Skip to content

Lepsto Consent

Collect cookie choices, block declared trackers, and keep signed consent records.

Lepsto Consent adds a cookie banner to your site, blocks declared third-party scripts until their category is allowed, and stores signed records of visitors’ decisions. You configure it in app.lepsto.com or through the consent_* MCP tools.

Start by declaring the providers your site uses. The banner cannot block an undeclared tracker, and code bundled into your own app needs its own consent check. See Add a cookie consent banner.

The three audiences

Visitors choose which categories to allow and can reopen their preferences later. Their choice is stored in a cookie on your site’s origin for twelve months, after which they are asked again.

Site owners declare providers and cookies, configure the banner’s appearance, install the snippet, and review or export consent records in the app.

Agents use the same product-scoped operations through MCP. Read, write and administrative operations require the corresponding access level. See The consent tools.

Categories

Visitors choose among three optional categories. The necessary category is always on.

Category
Visitor can turn it off
Use
necessary
No
Strictly necessary services
preferences
Yes
Services that remember visitor choices
statistics
Yes
Analytics and measurement
marketing
Yes
Advertising, retargeting and ad measurement

The banner, API and stored records all require necessary: true. Scripts belonging to the other categories stay blocked until the visitor allows them.

The banner maps these choices to Google Consent Mode v2. Storage starts as denied; analytics_storage follows statistics, while ad_storage, ad_user_data and ad_personalization follow marketing.

From a decision to proof

When a visitor saves a choice:

  1. The banner collects the category flags.
  2. The server stores the flags, method (explicit, implied or withdrawal), timestamp, region and page origin/path. It signs the record with a cryptographic stamp. See Consent records.
  3. The browser writes lepsto_consent on your origin, including the choice, stamp, record id and decision time. The server does not set this cookie.
  4. The blocker releases resources in allowed categories and blocks categories the visitor has withdrawn. See Script blocking.

The cookie and record have different lifetimes:

  • Cookie: twelve months. Its expiry determines when the visitor is asked again.
  • Record: 1095 days. This is the implemented retention period for decision history, not a universal legal requirement or guarantee of compliance.

What is your data and what is the visitor’s

Consent records belong to your product. They store the category flags, method, timestamp, region, page path and signature, but no name, email, IP address, visitor id or user agent.

A visitor can locate their decision history using the record id in their cookie. Consent cannot look up records by an end-user identity, so the platform’s end-user erasure operation does not select these records. Product erasure deletes the product’s Consent tables. See Consent records and Data and privacy.

Visitors reopen preferences through the floating icon, a custom element on your site, or the Cookie Declaration page’s button. Disabling the icon requires a CSS selector for a replacement trigger; your page must provide that element.

A withdrawal creates a new record linked to the previous decision and clears storage on the same cookie domain used for the choice. The linked records preserve the history. See Configure the banner.

Consent collects and records the choice. Lepsto Tracking reads it and adjusts collection. You can use either feature independently.

When a page uses both, install the banner first and declare it on the tracking snippet with data-consent="banner". This keeps an undecided visitor in cookieless mode even if tracking runs before the banner is ready. See What tracking does with a consent answer.

Next steps

Was this page helpful?
Esc

Start typing to search the docs.

↑↓navigate↵select