Live on this page

Watch the consent box work

This site runs its own product. The box in the corner is the same widget a practice installs, talking to the same API, writing to the same append-only record. Everything below reads live state out of your browser and out of the server — nothing on this page is a mockup.

“Clear my browser state” deletes the cookie and the widget's local queue so the banner appears again. It does not delete anything on the server — that is the point of an append-only log, and you can watch the old entries stay put in the last panel.

Your decision, as stored in your browser

Read from the first-party consential_consent cookie on this domain.

Decision on file—

Visitor ID—

Recorded at—

Policy version—

Essential—

Analytics—

Marketing—

Browser privacy signal (GPC)—

What this page is holding

Status is read from the browser's own Resource Timing entries — whether the request was actually made, not whether we think it was. The marketing row points at a first-party file on this domain rather than a real ad pixel: this site runs no ad tracking, and adding one so a demo could show it firing would be the exact thing this product complains about. What is real is the holding and the release.

Google Tag Manager
third party, real container—

Marketing tag stand-in
first party, this domain—

Tags released so far—

The Google Consent Mode v2 signal

Read live from window.dataLayer. The widget sends default before anything loads and update the moment you choose.

ad_storage—

analytics_storage—

ad_user_data—

ad_personalization—

Signals sent—

What gets sent to the server

One request, on the decision only — not on every page view. A returning visitor's stored choice is re-applied from the cookie without writing a second record. Here is the exact body of the last POST /v1/consent this browser would send for your current decision:

Make a choice in the consent box to see the payload.

Three things are deliberately absent from that body: your IP address, your user agent, and your jurisdiction. The server derives all three from the request it actually receives, because a value supplied by the page could be a lie. The IP is hashed before it is stored — the address itself is never written down.

What the server actually stored

This table is fetched back from the API by visitor ID. It is the append-only record: choosing again adds a row, it never edits one. If the table is empty, no decision has been recorded for this browser yet.

Recorded at (UTC)	Action	Categories	Source	Policy	Region	IP hash
No record on file for this browser yet.

What this page shows and what it doesn't. It shows a real widget holding a real third-party container, a real Consent Mode v2 signal, and real rows in the API's append-only table, read back over the network. It does not show tamper-evidence: the append-only guarantee here is a Postgres permission — the application role holds INSERT and SELECT on that table and has had UPDATE and DELETE revoked — not a cryptographic chain. The IP hash is shown truncated on purpose, because an unsalted SHA-256 of an IPv4 address is reversible by brute force and publishing the whole value would defeat hashing it.