GDPR-related features

import { Aside } from ‘@astrojs/starlight/components’;

This page describes what the package's code does. It isn't legal advice, and using it doesn't by itself make a site compliant — that also depends on your privacy policy, what you actually gate behind it, and obligations outside any code library (legal basis analysis, data processing agreements, records of processing, etc.).

What the package handles

• Opt-in by default. gateScript() only injects third-party scripts after accept — nothing loads pre-consent. This is the core ePrivacy requirement: prior consent before non-essential storage or tracking.
• No pre-ticked boxes. Decline is a genuine, equally-clickable choice, not a pre-selected default.
• Equal visual prominence. Accept and decline are styled identically — no dark-pattern nudging toward accepting, which several DPAs (CNIL, ICO) explicitly flag when a CMP visually favors one choice.
• Easy withdrawal. The reopen button lets visitors change their choice at any time, which regulators require to be as easy as giving consent in the first place.
• Consent expiry. Choices expire after expiryDays (default 365) and the banner reappears — no silent, permanent consent from a choice made a year ago.
• A record you can point to. The stored record includes a timestamp ({ categories, timestamp }), retrievable via getConsentRecord() — something to reference if you ever need to demonstrate consent was given (GDPR Art. 7(1) accountability).
• Per-category consent, if you need it. See Per-category consent — useful when a site bundles genuinely distinct purposes (e.g. analytics and marketing) that need separate yes/no answers.

What’s still on you

• Writing the actual privacy/cookie policy and naming the real third parties and purposes involved — the package can render a link (privacyHref) but can’t write the policy content.
• Deciding whether you need categories at all. A single accept/decline is fine if your site only has one non-essential purpose; bundling multiple distinct purposes behind one toggle is where regulators expect granularity.
• Legal basis analysis, data processing agreements with third parties, records of processing, DPO appointment, etc. — organizational obligations no client-side library can satisfy.
• Gating the right things. gateScript() only blocks what you tell it to. A stray <script src="..."> added directly, outside gateScript(), bypasses consent entirely.