What is c15t?

c15t is an open-source cookie consent manager and consent management platform (CMP) for JavaScript applications. The project describes itself as "the open standard for cookie banners" and is built by Inth, the company that also runs the hosted consent backend. It provides a GDPR cookie banner, a preference dialog and consent-gated loading of third-party scripts for React, Next.js, Vue, Nuxt, Svelte, SvelteKit, Astro, TanStack Start and plain HTML. The banner is shipped in the application bundle and rendered by the application itself rather than injected by a third-party snippet after the page loads.

The code lives in the c15t/c15t monorepo, written in TypeScript and built with Bun and Turborepo. Most applications install the single c15t npm package, which contains the consent engine and the framework adapters behind subpath imports such as c15t/next, c15t/vue and c15t/astro. Separate packages cover the headless engine (@c15t/core), the script-tag build for Webflow, WordPress, Framer, Squarespace and static HTML (@c15t/browser), vendor loaders (@c15t/integrations), IAB TCF 2.4 and GPP (@c15t/iab), banner text in 53 languages (@c15t/translations), the self-hostable backend (@c15t/backend), a Node SDK, a CLI and development tools.

Each package is released separately from the monorepo. The main c15t package is at c15t@3.2.2, published November 1, 2026 together with the other 3.2.2 packages; a maintenance tag c15t@2.4.1 on the older v2 line followed on November 2. Version 3.0.0, published October 12, 2026, introduced adapters for TanStack Start, Nuxt, Vue, Astro, Svelte and SvelteKit, a self-hosted backend on Effect SQL, a cacheable /manifest endpoint, 34 policy rule presets and GPP 1.1 with 16 US state sections. The 3.2.0 changelog (October 29) lists scripts that start from server HTML before hydration, a shadcn registry, 18 additional languages, about 30 new vendor integrations and the rename of offline() to local().

A c15t app needs a backend to serve policies and keep consent records. The project offers two options: the hosted backend on Inth, which has a free tier and paid plans, or the open-source @c15t/backend run on the operator's own server with PostgreSQL, MySQL or SQLite. A local mode keeps choices only in the browser and keeps no server-side consent record; the documentation marks it as not recommended for production. According to the license page, c15t and its published SDKs and packages in the repository are licensed under the Apache License 2.0.

c15t decides when scripts may run and records choices; it does not by itself establish a legal basis for processing. The policy documentation states that presets are starting configurations and that a country match does not establish a legal basis for a vendor's data use. Consent-aware loaders exist for analytics tools listed on iThub such as PostHog, Umami and Rybbit, and adapters cover frameworks such as Next.js and Astro.

Inside the application

c15t screenshots

Explore the interface. Open a screenshot to view it at full size.

View full size ↗

c15t screenshot 1

Official c15t documentation image of the preference dialog over a demo coffee shop page, with a custom green theme.

View full size ↗

Bottom bar banner

Official c15t documentation image of the stock banner in bar presentation, with a Privacy settings link in the page footer.

View full size ↗

Choice wall

Official c15t documentation image of the wall presentation, which blocks the page until the visitor chooses.

View full size ↗

Branded card banner

Official c15t documentation image of a branded floating card banner built with theme tokens.

View full size ↗

Headless custom bar

Official c15t documentation image of a custom bar rendered with the headless API instead of the stock components.

Source: official c15t project page.

Key capabilities

Prebuilt banner, dialog and widget components ConsentBanner, ConsentDialog, ConsentDialogLink, ConsentWidget and ConsentGate are exported per framework. Presentation options include floating, bar, widget and wall, and the 3.0 release added A/B experiments for banner variants. In Next.js the root layout can stay a Server Component without a 'use client' wrapper or a separate stylesheet import.
Headless runtime and hooks Applications that need their own interface can use the headless engine in c15t or c15t/runtime, or the per-field hooks and composables in React, Vue and Svelte. Version 3.2 added hooks such as useBannerCopy(), useConsentLabels() and useConsentGate(). Solid has no adapter; the documentation points to the headless runtime for it.
Framework adapters The README lists React 18 and 19, Next.js 15 and 16 (App Router and Pages Router), Vue 3, Nuxt 3 and 4, Astro 5, 6 and 7, TanStack Start, Svelte 5 and SvelteKit. The 3.x packages are ESM only. A @c15t/browser script tag from a CDN covers Webflow, WordPress, Framer, Squarespace and static HTML without a build step.
Server-rendered banner In Next.js, Nuxt, Astro, TanStack Start and SvelteKit the server resolves each visitor's policy, so the banner can be part of the first HTML response. Since 3.2, scripts the visitor's stored consent already allows can start from server HTML before hydration; this can be turned off with scriptLoader: { serverStart: false }. Static, prerendered and shared-cache pages resolve consent in the browser instead.
Consent modes Every framework package exports manifest(), hosted() and local(). manifest() resolves policy from a manifest downloaded at build time or fetched at runtime, hosted() asks the backend's GET /init on each page, and local() keeps choices in browser storage with no server-side record. In development builds local mode logs a warning that it keeps no consent records.
Policy rules per region Policy rules select an opt-in, opt-out or none model, the prompt type and the categories in scope. The local recommended pack uses opt-in for Europe and Quebec, opt-out for its supported US privacy states and a no-prompt default elsewhere, with a strict opt-in fallback for unknown countries. The 3.0 release introduced 34 policyRulePresets; the documentation describes presets as starting configurations.
Google Consent Mode v2 The Google tag helper in @c15t/integrations sends the Consent Mode v2 default command before config and an update on each change. By default the measurement category maps to analytics_storage and marketing to ad_storage, ad_user_data and ad_personalization; consentMapping replaces the map. The Google Tag Manager loader passes choices to Consent Mode as well. With loadMode: 'after-consent' nothing is sent to Google until the category is allowed.
IAB TCF 2.4 and GPP The optional @c15t/iab package adds an IAB TCF 2.4 banner and dialog, configured with a CMP ID, policy and vendor data, plus publisher restrictions written into the TC string. GPP 1.1 is installed at __gpp with 16 US state sections. IAB components are available in React, Next.js, Nuxt, Vue, Astro, Svelte, SvelteKit and the script tag; the shadcn registry has no IAB items.
Global Privacy Control C15t evaluates the Global Privacy Control signal live and, according to the 3.0 changelog, never stores it as a refusal. Saved refusals and privacy signals can keep a category denied under opt-out policies. The snapshot exposes effectivePermissions, explicitChoice and privacySignals separately.
Vendor integrations @c15t/integrations has consent-aware loaders for more than 40 vendors across web analytics, product analytics, replay and monitoring, experimentation, ads, data and tag tools, and chat widgets, including Google Tag Manager, GA4, Meta Pixel, PostHog, Matomo, Plausible, Hotjar, Segment and Intercom. Most loaders wait for the vendor's consent category; a few, such as Google Tag Manager and Mixpanel, load immediately and pass the choice to the vendor's own consent API. YouTube and Google Maps use consent-gated embeds.
Network blocker A networkBlocker configuration holds fetch and XMLHttpRequest calls to listed domains until their category is granted, with optional path matching. It covers browser requests only: requests made on the server, and modules evaluated before the consent root renders, are outside its scope.
Self-hosted backend @c15t/backend serves policies and stores consent records on PostgreSQL, MySQL or SQLite through Effect SQL drivers. The schema is created with npx @c15t/cli self-host migrate, and c15tInstance().handler takes a web Request and returns a Response, so it mounts in Next.js, TanStack Start, Nuxt, SvelteKit or another server. Only sites listed in trustedOrigins can record consent; others receive 400 DOMAIN_NOT_ALLOWED.
Consent records and Node SDK Since 3.0, consent records store only the visitor's action, and permissions are computed against the current rule on each read. Visitors are asked again when a choice expires or a rule change affects it, and copyRevision asks everyone again. @c15t/node-sdk provides createC15tClient() to read and write consent records from a server.
Hosted backend on Inth Inth runs the backend, consent records, website and code audits, managed regional policy packs on Pro and above, and an agent. The pricing page lists Free (500 consent sessions per month), Starter at $36 per month (5,000 sessions), Pro at $124 per month (50,000 sessions) and Business at $624 per month (250,000 sessions), with yearly prices and Enterprise and bring-your-own-cloud options through sales. The Free plan stops answering once its limit is reached; paid plans bill overage per 1,000 sessions.
Theming and translations Prebuilt components use a theme system with tokens, class names, slots, dark mode, motion settings and Tailwind CSS support; Tailwind CSS 3 needs the c15t/postcss-tailwind3 plugin. @c15t/translations ships banner and dialog text in 53 languages, importable one language at a time, with right-to-left support.
shadcn registry Since 3.2 the consent UI can be installed with the shadcn CLI. Items include consent-banner, consent-dialog, consent-sheet, consent-preferences, consent-widget and consent-gate, each in Next.js, React and TanStack Start versions with builds for 27 shadcn styles.
CLI, dev tools and agent docs npx @inth/cli c15t signs in to Inth, creates or picks a project and sets up c15t, either through a coding agent or with inth c15t scaffold. @c15t/dev-tools inspects consent state during development. Each package ships Markdown docs matched to its version, including node_modules/c15t/AGENTS.md, and the website publishes an llms.txt index.

Where c15t fits

Adding a consent banner to a Next.js App Router site

The Next.js quickstart installs c15t and @c15t/integrations, wraps next.config.ts with withConsentManifest(), declares scripts in c15t.config.ts and renders ConsentRoot, ConsentBanner and ConsentDialog in the root layout. The backend URL comes from NEXT_PUBLIC_C15T_BACKEND_URL. The policy is downloaded at build time and resolved on the server for each request.

Holding analytics and ad tags until consent

Vendor loaders such as posthog() or gtag() are listed in the scripts array with a category. With loadMode: 'after-consent' a loader does not run until the visitor allows its category; Google helpers also send Consent Mode v2 default and update commands. The integrations overview documents what each loader does before and after a choice.

Serving different rules by region

Policy rules decide who sees a banner: opt-in for visitors in the EU, opt-out for some US states, or custom rules. On Inth the rules are configured on the hosted project; on a self-hosted backend they live in manifest.policyRules, as described in the policy packs guide. The policies page explains how to read effectivePermissions and explicitChoice and why a banner may be absent.

Running programmatic advertising with IAB TCF

Publishers using the IAB framework add @c15t/iab and render the IAB banner and dialog inside the consent root with their CMP ID and vendor data. Publisher restrictions can override a vendor's declared use of a purpose. The IAB TCF guide covers the Next.js setup and stylesheet options.

Operating the consent backend in-house

Teams that keep consent data on their own infrastructure install @c15t/backend and a database driver, create c15t-backend.config.ts, run the CLI migration with --plan and --apply, and mount the request handler on a catch-all route. The self-hosting guide describes checking /status and /manifest and confirming a POST to /subjects. The operator then owns migrations, backups, signing secrets, availability and upgrades.

Adding consent to a CMS or static site

Sites built with WordPress, Webflow, Framer, Squarespace or a static generator such as Hugo load @c15t/browser as one script tag. The hosted bundle c15t.js talks to a backend, while c15t.local.js keeps choices in the browser only. Since static HTML is the same for every visitor, consent resolves in the browser after the page loads.