Can I not just install a consent plugin and be done?

Installing it is genuinely easy. The part that matters is a separate configuration called prior blocking, and without it the plugin will happily render a banner while every tag underneath keeps firing exactly as before. A banner over unchanged tracking is a picture of consent, not consent, and it is the state we most often find when we first look at a site.

Does this make us compliant?

No, and be careful of anyone who says it does. Compliance is decided by a regulator or a court, never by a supplier. What we do is technical implementation — the audit, the blocking, the wiring, the banner behaviour and the evidence. The wording of your privacy and cookie policies needs confirming by your own legal adviser, and we mark the specific points where that judgement is required.

Will my analytics data drop after this?

Some of it, yes, and you should hear that before we start rather than after. Visitors who decline are no longer measured. With Consent Mode v2 configured, Google fills part of that gap with modelled rather than measured figures, which behave differently in reporting. We write a short plain-English note explaining what will change in your reports so nobody panics in week two.

We are not based in the EU. Does any of this apply to us?

It follows who your site is shown to, not where your company is registered. If people in the EU or the UK can reach and use the site, the rules travel with them. The commonest trigger we actually see is not a letter at all — it is a consent-related warning appearing on a Google Ads account and audience data behaving oddly as a result.

We already have a banner. Do you start by replacing it?

No. We start by auditing what your current setup actually does, before touching the banner, because the only way to know what is being set pre-consent today is to look at a cold page load with nothing clicked. Sometimes the existing platform is fine and only its configuration is wrong, which is a cheaper outcome than replacing it.

What do I have at the end of it?

A classified cookie and script inventory, a consent platform configured with prior blocking on, Consent Mode v2 wired where you run Google tags, a banner that gives accept and reject equal weight, cookie and privacy policy pages ready for your legal adviser, a record of which third-party services receive what data, and dated screenshots proving the three states behave correctly.

Cybersecurity

Cookie consent that blocks before it asks

The banner is the easy half. The work is proving that nothing non-essential is set before a visitor says yes — and screenshotting it.

From: $300–$4,000
Typical time: 1–3 weeks
Usually bought by: EU / UK-facing sites

What this actually solves

People arrive here for one of three reasons, and only one of them is the one they say out loud. Sometimes a letter or a complaint has landed. Sometimes a partner or an enterprise customer has sent over a due-diligence pack with a section on cookies. But the most common trigger, and the one that gets a decision made the same week, is commercial — a consent-related warning has appeared on a Google Ads account, audience data has started behaving strangely, and the marketing spend suddenly feels like it is leaking. That pain is felt immediately, which is why this job tends to move quickly once it starts.

The gap underneath all three is the same. Having a banner and having consent are different things, and almost nothing on the page tells you which one you have. Left as installed, the analytics tag and the advertising pixel have already fired, cookies are already written, and the third-party embeds have already loaded, all before the visitor has been shown a single choice. The banner then appears over the top of work that is already done. Legally, and practically, nothing has happened. The skill being bought here is not banner installation — it is the ability to demonstrate, with evidence, that nothing non-essential runs until someone agrees to it.

One boundary, stated plainly because it protects both sides: this is technical implementation, not legal advice. We build and prove the mechanism. Where a judgement call belongs to a lawyer — retention periods, lawful basis, who your data protection contact is — we flag it as a question rather than answering it for you.

What we do, and in what order

The order is not cosmetic. Auditing before touching anything is what makes the before-and-after meaningful, and wiring in the right sequence is what stops a site tracking without consent during the change itself.

Audit the cold page load, before touching the banner. Open the site in Chrome, open DevTools, and read the Application tab's cookie list without clicking anything at all. Then the Network tab, to see which third-party scripts load unprompted — analytics, advertising pixels, chat widgets, embedded video players, heatmap tools. Every cookie gets a row: who set it, what it does, how long it persists, and which category it belongs in. Half a day to a day.
Classify, and be strict about one word. A cookie is "strictly necessary" only if the site genuinely cannot function without it — not if removing it is inconvenient, and not because the vendor's documentation says so. Anything uncertain goes into a category that requires consent and gets flagged for review rather than quietly waved through. This single rule is where most inherited setups turn out to be wrong. Half a day.
Select and configure the consent platform, with prior blocking on. Cookiebot, CookieYes or Complianz on WordPress, whichever suits the stack and the budget. The setting that matters is the one that holds scripts until consent exists; everything else is presentation. Half a day to a day.
Wire Consent Mode v2, usually through Google Tag Manager. Signals mapped to consent categories, deployed in an order where no tag is ever left firing without consent at any point mid-change, and a rollback path written down in advance in case analytics data stops arriving and someone needs it back today. One to three days, depending on how many tags the container holds.
Fix the banner's behaviour, not just its colours. Accept and reject given equal prominence on the same screen, no pre-ticked boxes, and closing or dismissing the banner treated as no rather than yes. Then consent records configured so there is something to show if anyone ever asks what a given visitor agreed to. Half a day.
Prove it in an incognito window, three times. Repeat the DevTools test in a clean session — before consent, after accepting everything, after rejecting everything — and screenshot the cookie and network state at each. Those dated screenshots are the deliverable. Anyone can install a banner; this is the part that shows it works. Half a day.
Produce the policy pages and the data record. A public cookie table grouped into strictly necessary, functional, analytics and marketing with a short plain-English purpose line for each entry, plus an internal summary of which third-party service receives what data, in which region it is stored, and where a data processing agreement is likely to be needed. Handed over marked up for your legal adviser to confirm. Two to three days including your review.

Tools, so you know what you are paying for rather than a black box: Chrome DevTools for the audit and the proof, Cookiebot, CookieYes or Complianz as the consent platform, Google Tag Manager and Google's Tag Assistant for the wiring and its verification.

What moves the price

The range is $300–$4,000 over 1–3 weeks, and three things decide where a particular site lands inside it.

How many tags and third-party scripts are in play. A brochure site with one analytics tag and a contact form is at the bottom of the range. A shop running a tag manager container full of advertising, remarketing, reviews, live chat and a heatmap tool, with campaigns live while the work happens, is a different job — every one of those has to be classified, blocked correctly and then verified individually.

How many domains, subdomains and languages. Consent does not automatically carry across domains, and a banner has to be readable in every language the site serves. Each additional property is close to a repeat of the whole verification pass, which is why it is priced as more work rather than absorbed.

Whether you need data mapping as well as blocking. Some buyers only need the site to behave correctly. Others need the record behind it — what each processor receives, where it goes, which agreements exist. That is a separate body of work with its own interviews and its own review cycle, and it is the main thing that carries a project toward the top of the range.

What usually goes wrong

The banner goes up and everybody stops. This is the defining failure of the service and the reason cheap implementations are worth nothing. A consent platform installed without prior blocking configured produces a site that looks compliant in a screenshot and behaves exactly as it did before underneath. The owner believes the problem is solved, which is worse than knowing it is not, because now nobody will look again for a year. If a supplier cannot show you a pre-consent cookie list from a clean session, the question has not been answered.

Policy text is generated and published without anyone owning the legal sign-off. Drafting a cookie table and a privacy page from a real audit is fine and sensible work. Pasting it live, letting you assume it has been checked, and leaving that ambiguity in place is not. The sentence that fixes it belongs in the proposal, not in a conversation after a complaint arrives — implementation is ours, legal confirmation is your adviser's.

Reject is buried, greyed out or one click further away than accept. It is a tempting optimisation because it visibly protects the analytics numbers, and it is now precisely what regulators look at first. A banner engineered to make refusal harder converts a site from untidy into deliberately non-compliant, which increases your exposure rather than reducing it. Equal weight, same screen, same number of clicks — and if that costs you consent rates, the honest answer is that those consents were never real.

See where the site stands before you brief anyone.

If the site is already live, start from what it scores rather than from a guess. The audit reports what it checked, what it found, and — the part most tools leave out — what it could not check, and why.

See the website audit Talk about this work

Questions people ask before they commit.

Can I not just install a consent plugin and be done?: Installing it is genuinely easy. The part that matters is a separate configuration called prior blocking, and without it the plugin will happily render a banner while every tag underneath keeps firing exactly as before. A banner over unchanged tracking is a picture of consent, not consent, and it is the state we most often find when we first look at a site.
Does this make us compliant?: No, and be careful of anyone who says it does. Compliance is decided by a regulator or a court, never by a supplier. What we do is technical implementation — the audit, the blocking, the wiring, the banner behaviour and the evidence. The wording of your privacy and cookie policies needs confirming by your own legal adviser, and we mark the specific points where that judgement is required.
Will my analytics data drop after this?: Some of it, yes, and you should hear that before we start rather than after. Visitors who decline are no longer measured. With Consent Mode v2 configured, Google fills part of that gap with modelled rather than measured figures, which behave differently in reporting. We write a short plain-English note explaining what will change in your reports so nobody panics in week two.
We are not based in the EU. Does any of this apply to us?: It follows who your site is shown to, not where your company is registered. If people in the EU or the UK can reach and use the site, the rules travel with them. The commonest trigger we actually see is not a letter at all — it is a consent-related warning appearing on a Google Ads account and audience data behaving oddly as a result.
We already have a banner. Do you start by replacing it?: No. We start by auditing what your current setup actually does, before touching the banner, because the only way to know what is being set pre-consent today is to look at a cold page load with nothing clicked. Sometimes the existing platform is fine and only its configuration is wrong, which is a cheaper outcome than replacing it.
What do I have at the end of it?: A classified cookie and script inventory, a consent platform configured with prior blocking on, Consent Mode v2 wired where you run Google tags, a banner that gives accept and reject equal weight, cookie and privacy policy pages ready for your legal adviser, a record of which third-party services receive what data, and dated screenshots proving the three states behave correctly.

Often taken together.

Start with the brief, not the invoice.

Send what you are trying to achieve. You get a written scope, a price and a date — or an honest “this is not the right service for that”.

Talk about Privacy & cookie consent implementation All Cybersecurity services