Most websites load a dozen or more third-party scripts for analytics, A/B testing, retargeting and other purposes. Every one of those tools may drop its own cookies, and under a growing number of privacy regulations each one needs explicit user consent. For site owners, however, keeping track of which scripts are running and making sure a consent banner actually controls them has traditionally been a messy integration problem.

Cloudflare Zaraz is designed to close that gap. The service already moves most third-party script execution to Cloudflare Workers, which improves page speed by reducing the amount of JavaScript that loads in the browser. The same dashboard that configures those tools can now power a built-in consent modal. Because Zaraz knows what tools a site uses and controls when those tools execute, consent decisions made in the modal can be enforced directly on the scripts, without custom wiring between separate consent and tag-management systems.

Why Regulators Are Paying Attention

The legal landscape for tracking cookies is shifting quickly. European regulators have levied multimillion-euro fines on Google and Facebook for making it too hard to reject all cookies. In California, enforcement actions have targeted retargeting cookies, and several states have new rules coming into effect in 2023. The common thread across jurisdictions is that users must be told about trackers and given a real opportunity to consent to them.

In Europe, consent must be obtained before third-party scripts load and run. That requirement is often missed in practice, sometimes because the consent platform in use makes it difficult to actually block scripts until a user opts in. Some consent banners go a step further and rely on dark patterns that make refusing consent deliberately cumbersome, a practice that regulators are now actively pursuing.

Opt-In by Default, Enforced Automatically

The Zaraz consent manager treats every tool as opt-in unless it is strictly necessary. Users see a modal where they can accept all purposes, reject all purposes, or selectively enable specific categories. The modal appears automatically after the site administrator provides basic legal contact information and assigns a purpose to each tool that should be gated behind consent. The modal's styling is configurable through CSS, so it can match the site's design.

Because Zaraz sits in the middle of all third-party loading, it handles a common problem with consent platforms: the loss of pageview events from first-time users who have not yet consented. Normally, a pageview fired by a script that gets blocked for lack of consent is simply lost. Zaraz tracks these events and re-emits them for a given script once a user grants consent to the relevant purpose, so analytics data does not vanish just because a first load was blocked.

What Is Configured and What Comes Next

Administrators must provide their name, street address and email address, and then map each third-party tool to a purpose that will appear in the consent modal. That setup is the entire integration process for consent enforcement.

Upcoming features are planned for the consent functionality, including support for opt-out purposes, internationalization of the modal, and analytics on how users interact with it.