Nothing tracks your visitor until they say yes.
Most cookie banners ask the question, then load Google Analytics, the Ads tag and everything else regardless of the answer. The visitor said no and was tracked anyway. MevvLegal stops the tracking code from running at all until they agree — and if they never do, it never runs. It also records what they agreed to, and writes your privacy and cookie pages from the list of cookies your site actually uses.
How it works
The home page is fetched the way a logged-out visitor would fetch it, with a cache-busting parameter, and every script tag in it is counted: held, unheld, first-party, inline, iframe. One number is the product’s whole promise, and it is the one at the top.
The banner text is not decoration: it is the wording the consent was given to. Edit it and the policy version changes, and every visitor is asked again — which is the intended behaviour, not a bug. The withdrawal link is added to the footer for the same reason.
All prices include VAT.
1 USD = 50,7641 ₺ (İşbank rate)
What it does
Each capability exists to remove a specific operational friction.
Until consent, the browser neither downloads nor executes it — the address is set aside rather than deleted, because consent has to be able to put it back.
Some plugins paste their tracker straight into the page, where the usual mechanism cannot see it. Those are matched by their address instead — found on a live store, where a Google Ads tag was running under a banner that believed it had blocked it.
The policy version is a hash of the open categories, the banner text and the inventory. Change any of them and the old consent stops counting, so the question is asked again.
The server keeps counts of (day, policy version, choice) and an archive of every policy text. Person-level proof would mean giving the visitor a durable identifier — opening a new processing operation in order to prove consent for the old one.
Both buttons carry the same class and reject is printed first. A test asserts their class attributes are identical, because consent obtained through a harder refusal is not freely given.
No cookie, no nonce, no logged-in check on the front end. A consent banner that varies the page per visitor breaks full-page caching, and a nonce dies behind it silently.
The cookie policy is generated from the categories and rows you actually filled in. An empty category prints no invented line — declaring a processing operation you do not run is worse than declaring too little.
If it went quiet when payment lapsed, the site would start writing tracking cookies without consent — and the fine lands on the site owner, not on us.
The library recognises 121 third-party services by the addresses they load from, together with the cookies each one sets and how long those last. Thirty-three of the records are complete; the other eighty-eight carry a visible “verify this” mark instead of a plausible guess, because a cookie table that invents a retention period is worse than one with a gap in it. Payment and bot-protection scripts are recognised too but never offered as blockable — holding one back breaks a checkout silently.
Put the front-end audit on a weekly or daily timer and it tells you when a new unheld third-party script or an unlisted cookie appears — not the whole list again. Switching the schedule on is Pro; switching it off and scanning by hand are free.
Product information