Consent models explained

Last updated 2 November 2026

Kukie.io supports four consent models, each designed for different regulatory requirements. The consent model determines whether cookies and scripts are blocked by default, when the banner appears, and how Google Consent Mode signals are set. You can assign different models to different regions using region rules.

Opt-in (GDPR)

The Opt-in model is the strictest option and the one required by GDPR and the ePrivacy Directive in the EU/EEA. All non-essential cookies and scripts are blocked until the visitor explicitly accepts them. Google Consent Mode defaults are set to denied for all parameters.

How it works

The banner appears on the first visit.
No analytics, marketing, or functional cookies are set until the visitor clicks Accept All or saves custom preferences.
Google Tag Manager is not loaded until consent is given.
If the visitor rejects all, only necessary cookies are used.

Tip: This is the recommended model for any website serving visitors in the EU, UK, or other strict-consent jurisdictions.

Opt-out (CCPA)

The Opt-out model allows all cookies by default and gives the visitor the option to refuse. This matches the CCPA/CPRA approach used in California and other US states where consent is implied until the user opts out.

How it works

Google Consent Mode is told granted from page load, through a consent default scoped to the regions whose rule is Opt-out. The banner sends no consent update until the visitor acts.
All scripts and cookies load normally from the first page view.
The banner still appears, informing the visitor and offering a way to opt out, unless the visitor's browser sends Global Privacy Control (see below).
If the visitor opts out, non-essential cookies are blocked going forward.

Notice Only

The Notice Only model shows the banner as an informational notice without any blocking. All cookies and scripts run regardless of the visitor's interaction with the banner. This is suitable for regions with minimal cookie regulation or where you only need to inform visitors that cookies are used.

How it works

The banner appears with an informational message.
All cookies and scripts are active from the start.
Dismissing the banner does not change cookie behaviour. If the banner offers Reject All and the visitor uses it, the refused categories stay blocked on every page while that choice is stored.
Google Consent Mode is told granted from page load through a region default, the same as opt-out. If the notice closes by itself, the banner then sends the granted update.

Hidden

The Hidden model does not display any banner at all. Consent is granted silently, and all Google Consent Mode parameters are set to granted. Use this for regions where cookie consent is not legally required, or for internal/intranet sites.

If the visitor made a choice earlier, for example through a "Do Not Sell or Share" link in your footer or in a region that shows the banner, that choice is applied instead on every page while it is stored. A Global Privacy Control signal is the one exception, described below.

Important: Using the Hidden model in a region that requires consent (such as the EU) may result in non-compliance. Always check local privacy regulations before choosing this model.

Visitors who send Global Privacy Control

Some browsers and extensions send a Global Privacy Control signal, a request to opt out of the sale and sharing of personal information. When Respect Global Privacy Control is on in the Banner Editor's Behaviour tab (it is on by default), the Opt-out, Notice Only and Hidden models record the signal as the visitor's opt-out the first time they see it:

Only necessary cookies and scripts are used, the same as a Reject All.
The opt-out is saved like a choice, and with the consent log on it is recorded in the Consent Log with the action opt_out. It is recorded once per browser, not on every page.
No banner or notice appears. In the Opt-out and Notice Only models the revisit button appears as it does after any choice.
A choice saved earlier, before the browser sent the signal, that allowed one of your optional cookie categories is replaced by the opt-out. A sale the visitor allows while their browser sends the signal is kept when they allow it in the Do Not Sell or Share dialog or in the cookie preferences, the two places that show the opt-out's status. A cookie choice made elsewhere that allows a sale, for example the button on a blocked video, is replaced by the opt-out on the next page.

The visitor can still allow more, for example through the preferences or your Do Not Sell or Share link. In the Opt-in model nothing changes: the signal keeps optional cookies blocked and the banner appears as usual.

Google Consent Mode Interaction

All four models integrate with Google Consent Mode v2. The key difference is timing:

Opt-in - GCM defaults stay denied until the visitor explicitly grants consent.
Opt-out / Notice Only - a consent default scoped to these regions tells Google tags granted from page load. While the banner is on screen, no consent update is sent until the visitor acts.
Hidden - no banner is shown, and a granted update is sent at page load.

For full details on the Google Consent Mode integration, see Google Consent Mode v2.

Choosing the Right Model

Most websites need at least two models: Opt-in for EU/UK visitors and Opt-out for US visitors. You can configure this using region rules, which let you assign different consent models to different geographic regions.