InCookie is a lightweight cookie consent manager deployed via Google Tag Manager. It supports GDPR, ePrivacy, and Google Consent Mode v2. No code changes needed on your site.

How long does setup take?

About 3 minutes. You add two tags in Google Tag Manager (consent defaults + banner), publish, and you are live. No backend or frontend changes required.

Yes, the basic version with InCookie branding is free. Premium features include white-label (no branding) and custom styling.

How does Google Tag Gateway help recover conversions?

Google Tag Gateway serves Google scripts (GA4, Ads) from your own domain via Cloudflare Workers. Ad blockers see first-party requests and let them through, recovering 10-22% of blocked signals.

What happens when a user rejects cookies?

GA4 switches to cookieless mode. It still collects session data without personal identifiers and uses conversion modeling to estimate the impact. Smart Bidding in Google Ads continues to work.

Which languages are supported?

Polish, English, German, Spanish, French, Ukrainian, Czech, and Slovak. The banner auto-detects the page language from the HTML lang attribute.

Gesetzlich vorgeschrieben · DSGVO + ePrivacy · Einrichtung im Google Tag Manager

Ein Cookie-Banner ist gesetzlich Pflicht. Erledigt in 3 Minuten - kostenlos, ohne Code.

InCookie ist ein fertiger Consent-Manager, konform mit DSGVO und ePrivacy-Richtlinie. Sie richten ihn im Google Tag Manager ein - ohne Änderungen am Code Ihrer Website und ohne Entwickler. Banner in 8 Sprachen, Consent Mode v2, Einwilligungsprotokoll. Und als Bonus stellt er zusammen mit dem Google Tag Gateway Signale wieder her, die von Adblockern und Safari ITP blockiert werden.

Deploy in 3 minutes

GDPR / ePrivacy Google Consent Mode v2 15 KB · zero dependencies MIT

dataLayer.push — consent_update

live

// 1. Default: all denied gtag('consent', 'default', { analytics_storage: 'denied', ad_storage: 'denied', ad_user_data: 'denied', ad_personalization: 'denied', }); // 2. On accept: update CookieConsent.run({ onAccept: ({ categories }) => { gtag('consent', 'update', { analytics_storage: categories.includes('analytics') ? 'granted' : 'denied', ad_storage: categories.includes('marketing') ? 'granted' : 'denied', }); } });

+22% signals after GTG deployment

/measured Q1 2026, n=84 clients

Works with your stack

Google Analytics 4 Google Ads Bing Ads Google Tag Manager Cloudflare Workers

// why it matters

Numbers that hurt, and numbers that save.

Without a consent manager Google blocks signals. Without Google Tag Gateway, ad blockers do it. After deploying both - you recover what you can't see in reports today.

14%

average conversion gap

Ad blockers, Safari ITP and missing consent cut every 7th signal. These conversions exist - Google just doesn't count them.

+22%

recovery after GTG

Google scripts served from your domain via Cloudflare Worker. Ad blockers see a first-party request and let it through.

15KB

gzip, zero dependencies

CookieConsent v3 (MIT, Orestbida). Loads faster than a single OneTrust poll. No React, no jQuery.

// how it works

Four steps. Zero code on your site. Three minutes in GTM.

Deployment is two tags in Google Tag Manager - defaults and banner. No backend, no frontend, no waking up a developer at 10 PM.

Blocks by default

Consent Mode v2 starts in denied state. Google Tag holds cookies and signals until the user decides.

~50 ms

Shows banner

Box inline in the bottom left corner - doesn't block content, no wall to click through. Accept / Reject / Customize.

<1 LCP impact

Pushes to dataLayer

After choice - consent_update to GTM. GA4 and Ads tags fire only now, with the right flags.

Consent Mode v2

Remembers choice

Cookie cc_cookie (6 months) holds preferences. Re-prompt only when you change policy or categories.

180 days

// consent categories

Three categories. Granular control for the user, clear flags for Google.

1:1 mapping to Google Consent Mode v2. Necessary is always on. Analytics and Marketing - off by default.

Necessary

necessary — always on · functionality_storage

Session, language, cart, CSRF token. Site doesn't work without these. No consent required under GDPR (Art. 6(1)(f)).

cc_cookie6 mo.

session_idsession

csrf_tokensession

Analytics

analytics — analytics_storage

Google Analytics 4: how users navigate the site, source/medium, conversions.

_ga2 years

_ga_*2 years

_gid24 h

Marketing

marketing — ad_storage · ad_user_data · ad_personalization

Google Ads and Bing Ads: remarketing and conversion tracking. Without this, campaign optimizer doesn't know who bought.

_gcl_*Google Ads · 90 d

_uetsidBing Ads · 24 h

IDEDoubleClick · 13 mo

// GTM setup

Two tags in Google Tag Manager. Third if you want +22% signals.

Paste, save, publish. No developer or code access needed.

Trigger

Consent Initialization — All Pages

gtm-consent-defaults.html JavaScript

1<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
4
gtag('consent', 'default', {
  analytics_storage:     'denied',
  ad_storage:            'denied',
  ad_user_data:          'denied',
  ad_personalization:    'denied',
  wait_for_update:       500,
});
12</script>

// compliance & i18n

Legally compliant. Understandable to users in 8 languages.

Language detection from document.documentElement.lang - banner auto-selects the right translation.

GDPR / RODO

Granular consent, withdrawal option, decision log. Maps to GDPR Art. 7.

ePrivacy

Directive 2002/58/EC. Cookies only after consent. Only necessary without consent.

Consent Mode v2

All 4 signals: ad_storage, analytics_storage, ad_user_data, ad_personalization.

MIT License

Open source (Orestbida CookieConsent). You can audit, fork, self-host.

🇵🇱 PL Polski 🇬🇧 EN English 🇩🇪 DE Deutsch 🇪🇸 ES Español 🇫🇷 FR Français 🇺🇦 UK Українська 🇨🇿 CZ Čeština 🇸🇰 SK Slovenčina

// even when the user declines

Cookieless GA4 isn't empty.

Without marketing consent Google doesn't set cookies - but receives an ad_storage: denied signal. Consent Mode v2 then models conversions based on aggregates.

Cookieless ping instead of cookie - full session in GA4
Conversion modeling in Ads (Smart Bidding still works)
Behavioral & conversion modeling report active from day one
No raw personal data - 100% GDPR-compliant

GA4 · user_engagement

modeled

SourceSessionsConversions

Direct · consented4 218187

Google / cpc · consented2 904142

Direct · modeled+ 612+ 26

Google / cpc · modeled+ 388+ 19

Total (after InCookie deployment)8 122374

// what's next

InCookie is the first widget from Intum Widget Platform.

Eventually one JavaScript snippet will handle cookies, chat, helplinks, forms and A/B flags. One GTM tag instead of five.

Rechtskonform. In 3 Minuten eingerichtet. Kostenlose Version.

Richten Sie heute ein rechtskonformes Cookie-Banner ein. Kostenlos, in 3 Minuten, ohne Code.

Hinterlassen Sie Ihre E-Mail - wir senden ein fertiges GTM-Container-Paket (Consent Defaults + Banner) und einen kurzen Einrichtungs-Call. Die Signal-Wiederherstellung per Google Tag Gateway ist optional.

$ npm - not needed · < 3 min - your time · $0 - basic version

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    analytics_storage: 'denied',
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    wait_for_update: 500,
  });
</script>

<link rel="stylesheet" href="https://cdn.incookie.com/v3/cc.min.css">
<script src="https://cdn.incookie.com/v3/cc.min.js"></script>
<script>
  CookieConsent.run({
    categories: { necessary: { readOnly: true }, analytics: {}, marketing: {} },
    onChange: ({ cookie }) => {
      const c = cookie.categories;
      gtag('consent', 'update', {
        analytics_storage: c.includes('analytics') ? 'granted' : 'denied',
        ad_storage: c.includes('marketing') ? 'granted' : 'denied',
      });
    }
  });
</script>

export default {
  async fetch(req) {
    const url = new URL(req.url);
    const origin = url.pathname.startsWith('/gtag')
      ? 'https://www.googletagmanager.com'
      : 'https://www.google-analytics.com';
    return fetch(new Request(origin + url.pathname, req));
  }
};