Open source · MIT · on npm

The open-source consent firewall

Most consent tools gate a list of known tags and hope vendors honour a string. noidme.js patches the browser's networking primitives directly (fetch, XHR, beacons, scripts, images) so it can allow, block, or quarantine outgoing requests until consent — fail-closed by default, and honest about exactly what it covers.

View on GitHub Book a demo

Why it's different

Block, don't just signal

Network-level

Patches fetch / XHR / sendBeacon / script / img, so unknown trackers can't slip through a tag list.

Fail-closed

Unconsented, unrecognised requests are blocked or quarantined by default, never allowed-until-caught.

Quarantine & replay

Hold requests made before consent, then replay them the moment the matching purpose is granted.

Purpose-bound

Every request is mapped to a purpose; consent state decides allow / block per request, live.

Honest coverage

We publish the per-vector coverage matrix and the adversary boundary. Prove, don't promise — no closed incumbent does.

Self-hostable

MIT-licensed, on npm, ~40 KB gzipped. Run it standalone with a static policy — no backend required to install or evaluate.

Drop-in

Enforce before anything fires

noidme.js

<script src="https://cdn.noidme.com/noidme.js"
  data-key="pk_live_yourPublishableKey"
  data-notice="n1"
  data-enforce="true"></script>

<!-- non-essential tags stay inert until their purpose is consented -->
<script type="text/plain" data-dpdp-purpose="analytics" src="https://example-analytics.js"></script>

Pairs well with the Consent SDK (banner + script-blocking) for a fast start — but noidme.js runs on its own when you need to guarantee nothing leaks pre-consent.

Consent → enforcement

Captured consent drives the firewall

A turnkey consent-sdk adapter bridges the DPDP Suite banner and noidme.js enforcement: the same §6(10) consent decision that writes to the tamper-evident ledger also updates noidme.js in the browser — allowing or blocking outgoing requests for each purpose in real time, without custom glue code.

This is Layer-1 honest-SDK enforcement. It reliably stops honest-but-eager third-party tags (analytics, ads, heatmaps) from firing before consent. Against a deliberately hostile in-page script the authoritative layers remain the opt-in service worker and a strict CSP — the adapter does not change that boundary.

Honest scope

Defence-in-depth, not a silver bullet

Honest scope: Layer-1 interception runs on the main thread and reliably stops honest-but-eager third-party SDKs — the analytics/ads/heatmap tag firing before consent — before the request leaves the browser. Against a deliberately hostile in-page script the authoritative layers are the opt-in service worker plus a strict CSP, for which Layer-1 is the substrate. We block the honest case and publish the bypass surface — never "blocks everything."

Stop trusting tags to behave

Add real, fail-closed enforcement to your site — MIT-licensed, on npm.

View on GitHub See pricing