A consent banner is not a banner.
It's a switch.

Anyone can show a bar that says "We value your privacy." The real question is what happens after the click: does Reject actually stop data from being collected? This page explains exactly how Vafer works — what gets blocked and when, what we store, and the limits we tell you about instead of hiding.

What happens when someone visits a store

1

We read where the visitor is

Country, plus the US state, resolved at the network edge on each visit — fast enough that the page never waits. We use the location to pick the rules; we don't store it raw.

2

The store's own rules decide the experience

The merchant writes ordered rules: Europe might get strict ask-first, California gets its "Do Not Sell or Share" link, another state might get a quiet notice or no banner at all. The first matching rule wins. If we can't read a visitor's location, they get the most protective treatment, never the most permissive.

3

Trackers wait for permission

In ask-first regions, known tracker scripts, pixels and ad iframes are held before the visitor chooses — a maintained list of known tracking domains, plus anything the merchant tags. Shopify's own analytics respect the choice through Shopify's Customer Privacy API, and Google tags through Consent Mode v2.

4

The visitor decides — once

Accept all, reject all, or pick categories. If their browser sends the Global Privacy Control signal, we honour it automatically with no click needed. The choice is saved on their device, and the store decides how long it stays valid before asking again (a year by default).

5

The choice is enforced, not just saved

Accept releases the held trackers. Reject keeps them held and deletes the tracking cookies already on the device — while necessary ones, like the cart, are never touched. Either way, the decision is recorded, so the store can prove it asked and honoured the answer.

What "blocking" honestly means

The limits — stated here, not buried
  • Coverage is a floor, not a guarantee. We hold known trackers plus whatever the store tags. A tracker from a domain nobody has heard of passes through. No consent tool can truthfully say "blocks all tracking" — so we don't.
  • Scripts hard-coded into a theme can win the race. Code pasted directly into a store's theme can execute before any consent tool loads. We detect and surface this; we can't un-run it.
  • We show stores their real coverage. The app's Diagnostics screen shows, live, what a visitor from each country is actually served — proof, not promises.

What we store — and what we never do

Vafer is a consent product, so this part is deliberately boring and specific. When a visitor makes a choice, exactly one record is written:

Each decision records
  • Which store, and when
  • Region (country / US state)
  • What was granted or refused, per category
  • Which policy version was shown
  • How it was decided (banner, preferences, GPC)
  • A one-way scrambled visitor code — scoped per store, so two stores can never link the same person
Never stored
  • Shoppers' names or email addresses
  • Raw IP addresses
  • Raw browser fingerprints
  • Browsing history or behaviour
  • Anything readable across stores

Stores can export their consent log any time, choose how long records are kept (one year by default), and deleting the app deletes the store's data — including the copies at the edge. And this website itself practices what it preaches: no analytics scripts, no ad pixels — the waitlist form stores only what you type into it.

How a store knows it's working

See it for yourself

Check any store's current consent coverage in one click — including one running a different consent app.

Run the free coverage check Join the waitlist