Why ProtoConsent

The problem with consent today

Every website asks you to make privacy decisions through a banner. Most people click "accept" just to get to the content. That's consent fatigue, not informed choice. Meanwhile, blockers operate on domains and filter lists (effective but blunt), and CMPs operate per site and vendor (flexible for sites, opaque for users). There's no consistent browser-level layer in between.

The missing layer

There is no simple, browser-level place where you can say: "on this site, I allow functional use and analytics, but never ads or advanced tracking", and have that preference enforced consistently, without relying on each site to honour it.

ProtoConsent fills that gap. It's a browser extension that lets you define how different purposes of data use should be treated, per site and from a single interface. Instead of deciding vendor by vendor in each cookie banner, you set high-level profiles (Strict, Balanced, Permissive) and adjust individual purpose toggles (functional, analytics, ads, personalisation, third-party services, advanced tracking).

The key difference: ProtoConsent organises decisions around what your data is used for, not around which company is asking. This maps directly to how privacy regulation frames consent, and it's how most people actually think about their choices.

How it works, in practice

ProtoConsent is a Chromium extension (Firefox planned) that runs entirely on your device:

• Per-site profiles and purpose toggles: assign a trust level to any website and refine specific purposes (functional, analytics, ads, personalisation, third-party services, advanced tracking).
• Network-level enforcement: the browser blocks requests associated with disabled purposes before they leave your device.
• Conditional GPC signal: sends Sec-GPC only when privacy-relevant purposes are denied, per site, with legal weight under CCPA/CPRA.
• Optional site cooperation: websites can declare practices via .well-known/protoconsent.json or adapt behaviour via the SDK. Neither is required.
• Client Hints stripping: removes high-entropy fingerprinting headers (Sec-CH-UA-*) when advanced tracking is denied.
• Cookie banner detection: detects IAB TCF consent management platforms on the page and shows their consent state, so you can see what the site's banner is doing alongside ProtoConsent's enforcement.

Enforcement uses standard browser extension capabilities and runs entirely locally. No on-page scripts, no backend.

What ProtoConsent does not do

ProtoConsent is not designed as a full ad blocker, though its optional enhanced lists provide broader coverage. It is not a VPN, and not a replacement for consent management platforms. It doesn't remove cookie banners from the page and doesn't claim to solve every privacy problem.

What it does is add a layer that didn't exist: a personal consent control panel in the browser, organised around purposes, that can work alongside the tools you already use. Think of it as complementary to your existing setup: content blockers, privacy-focused browsers, or CMP preferences, not a replacement for any of them.

Why now

Browser extension APIs have matured enough for real enforcement without injecting scripts into pages. At the same time, regulators and standards bodies are actively discussing how browsers should mediate consent. ProtoConsent already sends a conditional GPC signal with legal weight under CCPA/CPRA, per site, not as a global switch.

The Permissions API, Storage Access API, and ongoing W3C privacy work all point in the same direction: the browser as a consent agent, not just a consent display. ProtoConsent is a working implementation in that direction. Open, inspectable, and aligned with where the web is heading.

Design principles

• Purpose-based: decisions are organised around what data is used for, not which company is asking.
• User-side: enforcement happens in the browser, not delegated to sites or backends.
• Observable: users see the effects of their choices: blocked requests, GPC signals, domain-level detail.
• Voluntary: site cooperation (declarations, SDK) is optional and does not change user-side enforcement.

For the full design rationale, see the design rationale on GitHub.

Get involved

ProtoConsent is free and open source: GPL-3.0+ for the extension, MIT for the SDK, CC BY-SA 4.0 for documentation. Everything is developed in public on GitHub.

• Publish a .well-known/protoconsent.json on your site to declare your data practices.
• Integrate the SDK (MIT) to read user preferences from your pages.
• Open an issue or pull request on GitHub with feedback, bug reports, or ideas.
• Try the live SDK test on the project website or visit demo.protoconsent.org for a full-featured demo with site declaration, SDK and GPC signal check.
• Reach out at contact@protoconsent.org for questions or collaboration.