Per-category defaults
analytics runs on first paint; ads and other are gated until the visitor accepts. Mark each script with data-pc-track to opt it into the gate.
Drop a self-hosted cookie banner onto your site.
PrivacyWatchreads the trackers your scan already collected and emits a single <script> + <noscript> block. The block defaults to opt-in (refuse ads and "other") and uses a same-origin pc_consent_v1 cookie — no third-party consent iframe, no CDN import, no vendor key required.
How it works
Run a scan first — then generate the banner.
A consent banner must reflect what your site actually does at the moment of the scan. We read the persisted report and emit the snippet from it.
Paste your URL on the scanner, pick up the result, then click Generate cookie banner at the bottom of the report.
Open the scannerDefault-deny blocking
The snippet patches appendChild / insertBefore so off-by-default scripts stay queued in memory and replay only after the visitor accepts that category.
Self-contained — no CDN
A single <script> opens window.PrivacyConsent. No fetch() to a third-party service, no CSP script-src exception required.