Andes Consent: Cookie Consent with Banking-Grade Security

Andes Consent is the cookie consent script we built for corporate platforms where security isn't up for negotiation. It weighs 15 KB gzipped, has zero dependencies, works with any framework, and runs under strict Content Security Policies (CSP) and Trusted Types, something most commercial banners can't handle. It supports Google Consent Mode v2 and covers the main privacy laws across the US and Latin America.

// The challenge

Asking for consent sounds simple until the platform runs to banking security standards. The key challenges were:

• The Guard Who Opens the Door Commercial consent platforms often require unsafe-inline or eval, exactly what a strict CSP forbids. The script meant to protect privacy ended up weakening the site's security.
• Real Blocking, Not Cosmetic Analytics scripts and third-party iframes can't run before the visitor agrees, without breaking load order or script integrity.
• A Fragmented Regulatory Map A corporate site in the region answers to GDPR, CCPA, the Texas privacy act, and the laws of Brazil, Mexico, Chile, Colombia, and El Salvador.
• Accessible to Everyone The banner is the first thing every visitor sees; it has to work with a keyboard and a screen reader.
• No Vendor Lock-In No per-visit subscriptions and no scripts served from someone else's servers.

// The technology solution

Andes Development built a small, auditable script designed from day one to live under a strict CSP:

• Vanilla TypeScript, Zero Dependencies A single file that works on any site, with size budgets enforced on every build: 15.25 KB of JavaScript and under 5 KB of CSS, gzipped.
• Safe Under a Strict CSP Tested with nonce + strict-dynamic and with Trusted Types. No eval, no Function, no HTML injection, with prototype-pollution hardening and a frozen public API.
• Declarative Prior Blocking Scripts are tagged in the HTML and only activate with consent, keeping their order, nonce, and integrity hash (SRI). Third-party iframes show as facades until the visitor accepts.
• Bounded Trust An allowlist of origins for gated scripts; remote configuration can never widen that trust.
• Integrations Built In Google Consent Mode v2, dataLayer events, consent receipts, Global Privacy Control, opt-in and opt-out modes, and cookie cleanup when consent is withdrawn.
• Brand and Accessibility A Shadow DOM banner with five layouts and per-brand themes, English and Spanish, and WCAG 2.2 AA checked automatically on every integration.
• Verifiable Delivery Every release ships as a package with SRI hashes, so clients host it on their own infrastructure.

It doesn't implement the IAB TCF framework, by design: it's built for corporate sites and regulated platforms, not programmatic ad networks, and that choice is part of what keeps it at 15 KB.

// Results and key wins

A consent script your site's security doesn't have to tolerate, because it can audit it:

• 15 KB

  The full script gzipped, with no dependencies and a size budget validated on every build.

• 245 Tests

  139 unit tests and 106 end-to-end tests across Chromium, Firefox, and WebKit, plus a security audit with every finding fixed.

• 8 Legal Frameworks

  GDPR and ePrivacy, CCPA/CPRA, the Texas privacy act, and the laws of Brazil, Mexico, Chile, Colombia, and El Salvador.

// The bottom line

Andes Consent resolves a contradiction we keep seeing on corporate platforms: asking permission to protect privacy without weakening the site's security. It's small, auditable, client-hosted, and built with the same rigor we bring to banking. Its first production deployment is a healthcare site, where consent matters as much as security.