# Publish a Cookie Declaration page

Link to your product's Cookie Declaration or embed it in your site. The page lists declared providers and cookies by category and updates from the same provider data as the banner.

To let visitors reopen preferences from an embedded declaration, the host page must also load the consent banner.

## Before you start

- [Declare your providers and cookies](/privacy/providers-and-cookies). The declaration has no separate content editor.
- Have your product id ready. Replace `<YOUR_PRODUCT_ID>` in both examples below.

## 1. Find the URL

```text
https://public.lepsto.com/<YOUR_PRODUCT_ID>/consent/declaration
```

Use the base URL and product id from your banner snippet, replacing `banner.js` with `declaration`. In `app.lepsto.com`, the **Install on your site** card also shows this URL beside the snippet.

## 2. Link it, or embed it

Add a link from your cookie policy, or place this iframe on a page that loads the banner:

```html
<iframe src="https://public.lepsto.com/<YOUR_PRODUCT_ID>/consent/declaration"
        title="Cookie Declaration" width="100%" height="800"></iframe>
```

The declaration is a complete HTML document with inline CSS and one inline script. It supports embedding from any origin through `Content-Security-Policy: frame-ancestors *` and has no `X-Frame-Options` header.

In an iframe, **Open cookie preferences** sends a message to the parent page. The banner runtime checks the sender's origin and opens preferences. If the host page has no banner, the button only logs a console warning. On a top-level page with the runtime available, it calls `window.LepstoConsent.openPreferences()` directly.

## 3. Check it worked

1. Open the declaration URL and confirm each provider appears in the correct category with its description and privacy policy link.
2. Check each cookie table: **Name**, **Purpose**, **Duration** and **Type** must match your declaration.
3. Check the heading's date. It is the latest provider or cookie change, shown as a UTC date.
4. Confirm *Lepsto Consent* appears first under `necessary`, with `lepsto_consent`. This built-in entry is present even if you have added no providers.
5. On the page hosting your iframe, click **Open cookie preferences** and confirm the panel opens.

## Freshness

Successful responses are cached for five minutes in the browser and any CDN, separately for each product. Allow that window for provider and cookie edits to appear.

Unconfigured-product and failed responses are not cached.

## Two limits to know

The page is **English only**. It ignores `Accept-Language` and has no per-product language setting.

Privacy policy links appear only for `http` and `https` URLs. Other schemes are omitted. Provider names, descriptions and cookie fields are escaped, so markup in a field displays as text.

## Next steps

- [Declare your providers and cookies](/privacy/providers-and-cookies): change what the declaration shows.
- [The banner runtime](/privacy/banner-runtime): connect the preferences button to your banner.