Cookie consent is one of those website features that feels small and turns out to be anything but. It appears on every page, it blocks visitors until they interact with it, it has legal weight in Europe, and if it is built badly it makes an otherwise polished site feel cheap in the first two seconds of the visit.
After years of working with off-the-shelf consent solutions on client sites, we decided to build our own. It is bundled into every project we ship, at no extra cost. Here is what that decision buys our clients, and why we think most organizations would be better off with a solution that lives inside their own site rather than next to it.
What the law actually requires
The GDPR and the ePrivacy Directive ask for three things. Non-essential cookies must not be set before the visitor gives explicit consent, so analytics, advertising, and tracking scripts have to stay blocked until someone accepts. Visitors must be able to accept or reject categories of cookies independently, not just face an all-or-nothing button. And withdrawing consent has to be as easy as giving it.
The law does not mandate a particular technical approach. It only asks that these three principles hold reliably. How you implement them is your decision, and that is exactly where the choice of tool starts to matter.
Why we build it into the site
The usual route is a third-party consent platform, and those platforms do their job. We chose to build our own because of a handful of trade-offs that only become clear once you have lived with the alternative for a while. These are the ones that mattered to us.
They load from someone else's servers. The consent banner, its configuration, and the logic that decides what gets blocked all come from a third-party domain. That is an extra network hop on every page, on top of the regulator-mandated fact that nothing else can run until consent is decided. In practice it means the first moments of your site are spent waiting for a banner to decide whether you are allowed to load your own fonts.
They do not know your site. A generic consent platform does not understand your content, your languages, your brand, or your admin workflows. Editors end up managing the banner through a separate dashboard, translators update the strings in yet another tool, and the colors and typography never quite match the rest of the site.
They cost money, every year. A third-party consent subscription is a recurring annual cost that scales with traffic. Multiply that by every year the site exists and it stops being a small line item.
You stay responsible for their compliance. When the rules change, and they do every couple of years, you have to wait for a third-party vendor to update their product. The legal responsibility stays with you either way, so the speed and quality of those updates matter.
What we built instead
Our cookie consent banner is a small Drupal module. It knows about your site's languages and uses your existing translations. It inherits your brand colors and typography automatically. Editors configure the text and the categories in the same admin interface they use for everything else, with the same permissions, the same review flow, and the same audit trail.
It loads with the page rather than from a third-party server, so it appears in the first paint and adds nothing to the time it takes the page to become interactive. It implements the Google Consent Mode v2 contract, so analytics, advertising, and conversion tracking degrade gracefully for visitors who opt out instead of simply disappearing. And it stores consent decisions in a way that is easy to report on if a regulator ever asks to see your records.
Because the module runs inside Drupal, it can also scan from the inside. It crawls your own sitemap, reads the cookies set in the HTTP headers of each page, and detects client-side cookies through a collector that runs in a real browser. Running within your own infrastructure, it can see cookies on authenticated pages, in dynamic content, and in user interactions that an external scanner would miss.
And because it is part of the site, it is part of our normal maintenance rhythm. When regulations change, we update the module in the same update cycle as everything else, across all the sites we maintain, in a single release. No separate vendor contract, no separate invoice, no separate compliance update to chase.
When a managed service makes more sense
We want to be fair about the trade-offs, because a managed consent service is the right call in some situations. If you run dozens of sites across several different CMS platforms and need unified consent management from a single dashboard, a managed service gives you that cross-platform view. If you have no development team and no maintenance agreement, a drop-in script asks less of you up front. And if you operate across many jurisdictions with genuinely different consent rules, some managed services offer jurisdiction-specific configuration that would be involved to build from scratch.
For most organizations running a handful of Drupal sites with a development team already in place, though, the CMS-native approach is simpler, faster, more private, and removes a recurring cost.
What clients tell us about it
The most common feedback is that the site feels more coherent. The banner matches the rest of the design, the copy sounds like the rest of the site, and it stops being the generic third-party pop-up that lives on so many corporate pages. The second most common piece of feedback is that the legal team finally stopped worrying about it.
Occasionally a client arrives from another agency with a third-party consent platform already in place and asks us to keep it. We can, and sometimes we do. But when we migrate them to our own solution later, usually because a contract comes up for renewal, the improvement in load speed and visual polish is consistent enough that we feel comfortable recommending the switch up front.
If you are rethinking cookie consent
If you are about to renew a third-party consent platform, or the one you have is causing problems through slow loading, mismatched design, editorial friction, or legal uncertainty, this is a good time to have the conversation. On the sites we maintain we install and configure our banner in about a day, and most clients see the improvement in Core Web Vitals the same week.
If you are planning a new Drupal site with us, you do not need to think about this at all. It is already included.