Skip to main content

Beexy / Consent / Technical Reference

Beexy Consent

The complete cookie consent solution for Google Tag Manager. 143+ jurisdictions. 33 languages. WCAG 2.2 AA. One-time purchase from €79.

Version 1.5.0
Regions 143+
Languages 33
Services Detected 44
Cookies Mapped 115
Accessibility WCAG 2.2 AA
License From €79
See pricing Book a call

Segment 01 / 03

Coverage

Which laws the banner covers, which regions it targets, which languages it speaks. Start here if you're checking whether Beexy Consent fits your legal footprint.

In this segment

01 Consent Models 02 Region Coverage 03 Language Support 04 Legal Compliance

02 Coverage

Region Coverage

143+ jurisdictions covered. US state-level and Canadian province-level granularity. Unmapped regions fall back to opt-in.

76Opt-in countries
39Opt-out countries
11GPC US states
15No-banner countries

03 Coverage

Language Support

33 languages. English is embedded in the core config. All others are loaded on-demand from the CDN (~3KB each).

Localization runs end to end. It is not only the banner buttons and category descriptions: the entire cookie-purpose database and the cookie-duration labels are translated into every one of the 33 languages too, so a non-English visitor never drops back to English mid-panel. See Multilingual cookie purposes.

bg cs da de el en es et fi fr hi hr hu it ja ko lt lv nb nl pl pt ro ru sk sl sv th tr uk vi zh zh-TW

Auto-detection chain

  1. window.beexyConsentLang (GTM field override, Pro/Agency)
  2. <html lang> attribute
  3. navigator.languages browser preference
  4. English fallback

04 Coverage

Legal Compliance Status

Compliance is a moving target. This table reflects the current version. Consent records age out automatically when they pass the region's retention limit (365 days default, 182 days in France per CNIL Deliberation 2020-091), with a 1-day grace window for clock skew; expired records trigger a fresh prompt before any restoration. "Partial" means the core mechanism is implemented but optional add-ons (e.g. operator-side consent-proof backend) remain operator-supplied.

FrameworkJurisdictionStatus
GDPREU/EEA (27 member states)Compliant
UK GDPR + PECRUnited KingdomCompliant
revFADPSwitzerlandCompliant
Privacy Act 1988AustraliaCompliant
Privacy Act 2020New ZealandCompliant
CCPA / CPRACalifornia, USACompliant
CPA, CTDPA, DPDPA, MODPA, MCDPA, MCDPA-MT, CDPA-NE, NHIPA, OCPA, TDPSA10 additional US statesPartial
LGPDBrazilCompliant
PIPEDA / Quebec Law 25CanadaCompliant
European Accessibility Act / WCAG 2.2 AAEU + UKCompliant
Framework
GDPR
Jurisdiction
EU/EEA (27 member states)
Status
Compliant
Framework
UK GDPR + PECR
Jurisdiction
United Kingdom
Status
Compliant
Framework
revFADP
Jurisdiction
Switzerland
Status
Compliant
Framework
Privacy Act 1988
Jurisdiction
Australia
Status
Compliant
Framework
Privacy Act 2020
Jurisdiction
New Zealand
Status
Compliant
Framework
CCPA / CPRA
Jurisdiction
California, USA
Status
Compliant
Framework
CPA, CTDPA, DPDPA, MODPA, MCDPA, MCDPA-MT, CDPA-NE, NHIPA, OCPA, TDPSA
Jurisdiction
10 additional US states
Status
Partial
Framework
LGPD
Jurisdiction
Brazil
Status
Compliant
Framework
PIPEDA / Quebec Law 25
Jurisdiction
Canada
Status
Compliant
Framework
European Accessibility Act / WCAG 2.2 AA
Jurisdiction
EU + UK
Status
Compliant

Dark pattern prevention: structural button equality

The single most-enforced cookie-banner violation is asymmetric consent, making "Accept" visually prominent while pushing "Reject" into a lower-contrast or lower-prominence treatment. Regulators have converged on a "deny as easy as accept" doctrine and enforce it: the CNIL fined Google EUR 150M and Meta EUR 60M in 2022 specifically because rejecting was harder than accepting; the CPPA fined American Honda USD 632,500 in March 2025 for asymmetric opt-out; and the EDPB Cookie Banner Taskforce (2023) made equal-weight buttons effectively mandatory across the EEA.

Beexy Consent makes that violation impossible to build, not merely discouraged. Every action button (Accept, Customise, Decline) is rendered from one shared CSS class, derived from a single primaryColor and one buttonStyle. There is no per-button color path in the code, so accept and decline always share the same color, fill, border, and size by construction. Competing consent platforms that expose independent Background / Text / Border controls per button hand this responsibility to the installer, which is exactly the surface regulators sweep. Beexy takes the responsibility on itself: equal weight is a property of the markup, not a configuration the operator can get wrong.

Outline-button affordance. When buttonStyle is set to outline, every action button carries a small rest-state drop shadow (box-shadow: 0 2px 6px rgba(0,0,0,0.14), lifting to 0 4px 10px rgba(0,0,0,0.20) on hover). The shadow uses a neutral black alpha rather than the outline color, so it reads as tappable on light or busy pages while staying visibly lighter than a filled button. The same neutral shadow is applied to the secondary button (the opt-out-region deny action), so every action button shares the affordance: still no per-button surface a deployer can desync.

Not covered in this version

  • IAB TCF 2.2 / 2.3 (deferred to v2.0)
  • Children / age-specific consent
  • Cross-TLD multidomain consent (e.g. brand.com ↔ brand.nl), research only
  • Right to erasure of consent records
  • ePrivacy Regulation (pending EU law)

Segment 02 / 03

Mechanics

How the banner behaves once it's live: Google Consent Mode wiring, cookie detection, privacy signals, accessibility, and how it decides which region a visitor belongs to.

In this segment

05 Consent Mode v2 06 Cookie Auto-Detection 07 GPC & DNSMPI 08 Accessibility 09 Geo-Adaptation

05 Mechanics

Google Consent Mode v2, Advanced

Beexy Consent implements the Advanced mode (not Basic). This enables cookieless conversion and behavioral modeling even when consent is denied.

How it works

  1. consent default fires on every page load with all types denied plus wait_for_update: 500
  2. For returning visitors: consent is read synchronously from the beexy_consent cookie. Zero async gap before consent update.
  3. consent update fires immediately on any user action

Category to storage-type mapping

Consent CategoryGoogle Storage Types
Necessarysecurity_storage
Preferencesfunctionality_storage, personalization_storage
Analyticsanalytics_storage
Marketingad_storage, ad_user_data, ad_personalization
Consent Category
Necessary
Google Storage Types
security_storage
Consent Category
Preferences
Google Storage Types
functionality_storage, personalization_storage
Consent Category
Analytics
Google Storage Types
analytics_storage
Consent Category
Marketing
Google Storage Types
ad_storage, ad_user_data, ad_personalization

Configurable via GTM fields

  • url_passthrough: preserve click IDs in URLs for cookieless measurement
  • ads_data_redaction: redact ad click identifiers in pings when marketing denied
  • wait_for_update: configurable ms to wait before GTM fires tags (default 500)

06 Mechanics

Cookie Auto-Detection

Beexy Consent automatically detects which third-party cookies are active on the page and displays them in the banner's Details tab. No manual configuration. v1.4.0 introduces a two-layer detection model + tier-selectable database scaling from ~50 to 370+ services.

372
Services (Large tier)
2,071
Cookies mapped
3
Database tiers

4-layer detection (v1.4.0+)

  1. Layer 1: Banner's own cookies (beexy_consent, beexy_geo): always shown in Necessary.
  2. Layer 0 (full coverage, v1.4.0+): Scans document.cookie on the live page and regex-matches each name against the loaded tier database. On match, surfaces the cookie with full metadata (provider, duration, purpose, category). Works for any service in the active tier with zero per-service curation. This is the path that makes Medium and Large tiers genuinely useful: every actually-set cookie gets metadata if its name is in the database.
  3. Layer 2 (pre-consent transparency): When a known service's script is detected on the page (window[scriptGlobal] exists OR a <script src> contains the service's URL pattern), ALL its cookies surface even before they are set. Gives visitors the "these cookies will be set if you accept" view ahead of any actual storage. Applies only to the 44 curated services that carry script-presence signals.
  4. Layer 3: Custom cookies defined in the customCookies GTM SIMPLE_TABLE field (Pro / Agency), for proprietary cookies not in any tier database.

All four layers merge with de-duplication by cookie name (Layer 0 wins on collision — same metadata source either way, idempotent).

Cookie database tier (v1.4.0+, Pro+ field)

A new Pro+ GTM template SELECT field, Cookie database tier, controls which cookie-database tier the banner loads at init. Three tiers, all served from the jsDelivr CDN:

TierServicesCookiesRaw sizeGzipped (CDN wire)Composition
Small (default)4411529 KB4.4 KBCurated set, full script-presence detection signals. Covers the ~50 most-prevalent trackers (Google, Meta, LinkedIn, TikTok, HotJar, Microsoft Clarity, Stripe, Intercom, etc.).
Medium (Pro+ opt-in)150829248 KB35.5 KBCurated 44 + 106 additional platforms ranked by global tracker prevalence. Adds mid-tail SaaS + ad-tech vendors.
Large (Pro+ opt-in)3722,071591 KB81.3 KBCurated 44 + the full catalogued platform set. Full coverage for sites with heavy ad-tech stacks.
Tier
Small (default)
Services
44
Cookies
115
Raw size
29 KB
Gzipped (CDN wire)
4.4 KB
Composition
Curated set, full script-presence detection signals. Covers the ~50 most-prevalent trackers (Google, Meta, LinkedIn, TikTok, HotJar, Microsoft Clarity, Stripe, Intercom, etc.).
Tier
Medium (Pro+ opt-in)
Services
150
Cookies
829
Raw size
248 KB
Gzipped (CDN wire)
35.5 KB
Composition
Curated 44 + 106 additional platforms ranked by global tracker prevalence. Adds mid-tail SaaS + ad-tech vendors.
Tier
Large (Pro+ opt-in)
Services
372
Cookies
2,071
Raw size
591 KB
Gzipped (CDN wire)
81.3 KB
Composition
Curated 44 + the full catalogued platform set. Full coverage for sites with heavy ad-tech stacks.

Data source. A curated, regularly-updated cookie database covering the most prevalent global trackers. Each larger tier adds progressively broader ad-tech and SaaS coverage. The database is refreshed periodically and served from the CDN, so updates reach every install automatically.

Defaults + tier fallback. New installs default to small. Existing installs without the field set fall through to small (smallest visual change). Basic tier hard-codes small because cookieDeclarationsGroup is stripped from the Basic template entirely; banner JS defaults window.beexyConsentCookieDatabaseTier || 'small' so the missing window var is harmless.

Fetch failure behavior. If the tier file fails to load (CDN incident, network block), banner falls through to empty knownCookies. Cookie display is informational, not consent-blocking. Consent still works. Layer 0 finds zero matches in that state; any actual cookies on the page surface in the Unknown section instead.

Multilingual cookie purposes & durations (v1.5.0+)

Detection metadata is fully localized. Every cookie purpose in the curated database is translated into all 33 supported languages, and the duration labels are localized too. A visitor on the banner in Polish or Japanese reads the Purpose column in their own language, and the Duration column renders in-language as well: 30 days shows as 30 dni (Polish) or 30 日 (Japanese), and Session as Sesja / セッション.

  • Purposes. The purpose catalogue is maintained once in English, then translated per language. The banner fetches only the slice for the active language and selected tier, on demand, from cookie-purposes/{tier}/{lang}.json on the CDN. English visitors load nothing extra. A missing slice falls back to the English purpose per entry, so display never breaks.
  • Durations. Each language ships a small duration lexicon (unit words plus keywords like Session, Persistent, Unknown). Free-text durations such as 1 year or Session are parsed and re-rendered in-language; anything unrecognised is shown verbatim.

This closes the last English-only surface in the consent UI: for a non-English visitor the banner text, the category descriptions, the individual cookie purposes, and the durations are now all in one language.

Browse the cookie database

Explore exactly which services and cookies each tier covers. Beexy Consent uses the same tiered database structure in production: Small for the curated default set, Medium for broader SaaS and ad-tech coverage, and Large for the full catalogued platform set.

Small Default
Services
44
Cookies
115
Best for
Most common analytics, ads, chat, payment and embed tools.
Medium Pro+
Services
150
Cookies
829
Best for
Sites with a broader SaaS and ad-tech stack.
Large Pro+
Services
372
Cookies
2,071
Best for
Heavy ad-tech stacks that need the widest database coverage.
Full appendix

Download the complete cookie database appendix covering Small, Medium and Large tiers: 3,015 cookie rows across 44, 150 and 372 services.

Download PDF

Upload the PDF appendix to WordPress Media Library using the exact filename beexy-consent-cookie-database-appendix.pdf. If WordPress gives it a different URL, replace the button href with the Media Library file URL.

Unknown cookies (v1.4.0+)

The Details panel surfaces every cookie the browser is currently storing for the visitor's session, including ones the banner does not yet recognise. Unknown cookies appear in a dedicated Unknown group beneath the four category accordions, so the visitor sees the full picture rather than only what we have catalogued.

Two reasons this matters:

  • Transparency. Visitors see exactly what is on their device, not a filtered subset that hides third-party tags the banner has not learned yet.
  • Discoverability for site owners. If a cookie that is meaningful for the site keeps appearing in Unknown, the site owner knows to categorise it explicitly.

Pro and Agency tiers include a customCookies simple-table field in the GTM template's Cookie Declarations group, letting the site owner promote a specific Unknown cookie into the appropriate category. The Category column is a SELECT with four values (necessary, preferences, analytics, marketing); default is analytics. Help text inside GTM enumerates the four valid values inline so the choice is unambiguous.

Basic tier does not expose customCookies (the field is stripped from the Basic .tpl by build-tiers.js). Unknown cookies still surface in the Details panel on Basic, they just cannot be promoted into a category without upgrading.

07 Mechanics

Global Privacy Control & Do Not Sell

Beexy Consent is the only GTM consent template that natively supports the Global Privacy Control (GPC) browser signal and the "Do Not Sell or Share My Personal Information" mechanism required by US state privacy laws.

Global Privacy Control (GPC)

  • Detects navigator.globalPrivacyControl === true at banner init
  • In opt-out-gpc regions: automatically denies Analytics and Marketing
  • GPC state is included in all consent events and server-side log payloads
  • Legally required in: CA, CO, CT, DE, MD, MN, MT, NE, NH, OR, TX

Do Not Sell or Share My Personal Information (DNSMPI)

  • Plain-text opt-out link shown in all 3 banner tabs (Consent, Details, About)
  • Only visible to visitors in opt-out-gpc regions
  • Clicking immediately denies Analytics plus Marketing and fires consent_outcome: 'do_not_sell'

08 Mechanics

Accessibility, WCAG 2.2 AA

10 out of 11 commercial CMPs fail WCAG 2.2 AA. Beexy Consent passes.

Compliant since v1.0.25. Also satisfies the European Accessibility Act (EAA), in force June 28, 2025.

Keyboard navigation

KeyActionWCAG criterion
Tab / Shift+TabCycle focus within banner (focus trap)2.1.2
Enter / SpaceActivate focused button or toggle2.1.1
EscapeClose banner (opt-out regions only, disabled in opt-in per GDPR)2.1.1
← / → Arrow keysNavigate between Consent / Details / About tabsARIA tablist pattern
Key
Tab / Shift+Tab
Action
Cycle focus within banner (focus trap)
WCAG criterion
2.1.2
Key
Enter / Space
Action
Activate focused button or toggle
WCAG criterion
2.1.1
Key
Escape
Action
Close banner (opt-out regions only, disabled in opt-in per GDPR)
WCAG criterion
2.1.1
Key
← / → Arrow keys
Action
Navigate between Consent / Details / About tabs
WCAG criterion
ARIA tablist pattern

Screen reader support

ImplementationWCAG criterion
role="dialog" + aria-modal="true" on banner1.3.1
aria-live="polite" region announces banner title on open4.1.3
inert attribute on all page content behind banner1.3.1
role="tablist", role="tab", role="tabpanel" on 3-tab interfaceARIA pattern
role="switch" + aria-checked on consent toggles4.1.2
Focus enters Consent tab on open; returns to previously focused element on close2.4.3
3px :focus-visible outline on all interactive elements2.4.7
Shell-level focus ring (3px primary-color outline, offset 0, flush against the banner border) painted whenever the banner first opens; persists through mouse clicks; yields to the inner :focus-visible ring once the visitor presses Tab / Shift+Tab / arrow. New in v1.4.0 (BACKLOG #20).2.4.7 + 2.4.13 (AAA)
.beexy-consent-sr-only class for visually-hidden screen-reader text1.3.1
Implementation
role="dialog" + aria-modal="true" on banner
WCAG criterion
1.3.1
Implementation
aria-live="polite" region announces banner title on open
WCAG criterion
4.1.3
Implementation
inert attribute on all page content behind banner
WCAG criterion
1.3.1
Implementation
role="tablist", role="tab", role="tabpanel" on 3-tab interface
WCAG criterion
ARIA pattern
Implementation
role="switch" + aria-checked on consent toggles
WCAG criterion
4.1.2
Implementation
Focus enters Consent tab on open; returns to previously focused element on close
WCAG criterion
2.4.3
Implementation
3px :focus-visible outline on all interactive elements
WCAG criterion
2.4.7
Implementation
Shell-level focus ring (3px primary-color outline, offset 0, flush against the banner border) painted whenever the banner first opens; persists through mouse clicks; yields to the inner :focus-visible ring once the visitor presses Tab / Shift+Tab / arrow. New in v1.4.0 (BACKLOG #20).
WCAG criterion
2.4.7 + 2.4.13 (AAA)
Implementation
.beexy-consent-sr-only class for visually-hidden screen-reader text
WCAG criterion
1.3.1

09 Mechanics

Automatic Geo-Detection

Beexy Consent automatically determines each visitor's jurisdiction and applies the correct consent model. No manual country lists required.

Detection chain (in priority order)

  1. window.beexyConsentRegion: manual override (e.g. for testing)
  2. beexy_geo cookie: 30-day cached result from previous detection
  3. Cloudflare Worker at beexy-geo.voxxycreativelab.workers.dev: real-time IP-based detection
  4. 'unknown' fallback → opt-in model (strictest)

Granularity

  • US state-level: Distinguishes all 11 GPC-required states from general US
  • Canadian province-level: Distinguishes Quebec (opt-in) from rest of Canada (opt-out)
  • EU/EEA member state: France gets 182-day cookie cap; Germany's X button is hidden

Geo cookie: beexy_geo, 30-day TTL. Prevents repeated geo API calls on subsequent page loads.

Segment 03 / 03

Integration

Pick a tier, import the template, wire the fields, ship. This segment covers the setup surface: what's in each tier, every GTM field, the banner UI, the dataLayer events, the JavaScript API, and how the assets are stored and served.

In this segment

10 Product Tiers 11 GTM Setup 12 Banner UI & Behavior 13 dataLayer Events 14 JavaScript API 15 Storage & CDN

10 Integration

Product Tiers

Three tiers, three separate .tpl files. No runtime license key. Features are enforced by the template itself.

Basic · €79 one-time
  • All compliance features
  • Unlimited installs
  • 143+ regions, 33 languages, WCAG 2.2 AA
  • Google Consent Mode v2 (Advanced)
  • GPC + DNSMPI
  • Cookie auto-detection
  • Consent logging endpoint
  • 6 GTM fields
  • 15 test scenarios
  • Branding locked to Voxxy defaults
  • No color/font/style customization
Pro · €249 one-time
  • Everything in Basic, plus:
  • Unlimited installs
  • Full color system (4 brand colors)
  • Widget color control (2 colors)
  • Button style (filled / outline / bordered)
  • Corner style (rounded / square / pill)
  • Border width control
  • Surface intensity control
  • Custom font URL + font family name (v1.2.1+)
  • Client logo (top-left)
  • Cookie declarations table
  • Language override
  • Widget position (left / right)
  • Overlay toggle
  • Privacy-page suppression (v1.2.0+, default ON)
  • Banner density preset (v1.3.0+, default Standard)
  • Mobile banner density preset (v1.5.0+, default Standard)
  • Custom cookies (SIMPLE_TABLE, v1.4.0+)
  • 27 GTM fields
  • 26 test scenarios
  • Monochrome Beexy badge (not removable)
Agency · €999 one-time
  • Everything in Pro, plus:
  • Unlimited client implementations
  • Agency logo replaces Beexy badge
  • Agency URL on badge link
  • Custom widget logo
  • Full white-label
  • 30 GTM fields
  • 28 test scenarios

The Agency tier permits unlimited client implementations as part of the agency's own services. It does not permit standalone resale of the template.

11 Integration

GTM Template Setup

Import the template file directly into your GTM container as a custom template. No code editing required.

Installation (3 steps)

  1. Import the Beexy Consent template (.tpl file) into GTM as a custom template
  2. Configure fields: set Privacy Policy URL and Data Controller Name (required), plus any optional branding/consent fields
  3. Publish the GTM container

Required fields (all tiers)

FieldDescription
privacyUrlURL of your privacy policy page
dataControllerLegal name of the data controller
Field
privacyUrl
Description
URL of your privacy policy page
Field
dataController
Description
Legal name of the data controller

12 Integration

Banner UI & Behavior

3-tab interface

TabContents
ConsentCategory toggles, main action buttons, DNSMPI link (GPC regions)
DetailsPer-category cookie declaration tables (auto-detected + custom)
AboutData controller info, privacy policy link, "Legal details" link to the product details page (v1.4.0+, all tiers, opens in a new tab), "Privacy by" badge
Tab
Consent
Contents
Category toggles, main action buttons, DNSMPI link (GPC regions)
Tab
Details
Contents
Per-category cookie declaration tables (auto-detected + custom)
Tab
About
Contents
Data controller info, privacy policy link, "Legal details" link to the product details page (v1.4.0+, all tiers, opens in a new tab), "Privacy by" badge

Model-aware button layouts

ModelButtons shownX button
opt-inAllow All · Deny All · CustomizeHidden
opt-outAllow All · Manage PreferencesShown (accepts defaults)
opt-out-gpcAllow All · Manage Preferences + DNSMPI linkShown
noneNo banner shownN/A
Model
opt-in
Buttons shown
Allow All · Deny All · Customize
X button
Hidden
Model
opt-out
Buttons shown
Allow All · Manage Preferences
X button
Shown (accepts defaults)
Model
opt-out-gpc
Buttons shown
Allow All · Manage Preferences + DNSMPI link
X button
Shown
Model
none
Buttons shown
No banner shown
X button
N/A

Other UI elements

  • Floating re-open widget: Fixed button (left or right, configurable) that re-opens the banner after it's been dismissed
  • Privacy-page suppression (Pro+, v1.2.0): When the visitor lands on the configured Privacy Policy URL, the consent popup is hidden so they can read the policy. The floating widget stays visible so consent remains reachable. Default ON for Pro and Agency. Basic tier always shows the banner. Initial page load only: SPA route changes are not detected.
  • Background overlay: Semi-transparent backdrop behind banner. Toggleable via GTM field (Pro+). Page remains scrollable (no cookie wall).
  • "Privacy by" badge: Basic = colored Beexy logo; Pro = monochrome Voxxy; Agency = custom agency logo
  • Responsive: Adapts at desktop, tablet, mobile, and landscape breakpoints

Banner density (Pro+, v1.3.0+)

Three density presets control vertical occupancy on desktop. Selectable via the GTM SELECT field bannerDensity in the Branding > Style section.

PresetBanner height (Consent tab, English copy)WidthPosition vs peers
Compact~308px tall800pxShorter than CookieBot and CookieConfirm
Standard (new-install default)~356px tall850pxClose to peer banner heights
Spacious~421px tall900pxv1.1.x / v1.2.x baseline
Preset
Compact
Banner height (Consent tab, English copy)
~308px tall
Width
800px
Position vs peers
Shorter than CookieBot and CookieConfirm
Preset
Standard (new-install default)
Banner height (Consent tab, English copy)
~356px tall
Width
850px
Position vs peers
Close to peer banner heights
Preset
Spacious
Banner height (Consent tab, English copy)
~421px tall
Width
900px
Position vs peers
v1.1.x / v1.2.x baseline

Each preset scales 19 CSS tokens together: banner width, padding (large + small variants), tab sizing (margin, padding, gap), title font-size + margin-bottom, body font-size + line-height, category headers + content padding, action row padding + gap, button padding + font-size, logo cap, badge cap, content panel max-height. The About and Details panels inherit the same tokens via shared classes; nothing has to be configured separately.

Accessibility. All three presets pass WCAG 2.5.5 AAA target sizes (>= 44px) on the primary CTA buttons. Compact-preset button height measures 48px (4px AAA headroom). Width also clears the 24px AA threshold by orders of magnitude (416-422px across presets, driven by flex: 1 distributing button width within the banner).

Mobile is independent. Desktop density does not affect mobile rendering. Mobile is controlled by the separate mobileBannerDensity field, see the next subsection.

Existing-client migration. Pro and Agency clients on upgrade keep their current visuals: undefined density falls through to spacious, which matches the pre-v1.3.0 hardcoded sizing exactly. No re-consent event, no surprise visual change. Basic tier renders at spacious always (no field in Basic).

Mobile banner density (Pro+, v1.5.0+)

Three density presets control vertical occupancy on mobile viewports (below 600px wide). Selectable via the GTM SELECT field mobileBannerDensity in the Branding > Style section, directly under the desktop banner density field.

Each preset scales 19 mobile-specific CSS custom properties (--beexy-consent-md-*) together: shell margin, padding (x/y, actions bottom), title (size + margin), body (size + line-height), tab strip (margin x/y, button padding x/y, font size), action gap, buttons (padding + font-size), logo height, badge height. New-install default: standard. Existing clients on upgrade fall through to spacious (D10 contract; no re-consent event).

Approximate total height at 393x750 viewport: Compact ~290px (~39%), Standard ~360px (~48%), Spacious ~440px (~59%). All presets preserve WCAG 2.5.5 AAA touch target (44px via padding) and the EDPB equal-prominence rule (Allow and Manage buttons render at identical dimensions). The Spacious preset matches the pre-v1.5.0 rendering for rules previously set explicitly on mobile; five rules that previously inherited desktop values (header pad-y, content pad-y, tabs margin-top, tab padding) intentionally tighten by 2-3px per the spec table.

Desktop density (bannerDensity) is configured independently. A client can ship Spacious desktop and Compact mobile, etc. Above the 600px breakpoint, mobile density has no effect. The landscape emergency block (@media (max-height: 500px)) remains hardcoded and not density-aware.

Basic tier: field stripped via brandingGroup removal. Banner JS D10 fallback renders Spacious.

13 Integration

dataLayer Events

Beexy Consent fires structured dataLayer events on every consent action and on every page load for returning visitors.

Main event: cookie_consent_update

PropertyValues
consentType'update' | 'existing' | 'auto_grant'
consent_outcome'granted_all' | 'denied_all' | 'partial' | 'auto_grant' | 'existing' | 'do_not_sell'
permissionsObject: { necessary, preferences, analytics, marketing } (booleans)
gpcEnabledtrue | false
regionRegion code string (e.g. 'DE', 'US-CA')
Property
consentType
Values
'update' | 'existing' | 'auto_grant'
Property
consent_outcome
Values
'granted_all' | 'denied_all' | 'partial' | 'auto_grant' | 'existing' | 'do_not_sell'
Property
permissions
Values
Object: { necessary, preferences, analytics, marketing } (booleans)
Property
gpcEnabled
Values
true | false
Property
region
Values
Region code string (e.g. 'DE', 'US-CA')

Per-category events

Event nameFires when
cookie_consent_statisticsAnalytics consent is granted (new or existing)
cookie_consent_marketingMarketing consent is granted (new or existing)
cookie_consent_preferencesPreferences consent is granted (new or existing)
Event name
cookie_consent_statistics
Fires when
Analytics consent is granted (new or existing)
Event name
cookie_consent_marketing
Fires when
Marketing consent is granted (new or existing)
Event name
cookie_consent_preferences
Fires when
Preferences consent is granted (new or existing)

Server-side consent logging

When a logEndpoint is configured, Beexy Consent sends a POST via navigator.sendBeacon (XHR fallback) with the following payload, providing GDPR Art. 7 consent proof:

{
  "timestamp":     "ISO 8601 datetime",
  "action":        "consent_outcome value",
  "permissions":   { necessary, preferences, analytics, marketing },
  "bannerVersion": "1.5.0 (current BANNER_VERSION constant; cookie schema cfg.version is frozen at '1')",
  "gpcEnabled":    true | false,
  "region":        "XX",
  "pageUrl":       "https://..."
}

14 Integration

JavaScript API

Available as window.beexyConsentAPI once the banner script loads. Use it to integrate with custom cookie preference links, analytics conditions, or programmatic consent flows.

MethodReturnsDescription
showBanner()voidRe-opens the consent banner on the Consent tab
getConsent(){ necessary, preferences, analytics, marketing } | nullCurrent permissions object, or null if no consent cookie exists
getRegion()stringDetected region code (e.g. 'DE', 'US-CA', 'unknown')
getLanguage()stringResolved language code (e.g. 'nl', 'en')
getMode()stringActive consent model name ('opt-in' | 'opt-out' | 'opt-out-gpc' | 'none')
isGpcEnabled()booleanWhether the browser's GPC signal is active
updateConsent(permissions)voidProgrammatically update consent. Writes cookie, fires dataLayer events, calls log endpoint.
resetConsent()voidDeletes the consent cookie and re-opens the banner
Method
showBanner()
Returns
void
Description
Re-opens the consent banner on the Consent tab
Method
getConsent()
Returns
{ necessary, preferences, analytics, marketing } | null
Description
Current permissions object, or null if no consent cookie exists
Method
getRegion()
Returns
string
Description
Detected region code (e.g. 'DE', 'US-CA', 'unknown')
Method
getLanguage()
Returns
string
Description
Resolved language code (e.g. 'nl', 'en')
Method
getMode()
Returns
string
Description
Active consent model name ('opt-in' | 'opt-out' | 'opt-out-gpc' | 'none')
Method
isGpcEnabled()
Returns
boolean
Description
Whether the browser's GPC signal is active
Method
updateConsent(permissions)
Returns
void
Description
Programmatically update consent. Writes cookie, fires dataLayer events, calls log endpoint.
Method
resetConsent()
Returns
void
Description
Deletes the consent cookie and re-opens the banner

15 Integration

Consent Storage & CDN

Cookie scope (cross-subdomain consent, v1.1.0)

beexy_consent and beexy_geo are written at the registrable-domain scope (e.g. .example.com, .example.co.uk). A user who consents on shop.example.com is silently recognized on blog.example.com. No second prompt. For unusual deployments (apex-only, *.pages.dev, etc.) Pro and Agency tiers can override the auto-detected root via the rootDomainOverride GTM field. Hosts where root-domain cookies don't apply (localhost, IP literals, single-label hosts) fall back to host-only.

Migration: existing visitors with the legacy host-only cookie are migrated to the root scope automatically on their next page load. No re-consent required.

Consent cookie: beexy_consent

PropertyValue
FormatJSON
Fieldsversion, permissions, explicitConsent, timestamp, region, gpcApplied
Default expiry365 days
France (FR) expiry182 days (CNIL requirement)
Versioned consentMajor version bump triggers re-consent from all visitors
Property
Format
Value
JSON
Property
Fields
Value
version, permissions, explicitConsent, timestamp, region, gpcApplied
Property
Default expiry
Value
365 days
Property
France (FR) expiry
Value
182 days (CNIL requirement)
Property
Versioned consent
Value
Major version bump triggers re-consent from all visitors

Geo cookie: beexy_geo

Caches the detected region code for 30 days. Prevents a geo API call on every page load.

CDN delivery

All assets served via jsDelivr from the VoxxyCreativeLab/cdn-beexy-consent@v1 GitHub repository. The @v1 alias automatically serves the latest tagged release.

AssetURL patternSize
Banner JScdn.jsdelivr.net/gh/VoxxyCreativeLab/cdn-beexy-consent@v1/beexy-consent.js~76KB
Global configcdn.jsdelivr.net/gh/VoxxyCreativeLab/cdn-beexy-consent@v1/beexy-global.json~8KB
Language filescdn.jsdelivr.net/gh/VoxxyCreativeLab/cdn-beexy-consent@v1/lang/[code].json~3KB each
Asset
Banner JS
URL pattern
cdn.jsdelivr.net/gh/VoxxyCreativeLab/cdn-beexy-consent@v1/beexy-consent.js
Size
~76KB
Asset
Global config
URL pattern
cdn.jsdelivr.net/gh/VoxxyCreativeLab/cdn-beexy-consent@v1/beexy-global.json
Size
~8KB
Asset
Language files
URL pattern
cdn.jsdelivr.net/gh/VoxxyCreativeLab/cdn-beexy-consent@v1/lang/[code].json
Size
~3KB each

Ready to get consent right?

Install the template into your GTM container, set two required fields, publish. That's the whole setup.

Get the template Book a call
What's not in this version
IAB TCF 2.2 / 2.3 (deferred to v2.0)
Cross-domain consent sharing (not planned)
Children / age-specific consent (not planned)
ePrivacy Regulation (pending EU law)
Auto-contrast enforcement (deferred to v2.0)
© 2026 Voxxy Creative Lab. All rights reserved

Privacy Preference Center

Privacy Preferences