Skip to content
Start for free

Add a cookie consent banner to TanStack Start

c15t puts the banner in your TanStack Start app as code. It resolves consent on the server, holds tags until the visitor chooses and keeps Google Consent Mode v2 in sync.

Start for freeSee the code
Ask your coding agent
Sample Consent banner with c15t’s English strings

Install c15t in a TanStack Start app

c15t is the open source consent library behind Inth Consent. It renders the banner from your own bundle and records each choice in your Inth project.

npm install c15t @c15t/integrations

Add your Inth project URL to .env. Copy it from your Inth dashboard. Vite writes it into the server and browser builds, so set it before you build.

.env

VITE_C15T_BACKEND_URL=https://your-project.inth.app

Add the consentManifest plugin before tanstackStart(). During the build, it downloads your consent policy and keeps it on the server. Rebuild after you change a policy.

vite.config.ts

import { tanstackStart } from '@tanstack/react-start/plugin/vite';
import viteReact from '@vitejs/plugin-react';
import { consentManifest } from 'c15t/tanstack-start/build';
import { defineConfig } from 'vite';

export default defineConfig({
  plugins: [consentManifest(), tanstackStart(), viteReact()],
});

Code on this page comes from the c15t TanStack Start quickstart, checked 28 October 2026.

This setup needs the Start server. For SPA mode, prerendered pages or a static host, see TanStack Start rendering.

Resolve consent in the root route

A server function in the root loader reads the consent cookie and the location headers of the visitor. It resolves the policy from the bundled snapshot, so the render does not wait for Inth.

src/routes/__root.tsx

import { posthog } from '@c15t/integrations/posthog';
import {
  createRootRoute,
  HeadContent,
  Outlet,
  Scripts,
} from '@tanstack/react-router';
import { createServerFn } from '@tanstack/react-start';
import {
  ConsentBanner,
  ConsentDialog,
  ConsentDialogLink,
  ConsentRoot,
} from 'c15t/tanstack-start';
import {
  consentLoaderOptions,
  createConsentStateHandler,
} from 'c15t/tanstack-start/server';

// Start's compiler keeps the handler and the bundled policy on the server.
const getConsentState = createServerFn({ method: 'GET' }).handler(
  createConsentStateHandler()
);

const scripts = [
  posthog({
    id: 'phc_your_project_key',
    initOptions: { cookieless_mode: 'never' },
    loadMode: 'after-consent',
  }),
];

const RootComponent = () => {
  const { consent } = Route.useLoaderData();
  return (
    <html lang="en">
      <head>
        <HeadContent />
      </head>
      <body>
        <ConsentRoot state={consent} scripts={scripts}>
          <Outlet />
          <ConsentBanner />
          <ConsentDialog />
          <footer>
            <ConsentDialogLink>Privacy settings</ConsentDialogLink>
          </footer>
        </ConsentRoot>
        <Scripts />
      </body>
    </html>
  );
};

export const Route = createRootRoute({
  ...consentLoaderOptions,
  component: RootComponent,
  head: () => ({
    meta: [
      { charSet: 'utf-8' },
      { content: 'width=device-width, initial-scale=1', name: 'viewport' },
    ],
  }),
  loader: async () => ({ consent: await getConsentState() }),
});

Declare the createServerFn() call in your own module, as shown. The Start compiler finds it there and keeps the policy out of the browser build. consentLoaderOptions makes sure that the loader does not run again on client navigation.

Hold scripts until consent

Keep the scripts array in the root route module. A server function returns only data, and vendor helpers contain functions. With loadMode: 'after-consent', PostHog stays off the page until the visitor allows measurement.

Remove every other loader for PostHog, so it loads once and only through c15t. TanStack Start scripts and embeds covers more vendors, iframes and the network blocker. The c15t integrations list the helper for each vendor.

src/components/marketing-banner.tsx

import { useConsent } from 'c15t/tanstack-start';

export function MarketingBanner() {
  return useConsent('marketing') ? <aside>Spring sale</aside> : null;
}

src/consent-scripts.ts

import { gtag } from '@c15t/integrations/google-tag';

export const scripts = [gtag({ id: 'G-XXXXXXXXXX', category: 'measurement' })];

Show the right banner in each region

Your Inth project sets a policy for each region, such as opt in for the EU and UK or opt out for California. On the server, createConsentStateHandler() reads the location header that your host adds, such as x-vercel-ip-country, and applies the policy for that location. TanStack Start geography headers lists the headers it reads.

Test each region before launch. See how regional policies work.

Keep the banner in the first HTML

The server resolves consent before it renders, so the banner is part of the first HTML. Most scripts that have the visitor’s consent start before the page hydrates. A visitor who already chose gets HTML with no banner.

Measure your own pages before and after you add the banner.

Check that consent gates work

Run a production build, start the server and open a private window with the Network tab open. On localhost, your host adds no location header. For the test only, pass country: 'DE' to createConsentStateHandler() to get the EU policy.

  1. The first HTML contains the banner.
  2. No PostHog request leaves the page before a choice.
  3. After Reject All and a reload, PostHog stays off.
  4. When you turn on measurement in Privacy settings, PostHog loads.

Choices post to your Inth project. Check that Inth has a record for each one. The c15t verify consent guide has the full release checklist.

Use Inth in production

c15t is open source. Point it at your Inth project, which hosts the backend and keeps the consent records. See Inth open source.

c15t also has a local mode with no backend. It keeps no consent records, so the docs advise against it in production.

Want to see what else your repo sends before consent? Run a free codebase scan.

Cookie consent banners for other frameworks

The same banner and the same Inth project work in other stacks. See the setup for Next.js, React, Nuxt, Vue, Astro, Svelte, SvelteKit, HTML and JavaScript.

Building a React app without a server? See the React cookie consent banner.

See how the Inth consent banner works.

Questions about TanStack Start consent