UserGuard verifies every cookie with hard evidence, publishes consent UX visitors don’t resent, measures what they choose, and adds accessibility controls. $10 a site, not an enterprise contract.
Hold the trackers. Disclose everything.
Known tracker scripts are held until the visitor answers, and released only into the categories they allow. Then everything the scan found is disclosed: cookies in the cookie tables, and scripts, pixels, frames and storage keys named in their own section, as what they actually are.
It is the second half that most tools quietly fail. Promote every storage key to “cookie” and the report looks thorough, but you are now disclosing things that do not exist. Ninety-two entries where forty-four are real is not a stricter policy. It is a document that cannot survive its first question.
Compliance coverage
US-first, Europe-ready. UserGuard is built to run the visitor-facing machinery these regimes ask for, and to keep the records that show it.
“Do Not Sell or Share” link, notice at collection, and automatic Global Privacy Control honoring.
See how → US state privacy lawsTwelve requiring universal opt-out signals. Region-aware behavior per state.
See how → GDPR + ePrivacy · EUPrior consent before non-essential tags fire, equal-prominence reject, and Article 7(1) consent records.
See how → UK GDPR + PECRTracked as the Data (Use and Access) Act 2025 reshapes the rules.
See how → Google Consent Mode v2Default-denied signals for all four consent types before Google tags load, updated the moment a visitor chooses.
See how → WCAG 2.1 AA · ADA · EAAA consent banner every visitor can operate, plus honest accessibility tooling.
See how →UserGuard helps you operate consent and opt-out management as part of your compliance program. No tool makes you compliant on its own, and configuration remains yours. Not legal advice.
How it works
Chromium, up to 50 pages by default, twice. The first pass agrees to nothing: what fires before anyone consents is the compliance question. The second accepts everything, which is the disclosure one. Every cookie records which pass found it.
A record earns the word only with proof: a Set-Cookie header, an HTTP-only record, or a document.cookie value. You can add one the crawler cannot reach yourself, behind a login. Nothing is thrown away. Scripts, pixels and storage keys are disclosed as what they are, outside the cookie count.
Cookies the known list does not recognize go to AI. It drafts a category, a provider and a purpose, labels each one a draft with its confidence, and stops there. Nothing reaches a published policy until a person approves it, and no category cannot be approved at all.
Each publish freezes a numbered version. Superseded, never edited. Every consent decision names the version the visitor actually saw, the region, the language it was shown in, and the moment. Export the lot as CSV the day somebody asks you to prove it.
What visitors see
One script publishes everything below, per site, in the visitor’s own language. These are the real panels, drawn as they ship.
Accept all and Reject optional are the same button, filled with your accent color at the same size and weight, and neither is pre-selected when the banner opens. Preferences is a quieter text button that opens the preference center, and the cookie policy is a real link in the dialog’s tab order.
Cookie banner → Preference centerFour categories in plain language, each one expanding to name the cookies it covers — cookie, duration, provider, purpose. Necessary says why it cannot move instead of showing a switch that pretends. Allow all, Reject all and Save choices are drawn as the same button, so refusing everything is one click here too.
Cookie banner → Accessibility widgetText size to 140%, contrast, spacing, motion, readable font, link and focus highlighting, and more. Every control changes the page or it isn’t offered, and choices never leave the visitor’s device.
Accessibility widget → Do Not Sell or ShareCalifornia’s regulations are explicit that a cookie control is not by itself an acceptable opt-out method, so this is its own mechanism: its own link, its own panel, its own record, and its own 365-day lifetime. No account, no identity check, and the “Opt-Out Request Honored” marker appears the moment a Global Privacy Control signal is recognised.
CCPA + US state laws →Every surface above is generated from your approved cookie inventory and published per site. Turning one on is a toggle, not an install.
The difference
Six things a compliance tool either does or does not do.
Honest pricing
No pageview meters, no feature ransom, no “contact sales” to learn a number. Every compliance feature ships on every tier: GPC, geo-targeting, the accessibility widget.
$10/site/mo $10/mo total · Starter tier
Discounts apply themselves. Crossing a line drops every site to the new rate, not just the ones past it.
From the blog
Start today
Create an account, drop one script on a site, and the first scan verifies your cookies in minutes. Honest consent UX, consent analytics and accessibility controls, from $10 a site. Thirty days to get your money back if it is not right.
