PermitoLive demo, core and Pro.

The first section runs the free core (MIT). Every section after it is produced by the Pro packages themselves. The themes and layouts run in your browser. The catalog, the cookie table and the scanner report are rendered on the server, so what reaches your browser is the finished HTML and not the packages.

The banner preview uses its own in-memory storage. Nothing you click here changes the consent of this site.

See pricing

Core

Core (free, MIT)Banner, dialog and gates.

The banner, the settings dialog and the gates belong to the free core, @permitojs/react. Decide in the banner, then watch the gate and the video below react. The decision is kept in memory only and is gone on reload.

Themes

Themes and layoutsLive, in the frame below.

Pick a theme, a mode and a layout, then decide in the banner. Changing the layout shows the banner again. The decision is kept in memory only and is gone on reload.

Catalog

Service catalogFacts with a source.

The catalog holds 71 services. 8 are shown in full below. Each entry states what the provider documents, with the source page and the date it was read.

Google Analytics 4Google, Irelandretrieved 2026-10-04

Provider: Google
Hosting: Run by the provider
Legal entity: Google Ireland Limited, Ireland
Third countries: United States
Data Privacy Framework: Google LLC, EU-US listed, Swiss-US listed
Purpose: Measurement of website usage with Google Analytics 4.

Cookies and storage

Name	Type	Duration	Description
_ga	cookie	2 years	According to Google, used to distinguish users.
_ga_<container-id>	cookie	2 years	According to Google, used to persist session state.

Source: https://support.google.com/analytics/answer/11397207. retrieved 2026-10-04.

Matomo On-PremiseInnoCraft, Self-hosted, runs on your infrastructureretrieved 2026-10-04

Provider: InnoCraft
Hosting: Self-hosted, runs on your infrastructure
Legal entity: No provider receives data from this setup, so entity and transfers do not apply.
Purpose: Web analytics: Matomo records visits to the operator's website. The software runs on the operator's infrastructure.

Cookies and storage

Name	Type	Duration	Description
_pk_id	cookie	13 months	Stores a unique visitor ID to recognize returning visitors.
_pk_ses	cookie	30 minutes	Session cookie that temporarily stores data for the visit.
_pk_ref	cookie	6 months	Stores attribution information, i.e. the referrer that brought the visitor to the website.
_pk_cvar	cookie	30 minutes	Session cookie that temporarily stores custom variables for the visit.
_pk_testcookie	cookie	Immediate expiry	Checks whether the browser supports cookies (according to Matomo, for Internet Explorer).
matomo_sessid	cookie	14 days	Optional. A nonce to help prevent CSRF issues when using the opt-out feature.
mtm_consent_removed	cookie	30 years	Optional. Indicates that a visitor opted out of Matomo tracking.
mtm_cookie_consent	cookie	30 years	Optional. Records the visitor's consent to Matomo tracking.
_pk_hsr	cookie	30 minutes	Optional. Stores heatmap and session recording data.
_pk_uid	cookie	13 months	Optional, not default. Enables cross-domain visitor recognition.
MatomoAbTesting	localStorage	Not stated	Optional. Stores information for Matomo A/B Testing in local storage. Matomo states no expiry.

Source: https://matomo.org/faq/general/faq_146/. retrieved 2026-10-04.

Meta PixelMeta, Irelandretrieved 2026-10-04

Provider: Meta
Hosting: Run by the provider
Legal entity: Meta Platforms Ireland Limited, Ireland
Third countries: United States
Data Privacy Framework: Meta Platforms, Inc., EU-US listed, Swiss-US listed
Purpose: JavaScript code that, according to Meta, tracks visitor activity on a website to measure the effectiveness of advertising and analyze conversion funnels. According to Meta, the Pixel relies on Facebook cookies to match website visitors to their Facebook accounts.

Cookies and storage

Name	Type	Duration	Description
_fbp	cookie	Not stated	Meta names this cookie as the place where the Meta browser ID is stored, under the website's domain. Meta states no duration in the documentation retrieved (including its documentation on managing fbp and fbc).
_fbc	cookie	Not stated	Meta names this cookie as the place where the Meta click ID is stored. Meta states no duration for the cookie set by the Pixel. For a _fbc cookie set by the website's own server, Meta's Conversions API documentation recommends a duration of 90 days.

Source: https://developers.facebook.com/docs/meta-pixel/get-started/. retrieved 2026-10-04.

YouTube (youtube-nocookie.com)Google, Irelandretrieved 2026-10-04

Provider: Google
Hosting: Run by the provider
Legal entity: Google Ireland Limited, Ireland
Third countries: United States
Data Privacy Framework: Google LLC, EU-US listed, Swiss-US listed
Purpose: Embedding of YouTube videos in privacy-enhanced mode through youtube-nocookie.com.

Cookies and storage

The provider documents no cookies or storage entries.

Source: https://support.google.com/youtube/answer/171780. retrieved 2026-10-04.

TWINT (Webshop)TWINT AG, Switzerlandretrieved 2026-10-04

Provider: TWINT AG
Hosting: Run by the provider
Legal entity: TWINT AG, Switzerland
Third countries: None named by the provider
Data Privacy Framework: Not checked
Purpose: Payment method in the web shop. According to TWINT, TWINT is integrated via the merchant's payment service provider or a plug-in of the shop system; payment is completed in the TWINT app via the Web2App switch.

Cookies and storage

The provider documents no cookies or storage entries.

Source: https://www.twint.ch/en/business-customers/products/twint-for-online-shops/. retrieved 2026-10-04.

Datatrans Payment Page / LightboxDatatrans AG, Switzerlandretrieved 2026-10-04

Provider: Datatrans AG
Hosting: Run by the provider
Legal entity: Datatrans AG, Switzerland
Third countries: None named by the provider
Data Privacy Framework: Not checked
Purpose: Payment processing via the Datatrans Payment Page in redirect or lightbox mode. According to Datatrans, the lightbox displays an iframe on top of the merchant page; on mobile devices it switches to redirect mode automatically.

Cookies and storage

The provider documents no cookies or storage entries.

Source: https://docs.datatrans.ch/docs/redirect-lightbox. retrieved 2026-10-04.

etracker AnalyticsJustRelate Deutschland GmbH, Germanyretrieved 2026-10-04

Provider: JustRelate Deutschland GmbH
Hosting: Run by the provider
Legal entity: JustRelate Deutschland GmbH, Germany
Third countries: None named by the provider
Data Privacy Framework: Not checked
Purpose: Web analytics: etracker Analytics records the use of the operator's website. According to etracker, data is processed and stored exclusively in Germany.

Cookies and storage

Name	Type	Duration	Description
et_allow_cookies	localStorage	480 days	Signals whether etracker may set cookies via API call. Set when _etracker.enableCookies() is called and deleted on disableCookies().
et_oi_v2	localStorage	50 years (value "no"), 480 days (value "yes")	Implements the objection function (opt-out) and serves an opt-in where used.
et_oi_services	localStorage	720 days	Stores the user's choice (acceptance or refusal) per category or provider.
_et_coid	localStorage	720 days (configurable)	Used to recognize users by means of a virtual expiry timestamp.
isSdEnabled	cookie	24 hours	Indicates whether scroll depth measurement is active.
et_scroll_depth	sessionStorage	Session	Buffers scroll measurement data for ScrollMap reports. Set when scroll tracking is enabled.
et_cssSelectors	sessionStorage	Session	Cache for the configuration of events defined by CSS selectors.
et_tagManagerEntries	sessionStorage	Session	Cache for the trigger configuration of the etracker Tag Manager.
et_tagManagerVars	sessionStorage	Session	Cache for the variable configuration of the etracker Tag Manager.

Source: https://help.etracker.com/en/article/cookies-used/. retrieved 2026-10-04.

Friendly CaptchaFriendly Captcha GmbH, Germanyretrieved 2026-10-04

Provider: Friendly Captcha GmbH
Hosting: Run by the provider
Legal entity: Friendly Captcha GmbH, Germany
Third countries: None named by the provider
Data Privacy Framework: Not checked
Purpose: Bot detection on forms. According to Friendly Captcha, the data is only used to identify and handle potential bots and risks.

Cookies and storage

The provider documents no cookies or storage entries.

Source: https://friendlycaptcha.com/legal/privacy-end-users/. retrieved 2026-10-04.

63 more services, by name

Every entry has the same fields as the ones above.

Adobe Fonts
Awin Affiliate-Tracking (MasterTag)
Brevo
Bunny Fonts
Calendly (embedded scheduling page)
Cloudflare Turnstile
Cloudflare Web Analytics
Criteo OneTag
econda Analytics
Facebook (social plugins, embedded posts)
Fathom Analytics
Google Ads Conversion Tracking / Remarketing
Google Fonts
Google Maps
Google reCAPTCHA
Google Tag Manager
Hotjar
HubSpot
Infomaniak Newsletter
Instagram (embedded post)
Intercom Messenger
Klarna On-site Messaging / Checkout-Widget
Klaviyo (onsite tracking and forms)
LinkedIn Insight Tag
Mailchimp
Mapbox GL JS
Mapp Intelligence
Matomo Cloud
Microsoft Advertising Universal Event Tracking (UET)
Microsoft Clarity
Mollie Components / Checkout
Mouseflow
OpenStreetMap (Tile-Server)
PayPal
Payrexx
Pinterest Tag
Piwik PRO Analytics Suite
Plausible Analytics
Plausible Community Edition
PostFinance Checkout
PostHog (self-hosted)
PostHog Cloud
ProvenExpert Bewertungssiegel
Sentry
Sentry (self-hosted)
Shopware 6
SoundCloud (eingebetteter Player)
Spotify (embedded player)
Stripe
swisstopo maps (geo.admin.ch)
TikTok (embedded videos)
TikTok Pixel
Trustpilot TrustBox
Typeform
Umami (self-hosted)
Umami Cloud
Vercel Web Analytics
Vimeo
Worldline Saferpay
X (embedded posts)
X Pixel (Conversion-Tracking)
YouTube
Zendesk Web Widget (Messaging)

From entry to config

The catalog contains facts with a source, not a legal assessment. The category is set by you, the operator, when you turn an entry into a service.

toConsentService takes over name, provider, purpose, cookies and privacy policy link. You add the category. The catalog cannot set it for you, and entries may not contain one.

import { catalog, toConsentService } from "@weber-development/permito-catalog"

const entry = catalog.find((e) => e.id === "google-analytics-4")
if (!entry) throw new Error("Entry not found")

// The category is your decision. The catalog never sets it.
const service = toConsentService(entry, { category: "statistics" })

Cookie table

Cookie tableFrom the same config as the banner.

This table is built from the config below with buildCookieTable and toHtml, enriched from the catalog and rendered on the server. The tabs only switch between finished blocks.

consent.config.ts

// consent.config.ts
import type { ConsentConfig } from "@permitojs/core"
import { catalog, toConsentService } from "@weber-development/permito-catalog"

const entry = (id: string) => {
  const found = catalog.find((e) => e.id === id)
  if (!found) throw new Error(`Catalog entry missing: ${id}`)
  return found
}

export const consentConfig: ConsentConfig = {
  consentVersion: "2026-10",
  categories: [{ id: "necessary", required: true }, { id: "statistics" }, { id: "marketing" }],
  services: [
    toConsentService(entry("google-analytics-4"), { category: "statistics" }),
    toConsentService(entry("meta-pixel"), { category: "marketing" }),
    toConsentService(entry("youtube-nocookie"), { category: "marketing" }),
  ],
}

The example config lists three services. The categories are choices made for this demo.

Build

import { buildCookieTable, toHtml, toMarkdown } from "@weber-development/permito-cookie-table"
import { catalog } from "@weber-development/permito-catalog"
import { consentConfig } from "./consent.config"

const table = buildCookieTable(consentConfig, {
  language: "de",
  catalog,
  includeConsentCookie: { duration: "180 Tage" },
})

toHtml(table, { classes: true })
toMarkdown(table)

Cookies und ähnliche Technologien
Dienst	Anbieter	Zweck	Cookie	Laufzeit	Beschreibung	Datenschutzerklärung	Rechtsträger	Sitzland	Drittländer	Speicherart	Quelle	Stand
Notwendig
Permito	–	Speichert die Einwilligungsentscheidung für diese Website.	permito_consent	180 Tage	–	–	–	–	–	–	–	–
Statistik
Google Analytics 4	Google	Messung der Nutzung einer Website mit Google Analytics 4.	_ga	2 Jahre	Laut Google dient der Cookie dazu, Nutzer zu unterscheiden.	policies.google.com	Google Ireland Limited	Irland	Vereinigte Staaten	Cookie	support.google.com	2026-10-04
Google Analytics 4	Google	Messung der Nutzung einer Website mit Google Analytics 4.	_ga_<container-id>	2 Jahre	Laut Google dient der Cookie dazu, den Sitzungsstatus zu speichern.	policies.google.com	Google Ireland Limited	Irland	Vereinigte Staaten	Cookie	support.google.com	2026-10-04
Marketing
Meta Pixel	Meta	JavaScript-Code, der laut Meta Besucheraktivitäten auf einer Website erfasst, um die Wirkung von Werbung zu messen und Conversion-Abläufe zu analysieren. Laut Meta stützt sich der Pixel auf Facebook-Cookies, um Website-Besucher den jeweiligen Facebook-Konten zuzuordnen.	_fbp	–	Meta nennt dieses Cookie als Speicherort der Meta-Browser-ID, unter der Domain der Website. Eine Laufzeit nennt Meta in der abgerufenen Dokumentation nicht (auch nicht in der Dokumentation zum Verwalten von fbp und fbc).	facebook.com	Meta Platforms Ireland Limited	Irland	Vereinigte Staaten	Cookie	developers.facebook.com	2026-10-04
Meta Pixel	Meta	JavaScript-Code, der laut Meta Besucheraktivitäten auf einer Website erfasst, um die Wirkung von Werbung zu messen und Conversion-Abläufe zu analysieren. Laut Meta stützt sich der Pixel auf Facebook-Cookies, um Website-Besucher den jeweiligen Facebook-Konten zuzuordnen.	_fbc	–	Meta nennt dieses Cookie als Speicherort der Meta-Klick-ID. Eine Laufzeit für das vom Pixel gesetzte Cookie nennt Meta nicht. Für ein serverseitig selbst gesetztes _fbc empfiehlt Meta in der Conversions-API-Dokumentation eine Laufzeit von 90 Tagen.	facebook.com	Meta Platforms Ireland Limited	Irland	Vereinigte Staaten	Cookie	developers.facebook.com	2026-10-04
YouTube (youtube-nocookie.com)	Google	Einbettung von YouTube-Videos im erweiterten Datenschutzmodus über youtube-nocookie.com.	–	–	–	policies.google.com	Google Ireland Limited	Irland	Vereinigte Staaten	–	support.google.com	2026-10-04

Cookies et technologies similaires
Service	Fournisseur	Finalité	Cookie	Durée	Description	Politique de confidentialité	Entité juridique	Pays du siège	Pays tiers	Type de stockage	Source	État au
Nécessaires
Permito	–	Enregistre la décision de consentement pour ce site web.	permito_consent	180 jours	–	–	–	–	–	–	–	–
Statistiques
Google Analytics 4	Google	Mesure de l'utilisation d'un site web avec Google Analytics 4.	_ga	2 ans	Selon Google, sert à distinguer les utilisateurs.	policies.google.com	Google Ireland Limited	Irlande	États-Unis	Cookie	support.google.com	2026-10-04
Google Analytics 4	Google	Mesure de l'utilisation d'un site web avec Google Analytics 4.	_ga_<container-id>	2 ans	Selon Google, sert à conserver l'état de la session.	policies.google.com	Google Ireland Limited	Irlande	États-Unis	Cookie	support.google.com	2026-10-04
Marketing
Meta Pixel	Meta	Code JavaScript qui, selon Meta, suit l'activité des visiteurs d'un site web afin de mesurer l'efficacité de la publicité et d'analyser les tunnels de conversion. Selon Meta, le Pixel s'appuie sur des cookies Facebook pour associer les visiteurs du site à leurs comptes Facebook.	_fbp	–	Meta indique que ce cookie contient l'identifiant de navigateur Meta, sous le domaine du site web. Meta n'indique pas de durée dans la documentation consultée (y compris celle sur la gestion de fbp et fbc).	facebook.com	Meta Platforms Ireland Limited	Irlande	États-Unis	Cookie	developers.facebook.com	2026-10-04
Meta Pixel	Meta	Code JavaScript qui, selon Meta, suit l'activité des visiteurs d'un site web afin de mesurer l'efficacité de la publicité et d'analyser les tunnels de conversion. Selon Meta, le Pixel s'appuie sur des cookies Facebook pour associer les visiteurs du site à leurs comptes Facebook.	_fbc	–	Meta indique que ce cookie contient l'identifiant de clic Meta. Meta n'indique pas de durée pour le cookie déposé par le Pixel. Pour un cookie _fbc déposé par le serveur du site lui-même, la documentation de l'API Conversions de Meta recommande une durée de 90 jours.	facebook.com	Meta Platforms Ireland Limited	Irlande	États-Unis	Cookie	developers.facebook.com	2026-10-04
YouTube (youtube-nocookie.com)	Google	Intégration de vidéos YouTube en mode de confidentialité renforcée via youtube-nocookie.com.	–	–	–	policies.google.com	Google Ireland Limited	Irlande	États-Unis	–	support.google.com	2026-10-04

Cookie e tecnologie simili
Servizio	Fornitore	Finalità	Cookie	Durata	Descrizione	Informativa sulla privacy	Entità giuridica	Paese della sede	Paesi terzi	Tipo di archiviazione	Fonte	Aggiornato al
Necessari
Permito	–	Memorizza la decisione di consenso per questo sito web.	permito_consent	180 giorni	–	–	–	–	–	–	–	–
Statistiche
Google Analytics 4	Google	Misurazione dell'utilizzo di un sito web con Google Analytics 4.	_ga	2 anni	Secondo Google serve a distinguere gli utenti.	policies.google.com	Google Ireland Limited	Irlanda	Stati Uniti	Cookie	support.google.com	2026-10-04
Google Analytics 4	Google	Misurazione dell'utilizzo di un sito web con Google Analytics 4.	_ga_<container-id>	2 anni	Secondo Google serve a mantenere lo stato della sessione.	policies.google.com	Google Ireland Limited	Irlanda	Stati Uniti	Cookie	support.google.com	2026-10-04
Marketing
Meta Pixel	Meta	Codice JavaScript che, secondo Meta, traccia l'attività dei visitatori di un sito web per misurare l'efficacia della pubblicità e analizzare i funnel di conversione. Secondo Meta, il Pixel si basa sui cookie di Facebook per associare i visitatori del sito ai rispettivi account Facebook.	_fbp	–	Meta indica questo cookie come luogo in cui è memorizzato l'ID del browser Meta, sotto il dominio del sito web. Meta non indica una durata nella documentazione consultata (inclusa quella sulla gestione di fbp e fbc).	facebook.com	Meta Platforms Ireland Limited	Irlanda	Stati Uniti	Cookie	developers.facebook.com	2026-10-04
Meta Pixel	Meta	Codice JavaScript che, secondo Meta, traccia l'attività dei visitatori di un sito web per misurare l'efficacia della pubblicità e analizzare i funnel di conversione. Secondo Meta, il Pixel si basa sui cookie di Facebook per associare i visitatori del sito ai rispettivi account Facebook.	_fbc	–	Meta indica questo cookie come luogo in cui è memorizzato l'ID di clic Meta. Meta non indica una durata per il cookie impostato dal Pixel. Per un cookie _fbc impostato dal server del sito stesso, la documentazione dell'API Conversions di Meta raccomanda una durata di 90 giorni.	facebook.com	Meta Platforms Ireland Limited	Irlanda	Stati Uniti	Cookie	developers.facebook.com	2026-10-04
YouTube (youtube-nocookie.com)	Google	Incorporazione di video YouTube in modalità con privacy avanzata tramite youtube-nocookie.com.	–	–	–	policies.google.com	Google Ireland Limited	Irlanda	Stati Uniti	–	support.google.com	2026-10-04

Cookies and similar technologies
Service	Provider	Purpose	Cookie	Duration	Description	Privacy policy	Legal entity	Country of registration	Third countries	Storage type	Source	As of
Necessary
Permito	–	Stores the consent decision for this website.	permito_consent	180 days	–	–	–	–	–	–	–	–
Statistics
Google Analytics 4	Google	Measurement of website usage with Google Analytics 4.	_ga	2 years	According to Google, used to distinguish users.	policies.google.com	Google Ireland Limited	Ireland	United States	Cookie	support.google.com	2026-10-04
Google Analytics 4	Google	Measurement of website usage with Google Analytics 4.	_ga_<container-id>	2 years	According to Google, used to persist session state.	policies.google.com	Google Ireland Limited	Ireland	United States	Cookie	support.google.com	2026-10-04
Marketing
Meta Pixel	Meta	JavaScript code that, according to Meta, tracks visitor activity on a website to measure the effectiveness of advertising and analyze conversion funnels. According to Meta, the Pixel relies on Facebook cookies to match website visitors to their Facebook accounts.	_fbp	–	Meta names this cookie as the place where the Meta browser ID is stored, under the website's domain. Meta states no duration in the documentation retrieved (including its documentation on managing fbp and fbc).	facebook.com	Meta Platforms Ireland Limited	Ireland	United States	Cookie	developers.facebook.com	2026-10-04
Meta Pixel	Meta	JavaScript code that, according to Meta, tracks visitor activity on a website to measure the effectiveness of advertising and analyze conversion funnels. According to Meta, the Pixel relies on Facebook cookies to match website visitors to their Facebook accounts.	_fbc	–	Meta names this cookie as the place where the Meta click ID is stored. Meta states no duration for the cookie set by the Pixel. For a _fbc cookie set by the website's own server, Meta's Conversions API documentation recommends a duration of 90 days.	facebook.com	Meta Platforms Ireland Limited	Ireland	United States	Cookie	developers.facebook.com	2026-10-04
YouTube (youtube-nocookie.com)	Google	Embedding of YouTube videos in privacy-enhanced mode through youtube-nocookie.com.	–	–	–	policies.google.com	Google Ireland Limited	Ireland	United States	–	support.google.com	2026-10-04

## Cookies and similar technologies

### Necessary

| Service | Provider | Purpose | Cookie | Duration | Description | Privacy policy | Legal entity | Country of registration | Third countries | Storage type | Source | As of |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Permito | – | Stores the consent decision for this website. | `permito_consent` | 180 days | – | – | – | – | – | – | – | – |

### Statistics

| Service | Provider | Purpose | Cookie | Duration | Description | Privacy policy | Legal entity | Country of registration | Third countries | Storage type | Source | As of |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Google Analytics 4 | Google | Measurement of website usage with Google Analytics 4. | `_ga` | 2 years | According to Google, used to distinguish users. | [policies.google.com](https://policies.google.com/privacy) | Google Ireland Limited | Ireland | United States | Cookie | [support.google.com](https://support.google.com/analytics/answer/11397207) | 2026-10-04 |
| Google Analytics 4 | Google | Measurement of website usage with Google Analytics 4. | `_ga_<container-id>` | 2 years | According to Google, used to persist session state. | [policies.google.com](https://policies.google.com/privacy) | Google Ireland Limited | Ireland | United States | Cookie | [support.google.com](https://support.google.com/analytics/answer/11397207) | 2026-10-04 |

### Marketing

| Service | Provider | Purpose | Cookie | Duration | Description | Privacy policy | Legal entity | Country of registration | Third countries | Storage type | Source | As of |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Meta Pixel | Meta | JavaScript code that, according to Meta, tracks visitor activity on a website to measure the effectiveness of advertising and analyze conversion funnels. According to Meta, the Pixel relies on Facebook cookies to match website visitors to their Facebook accounts. | `_fbp` | – | Meta names this cookie as the place where the Meta browser ID is stored, under the website's domain. Meta states no duration in the documentation retrieved (including its documentation on managing fbp and fbc). | [facebook.com](https://www.facebook.com/privacy/policy/) | Meta Platforms Ireland Limited | Ireland | United States | Cookie | [developers.facebook.com](https://developers.facebook.com/docs/meta-pixel/get-started/) | 2026-10-04 |
| Meta Pixel | Meta | JavaScript code that, according to Meta, tracks visitor activity on a website to measure the effectiveness of advertising and analyze conversion funnels. According to Meta, the Pixel relies on Facebook cookies to match website visitors to their Facebook accounts. | `_fbc` | – | Meta names this cookie as the place where the Meta click ID is stored. Meta states no duration for the cookie set by the Pixel. For a \_fbc cookie set by the website's own server, Meta's Conversions API documentation recommends a duration of 90 days. | [facebook.com](https://www.facebook.com/privacy/policy/) | Meta Platforms Ireland Limited | Ireland | United States | Cookie | [developers.facebook.com](https://developers.facebook.com/docs/meta-pixel/get-started/) | 2026-10-04 |
| YouTube (youtube-nocookie.com) | Google | Embedding of YouTube videos in privacy-enhanced mode through youtube-nocookie.com. | – | – | – | [policies.google.com](https://policies.google.com/privacy) | Google Ireland Limited | Ireland | United States | – | [support.google.com](https://support.google.com/youtube/answer/171780) | 2026-10-04 |

The table scrolls sideways inside its frame.

In CI, run permito-cookie-table with --check and the file path. It writes nothing and exits with code 1 when the file differs from what the config generates, so the privacy policy page cannot fall behind the banner.

The table reflects the config. It does not check that the config is complete or correct. The scanner is for that.

permito-cookie-table --config ./consent.config.ts --lang en --catalog   --include-consent-cookie --consent-cookie-duration "180 days"   --check ./content/cookies.en.md

Scanner

ScannerA recorded run.

The scanner loads a page in headless Chromium without clicking anything and compares what it sees with your consent config. It reports and changes nothing.

This is a recorded run against a demo page, not a live check. The config for the run lists one service, Google Analytics 4.

Scanned page: http://127.0.0.1:4317/

Not in your config: 3
Active before consent: 4
Matched, for information: 0

Not in your config

A cookie, storage key or third-party host that no configured service accounts for. Where the catalog knows a match, it suggests an entry. Whether it belongs in your config, and in which category, is your decision.

connect.facebook.nethost
Catalog suggestions: Facebook (social plugins, embedded posts) (facebook-embed), Meta Pixel (meta-pixel)
fonts.googleapis.comhost
Catalog suggestions: Google Fonts (google-fonts)
www.facebook.comhost
Catalog suggestions: Meta Pixel (meta-pixel)

Active before consent

The entry belongs to a configured service that needs a decision, and it was present before any consent existed. This is an observation, not an assessment. A possible cause is a script that is not gated or a tag manager that loads it regardless.

_ga_DEMO123456cookie
Service: google-analytics-4, Category: statistics
_gacookie
Service: google-analytics-4, Category: statistics
region1.google-analytics.comhost
Service: google-analytics-4, Category: statistics
www.googletagmanager.comhost
Service: google-analytics-4, Category: statistics

Run it yourself

npx permito scan https://client.example --config consent.config.ts

Exit code

This run: 1

0No findings.
1At least one finding, not in your config or active before consent.
2Error during the run, for example an unreachable page or a missing Chromium.

A clean run is a snapshot, not proof. The scanner does not click, scroll or log in, so it misses what loads only after an interaction.

Consent log

Consent logStored on your server.

The log package is not part of this demo, so nothing is recorded here. This is what it stores per change of consent, and the route handler that receives it.

One record

{
  "id": "6f1c0b0e-4a52-4d0e-9b57-0e2a3f6c8d11",
  "visitorHash": "9b1d5c3a7e0f42a8c6d4b2e19f08a7d3c5e6b4a1f2d0c9e8b7a6f5d4c3b2a190",
  "timestamp": "2026-10-05T09:41:12.000Z",
  "consentVersion": "2026-10",
  "categories": { "necessary": true, "statistics": true, "marketing": false },
  "services": {},
  "source": "banner",
  "region": "CH",
  "language": "de-CH"
}

Example record with made-up values.

Stored: The record is kept in a store you choose, on your infrastructure. The visitor ID is hashed with a secret salt and the ID itself is not stored.
Not stored: No IP address and no user agent. Fields the client adds are discarded.

Once the log runs, you process personal data. The retention period is required and has no default. Whether and how you use it is your decision.

Next.js route handler

// lib/consent-log.ts
import { createConsentLog } from "@weber-development/permito-log"
import { fileStore } from "@weber-development/permito-log/file"

export const log = createConsentLog({
  store: fileStore(process.env.CONSENT_LOG_FILE ?? "./data/consent-log.jsonl"),
  salt: process.env.CONSENT_LOG_SALT!, // at least 32 characters
  retentionDays: 90, // your decision, there is no default
})

// app/api/consent-log/route.ts
import { createConsentLogRoute } from "@weber-development/permito-log/next"
import { log } from "@/lib/consent-log"

export const runtime = "nodejs"
export const { POST } = createConsentLogRoute(log, {
  allowedOrigins: ["https://www.example.ch"],
})

Two files: the log, and the route that receives the browser's POST.

Next step

Use it in your own projectPricing is per person.

After checkout, Polar gives your GitHub account access. The Pro packages then install from GitHub Packages with a read-only token.

See pricing

Permito is technical consent infrastructure, not legal advice.