# Consent-O-Matic
Most websites today want to process your data and ask for consent using cookie banners. While these banners are meant to give you control, in practice they often result in repetitive and time-consuming clicks—especially if your browser clears cookies when you close it. The same banner reappears, and you find yourself making the same choices again and again.
Consent-O-Matic is a browser extension designed to solve this problem. Developed by the Centre for Advanced Visualization and Interaction (CAVI) at Aarhus University, the tool automatically handles consent banners on your behalf. After you set your preferences during installation, Consent-O-Matic will recognize many common Consent Management Platform (CMP) banners, apply your choices, and confirm with a little checkmark next to the extension icon.
Because Consent-O-Matic is an open-source project, anyone can contribute to its improvement by [adding new rules, updating old rules](#extending-consent-o-matic), or updating documentation. This collaborative approach ensures that the extension keeps pace with the constantly changing landscape of online consent banners—and makes it easier for everyone to safeguard their data with less hassle.
### Further reading
#### Academic Papers
- [Nouwens, M., Liccardi, I., Veale, M., Karger, D., & Kagal, L. (2020, April). Dark patterns after the GDPR: Scraping consent pop-ups and demonstrating their influence. In Proceedings of the 2020 CHI conference on human factors in computing systems](https://doi.org/10.1145/3313831.3376321). [Open source PDF](https://arxiv.org/pdf/2001.02479.pdf)
- [Nouwens, M., Bagge, R., Kristensen, J. B., & Klokmose, C. N. (2022, April). Consent-o-Matic: Automatically answering consent pop-ups using adversarial interoperability. In CHI Conference on Human Factors in Computing Systems Extended Abstracts](https://doi.org/10.1145/3491101.3519683) [Open source PDF](https://web.archive.org/web/20220505144232id_/https://dl.acm.org/doi/pdf/10.1145/3491101.3519683)
- [Nouwens, M., Kristensen, J. B., Maalt, K., & Bagge, R. (2025, April). A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods For Scraping Them. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems](https://doi.org/10.1145/3706598.3713648)
#### Other mentions
- Recommended by the Dutch Data Protection Authority: [Privacy risks and protecting your privacy when accepting cookies](https://www.autoriteitpersoonsgegevens.nl/en/themes/internet-and-smart-devices/cookies/privacy-risks-and-protecting-your-privacy-when-accepting-cookies)
- Recommended by Mozilla: [Top anti-tracking extensions](https://addons.mozilla.org/blog/top-anti-tracking-extensions/)
- [Open-Source ‘Consent-O-Matic’ Tool Lets Anyone Automatically Stop Websites From Tracking Them (Vice, September 2022)](https://www.vice.com/en/article/y3p5q5/open-source-consent-o-matic-tool-lets-anyone-automatically-stop-websites-from-tracking-them)
- [How to stop annoying cookie pop-ups from ruining your browsing (TheNextWeb, May 2022)](https://thenextweb.com/news/how-to-stop-cookie-pop-ups-from-ruining-your-browsing)
- [How to Avoid Those Infuriating Cookie Pop-Ups (Wired, 2021)](https://www.wired.com/story/avoid-cookie-popups-gdpr/)
- [Virksomheder narrer brugerne til mere dataovervågning (PROSA, March 2020, in Danish)](https://www.prosa.dk/artikel/virksomheder-narrer-brugerne-til-mere-dataovervaagning/)[\[Internet Archive\]](https://web.archive.org/web/20200511044414/https://www.prosa.dk/artikel/virksomheder-narrer-brugerne-til-mere-dataovervaagning/)
- [Accepterer du cookies? Her er fire metoder til at undgå overvågning på nettet (DR, January 2020, in Danish)](https://www.dr.dk/nyheder/viden/teknologi/accepterer-du-cookies-her-er-fire-metoder-til-undgaa-overvaagning-paa-nettet)
## Compatible CMPs
Consent-O-Matic currently works with more than 200 CMPs (see full list [here](https://github.com/cavi-au/Consent-O-Matic/tree/master/rules)), including major platforms like UserCentrics, CookieBot, OneTrust, as well as cookie banners for specific websites.
## Privacy
Consent-O-Matic uses the following set of permissions in the browser when installed:
* Access to read all pages - It searches each page you visit for consent-related popups that it knows how to handle
* Information about tab URLs - You can turn the extension on/off on a page-by-page basis by clicking the icon. To check if it is enabled it needs to know the address of the page you are visiting
* Storage - Your preferences and settings are stored directly in your browser
The extension only communicates with the web in two situations:
* When fetching and updating rule lists
* When you report a website as not working through the extension icon menu (the **Let us know!** button)
The URL of the website reported through the extension icon is [sent](https://github.com/cavi-au/Consent-O-Matic/blob/master/Extension/popup.js#L50) to a website hosted by Aarhus University in the form of a URI-encoded query string (e.g., LinkedIn will be reported as `https://gdprconsent.projects.cavi.au.dk/report.php?url=www.linkedin.com`).
## Installation
We highly recommend installing directly through the official extension store of your browser ([mentioned at the top](#consent-o-matic)). Installing through the official channels will automatically keep you up-to-date with new versions when they are released.
It is also possible to get the extension by other means.
### Installing from Archived Release
As an alternative to extension stores you can manually download and extract one of the published versions from the [Releases](https://github.com/cavi-au/Consent-O-Matic/releases) page on Github.
If you do that you have to use the developer feature of the browser to [Load Unpacked](https://developer.chrome.com/docs/extensions/mv3/getstarted/development-basics/#load-unpacked) (Chrome) or [Load Temporary Addon](https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Your_first_WebExtension#installing) (Firefox) and point it at the manifest.json in the unpacked zip-directory.
### Building from Source
Lastly, if you intend to review or make changes to the code, you can build and install directly from the source code:
```
git clone https://github.com/cavi-au/Consent-O-Matic.git
cd Consent-O-Matic
npm install
```
and then run one of ```npm run build-firefox``` or ```npm run build-chromium``` or ```npm run build-safari```
For Firefox or Chromium you can now proceed as above for installing release archives but point the browser at the `build` folder or a folder where you extracted the zip from build/dist/. Safari requires loading the XCode project to further build an app.
We do not recommend installing from source.
## Extending Consent-O-Matic
If your favorite CMP is missing from the current list, feel free to either create a custom list that you can add (click the extension icon in your browser, click "More add-on settings", click "Rule lists", and enter the URL of your custom list.). If you **really** want to contribute, feel free to create a Pull Request while you're at it.
Users can send reports when rules for specific websites are not working. The full list of reported URLs is available [here](https://gdprconsent.projects.cavi.au.dk/reports.php). The number indicates how many times the URL was reported. This list currently does not show if/when the rules for a URL have been checked/adjusted, so always verify whether the rule is still broken/missing before you start working on it.
### Rule elements
* [Basic Structure](#basic-structure)
* [Detectors](#detectors)
* [Methods](#methods)
* [DOM Selection](#dom-selection)
* [Actions](#actions)
* [Click](#click)
* [List](#list)
* [Consent](#consent)
* [Slide](#slide)
* [If CSS](#if-css)
* [Wait For CSS](#wait-for-css)
* [For Each](#for-each)
* [Wait](#wait)
* [Hide](#hide)
* [Close](#close)
* [Matchers](#matchers)
* [CSS](#css)
* [Checkbox](#checkbox)
* [Consent](#consent-1)
* [Consent Categories](#consent-categories)
* [Full example](#full-example)
### Basic Structure
A rule list for Consent-O-Matic is a JSON structure that contains the rules for detecting a CMP (Consent Management Provider), and
dealing with the CMP popup when it is detected.
Each CMP is a named entry and contains 2 parts, `detectors` and `methods`. The name should ideally be the actual name of the underlying CMP (correctly capitalized and whitespaced) or of the website if it is unique to that domain. The name will be shown in the About section of extension's settings, so make it user-friendly.
```json
{
"MyCMP": {
"detectors": [ ... ],
"methods": [ ... ]
},
"AnotherCMP": {
"detectors": [ ... ],
"methods": [ ... ]
},
}
```
If more than 1 detector is added to a CMP, the CMP counts as detected if any of the detectors trigger.
#### Detectors
Detectors are the part that detects if a certain rule set should be applied. Basically, if a detector triggers, the methods will be applied.
Detector structure:
```json
{
"presentMatcher": [{ ... }],
"showingMatcher": [{ ... }]
}
```
The present matcher is used to detect if the CMP is present on the page.
Some CMPs still insert the popup HTML into the DOM even when re-visiting a page where you have already given consent earlier. We only want to handle the consent form if its actually showing on the page. This is what the showing matcher is used for.
Both the present and showing matcher follow the common structure of [`Matchers`](#matchers).
Both the present and showing matcher can be multiple matchers, only triggering the detector if all of the matchers (respectively for present and showing) apply.
#### Methods
Methods are collections of actions. There are 4 methods supported by Consent-O-Matic. `OPEN_OPTIONS`, `DO_CONSENT`, `SAVE_CONSENT`, `HIDE_CMP`
All the methods are optional, and, if present, the methods will be run in the order given below when a detector is triggered.
```
HIDE_CMP
OPEN_OPTIONS
HIDE_CMP
DO_CONSENT
SAVE_CONSENT
```
Methods take on the form:
```json
{
"name": " ... ",
"action": { ... }
}
```
where the name is one of the 4 supported methods and action is the [action](#actions) to execute.
---
### DOM Selection
Most actions and matchers have some target that they apply to. For this reason, Consent-O-Matic has a DOM selection mechanism that can easily help with selecting the correct DOM element.
```json
"parent": {
"selector": ".some.css.selector",
"textFilter": "someTextFilter",
"styleFilter": {
"option": "someStyleOption",
"value": "someStyleValue",
"negated": false
},
"displayFilter": true,
"iframeFilter": false,
"childFilter": {}
},
"target": {
"selector": ".some.css.selector",
"textFilter": "someTextFilter",
"styleFilter": {
"option": "someStyleOption",
"value": "someStyleValue",
"negated": false
},
"displayFilter": true,
"iframeFilter": false,
"childFilter": {}
}
```
There are 2 parts, `parent` and `target`. The `parent` is optional but if it exists it will be resolved first, and used as the starting point for `target`. This allows you to construct very complicated selections of elements that wouldn't otherwise be possible with a single plain CSS selector. One example of such is selecting into shadow DOM - where using parent to target the element with the shadow allows querying its children with the selector.
All the parameters to `parent` and `target` except `selector` are optional.
The selection method works by using the CSS selector from `selector` and then filtering the resulting DOM nodes via the various available filters:
* `textFilter` filters all nodes that do not include the given te