Iubenda is half software and half legal text. This verdict judges only the software: a banner that holds back third-party scripts until the visitor chooses, passes the choice to Google Consent Mode and keeps a log. An agent builds that in a weekend, and open-source banners already exist. The slow part is script blocking, because tags added later by a tag manager or an iframe slip through unless you tag them. The other half, privacy-policy text that someone keeps current as laws change, is legal work. No prompt replaces it, so have a lawyer read whatever you publish. Nothing here is legal advice.
Before you buildCheck iubenda's Free plan first: sites under 5,000 page views a month get a policy in one language and a basic banner at no cost, and the policy stays usable after you leave.
Build me a self-hosted cookie consent banner and consent log to replace Iubenda's cookie solution. Requirements:
- Node.js 22 + TypeScript in one repo: `banner/` (one JavaScript file built with esbuild, no
dependencies) and `server/` (Fastify). `npm start` serves the log API and an admin page on
http://localhost:4880.
- Banner: on a first visit show Accept all, Reject all and Customise with the categories necessary,
preferences, analytics and marketing; Reject looks as prominent as Accept. Store the choice in a
first-party cookie for 180 days and ask again when `policyVersion` in config.json changes. A
footer link reopens the dialog.
- Blocking: `<script type="text/plain" data-category="analytics" src="...">` runs only after consent
for that category; iframes use `data-src` the same way. A MutationObserver holds back matching
nodes that other scripts add later.
- Consent Mode: before any choice call `gtag('consent','default', ...)` with ad_storage,
analytics_storage, ad_user_data and ad_personalization denied, and update it on every choice.
- Cookie list: `npm run scan` opens each URL of my sitemap.xml with Playwright, collects cookies and
localStorage keys, and writes cookies.json (name, domain, lifetime, category set by hand) that the
Customise view shows.
- Log: the banner POSTs policyVersion, chosen categories and a timestamp to /api/consents; the server
adds a hash of IP plus user agent with a daily salt and stores rows in better-sqlite3 at
./data/consents.db. The admin page (one password in .env) lists, searches and exports CSV, and a
nightly job deletes rows older than RETENTION_DAYS.
- One site per install. No accounts, no telemetry; the banner calls only your own server.
- Out of scope: generated privacy-policy text, IAB TCF, geo-targeting, A/B tests, mobile SDKs.
- README: how to tag scripts, that tags added by a tag manager must be tagged too, a warning that a
banner is only part of compliance, and that the policy text should be read by a lawyer.Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.
The first prompt builds the core. Run these one at a time in the same folder to grow it into your own Iubenda.
Extend the consent banner and log in this folder. Requirements: - The banner stores a random consent id in its cookie and sends it with each choice. - The admin page gets a search box for a consent id that shows every stored choice for it, with timestamps and policy versions, and a CSV download of that one history. - A delete button removes all rows for an id and writes the deletion to an audit table without the id itself. - Update the README.
Add scheduled scanning to the consent banner project in this folder. Requirements: - `npm run scan -- --schedule` runs the Playwright scan every Monday at 06:00 and compares the result with cookies.json. - Any cookie or localStorage key not yet categorised is listed in the admin page and sent by SMTP from .env. - The scan runs once before and once after accepting analytics so the list shows what loads only after consent. - Update the README.
Add a policy-version report to the consent banner project in this folder. Requirements: - The admin page shows a bar per policyVersion with the number of stored choices and the share made in the last 30 days. - A button bumps policyVersion in config.json and records the date, so the banner asks everyone again. - Export the report as CSV. - Update the README.
Site owners pay for the text and the proof: a policy someone else maintains as rules change, and a log they can show a regulator or a client. The banner script is the cheap part. At $6.99 a site it is a small cost next to reading the rules in every country you sell to.
Estimate · The log server fits a free tier or a $5 VPS. A lawyer's review of your policy text isn't included. The build is token usage on your agent plan.
| Plan | Monthly | Annual, per month | What you get |
|---|---|---|---|
| Free | $0 | $0 | Privacy and cookie policy in one language with up to 3 clauses, limited banner styling, full iubenda branding, a site scan every 6 months. |
| Essentials | $6.99 | $5.99 | Privacy and cookie policy with up to 20 service clauses, custom clauses, one language, monthly scans, mild branding; 25K page views a month. |
| Advanced | $27.99 | $24.99 | Up to 30 service clauses, unlimited custom clauses, Terms and Conditions, all languages, geo-targeting; 50K page views a month. |
| Ultimate | $119.99 | $99.99 | Unlimited clauses, full branding removal, hourly scans, Mobile SDK, detailed analytics and consent recovery; 150K page views a month. |
Free plan for sites under 5,000 page views a month: one language, up to 3 third parties or clauses, a limited banner with iubenda branding, no Terms and Conditions or consent database.
Kinda. The core is a weekend build with the prompt on this page, but real gaps remain: Policy and cookie text kept current by lawyers across jurisdictions, Terms and Conditions generation on the Advanced plan and above.
About $6.99 a month on the Essentials plan, $83.88 a year (checked 2026-10-20).
Policy and cookie text kept current by lawyers across jurisdictions; Terms and Conditions generation on the Advanced plan and above; Maintained IAB TCF and Google Consent Mode v2 support, with the templates and integrations for WordPress, Shopify and Tag Manager; Automatic scans that find new cookies and trackers, monthly on Essentials and hourly on Ultimate; A hosted consent database you can show to an auditor or a client. If any of those matter to you, keep paying.
Yes: CookieConsent (open source), tarteaucitron.js (open source), Silktide Consent Manager (open source).