Cookie Consent at Coinbase
I built one cookie consent and management system for all of Coinbase and rolled it out across every Coinbase website and domain, replacing the older cookie banner.
What it does
The system shows the consent banner and the preferences center, blocks third party scripts until consent, removes cookies the user did not consent to, syncs consent for logged in users, and keeps a list of every cookie used across Coinbase domains. All of it is legally required under GDPR, CCPA, and similar laws in other countries.
How it is built
I built two libraries that use the same core code. The React version supports our standard React and Next.js apps. The vanilla JavaScript version covers non-React sites like Mintlify, which we use for our documentation.
The React package runs on our internally managed domains:
The vanilla package runs on our Mintlify docs:
There are more domains than these. These are the ones that matter most.
What it took
- One package, many very different apps. Server rendered and client rendered, logged in and logged out, across Retail, Base, Help Center, CDP, and the marketing sites. Each one was set up differently. I built it so a single package could work in all of them.
- Moving off the old manager without breaking anything. I moved every product from the old package to the new one without changing how cookies behaved on live sites.
- Agreement across Privacy, Retail, Base, and Security. Shipping needed all four to sign off. I got them to agree so we could ship one solution every team trusted.
A lot of the work was writing. I wrote the package architecture doc, the design signoff, the operational runbook, and the case for keeping consent out of the mobile app.
Impact
Every visitor to coinbase.com loads the consent system, and it runs on every other Coinbase website too. Whatever someone chooses is honored on all of them.
Where to see it
Go to any of the domains above and look at the bottom right. The banner you see was built by me and my colleague Abhishek Somani. There are a lot of details around security and privacy that I can’t discuss here.