GDPR and the consent banner

The banner is a deploy stage you opt into per project. It is off by default: Weblooks never injects anything into your site automatically. Once enabled, the next deploy ships the banner, with the Reject option the same size and prominence as Accept, by design.

Nothing non-essential runs before the visitor makes a choice. Consent-gated tags (analytics, marketing pixels) stay inert until the matching purpose is accepted, and only then does the banner activate them. A banner that appears after the trackers have already loaded is decoration, not consent, so the ordering is the whole point.

GDPR requires you to be able to demonstrate that consent was given, not just assert it. Every grant and withdrawal is recorded with the purposes chosen, the privacy policy version in force, and a timestamp. Records are pseudonymous: no IP addresses, emails, or account ids are stored, and records expire automatically (roughly thirteen months by default).

Find it under Checks → Consent log in the project. It is read-only, because an editable log is not evidence. Sites that run their own banner can post decisions to the same log through a small public API.