What SiteTrust Consent is

SiteTrust Consent is a consent-management banner you install with consent-widget.js. It is not the Trust Badge. The badge uses a different script, widget.js. You can run both on the same site. Consent always loads first.

The banner does four jobs at once:

• Ask first. Visitors see equal Accept and Decline controls. Necessary tools stay on. Analytics, marketing, and functional tools stay off until the visitor says yes to that category.
• Block optional trackers. In basic mode, the default, the widget watches scripts as they are inserted and stops known analytics and marketing tags until consent is stored.
• Speak Google Consent Mode v2. It fires gtag('consent', 'default', …) immediately, then gtag('consent', 'update', …) when the visitor accepts or declines.
• Keep a receipt. Every choice writes a timestamped record to localStorage under sitetrust_consent, including a unique consent ID. Visitors can reopen that record from Privacy Choices.

• It is not widget.js. That script draws the Trust Badge. Mixing them up is the most common install mistake.
• It is not a decorative cookie notice. A banner that appears while GA4 or Meta already fired is not a working CMP.
• It is not legal advice. SiteTrust gives you the controls and the evidence. Your counsel decides how you describe the risk.
• It is not Advanced Consent Mode unless you asked for it. Advanced mode lets Google tags send cookieless pings before consent. SiteTrust ships basic mode: tags stay blocked until the visitor chooses.

1. The page starts. consent-widget.js runs as the first script in the head, or as the first Consent Initialization tag in GTM.
2. The widget fires Consent Mode default: all four signals denied, plus wait_for_update: 500, url_passthrough: true, and ads_data_redaction: true.
3. It looks up the visitor country. EEA countries, the United Kingdom, and Switzerland stay on the strict default. Other regions grant analytics_storage only. Ads signals stay denied. If the lookup fails, the widget stays strict.
4. If there is no stored choice, the banner appears and optional tracker scripts are held.
5. Accept All grants the categories the visitor allowed and fires Consent Mode update with matching granted signals. Decline keeps optional categories off and fires update with denied signals.
6. The receipt is written. Privacy Choices stays available so the visitor can see the date, consent ID, and current state.

Basic mode is what you get on a normal install. Known tracker scripts are rewritten to text/plain until the matching category is granted. That is the setup Site Audit expects for Pre-Consent Behavior (Run A).

Advanced mode, where Google tags send cookieless pings before consent, is available on request. Do not enable it yourself by adding extra Google tags that ignore the default. If you need Advanced mode, email wecare@sitetrust.com.

The live widget looks up country and applies a stricter default for EEA, UK, and Switzerland. Non-EEA visitors can receive analytics_storage: granted while ads signals stay denied. Verify and Audit plans are the plans we position for regional consent defaults. If geo lookup fails, the widget does not guess: it keeps every signal denied.

The widget can block scripts it can see. It cannot reach inside a third-party iframe that loads Meta or chat on its own. Booking widgets, LeadConnector / GoHighLevel forms, review widgets, and chat embeds must not render on first paint. Gate them behind the stored sitetrust_consent record, the same way you gate analytics.