Include the banner script on every page of your website. The data-cp-id attribute links it to your collection point configuration.

<script
  src="https://cdn.neostra.io/cpmp-modal/latest/cpmp-modal.umd.js"
  data-cp-id="cp_your_collection_point_id"
  defer
></script>

The banner auto-initializes on DOMContentLoaded. No additional JavaScript is required.

In the Neostra dashboard, navigate to Consent > Collection Points and create a new collection point. Configure:

• Banner appearance (colors, position, layout)
• Cookie categories (Necessary, Analytics, Marketing, Functional)
• Purposes with descriptions for each category
• Languages for multilingual support
• GPC behavior (honor Global Privacy Control signal automatically)

The banner dispatches a custom event whenever a user updates their consent preferences. Use this to conditionally load scripts.

document.addEventListener("cpmp-consent-change", (event) => {
  const { analytics, marketing, functional } = event.detail;

  if (analytics) {
    // Load analytics scripts
  }

  if (marketing) {
    // Load marketing pixels
  }
});

After configuring the banner in the dashboard, use the BannerController to publish your changes. Only published configurations are served to the CDN.

curl -X POST https://api.neostra.io/v1/banners/{bannerId}/publish \
  -H "Authorization: Bearer <token>"

Set the target website, URL filter regex (to stay within your domain), and a maximum page limit to control crawl depth.

Trigger a scan via the API or from the Neostra dashboard under Consent > Cookie Scanner. The crawler uses Selenium Grid with headless Chromium to visit each page and record all cookies set, scripts loaded, and iframes embedded.

View the scan report to see detected cookies organized by category. Unknown cookies are flagged for manual review and categorization.

Assign categories to newly discovered cookies using the CookieController. This feeds back into the banner configuration so users see accurate descriptions.

Define the consent purposes your organization uses (e.g., "Analytics", "Marketing", "Functional"). Each purpose should have a clear, user-facing description.

Add known cookies to the system with their category, duration, and description. Run a cookie scan to discover any cookies you may have missed.

Create a collection point for each website or application where you collect consent. Link the relevant purposes and cookies.

Configure the banner appearance, layout, and copy for each language you support. Preview the banner before publishing.

Add the banner script tag to your website with the correct data-cp-id attribute. Verify it loads and functions correctly.

Set up a preference center where users can revisit and update their consent choices at any time. Link it from your privacy policy or website footer.

Set up periodic cookie scans to detect new tracking technologies as your website evolves. Review and categorize any unknown cookies after each scan.

A user task to verify the data subject's identity before processing the opt-out request.

An automated system task calls the CPMP Consent API to retrieve the subject's current consent state. The system uses the subject's email address (or email + name / email + address combination) to look up consent records across all collection points.

# System task: Retrieve consent for a data subject
curl -X GET "https://api.neostra.io/v1/consents/lookup?email=user@example.com" \
  -H "Authorization: Bearer <token>"

If opt-outs are present in the consent retrieval response, the system calls configured integration APIs (CRM, ad platforms, analytics services) to apply the opt-out state. Supported built-in integrations include: SendGrid, Mailchimp, HubSpot, and Salesforce. Custom API integrations can be configured for any external system.

A user task for the privacy team to review the enforcement results and close the DSAR.