026 from the repository on GitHub. Covered in Edition 11.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You include one script and one stylesheet, then describe your categories in a configuration object. A category is a group of scripts, such as measurement or advertising, that the visitor accepts or refuses as a unit. Scripts marked as belonging to a category do not run until that category is accepted; the plugin controls the order rather than reporting on it afterwards. It supports per-service switches inside a category, so a visitor can accept one tool and refuse another. It has a documented interface for reading and changing consent later, so a "manage preferences" link works. Translations are built in, so a Russian-speaking visitor sees a Russian notice without a second copy of the code. It is written in plain JavaScript with no dependencies and no framework. What it does not do is decide which categories the law requires, and it does not read your scripts to find out what they do: both of those remain your decision.
Why it matters
Who it suits. Any site that is about to add measurement, advertising or any other script that writes to a visitor's browser, and that has visitors in Europe or the United Kingdom. It suits a site built with a static site generator particularly well, because there is nothing to compile. Skip it if a consent platform is already in place and audited, and skip it if the site genuinely sets nothing beyond what it needs to function.
Verdict. The cheapest useful item on this page and one of the three things to do, specifically because of ordering: install it in the same sitting as the measurement script or carry the exposure for however many weeks pass before anyone returns to it. Version 3.1.0 is dated 4 February 2026 and code landed on 23 July 2026, so it is finished rather than abandoned, which for a 30 kB plugin with a settled interface is the right state to be in. Two practical notes: the default styling is generic and matching a site is an afternoon of CSS, and the documentation is clear that the legal judgement is not included. AmauriC/tarteaucitron.js is the main alternative if you want a large catalogue of pre-written service definitions.
Summary (Key Points)from the README
Key features
- Lightweight: The project describes itself as a lightweight cookie consent plugin.
- GDPR oriented: The README calls it GDPR compliant.
- Plain JavaScript: It is written in plain JavaScript.
- Live playground: A playground demo is available to try before installing.
- Stackblitz examples: A few examples are available on Stackblitz.
- Hosted documentation: Full docs are published on the project's documentation site.
- npm package: An npm package is available, created and maintained by Till Sanders, who is credited in the README.
- Contribution guide: A contribution guide is provided for people who want to contribute.
- MIT License: The project is distributed under the MIT License.
Important
- Thin README: Setup, configuration and API details are not in the README and must be found in the external documentation.
- Unquantified claims: The "lightweight" and "GDPR compliant" descriptions are the project's own wording and come with no measurements or legal details in the README.
- Version check: The README is for CookieConsent v3, so older guides or examples may not match this version.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- Plain JavaScript with no dependencies, so it drops into a static site and a single-page application alike.
- It actually holds scripts back, which is the half most implementations get wrong.
- Translations are built in, so a second language is configuration rather than a second copy.
- Slow-moving: version 3.1.0 is from February 2026, and code last landed in July 2026.
- It supplies the mechanism and not the legal advice, so which categories apply is still a decision somebody has to make.
- The default appearance is generic, and matching a site's design takes a session of CSS work.
npm i vanilla-cookieconsent@3.1.0
