Nova Sanctum - Privacy & Cookie Consent

Most consent plugins are built for the EU and treat the United States as one checkbox. Nova Sanctum resolves each visitor down to the state and applies the rules that actually apply there.

Key Features

Per-state resolution: 19 US states plus a generic US opt-out baseline, Canada under PIPEDA, and Quebec under Law 25
Fails closed: unknown country, EU, or a VPN/TOR/public-proxy visitor stays fully opt-in
Apple Private Relay recognized, so iPhone users are not mistaken for VPN evaders
Cache-safe: tags parked uniformly so cached HTML is byte-identical for every visitor
Global Privacy Control honored as an opt-out on every page load, even against a stored accept
Anonymized proof-of-consent log with CSV export, 24-month opt-out retention
Privacy Law Radar: cron ingest of authoritative privacy-law feeds, tagged and surfaced in admin
Built-in tag manager for GA4, Google Ads, Meta Pixel and custom snippets, each hard-gated by consent
Google Consent Mode v2 and WP Consent API with per-category signals
No license server and no call home to the plugin author

How Nova Sanctum compares to a typical consent platform

The mainstream consent platforms such as CookieYes, Cookiebot, Complianz, Termly and iubenda were designed around GDPR and added US support later, usually as a single blanket CCPA mode. That difference in origin shows up throughout:

Per-state US rules rather than one blanket CCPA mode
Fails closed when the visitor cannot be identified, instead of defaulting permissive
Apple Private Relay recognized as ordinary traffic rather than flagged as a VPN
Correct under full-page caching because every visitor is served byte-identical HTML
GPC honored even against a stored accept, on every page load
Tag manager built in, so a separate Google Tag Manager container is optional
Privacy-law monitoring inside the plugin via the Law Radar screen
No license server and no phone-home, rather than a hosted subscription

Comparisons are at the category level because these products ship changes constantly. Verify current behavior against your own shortlist before deciding.

Which US states and regions are covered

19 US states plus a generic US opt-out baseline, Canada under PIPEDA, and Quebec under Law 25 with express consent and French banner strings served automatically. Three presets cover most sites: US Smart gates the ad pixel everywhere, US Smart+ lets ads run by default where the law allows opt-out, and Strict asks everyone to opt in. A Custom profile exposes the full per-state matrix, and a child-directed posture forces targeted advertising and sale or share to opt-in across every US and Canada jurisdiction.

The shipped per-state rules encode legal judgments and are an engineering baseline, not legal advice. Have qualified counsel review them before relying on this in production.