Skip to main content
Code auditCheck every pull request for privacy riskWebsite auditCatch scripts and vendors that appear in productionInth AgentAsk what changed and follow the answer to its sourceCookie consentFast consent that lives in your codebase
AboutHandbookBlogOSS
AI feature reviewsFundraising Due DiligencePrivacy impact reviewsEnterprise customer reviewsCookie and tracking audits
Pricing
Sign inRun a free scan
Run a free scan
All handbook
02 / Handbook/Company

Why cookie banners are our wedge

Cookie banners look like a small UI problem. They are a live test of performance, consent, and whether a product honours what its users chose.

Updated
11 July 2026
Reading time
8 min
Inth handbook
02Company

On this page

Contents7 sections
  1. 01Everybody hates cookie banners
  2. 02Everyone thinks they can build one in ten minutes
  3. 03The tools started in the wrong place
  4. 04Performance is the opening
  5. 05Conversion needs a clearer definition
  6. 06Why this is the wedge
  7. 07The banner opens a larger system
  1. 01Everybody hates cookie banners
  2. 02Everyone thinks they can build one in ten minutes
  3. 03The tools started in the wrong place
  4. 04Performance is the opening
  5. 05Conversion needs a clearer definition
  6. 06Why this is the wedge
  7. 07The banner opens a larger system
Written by
Christopher Burns

Founder, Inth

A cookie banner is the most visible piece of privacy software on a website and, somehow, usually the worst built. It loads before the product, gets in the user’s way, slows down the page, and often fails to stop the thing a user rejected. That makes it a small-looking problem with a large surface area. It is where we chose to enter.

01 / Section

Everybody hates cookie banners

Users want them out of the way. Developers inherit them at the end of a build. Marketing wants its tools to load. Legal wants the company covered. Almost nobody thinks the result is good.

That shared frustration is useful. We do not have to persuade a team that the problem exists. They can see it sitting over their own homepage.

We first ran into it while building another company. We kept wrapping consent tools, fixing their styles, chasing their scripts, and checking whether a rejection stopped anything from loading. The same work appeared in every product, which made it an unsolved piece of the application stack.

02 / Section

Everyone thinks they can build one in ten minutes

Now you can vibe code a banner before the kettle boils. You get a modal, three buttons, and a cookie. It looks finished because the part you can see is simple.

The button is the smallest part of the consent system. The real work begins after someone clicks it.

01
Show the right thing
The experience changes with the user’s location, language, and the rules that apply there.
02
Honour the choice
Scripts, pixels, embeds, and iframes have to stay blocked until the product has permission to load them.
03
Keep a record
The company needs to know what the user saw, what they chose, and which version of the experience was running.

The trap

A banner can look correct while the product behind it is still wrong.

The UI is the smallest part of consent. Geolocation, internationalisation, script gating, storage, and changing rules are where the work lives.

03 / Section

The tools started in the wrong place

The established tools were built around a dashboard for legal or marketing. Installation meant pasting a third-party script into a finished website. “No developer needed” was treated as a feature, even though developers owned the performance, the integration, and the data leakage when it went wrong.

The banner exposed the same gap we now see across privacy. Legal could define the rule, a dashboard could record the configuration, and a performance tool could show that the page was slow. None of that told the team whether a rejection still stopped the new script an engineer shipped that morning.

Nothing felt native to the codebase. There were no useful components, hooks, or typed APIs. Styling the banner to look like the rest of the product was harder than it should have been. Debugging it meant leaving the application and opening a black box somewhere else.

We wanted the logic handled without giving up the product experience. c15t puts consent in the bundle, gives the team real components, and still lets them bring their own design.

04 / Section

Performance is the opening

A team can spend weeks making a site fast, then lose the result to the scripts added just before launch. The consent tool is often one of them. It arrives through another network request, waits on another service, moves the page when it appears, and then loads more scripts behind it.

That is why we built Cookiebench. General performance tools can show that a page is slow. Cookiebench isolates the banner so a team can see what the consent layer itself costs.

c15t currently leads Cookiebench with a score of 95 out of 100. The benchmark records 63ms for both First Contentful Paint and Largest Contentful Paint, no layout shift, and no separate network payload for the bundled banner. The score reflects a simple standard: the first thing a user sees should not ruin the page.

Our standard

The most performant cookie banner should also be the easiest one to own.

Bundle it with the application, keep the code inspectable, and let the product team control how it looks and behaves.

05 / Section

Conversion needs a clearer definition

Slow pages and clumsy interruptions cost the business. A banner that arrives late, shifts the layout, or feels nothing like the website gives a user one more reason to leave. Performance work is conversion work because it protects the experience the rest of the team built.

Consent acceptance is different. Our job is to make the choice fast, clear, and free of dark patterns, not to trick the largest possible number of people into clicking “accept”.

Tracking is different again. If analytics numbers fall because people who rejected tracking are no longer tracked, the consent system did not hurt conversion. It started reporting reality. A good tool has to protect site performance without pretending that a user’s rejection never happened.

06 / Section

Why this is the wedge

The cookie banner gives us a narrow way into a much larger market. Every serious website needs an answer. The problem is visible. The implementation touches code, production, vendors, regions, user choices, and the evidence left behind. That is most of the privacy system in miniature.

We make c15t open source because the first job is to earn developer trust. A team can inspect it, ship it, style it, and see whether it works. We get to prove that privacy software can be fast and pleasant before asking the company to change how it manages privacy everywhere else.

01
It is universal
The banner is a familiar problem with a clear moment of need, not a new category a team has to learn first.
02
It lives in the product
Consent has to work in code and at runtime. It cannot survive as a policy document or an annual questionnaire.
03
It opens the wider record
Once a team can see scripts, vendors, regions, choices, and changes together, the same model can cover the rest of the product.

07 / Section

The banner opens a larger system

The banner is where the separation between systems becomes obvious. Legal sets the rule. Marketing chooses the vendor. Engineering ships the scripts. Governance records the decision. A user’s browser is where all four have to agree.

c15t handles consent. Inth is the system around the change: what entered the codebase, what appeared in production, which vendor was involved, what the company told users, who reviewed it, and whether the fix held.

The banner is our first surface because it makes the whole problem concrete. The company we are building goes further. We want privacy to move with the product, one change and one piece of evidence at a time.

Keep reading.

Previous · 01What is Inth?Inth is privacy change management for software companies that ship fast. It connects what a company has promised to what its engineers just shipped.Company/6 minNext · 03Privacy should move with the productEvery software company makes promises about data. Those promises are implemented in code, and every product change can make them untrue.Company/6 min

Notes from building privacy into the product

Notes from building Inth. Sent occasionally.

Inth connects what your company promised to what engineers just shipped.

Platform

  • Code audit
  • Website audit
  • Inth Agent
  • Consent banner
  • Pricing

Use Cases

  • Privacy Impact Review
  • AI Feature Reviews

Company

  • About
  • Blog
  • Open source
  • Contact

Resources

  • Documentation
  • GitHub
  • Cookiebench
  • Status

© 2026 Inth. All rights reserved.

  • Contact us
  • Privacy
  • Cookies
  • Terms