How Cookie Craft is built
A first-party consent runtime — PHP on the server, JavaScript in the browser, data in your own database. No vendor script in the critical path, and a design a technical buyer can actually verify.
First-party, from your own server
Hosted CMPs such as CookieYes and Cookiebot load their consent runtime from the vendor’s own domain — a third-party dependency on every page. Cookie Craft installs and runs entirely on your own infrastructure. Cookie Craft itself makes no visitor-facing request to our servers; the analytics and advertising tools you enable still contact their providers, only under the consent rules you configure.
Two layers, by design
The reason the system is more robust than a lone JavaScript banner is that the work is split between the server and the browser.
Server-side (PHP)
Publishes the default consent state and places the injection points early in the page — before the browser starts making tag decisions.
Client-side (JavaScript)
Renders the banner, captures the choice and updates the consent state — first-party, from your own origin.
Local storage
The consent cookie and Cookie Craft’s own consent log live in your database. Nothing is sent to a vendor cloud.
The execution order
01
Default state, before the container
Cookie Craft publishes a default consent state (analytics and advertising denied) before Google Tag Manager or any gated tag can act.
02
Banner and choice
The first-party banner renders; the visitor’s choice is captured and the consent state updated. A returning visitor’s valid choice is applied without a new banner.
03
Consent-aware tags
Google tags read Consent Mode v2 states; Meta and TikTok load only after advertising consent. The trackers you configured then contact their own providers.
What still loads third-party — and when
Being honest about this is the point. Cookie Craft removes the vendor-CDN request for the consent tool from every page. It does not remove the trackers you choose to run: once the matching consent exists, GTM, GA4, Google Ads, Meta and TikTok load from their own providers, exactly as you configured them. What you gain is the order and the control — not a page with zero third parties regardless of consent.
The licence is separate from the runtime
The banner runs on your server and does not wait on us. Licensing is a separate background check a few times a day: Cookie Craft uses the last valid signed verdict, so a temporary API outage does not interrupt the banner — it keeps working for the documented tolerance period, and your admin shows exactly what is happening.
Verify it yourself
Network tab: filter for the consent tool — there is no request to a vendor CDN, because it is served from your own domain. GTM Preview / Tag Assistant: the default denied state is published before gtm.js, and updates after the visitor chooses. Your database: the consent state and log are yours to inspect. Every architectural claim on this page is checkable in a browser.
Architecture you can inspect.
First-party runtime, your own database, no vendor in the critical path. See the demo or the pricing.