Plain Consent 2.2.0

Plain Consent 2.2.0 is a backward compatible minor release: the opt-in credit link is now written in the banner's language. A free, dependency-free cookie consent banner with true opt-in, Google Consent Mode v2, Subresource Integrity and a strict-CSP friendly runtime. MIT licensed, built on vanilla-cookieconsent 3.1.0.

The files are meant to be self-hosted: download them, put them on your own server and embed them. The banner makes no network requests and, with the defaults below, carries no third-party attribution.

What is new

• Localized, opt-in credit. The optional "credit": true footer link now follows the banner language (Czech and Slovak "Lištu poskytuje Socionet", English "Consent bar by Socionet", German "Consent-Leiste von Socionet", Polish "Pasek zgody od Socionet") and links to https://socionet.cz/ with rel="nofollow noopener". The text is fixed. It is off by default and the snippet below does not enable it.

Nothing else changed in behaviour. Full reference: README.

Install

1. Download plain-consent.js and plain-consent.css (or the zip) from the assets below and place them on your web server, for example at /plain-consent/v2.2.0/. Do not minify or modify them, or the integrity check will fail.
2. Add this to the <head> of your page, before all other scripts (especially before the Google tag):

<link rel="stylesheet" href="/plain-consent/v2.2.0/plain-consent.css" integrity="sha384-UigpuEPI8sZ22V7UM8A95UEmcs6VT3cmYC49ue/wrNcQw0Vm9Hf6SsjkLv0C7zlM" crossorigin="anonymous">
<script type="application/json" id="plain-consent-config">
{
  "accent": "#1f2937",
  "categories": ["analytics", "marketing"],
  "privacyUrl": "/privacy/",
  "consentMode": true,
  "language": "auto",
  "revision": 0
}
</script>
<script src="/plain-consent/v2.2.0/plain-consent.js" integrity="sha384-49/hm1U4h5BoIV9XtX4ORW+YCses85oU2wvNtqvepXLNiRpD8p2VBcdJRwRDA9Fi" crossorigin="anonymous"></script>

3. Tag scripts that need consent with type="text/plain" and data-category="analytics" (or marketing, preferences), and embeds with data-category and data-src.
4. Add a withdrawal link to your footer: <button type="button" data-cc="show-preferencesModal">Cookie settings</button>.

Upgrading from 2.1.0: replace the two file URLs and the two integrity values.

Subresource Integrity (sha384)

File	integrity
plain-consent.js	sha384-49/hm1U4h5BoIV9XtX4ORW+YCses85oU2wvNtqvepXLNiRpD8p2VBcdJRwRDA9Fi
plain-consent.css	sha384-UigpuEPI8sZ22V7UM8A95UEmcs6VT3cmYC49ue/wrNcQw0Vm9Hf6SsjkLv0C7zlM
LICENSE.txt	sha384-Q3/LgG0LyClttbQ0PoWGaU+BLAdSPjC0CnLXhIN3NYgQoixCA2pkDMyVbJq5J0MK

Check a downloaded file yourself: openssl dgst -sha384 -binary plain-consent.js | openssl base64 -A

Assets

• plain-consent.js, plain-consent.css, LICENSE.txt: the release files, byte for byte what is in releases/v2.2.0/ at this tag.
• plain-consent-v2.2.0.zip: the same three files in one archive.

Published releases are immutable: this release never changes, and v2.1.0, v2.0.0 and v1.0.0 are untouched.

Plain Consent 2.1.0

Plain Consent 2.1.0 is a backward compatible minor release: embed blocking, five built-in languages, Global Privacy Control and a consent event. A free, dependency-free cookie consent banner with true opt-in, Google Consent Mode v2, Subresource Integrity and a strict-CSP friendly runtime. MIT licensed, built on vanilla-cookieconsent 3.1.0.

The files are meant to be self-hosted: download them, put them on your own server and embed them. The banner makes no network requests and carries no third-party attribution.

What is new

• Embed blocking. Tag an <iframe> (YouTube, maps, forms) with data-category and put its address in data-src: nothing loads until its category is accepted. A placeholder explains why and offers "Allow and show"; withdrawing consent unloads the iframe again. Iframes added later are handled too.
• Five built-in languages. Czech (default), Slovak, English, German and Polish via "language", or "language": "auto" to follow <html lang>. Your own texts still win.
• Global Privacy Control. When the browser sends GPC, marketing is not offered and never granted. Switch off with "respectGpc": false.
• plain-consent:update event on document for your own code after every choice.

Why these features and the full reference: README.

Install

1. Download plain-consent.js and plain-consent.css (or the zip) from the assets below and place them on your web server, for example at /plain-consent/v2.1.0/. Do not minify or modify them, or the integrity check will fail.
2. Add this to the <head> of your page, before all other scripts (especially before the Google tag):

<link rel="stylesheet" href="/plain-consent/v2.1.0/plain-consent.css" integrity="sha384-r7NJ29b3+NwyUK7PpfT49LlTn0l2x5NPSDMedN/20yRvAq+dXvcOp7paFDbfivUy" crossorigin="anonymous">
<script type="application/json" id="plain-consent-config">
{
  "accent": "#1f2937",
  "categories": ["analytics", "marketing"],
  "privacyUrl": "/privacy/",
  "consentMode": true,
  "language": "auto",
  "revision": 0
}
</script>
<script src="/plain-consent/v2.1.0/plain-consent.js" integrity="sha384-BAzp45CBWuieJ8BZBRXX5Cl4n+btT5+WeyGOr88wYUwi3taWxN0VibI7dGMzyzLe" crossorigin="anonymous"></script>

3. Tag scripts that need consent with type="text/plain" and data-category="analytics" (or marketing, preferences), and embeds with data-category and data-src as described above.
4. Add a withdrawal link to your footer: <button type="button" data-cc="show-preferencesModal">Cookie settings</button>.

Upgrading from 2.0.0: replace the two file URLs and the two integrity values. Visitors whose browser sends GPC no longer see marketing (set "respectGpc": false to opt out); the language stays Czech unless you set "language".

Subresource Integrity (sha384)

File	integrity
plain-consent.js	sha384-BAzp45CBWuieJ8BZBRXX5Cl4n+btT5+WeyGOr88wYUwi3taWxN0VibI7dGMzyzLe
plain-consent.css	sha384-r7NJ29b3+NwyUK7PpfT49LlTn0l2x5NPSDMedN/20yRvAq+dXvcOp7paFDbfivUy
LICENSE.txt	sha384-Q3/LgG0LyClttbQ0PoWGaU+BLAdSPjC0CnLXhIN3NYgQoixCA2pkDMyVbJq5J0MK

Check a downloaded file yourself: openssl dgst -sha384 -binary plain-consent.js | openssl base64 -A

Assets

• plain-consent.js, plain-consent.css, LICENSE.txt: the release files, byte for byte what is in releases/v2.1.0/ at this tag.
• plain-consent-v2.1.0.zip: the same three files in one archive.

Published releases are immutable: this release never changes, and v2.0.0 and v1.0.0 are untouched.

Plain Consent 2.0.0

Plain Consent 2.0.0 is the first release published under the name Plain Consent (v1.0.0 was the same banner under the former name cookie-lista). A free, dependency-free cookie consent banner with true opt-in, Google Consent Mode v2, Subresource Integrity and a strict-CSP friendly runtime. MIT licensed, built on vanilla-cookieconsent 3.1.0.

The files are meant to be self-hosted: download them, put them on your own server and embed them. The banner makes no network requests and carries no third-party attribution.

Install

1. Download plain-consent.js and plain-consent.css (or the zip) from the assets below and place them on your web server, for example at /plain-consent/v2.0.0/. Do not minify or modify them, or the integrity check will fail.
2. Add this to the <head> of your page, before all other scripts (especially before the Google tag):

<link rel="stylesheet" href="/plain-consent/v2.0.0/plain-consent.css" integrity="sha384-Q2cOPPvV3BauSPuRsd9k3+QwNRB6HZK4glR3pPPga2Qxj7/xzteDYdt3C+B7sXdz" crossorigin="anonymous">
<script type="application/json" id="plain-consent-config">
{
  "accent": "#1f2937",
  "categories": ["analytics", "marketing"],
  "privacyUrl": "/privacy/",
  "consentMode": true,
  "credit": false,
  "revision": 0
}
</script>
<script src="/plain-consent/v2.0.0/plain-consent.js" integrity="sha384-5FU5bjr8XxrnlQ6PE9CN8YF1SMQTr0cU54y/EwnVyRjPKhoa8GEsUYh4pRlj0aPj" crossorigin="anonymous"></script>

3. Tag scripts that need consent with type="text/plain" and data-category="analytics" (or marketing, preferences).
4. Add a withdrawal link to your footer: <button type="button" data-cc="show-preferencesModal">Cookie settings</button>.

Full configuration reference: README.

Subresource Integrity (sha384)

File	integrity
plain-consent.js	sha384-5FU5bjr8XxrnlQ6PE9CN8YF1SMQTr0cU54y/EwnVyRjPKhoa8GEsUYh4pRlj0aPj
plain-consent.css	sha384-Q2cOPPvV3BauSPuRsd9k3+QwNRB6HZK4glR3pPPga2Qxj7/xzteDYdt3C+B7sXdz
LICENSE.txt	sha384-Q3/LgG0LyClttbQ0PoWGaU+BLAdSPjC0CnLXhIN3NYgQoixCA2pkDMyVbJq5J0MK

Check a downloaded file yourself: openssl dgst -sha384 -binary plain-consent.js | openssl base64 -A

What is in it

• Opt-in without dark patterns: "Accept all" and "Reject all" side by side, same style. No cookie wall.
• Google Consent Mode v2: all types denied by default before any Google tag, updated on every choice.
• Script management by category, cleanup of known tracking cookies on refusal or withdrawal, a floating button to change or withdraw consent, re-asking after you raise revision.
• Strict CSP: no eval, no inline styles, two file URLs are enough.
• Czech texts by default, every text configurable (English example in the README).

Assets

• plain-consent.js, plain-consent.css, LICENSE.txt: the release files, byte for byte what is in releases/v2.0.0/ at this tag.
• plain-consent-v2.0.0.zip: the same three files in one archive.

Published releases are immutable: this release never changes. Fixes and new features arrive as new versions with new hashes.