ConsentOS review: self-hosted CMP with GPP for US states

GPP strings for California, Virginia, Colorado, Connecticut and Florida

ConsentOS encodes the IAB Global Privacy Platform v1 with the US National section and state sections for California, Virginia, Colorado, Connecticut and Florida. Ad partners that read GPP get a machine-readable opt-out from US visitors, alongside the TCF v2.3 string for Europe.

Region rules decide the banner: opt-in for the EU, opt-out for California, informational elsewhere if you choose. Behind Cloudflare, the visitor’s country arrives in the cf-ipcountry header with no setup, and state-level rules need Cloudflare’s region header. Global Privacy Control signals are detected. For a Shopify storefront, consent is passed to Shopify’s Customer Privacy API.

Unrecognized ad tags run before consent

The ConsentOS blocker holds back only scripts it can classify. A tag from an ad network it does not know executes before the visitor chooses. The documentation says unknown scripts default to marketing. The banner code does the opposite: a script with no category passes through.

Built-in patterns cover Google, Meta, X, LinkedIn, TikTok and a few analytics and chat tools. No adult network is among them or in the bundled Open Cookie Database. Add data-category="marketing" to ExoClick, TrafficStars or TrafficJunky tags to hold them. The documentation mentions a data-consent attribute, which the code never reads. Iframes are not blocked at all and need a placeholder you swap in after consent.

What you need to run it

ConsentOS ships as Docker Compose or a Helm chart: a Python API, a Playwright-driven scanner, PostgreSQL 17, Redis, Celery workers and a React admin. On the site, a script tag loads a 2 KB loader and a roughly 26 KB banner in a Shadow DOM. The software is free, the server and its upkeep are not. Each install sends a daily anonymous telemetry heartbeat with no consent records or domains, off with TELEMETRY_ENABLED=false.

Organisations, site groups and sites share settings that cascade down to each region, with role-based access. Banner text ships in English, and other languages are entered per site.

What the Elastic License 2.0 allows

You can self-host and modify ConsentOS for your own sites. You cannot provide it to third parties as a hosted or managed service, which rules out an agency reselling it to clients. The repository has 16 stars, 8 forks and 7 open issues, version 0.3.0 dates from June 2026 and fixes continued through late September.

Are there independent ConsentOS reviews?

Not yet. The post that Google titles “ConsentOS Review by Enterprise Expert” is a LinkedIn endorsement by a colleague of James Cottrill, the platform’s main developer, who writes that he recommends it without having tested or demoed it. The ConsentOS listed on Capterra is a different product, a compliance tool for Indian financial institutions under the DPDP Act 2023.

ConsentOS strengths and limitations