c15t review: open-source consent for Next.js sites

Is c15t free?

The c15t library is free under Apache 2.0, including the backend you can run yourself. Inth charges only for hosting that backend, in US dollars.

Yearly billing takes 20% off. Every plan bills usage past the quota at $0.001 per request, so 50,000 extra requests add $50. Region rules (policy packs) start with Starter, chat support with Pro, and an enterprise tier adds a dedicated Slack channel. Development instances get every paid feature even on Free.

For a tube pulling a few hundred thousand visits a month, self-hosting swaps that bill for a server, a database and someone to maintain them.

Opt-out for California, opt-in for the EU and Brazil

c15t picks the consent model from the visitor’s location: opt-in for the EU, the UK, Switzerland, Brazil, Japan, South Korea and Quebec, opt-out for California, the rest of Canada and Australia. Visitors from a region with no rule detected see no banner. Opt-out means every category starts granted and the visitor gets a notice or footer link to refuse.

The California preset turns on Global Privacy Control. A browser sending the GPC signal is denied measurement and marketing automatically, which matters for sites selling ad inventory to US visitors under the CCPA. Region rules can replace the default table entirely, and the EU presets double as the fallback when geolocation fails, so a European visitor is never waved through.

Google Consent Mode v2 and Google Tag Manager come as built-in helpers. For programmatic ads in Europe, c15t runs IAB TCF 2.3 with TC strings and __tcfapi. Inth is a certified CMP and supplies its CMP ID when you use its backend with the stock IAB interface. A self-hosted backend needs its own IAB Europe registration, which may carry fees.

Holding back adult ad network tags

c15t injects a script only once its consent category is granted, and its network blocker stops fetch and XMLHttpRequest calls to the domains you list. Iframes follow the same rule through a data-src attribute.

The @c15t/scripts helpers cover Meta, TikTok, Reddit, X, LinkedIn, Microsoft UET, PostHog, Segment and others. None is an adult network, so ExoClick, TrafficStars or TrafficJunky go in as plain scripts under marketing, with the network blocker catching beacons from anything already loaded.

Revoking consent reloads the page. That is how c15t deals with httpOnly cookies and cookies on an ad network’s domain, which JavaScript cannot delete: the script simply never runs again. c15t does not scan for cookies, so every tracker has to be known and declared.

Is c15t fast? The benchmark comes from Inth

On the CookieBench leaderboard, c15t’s Next.js and React setups score 95, ahead of Ethyca at 76, CookieYes at 66 and OneTrust at 62, with zero bytes of network impact because the banner is bundled with the app. CookieBench is published by Inth, the company that maintains c15t, from its inthhq/benchmarks repository. Roboto Studio, whose c15t review calls CookieBench independent, is itself listed among c15t users.

React and Next.js today, Vue and Svelte in alpha

The banner, preferences dialog and settings trigger are React components. The core c15t package is headless: it exposes consent state and functions, and you write the markup. Vue, Svelte and TanStack Start packages are in the version 3 alpha. A Next.js app installs with npx @c15t/cli, and the core ships translations for 35 languages, Portuguese and Hindi included.

Where c15t stores proof of consent

In offline mode, consent lives only in a cookie and localStorage, with no geolocation, no audit trail and the GDPR rule applied to everyone. With a backend, each decision becomes an append-only record holding preferences, the detected regulation, IP address and timestamp, alongside an audit log.

That backend runs at Inth or on your own Node.js, Bun, Deno or Cloudflare Workers setup, with Prisma, Drizzle, Kysely, TypeORM or MongoDB as storage. If it goes down, the banner keeps working locally and syncs later.

c15t strengths and limitations