Start by checking whether you need a banner at all. That comes first, because most sites show one without being required to, and a needless banner protects nobody: it is only one more obstacle between the visitor and the page.
Many sites have nothing to show
Consent only applies to trackers that are not strictly necessary for the service requested. These are exempt, and never have to be announced:
- Joomla's session cookie;
- remembering the language on a multilingual site;
- the light or dark theme choice, and Corpus's display settings;
- a shop basket, authentication, fraud prevention.
A brochure site with no analytics, no embedded video and no social media buttons must show no banner at all.
Analytics themselves can be exempt if they serve a single site, cross-reference nothing, follow nobody from one site to another, and produce only anonymous statistics. Several tools meet those conditions; the French data protection authority keeps a list of the ones it has assessed.
What Corpus does, and what it does not
Corpus does not ship a cookie banner. That is a decision, not an oversight.
A banner that collects a choice without stopping a single script from loading is worse than no banner: the site claims a protection it does not apply. Doing it properly means blocking trackers, keeping proof of consent, and following the regulator's decisions. Three trades, and none of them is a template's.
So Corpus styles an external manager: Orejime - free, dependency-free, developed in France, and built around accessibility. It exists because the banners on the market turned out to be unusable with a keyboard or a screen reader.
It ships with Corpus, in fourteen languages. You have nothing to download. The file follows the page language automatically, falling back to English.
The banner takes on your site's hue, its light or dark theme, its corner radius and its typeface. There is no colour for you to set.
What Corpus itself writes in the browser
You will need this the day you write your privacy page, and nobody else can tell you. Corpus sets no cookie. It writes two things, and only two:
| what | where | lifetime | to declare? |
|---|---|---|---|
| the theme the visitor picked, light or dark | localStorage, key corpus-theme |
until they change it | no |
| the state of the announcement panel, if there is one | sessionStorage, one key per module |
the tab | no |
Both fall under the interface personalisation exempt from consent: the first is a choice the visitor makes themselves, the second is cleared when the tab closes.
What Corpus refused to write. Remembering from one visit to the next that a visitor has already seen an announcement has a name, frequency capping, and the French regulator lists it among the purposes that require consent. The feature would have been more comfortable; it would have imposed a declaration on every Corpus site, including those that would never have suspected it. We did not write it.
Setting it up
Under Advanced settings → Cookie consent:
- Enable the consent manager.
- Folder: leave it empty. Only fill it in to use your own copy of Orejime - a missing language, or a newer version. Either way, host the files yourself: loading them from an outside service would send your visitors' addresses to that service before they have consented to anything.
- Privacy policy address: that page must exist and describe the trackers you set. This is the prior information without which consent is not valid.
- Your trackers: the list, as JSON. Without at least one service declared, no banner appears - the manager only asks consent for what it has been told about, and Corpus loads nothing if there is nothing to ask.
One place to fill in, even with several styles
These settings apply to the whole site. Fill them in on the default style: the other styles pick them up without you retyping anything.
That is deliberate. The hue or the page width may well differ from one style to another - that is what they are for. The trackers your site sets do not: they do not change depending on whether the visitor is on the home page or on a landing page. Repeated input is input that eventually diverges, and the day one style forgets a tracker, the site becomes less compliant on some pages only, with nothing to signal it.
A style can still carry its own values if it needs to - a landing page with one extra tracker, say. What it declares then replaces what the default style carries.
The withdrawal link in the footer is on by default. Leave it there: consent must be as easy to withdraw as it was to give. That is not a courtesy, it is a requirement.
Declaring a service
Two things to add per service: its description under Your trackers, and its script inside a template, under Custom code.
Self-hosted analytics
[{"id": "matomo", "title": "Analytics",
"description": "Helps us know which pages are read.",
"cookies": ["_pk_id", "_pk_ses"], "default": false}]Google Analytics
[{"id": "ga4", "title": "Google Analytics",
"description": "Analytics operated by Google, in the United States.",
"cookies": ["_ga", "_ga_*"], "default": false}]And the script, under Custom code:
<template data-purpose="ga4">
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>
</template>Browsers never run what sits inside a <template>. The script is not delayed: it does not exist until the visitor accepts.
Videos and maps
With data-contextual, the consent notice replaces the video exactly where it was meant to appear, instead of leaving a hole in the page. The visitor can see what they are turning down.
[{"id": "youtube", "title": "YouTube videos",
"description": "Playing videos will set Google trackers.",
"cookies": ["VISITOR_INFO1_LIVE", "YSC"], "default": false}]<template data-purpose="youtube" data-contextual>
<iframe src="https://www.youtube-nocookie.com/embed/XXXX" title="…"></iframe>
</template>Share buttons
Usually pointless. A link to a social network sets nothing; only the official button, with its script, sets trackers. Prefer the link: it works everywhere, it is faster, and it needs no consent.
Finding out what your site really sets
No tool does this for you, and that is the weak point of any hand-written declaration. The check takes two minutes and it does not lie:
- Open the site in a private browsing window.
- Decline in the banner, then browse five or six pages: an article with an image, a video if the site has one, the contact form.
- Open the browser tools, Application tab, Cookies section.
- Any cookie there that is not the session, the language or the theme is an undeclared tracker. It should not be there.
Do this again after every change to the site. This is what costs most over time: a site that gains a map or a video six months later keeps a banner that says nothing about it, and becomes less compliant than before with nothing to signal it. Put this check in the site's maintenance routine, alongside updates.
What is not required, and best avoided
The opaque overlay that blocks the page. No text requires it. It pushes people towards accepting, which makes the consent challengeable, and a focus trap in an overlay is an accessibility defect. Orejime's banner is anchored at the bottom and blocks nothing: that is deliberate.
Declining being harder than accepting. Same level, same number of clicks, same visual weight. It is the most scrutinised point, and the most penalised.
Up to date for Corpus 2.1.43.