Zest logo Zest

Zest - Lightweight Cookie Consent Toolkit

A lightweight, zero-dependency cookie consent toolkit for GDPR/CCPA compliance

Zest is a lightweight, zero-dependency cookie consent toolkit for GDPR/CCPA compliance. The full UI build is ~16KB gzipped (all 12 languages) or ~10KB per-language — a modern alternative to heavier solutions like Klaro (45KB) and Tarteaucitron (80KB). A headless build (~11KB gzipped) is also available for bring-your-own-UI consumers.

Key Features

  • Lightweight - ~16KB gzipped for the full build with all 12 languages, ~10KB per-language, ~11KB headless — zero dependencies
  • Two entry points - Full build with Shadow DOM UI, or headless engine if you want to render your own banner
  • Smart Script Blocking - Automatically blocks tracking scripts until user consents
  • Cookie & Storage Interception - Queues blocked operations and replays when consent is granted
  • Privacy Signals - Respects Do Not Track (DNT) and Global Privacy Control (GPC)
  • 12 Languages - Built-in support for EN, DE, ES, FR, IT, PT, NL, PL, UK, RU, JA, ZH
  • Beautiful UI - Customizable banner, modal, and floating widget with dark mode
  • Defense-in-depth Security - XSS, ReDoS, clickjacking, and prototype-pollution mitigations built in
  • TypeScript Ready - First-class .d.ts declarations for both entries, shipped with the package (v2.1.0+)
  • Composable interceptors - Disable cookie / storage / script interception per channel; declare your own strictly-necessary keys without rewriting the matcher (v2.2.0+)
  • Network & element-level interception - Patches fetch / XHR / sendBeacon and synchronous prototype setters on <script>, <link>, <img>, <iframe>. Catches trackers that ship via CMS first-party proxies (HubSpot, Cloudflare Zaraz, server-side GTM) and runtime-injected DOM elements BEFORE the browser fetches them (v2.3.0+)
  • Developer-Friendly - Simple API, DOM events, Zest.on() subscribers, and config callbacks

Quick Start

<script>
  window.ZestConfig = {
    position: 'bottom-right',
    theme: 'auto',
    accentColor: '#0071e3',
    policyUrl: '/privacy-policy'
  };
</script>
<script src="https://cdn.jsdelivr.net/npm/@freshjuice/zest"></script>

That's it! Zest will automatically show the consent banner and block known tracking scripts.

Documentation

Ready to get started? Check out the Getting Started guide for installation options and basic setup.

License

Zest is open source software licensed under the MIT License.