iluvfreetools
Site & safety46 of 46

Risk assessments, method statements, SWMS and job hazard analyses, for the UK, US, Australia and Canada. Finished documents, no empty boxes left for you.

All 46 ›
Structure & materials35 of 35

Steel, timber, concrete, brickwork, boards, groundworks and roofs. Section data, indicative sizing, quantities and the reference tables you normally go hunting for.

All 35 ›
Home & property32 of 32

See what it would look like before you commit, then work out what it takes. Upload a photo of your own wall, drive or house and try things on it.

All 32 ›
Invoices & docs20 of 20

Invoices, quotes, receipts and the rest of the paperwork, generated properly. No account, no watermark, and Download is the only button.

All 20 ›
Money & tax39 of 39

Wages, mortgages, tax and the everyday sums. What you actually take home, what it actually costs, and what you actually owe.

All 39 ›
People & hours46 of 46

Rotas, rosters and schedules, holiday and PTO, timesheets and staff paperwork. The admin that eats a Sunday evening, done in ten minutes.

All 46 ›
Business & marketing50 of 50

Starting up, getting found and keeping the admin straight. Everything downloadable, nothing paywalled at the last step.

All 50 ›
PDF & documents27 of 27

Merge, split, crop, sign, number and compress. Everything runs in your browser, so the contract you open here never reaches a server.

All 27 ›
Image tools24 of 24

Convert, resize, compress, crop and adjust. All of it on your own machine, with no upload, no account and no watermark on anything.

All 24 ›
Text & dates20 of 20

Word counts, case, days between dates, working days and ages. The ten-second look-ups, with no account and nothing stored.

All 20 ›
Random & party27 of 27

Secret Santa, draws, brackets, sweepstakes, printables and party quantities. The bit that is just for fun, done properly.

All 27 ›
Training & tests21 of 21

Practice tests for the cards and licences that decide whether you can work. Every answer cites the guidance it came from, not a forum.

All 21 ›

Cookie consent banner

Free. No account, no email, nothing uploaded.

What does your site actually set?

Tick honestly. Which tier you land in decides whether you need a blocking banner at all.

No blocking banner needed 0 opt-in
Nothing needed
1
Notice and opt-out
0
Opt-in consent
0

The banner

<!-- Cookie banner for this site. No library, no third party, nothing metered. -->
<div id="cc-banner" hidden role="dialog" aria-live="polite" aria-label="Cookies">
  <div class="cc-inner">
    <p class="cc-text">
      We use cookies. The ones that make the site work are always on. You choose the rest, and you
      can change your mind any time. <a href="/privacy/">What we use and why</a>.
    </p>
    <div class="cc-opts">

    </div>
    <div class="cc-buttons">
      <button type="button" id="cc-reject">Reject non-essential</button>
      <button type="button" id="cc-save">Save choices</button>
      <button type="button" id="cc-accept">Accept all</button>
    </div>
  </div>
</div>

<style>
  #cc-banner { position: fixed; inset: auto 0 0 0; z-index: 9999; background: #fff; color: #111;
    border-top: 3px solid #1a1a1a; box-shadow: 0 -2px 12px rgba(0,0,0,.15); font: 14px/1.5 system-ui, sans-serif; }
  #cc-banner .cc-inner { max-width: 60rem; margin: 0 auto; padding: 1rem 1.25rem; display: grid; gap: .75rem; }
  #cc-banner .cc-text { margin: 0; }
  #cc-banner a { color: #1a1a1a; }
  #cc-banner .cc-opts { display: flex; flex-wrap: wrap; gap: .25rem 1.25rem; }
  #cc-banner .cc-opt { display: flex; align-items: center; gap: .4rem; }
  #cc-banner .cc-buttons { display: flex; flex-wrap: wrap; gap: .5rem; }
  #cc-banner button { font: inherit; padding: .5rem .9rem; border: 1px solid #1a1a1a; background: #fff;
    color: #1a1a1a; cursor: pointer; }
  #cc-banner #cc-accept { background: #1a1a1a; color: #fff; }
  @media (prefers-color-scheme: dark) {
    #cc-banner { background: #111; color: #eee; }
    #cc-banner button { background: #111; color: #eee; border-color: #eee; }
    #cc-banner #cc-accept { background: #eee; color: #111; }
  }
</style>

<script>
(function () {
  var NAME = 'cc_choice';
  var DAYS = 180;
  var CATS = [];

  function read() {
    var m = document.cookie.match(/(?:^|; )cc_choice=([^;]*)/);
    if (!m) return null;
    try { return JSON.parse(decodeURIComponent(m[1])); } catch (e) { return null; }
  }
  function write(choice) {
    document.cookie = NAME + '=' + encodeURIComponent(JSON.stringify(choice)) +
      ';path=/;max-age=' + (DAYS * 86400) + ';samesite=lax' +
      (location.protocol === 'https:' ? ';secure' : '');
  }

  // Turn allowed tags on. A script already executed cannot be un-executed, so
  // tags must start as text/plain and be switched on, never loaded and stopped.
  function run(choice) {
    var nodes = document.querySelectorAll('script[type="text/plain"][data-cookie-category]');
    for (var i = 0; i < nodes.length; i++) {
      var el = nodes[i];
      if (!choice[el.getAttribute('data-cookie-category')]) continue;
      var s = document.createElement('script');
      for (var a = 0; a < el.attributes.length; a++) {
        var at = el.attributes[a];
        if (at.name !== 'type' && at.name !== 'data-cookie-category') s.setAttribute(at.name, at.value);
      }
      s.text = el.text;
      el.parentNode.replaceChild(s, el);
    }
    document.dispatchEvent(new CustomEvent('cc:choice', { detail: choice }));
  }

  function decide(all) {
    var choice = {};
    for (var i = 0; i < CATS.length; i++) choice[CATS[i]] = all;
    return choice;
  }

  var banner = document.getElementById('cc-banner');
  var saved = read();
  if (saved) { run(saved); } else { banner.hidden = false; }

  function finish(choice) { write(choice); run(choice); banner.hidden = true; }

  document.getElementById('cc-accept').addEventListener('click', function () { finish(decide(true)); });
  document.getElementById('cc-reject').addEventListener('click', function () { finish(decide(false)); });
  document.getElementById('cc-save').addEventListener('click', function () {
    var choice = {};
    var boxes = banner.querySelectorAll('[data-cc-cat]');
    for (var i = 0; i < boxes.length; i++) choice[boxes[i].getAttribute('data-cc-cat')] = boxes[i].checked;
    finish(choice);
  });

  // Let a "cookie settings" link anywhere on the site reopen this.
  document.addEventListener('click', function (e) {
    var t = e.target.closest && e.target.closest('[data-cc-open]');
    if (t) { e.preventDefault(); banner.hidden = false; }
  });
})();
</script>

One file, no library, no CDN, nothing metered. Nothing uploaded.

Worth knowing

  • A POLICY IS DISCLOSURE, A BANNER IS THE MECHANISM, AND ONLY THE SECOND IS WHAT PECR ASKS FOR. Regulation 6 is about not storing or accessing information until the conditions are met. A page of prose explaining what you set does not stop anything being set. Most small sites have the policy and not the mechanism, which is the wrong half of the job.
  • THERE ARE THREE TIERS, NOT TWO, AND MOST COOKIE TOOLS ARE OUT OF DATE ON THIS. Schedule A1 is not "essential or consent". Strictly necessary and transmission cookies need nothing. Statistics and preferences need NOTICE AND AN OPT-OUT but not prior consent, provided the data is not shared with third parties. Everything else needs opt-in. You have 1 in the first tier, 0 in the second and 0 in the third.
  • NOTHING YOU HAVE SELECTED NEEDS PRIOR CONSENT, WHICH IS A REAL ANSWER AND A GOOD ONE. Everything on your list is either strictly necessary or covered by the statistics and preferences exceptions, so you need clear notice and a simple way to opt out, not a blocking banner. The banner below still works and will simply not hold anything back. A site that does not need a consent wall should not build one.
  • REJECTING HAS TO BE AS EASY AS ACCEPTING. The banner here has Reject alongside Accept at the same size, not buried behind a settings link, because a design where refusing takes three clicks and accepting takes one is the thing regulators have been writing to people about. The choice is remembered for 6 months and any link with data-cc-open reopens it.
  • NO LIBRARY, NO CDN, NO PAGEVIEW METER. CookieYes caps free use at 5,000 pageviews a month and keeps its branding on your banner until the paid tier; Cookiebot, Termly and OneTrust meter the same way. This is one file you paste, and it does not phone anybody, which also means nobody can turn it off.

Worked out on this device, by this page. Nothing you typed was sent anywhere or stored, and closing the tab loses it.

Next in the same job

A policy is disclosure. A banner is the mechanism.

Regulation 6 of PECR is about not storing or accessing information on somebody's device until the conditions are met. That is something your site does, not something it says.

A cookie policy explaining what you set is disclosure, and it is required. It does not stop a single tag firing. Most small sites have the prose and not the mechanism, which is the wrong half of the job and the half that is easier to write.

Three tiers, not two

Nearly every cookie tool presents this as essential versus everything else. Schedule A1 is more specific than that, and the middle tier is where most small sites live.

Nothing needed. Technical storage for carrying out a transmission, and anything strictly necessary for a service the user asked for. The Schedule expressly includes security, fraud prevention, fault detection and authenticating users. Sessions, baskets and the cookie remembering this very choice are all here.

Notice and an opt-out, but no prior consent. Statistics whose sole purpose is understanding how the service is used with a view to making improvements, provided the information is not shared with third parties and there is a simple way to opt out. Also cookies that adapt the site to somebody's preferences or improve its appearance.

Opt-in consent. Everything else. Advertising, third-party analytics, embeds.

Which means some sites do not need a banner

A site with essential cookies, a dark mode preference and self-hosted analytics has nothing in the opt-in tier. It needs clear notice and a working opt-out, not a wall in front of the content.

That is a real answer and this tool gives it. Building a consent wall you do not need costs you visitors and gains you nothing, and it is what happens when a tool assumes every site is the same site.

The line that catches people is the third-party one

The statistics exception has a condition attached: the information must not be shared with third parties.

Self-hosted analytics can satisfy that. Google Analytics cannot, because sending the data to Google is sharing it with a third party. The same numbers, the same purpose, a different tier, entirely because of where the data ends up.

Free hosted analytics is generally free because the data is the payment, which is worth remembering when deciding which of the two you have.

How blocking has to work

A script that has already run cannot be un-run. So anything that claims to block tags after the page has loaded is decorative: the request went out, the cookie was set, and the consent banner is arguing with something that already happened.

The only approach that works is not putting the script on the page at all. Your tags go in with type="text/plain" and a category attribute. The browser sees something it does not recognise as JavaScript and leaves it alone. When somebody consents, the banner swaps the type and the tag runs for the first time.

It is slightly fiddly to set up once and it is the difference between a banner that works and a banner that looks like it works.

Two things people expect to help, which do not

Non-personalised advertising. Still storage on somebody's device, still needs consent. It buys a lower revenue per thousand impressions and no relief from the banner at all.

Frequency capping. Sounds like housekeeping. It is information stored on a visitor's device to remember what they have seen, which is exactly what the regulation is about.

Rejecting has to be as easy as accepting

The banner here puts Reject next to Accept, same size, same prominence, not behind a settings link.

A design where accepting takes one click and refusing takes three is the specific thing regulators have been writing to organisations about, and it is the default in a lot of the paid tools because it produces better consent rates. Better consent rates obtained that way are the problem rather than the point.

Common questions

Do I need a cookie banner?

It depends which tier your cookies fall into, and there are three rather than two. Strictly necessary cookies need nothing. First-party statistics and preference cookies need clear notice and a simple opt-out, but not prior consent, provided the data is not shared with third parties. Everything else, notably advertising and third-party analytics, needs opt-in. A site running only essential and self-hosted analytics may not need a blocking banner at all.

I thought all analytics needed consent

That is the version most cookie tools still tell you, and Schedule A1 to PECR is more specific. It permits collecting data for statistical purposes about how a service is used with a view to making improvements, on notice and an opt-out, but only where the information is not shared with third parties. Self-hosted analytics can meet that. Sending the same data to an analytics company cannot, because that is sharing it with a third party.

Is a cookie policy enough on its own?

No. A policy is disclosure. Regulation 6 is about not storing or accessing information on somebody's device until the conditions are met, which is a mechanism rather than a document. A page of prose explaining what you set does not stop anything being set. Most small sites have the policy and not the mechanism, which is the easiest half to get backwards.

How does the blocking actually work?

By never putting the script on the page in the first place. Your tags go in as type="text/plain" with a category attribute, which the browser will not execute, and the banner switches them on only for the categories somebody has allowed. That is the only approach that genuinely works: a script that has already run cannot be un-run, so anything claiming to block tags after page load is decorative.

Does non-personalised advertising avoid the banner?

No, and neither does frequency capping. Both still store or access information on the visitor's device, and that is what regulation 6 is about rather than whether the advertising is targeted. Serving non-personalised ads buys you a lower revenue per thousand and no relief from consent at all.

What about a YouTube embed?

It sets third-party cookies when the page loads, not when somebody presses play, which is the part people get wrong. A video nobody watches has already talked to Google by the time the page finishes rendering. Either hold the embed back with the banner or replace it with a click-to-load placeholder, which is usually faster anyway.

Why do the free banner tools have limits?

Because the banner is the funnel. CookieYes caps its free tier at 5,000 pageviews a month and keeps its own branding on your banner until the paid tier; Cookiebot, Termly and OneTrust meter the same way. What this produces is one file you paste into your site. It loads nothing, it phones nobody, and there is no tier for it to be limited by.