Tickbox

What it does

UK and EU jurisdictions

Built-in presets for UK Data (Use and Access) Act 2025 and EU GDPR. UK sites running only privacy-friendly analytics get a notice card; full consent banner kicks in for ad and tracking vendors.

PECR-correct gating

Real script-tag gating with type="text/plain" data-tb-category. No pre-consent network requests, even with Google Consent Mode v2 default-denied. Compliance scanners pass.

Headless or styled

Headless render-prop components for full control, or drop-in <ConsentBannerDefault> for a working consent UI in two lines of code.

AI training opt-out

/ai.txt (Spawning.ai format) and per-bot robots.txt rules generated from the same config. Pairs with EU AI Act Article 53 (in force August 2026).

Install

React / Next.js

npm install @tickboxhq/core @tickboxhq/react

# optional: drop-in styled banner
npm install @tickboxhq/banner-default

Vue

npm install @tickboxhq/core @tickboxhq/vue

# optional: drop-in styled banner
npm install @tickboxhq/banner-default

Nuxt

npm install @tickboxhq/core @tickboxhq/nuxt

# optional: drop-in styled banner
npm install @tickboxhq/banner-default

Vanilla JS

npm install @tickboxhq/core

The drop-in styled banner needs React or Vue. On vanilla you render your own markup and call the core store.

@tickboxhq/core comes along with every adapter, but install it explicitly anyway: your consent.config.ts imports defineConsent and jurisdictions from it, and the adapters do not re-export them. Depending on the transitive copy works under npm and fails under pnpm’s strict node_modules layout and Yarn PnP.

Or skip the choice entirely and run npx @tickboxhq/cli init, which writes the config and installs the right packages for your project.

Five-line example

import { defineConsent, jurisdictions } from '@tickboxhq/core'

export default defineConsent({
  jurisdiction: jurisdictions.UK_DUAA,
  policy: { version: '2026-05-08', url: '/privacy' },
  categories: {
    necessary: { required: true },
    analytics: { vendors: ['plausible'], default: true },
  },
})

That’s a UK site running Plausible. No banner — UK DUAA’s statistical-purposes exemption covers it. Just a one-time notice card. Add Google Ads and the SDK switches the same site to a full opt-in flow on its own.

→ Get started