Consent

About

Consent management that lives inside Payload instead of next to it. Editors maintain third-party services, categories, descriptions and cookie declarations as ordinary Payload collections. The frontend gets a themeable banner, a settings dialog, and a script loader that keeps every non-essential tag out of the document until consent covers it. No external platform, no per-domain licence, no second script in the critical path. Register the plugin in `payload.config.ts`, then wrap the frontend layout with `ConsentProvider` (a React server component) and render `ConsentBanner`. Scripts added in the admin panel are then gated. The plugin registers collections for consent categories and services, a settings global, and an optional consent logs collection. It can seed four default categories (Essential, Functional, Analytics, Marketing) on first start, and access-control options restrict who can manage scripts, since inline script code executes on every page. It supports Google Consent Mode v2, with `gtag('consent','default', ...denied)` emitted inline in the head ahead of everything else and per-category signal mapping. Global Privacy Control is on by default: when `navigator.globalPrivacyControl` is true and nothing is stored, non-essential categories are denied and the banner stays hidden, but that derived decision is never written to the cookie. A `ConsentGate` component blocks embedded content such as iframes, with `allowOnce` for a single non-persistent reveal and `allowAlways` to persist the category. Withdrawal is deliberately asymmetric. Declared cookies, `localStorage` and `sessionStorage` keys are deleted, Consent Mode signals flip back to denied, and services set to reload trigger a page reload. A structural version hash over category slugs, essential flags and script keys re-prompts visitors only when the config shape changes; fixing a typo in a description does not. This is not a cookie scanner. It does not crawl the site, discover cookies, or maintain a vendor database. Consent logging is opt-in. Requires Payload 3.40+, React 19, and Next.js 15 for the server-rendered entry point.

Package info

Package name

@bespokecode/payload-consent

Latest version

1.0.1

Unpacked size

519 kB

License

MIT

Last publish

Aug 5, 2026