How to Set Up Cookie and Privacy Compliance With AI (2026)

This guide walks through that end-to-end run using ConsentStack's MCP server, with prompts you can paste. ConsentStack is a modern consent management platform, and it's our product, so weigh that as you read. The questions near the end work for judging any tool in this category.

What can AI actually do for cookie and privacy compliance?

Nearly all of it, from the first install to checking its own work, as long as something else does the enforcing. An AI assistant is good at reading your site, working through settings and following up on what a scan finds. It isn't there at 3am when a visitor lands on your homepage, so something on the page has to hold trackers back, apply the right rules for that visitor and record the choice.

Why not just ask ChatGPT for a cookie banner and a privacy policy?

Because you get something that looks finished and does very little. Ask a model for a cookie banner and you get a box with two buttons that remembers the answer. Holding every tracker back until that answer arrives is a separate and much harder job (here's how blocking works), and nothing on screen shows whether it happened.

Looking right proves nothing, even with a working button. We measured 949 sites whose banners had a working Reject button and found that 43.4% of tracking cookies set by third-party scripts under the site's own name were still in the browser after Reject All.

The policy fails from the other direction. A model writes a plausible document from what it assumes about your business. It hasn't seen which trackers your site loads, it doesn't know your legal name, and it won't update anything when someone adds a pixel next month. What your policy promises and what your site does can drift apart with nobody noticing.

Tracking visitors without valid consent carries real risk. Law firm Fisher Phillips' public tally counts 5,846 tracking privacy suits in the US from February 2022 to September 2026, and regulators have fined companies over trackers, Google and SHEIN among them.

What is an MCP server?

An MCP server gives an AI assistant a set of tools it can use inside another service. MCP stands for Model Context Protocol, an open standard for connecting AI applications to outside systems. Without it, your assistant can only tell you what to click. With it, the assistant becomes an agent: it does the work itself, signed in as you, with the permissions you already have.

ConsentStack's server is hosted, so there's nothing to install or keep running. It lives at https://app.consentstack.io/api/mcp, you sign in with your ConsentStack account over OAuth, and there's no API key to create or paste.

How do I set up cookie and privacy compliance with AI, step by step?

This is the full run, from an empty account to a verified site. Your part is small: create the account, connect your AI tool and approve what goes live. The agent can handle the rest, including checking its own work.

You need a ConsentStack account and an AI tool that supports remote MCP servers. If the tool can edit your site's code, as Claude Code and Cursor can, it can do the install as well. If it can't, it hands you the tags and you paste them in. Built your site with an AI builder? Our Lovable guide covers that case.

Step 1: Scan your site to see where you stand

Run your site through the free compliance scanner before you change anything. You'll get a list of what fires before and after a visitor chooses, which is your before picture for later.

Step 2: Create a free account

Sign up and work through the short account setup. The Basic plan is free. You have to do this part yourself, because your agent signs in as you.

Step 3: Connect your AI tool

In Claude Code, run this in your terminal:

claude mcp add --transport http consentstack https://app.consentstack.io/api/mcp

In claude.ai or the Claude desktop app, go to Settings > Connectors > Add custom connector and paste the server URL. In Cursor, add the server to .cursor/mcp.json:

{
  "mcpServers": {
    "consentstack": {
      "url": "https://app.consentstack.io/api/mcp"
    }
  }
}

A browser window opens so you can sign in. Any other tool that supports remote MCP servers over streamable HTTP with OAuth connects the same way.

Step 4: Give your agent the job

One prompt covers everything from here to a verified site. Swap in your own domain. The next steps explain what to expect at each stage.

Set up and verify cookie consent and privacy compliance for example.com
using ConsentStack, end to end.

1. Find the site in my ConsentStack account, or create it.
2. Get the install guide for my platform and add the tags to the
   site's head. They must be the first scripts on the page.
3. Make the banner look like part of my site. Match my colors, fonts,
   corners and spacing, and use custom CSS if my plan includes it.
   Keep it as a draft, show me every change, and wait for my go-ahead
   before publishing.
4. Scan the live site, fix what the scan finds, and scan again until
   it comes back clean.
5. Set up my Privacy Policy and Cookie Policy. Ask me for any business
   facts you don't have. Never guess them. Show me the preview and
   wait for my go-ahead before publishing.
6. Give me the embed snippet for my policy page and make sure the
   banner links to both policies.
7. Run one last scan and give me a plain-English summary of the result.

Step 5: Review the install

The agent pulls an install guide with your real site key already filled in. There are guides for Next.js, React, WordPress, Shopify, Webflow, Squarespace and Wix, plus a generic one. Once the tags are deployed, load any page on your site. That first load verifies your domain, and the scan in Step 7 needs a verified domain.

Step 6: Make the banner look like part of your site

Your banner doesn't have to look like a template. A coding agent like Claude Code or Cursor can read your actual stylesheet and match the banner's colors, fonts, corners and spacing to your brand. On Pro and Business it can also inject custom CSS and JavaScript for the details those settings don't reach, like button heights, hover states and focus rings, so the banner looks pixel perfect next to the rest of your site.

Banner changes, custom code included, sit in a draft that never touches your live site. The agent should summarize them in plain language and ask before publishing. Read any custom JavaScript before you approve it, because it runs on your live pages, and whatever the styling, keep Reject as easy to find as Accept.

You don't need to tell the agent which laws apply. ConsentStack shows every visitor the consent rules their own country or state requires, automatically, across 195+ regulations in 157+ jurisdictions. Our guide to cookie consent requirements explains how those rules differ.

Step 7: Let the agent verify its own work

This is what makes the run end to end. The agent checks its own work with a compliance scan, which opens your live site in a real browser from both the EU and the US, declines the banner and reports any tracker that fired anyway. It takes about 60 to 90 seconds. Each finding comes back with a hint naming the tool that fixes it, so the agent can close the loop on its own: categorize the tracker, wait for the new configuration, scan again. You get five scans per site per hour.

Trackers in our catalog are detected and blocked automatically, so this step is mostly about leftovers, like a small vendor or a custom script. A failed scan doesn't mean a fine is on its way, and a clean one isn't a legal opinion. It tells you what your site actually did.

Step 8: Generate your policies

The policy generator works through the agent too. It fills in your business profile and asks you for what it can't know: your legal name, your privacy contact and where you do business. Your Privacy Policy and Cookie Policy start from the trackers ConsentStack found on your site, and the agent can add what a scan can't see, such as your payment or email provider.

It shows you the preview, publishes on your go-ahead, then gives you the snippet for your policy page and checks that the banner links to it. The same flow covers your Terms of Service, Disclaimer and Accessibility Statement, on every plan.

Step 9: Check it yourself

Run the free scanner again and compare it with your first report. To see it with your own eyes, open a private window, open your browser's network tab, click Reject and browse a few pages.

What can the ConsentStack MCP server do?

It has 39 tools, grouped by job below. Your agent sees all of them once connected, and the MCP docs list each one by name.

How do I stop an AI agent from publishing the wrong thing?

Treat it like a capable new hire: let it do the work, and check anything that goes live. These are the safeguards ConsentStack gives you:

• Drafts first. Banner changes wait in a draft until they're published, and a draft can't affect your live site.
• Your go-ahead. The server tells the agent to summarize every pending change and get your explicit OK before publishing a banner or a policy. That's an instruction rather than a lock, so keep your AI tool's approval prompts on for anything that changes data.
• Your permissions and no more. Every request runs under your account and team role. Any team member can read, but only admins and owners can make changes. Sign-in uses OAuth 2.1, so there's no long-lived API key to leak, and no tool touches your plan or billing.
• No AI-written legal text. Policy wording comes from fixed templates, so the same answers always produce the same policy. Custom sections hold only your own words, verbatim, and the agent is told to ask you for facts like your legal name rather than guess them.
• No stale publishes. A policy publish has to carry the version the agent previewed. If the draft changed in between, the server refuses it.

Which consent platforms have an MCP server?

More of them every month. ConsentStack, CookieYes, iubenda, ConsentLayer, Biscotti CMP, SureCookie, Cookie Compliance, CMPStack and Secure Privacy all document one, and they do very different amounts. Here's how six of them compare, going by each vendor's public docs on November 4, 2026. "Not documented" means we couldn't find it, not that it can't be done.

Sources: CookieYes, iubenda, ConsentLayer, Biscotti CMP, SureCookie.

ConsentStack is built to cover the whole job in one connection, from an empty account to published policies, with a scan that checks the result. If you only want an assistant to adjust an existing banner's colors, several of these will do. Whichever you're weighing, ask these five questions:

• Can it do the whole setup, or only change settings after you've done the rest by hand?
• Do changes wait for review, or go live as soon as the agent saves them?
• Does its scan test what fires after a visitor rejects, or only list cookies?
• Who writes the policy wording: fixed templates or the model?
• Is agent access included on the free plan, or only on higher tiers?

What happens after the setup is done?

Sites change. Someone adds a pixel, a vendor changes a cookie, a new tool shows up. ConsentStack checks every published Privacy Policy and Cookie Policy against your site once an hour. Routine changes, like a new tool in a category you already disclose, publish on their own as a new dated version. Anything that changes what your policy promises, like your first advertising tool, waits for your review and changes nothing live until you apply it.

Your agent stays useful after that. A few things worth asking it:

• "Do any of my policies have changes waiting for review? Explain each one."
• "Rescan my site and fix anything new."
• "What's my consent rate by country this month?" (Pro and Business)
• "A visitor asked us to delete their data. Here's their ID." (Pro and Business)
• "Show me the policy status of every site, then copy these answers to the new one." (handy for agencies)

What does it cost?

MCP access is included on every plan, including the free one, and the plan limits match the dashboard. If a feature needs an upgrade, the agent tells you which plan unlocks it.

Basic is free: 1,000 unique monthly visitors, one domain and all five policy generators. Pro is $29 a month: 30,000 visitors, two domains, custom CSS and JavaScript, analytics, consent logs and the option to remove branding. Business is $79 a month: 1 million visitors, three domains, one-year log retention and HIPAA support with a signed BAA.

Prefer not to run this yourself? Every paid plan includes free Concierge setup, where our team configures everything for you. That's also the route to the Compliance Guarantee, which requires a Concierge setup. Your agent can still handle the day-to-day afterward, but check with your Concierge before it overrides a tracker category, since replacing our catalog with your own rules ends the guarantee.

If you take one thing from this: have your AI run a real consent system instead of writing its own, then have it verify the result by what a browser sees after clicking Reject.