5.7k stars · MIT · v3.1.0 (2025-02-04)
Vanilla-JS GDPR consent with real script blocking — the banner that becomes necessary the day analytics goes live.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A small, dependency-free consent plugin written in plain JavaScript, with categories, per-service toggles, translations and a documented API for blocking scripts until the visitor agrees. Around 30 kB, no framework and no build step required.
Why it matters
PostHog (#8), Umami and any pixel you ever add all write to storage, and the moment one of them goes live on a site with European or UK visitors you need consent captured before the script runs — not a decorative banner that appears after the tracker has already fired, which is what most implementations actually do. The ordering genuinely matters here, which is why it is one of today's three things: install it in the same sitting as your analytics or you carry the exposure for however many weeks it takes you to come back. The bilingual detail is real too — it handles translations natively, so a Russian visitor sees a Russian banner rather than an English one, which is the same argument Edition 4 made about everything else on the site.
- Vanilla JavaScript — it drops into the Astro site and the React app equally, with nothing to compile.
- Real script-blocking rather than a cosmetic banner, which is the half most implementations get wrong.
- Multi-language support built in, so EN and RU are configuration rather than a fork.
- Seven months since v3.1.0. It reads as finished rather than abandoned, but it is not fast-moving.
- It gives you the mechanism, not the legal advice — which categories you need is still your call, and this report is not a lawyer.
- The default styling is generic; making it look like your site is a CSS afternoon.
A script tag on the Astro site and inside the React shell.
