Skip to content
Plain Theory

Consent people understand.Proof auditors accept.

Hold trackers until visitors choose, show the right notice in every region, and keep tamper-evident proof of each decision.

Try for freeRead the docs

Most banners only look compliant. Ours does the work.

Regulators click Reject and watch what still loads. These are the four things they check.

  • Nothing loads before consent

    Analytics and ad tags wait until the visitor agrees.

    A fine for getting this wrong: Shein, €150M · CNIL 2025

  • Reject is as easy as Accept

    Both on the first layer, with equal weight.

    A fine for getting this wrong: Google, €150M · CNIL 2021

  • Browser opt-outs honoured

    Global Privacy Control is applied automatically.

    A fine for getting this wrong: Tractor Supply, $1.35M · CPPA 2025

  • Leaks caught early

    If a tag fires after a decline, it shows up on your Leaks page.

    A fine for getting this wrong: Healthline, $1.55M · California AG 2025

Fines from each regulator's announcement. Not legal advice.

One installation covers every notice you need

The same 9.9 KB script works out which law applies to each visitor, shows them the right notice in their language, and tells your tags what they may do.

Where is your visitor?

shop.example · visitor in Paris

What they see

Your privacy choices

We'd like to use analytics and advertising cookies. Nothing runs unless you agree.

  • Analytics and ad tags are held until the visitor agrees
  • Reject all on the first layer, as easy as Accept all
  • Choices per purpose, withdrawable at any time

Google Consent Mode v2, before they choose

  • ad_storagedenied
  • analytics_storagedenied
  • ad_user_datadenied
  • ad_personalizationdenied

Held until the visitor agrees. Updated the moment they choose, and recorded on their receipt.

How we handle GDPR

One platform, from the banner to the audit

Each part shares the same configuration, the same receipts and the same API. Turn on what you need today and the rest is already wired.

  • Consent banner

    A bar, a centred modal or a corner notice in your colours and type. Accept and reject carry equal weight, so nobody is nudged.

    Banner options

  • Tracker blocking

    Analytics and ad scripts wait in place and run the moment someone agrees. Nothing loads early.

    How blocking works

  • Region rules

    GDPR opt-in in Europe, an opt-out in California and a DPDPA notice in India, decided at the edge for each visitor.

    Region mapping

  • Consent log

    Every decision becomes a receipt linked to the one before it by a SHA-256 hash. Change any record and verification shows exactly where.

    Try breaking the chain

  • Built for your stack

    One script tag that works with React, Next.js, Vue, Svelte, Angular and WordPress, or any site that renders HTML. Headless mode lets you render your own banner while we handle blocking and receipts.

    • HTML
    • React
    • Next.js
    • Vite
    • Vue
    • Svelte
    • Angular
    • WordPress
    See how to install
    app/layout.tsx
    import Script from "next/script";

<Script
  src="https://d34dtur9cre43o.cloudfront.net/sdk/v1/plain-consent.js"
  data-site="pk_live_7Hq"
  strategy="beforeInteractive"
/>
    Adding the consent script to a Next.js root layout

What your team sees on the other side

Visitors get a clear notice. Your team gets a builder, a scanner and a log, in one dashboard that a developer, a marketer and a DPO can all use.

Change layout, colours and copy and see the real banner update as you go.

  • Contrast checked against WCAG AA
  • Equal-weight buttons by default
  • Copy per region and language

Layout

Accent

Contrast 7.9 : 1, passes AA

Equal-weight buttons

Your choice about cookies

Essential cookies run this site. With your permission we'd also use analytics.

Reject allChooseAccept all

Don't just show a banner. Prove it worked.

When an auditor or the Data Protection Board asks, show them exactly what each visitor saw and chose, in a log no one can quietly edit.

Consent log

northwind.store

Chain verified

  1. #1043 Opted out of sale

    0c2925af…701b

    CCPA, Californialinks to 0bd3213d…8862

  2. #1042 Essential only

    0bd3213d…8862

    DPDPA, Indialinks to fc193c8b…979b

  3. #1041 Accepted analytics

    fc193c8b…979b

    GDPR, Germanylinks to 00000000…0000
Each receipt stores the hash of the one before it. Change any record and verification stops at that receipt.

  • Tamper-evident consent log

    Every decision is a receipt that carries the SHA-256 hash of the one before it. Edit or delete one and the chain breaks at that exact record.

  • Leak detection from real visits

    After a visitor declines, the script watches for tracker requests that still fire. Each one shows up on your Leaks page, page by page, before a regulator finds it.

  • Evidence Pack

    One export with the verified chain, the exact banner and languages shown, signals honoured and leaks found. Itself hashed, so it can't be quietly edited.

  • Verify it yourself

    Verification runs in one click. Anyone with your export can recompute the SHA-256 chain on their own and see that nothing was changed.

Want the full picture? How the log is built

Built for India's DPDP Act, not adapted to it

Notices in all 22 languages of the Eighth Schedule, an itemised list of data for every purpose, rights and grievance links, and consent records stored in India, in Mumbai.

Read the DPDPA readiness guide
  • অসমীয়াAssamese
  • বাংলাBengali
  • बड़ोBodo
  • डोगरीDogri
  • ગુજરાતીGujarati
  • हिन्दीHindi
  • ಕನ್ನಡKannada
  • كٲشُرKashmiri
  • कोंकणीKonkani
  • मैथिलीMaithili
  • മലയാളംMalayalam
  • ꯃꯤꯇꯩꯂꯣꯟManipuri
  • मराठीMarathi
  • नेपालीNepali
  • ଓଡ଼ିଆOdia
  • ਪੰਜਾਬੀPunjabi
  • संस्कृतम्Sanskrit
  • ᱥᱟᱱᱛᱟᱲᱤSantali
  • سنڌيSindhi
  • தமிழ்Tamil
  • తెలుగుTelugu
  • اردوUrdu

Customise Consent Preferences

DPDPA notice

Analytics

Counts visits and shows which pages are useful. Reported in aggregate, never sold.

Data collected
Pages visited, device and browser type, approximate city
Kept for
13 months
Withdraw
Any time, from Privacy choices on every page
Your rights. Access, correction and erasure, a grievance contact answered within 90 days, and a link to complain to the Data Protection Board.
An itemised DPDPA notice for the Analytics purpose

What Rule 3 asks for, done by default

  • Itemised noticeEach purpose lists the data it uses and how long it's kept.
  • Any of 22 languagesMachine-assisted drafts you review, with who reviewed them and when.
  • Withdrawal as easy as consentA Privacy choices button on every page and, on Business, signed webhooks to your other systems.
  • Rights and grievancesLinks to your rights page, a grievance contact and the Data Protection Board.

  1. , in effect

    Rules notified

  2. , next

    Consent Manager registration opens

  3. Notice, consent and withdrawal duties apply

A proposal to bring the May 2027 duties forward to November 2026 had not been notified as of October 2026.

Small enough to load first

Consent has to be decided before anything else runs, so the script that decides it can't slow the page down.

Script size
9.9 KB gzipped, with a hard 10 KB budget that fails our build if it's exceeded.
Delivery
Served from the CloudFront edge closest to your visitor. Your config is cached for 60 seconds.
Layout shift
None. The banner renders in its own shadow root, above your page, never inside it.
NetworkFirst visit
Example network waterfall: the consent script and its config load within 150 milliseconds, and the Google and Meta trackers are held until consent.
RequestSizeTiming
northwind.store18 KB0 to 110 milliseconds
plain-consent.js9.9 KB112 to 131 milliseconds
c/pk_live_7Hq.json1.1 KB131 to 146 milliseconds
app.css24 KB114 to 190 milliseconds
app.js96 KB116 to 290 milliseconds
gtag/jsHeldNot loaded. Waiting for consent.
fbevents.jsHeldNot loaded. Waiting for consent.
Plain Theory Your page Held until consent
Consent script weight on first load, gzippedSmaller is faster. Sources linked.

Questions teams ask first

Anything else? Email hello@theplaintheory.in.

Does Plain Theory block trackers before consent, or only show a banner?

It blocks them. Scripts you mark, and known trackers it recognises, are held in place and only run after the visitor agrees to their category. If one still fires after a decline, it shows up on your Leaks page with the page and the script (and, on Business, as a signed webhook).

Do we need to register with India's Data Protection Board to use a consent platform?

No. Only Consent Managers register with the Board, and using one is optional. A consent management platform like Plain Theory helps you, the Data Fiduciary, give proper notice, collect and record consent, and handle withdrawal.

How much does it cost?

Your first site is free for good, with real tracker blocking and a 90-day consent log. Paid plans start at $9 a month and are priced per account, not per domain, in US dollars, euros, pounds or rupees. Going over a limit never switches your banner off or adds a surprise charge.

See plans and pricing
Which laws does one installation cover?

GDPR and UK GDPR, CCPA/CPRA with Global Privacy Control, and India's DPDP Act, 2023 with the 2025 Rules. The visitor's location decides which notice they see, in their language where you've added it.

How do I prove consent to an auditor or the Data Protection Board?

Every decision is a receipt linked to the previous one by a SHA-256 hash. Verify the whole chain in one click, hand over the export so anyone can check the chain themselves, and export an Evidence Pack with the banner you showed and the signals you honoured.

Where is consent data stored?

In India, in AWS Mumbai (ap-south-1). EU or US residency is available on Enterprise, by arrangement. Raw IP addresses are never stored. They're truncated and hashed before anything is written.

Will it slow my site down?

The script is 9.9 KB gzipped, with a 10 KB ceiling our build enforces, and it's served from the nearest CloudFront edge. The banner renders in its own shadow root, so it doesn't shift your layout or clash with your CSS.

Start with one site today

Free for your first site. Upgrade when you add more sites or teammates.

Try for freeTalk to sales

No card needed · GDPR, CCPA/CPRA and DPDPA from one script