blitzkeks
DE Dashboard →
⚡ European-sovereign consent

Cookies. Sorted.

A German product, made in Nuremberg, sold across Europe.

Consent banner from Nuremberg. Under fifty milliseconds from EU-PoP to the visitor's browser. Every byte stays in Europe.

Open dashboard → How fast, exactly?
p95 TTFB
40 ms
EU-PoPs
36
US Subprocessors
0
Bundle gzipped
17 KB
Speed

Established CMPs take a full second.
We take under fifty milliseconds.

Vanilla TypeScript, 17 KB gzipped, cached across 36 EU-PoPs. No framework overhead, no global-CDN detour. Your Lighthouse score is going to thank you.

p95 TTFB · loader ms · lower is better
US CMP 1
443 ms
US CMP 2
260 ms
EU CMP 1
200 ms
EU CMP 2
160 ms
Blitzkeks
40 ms
Bundle size · gzipped KB · lower is better
US CMP 1
144 KB
US CMP 2
420 KB
EU CMP 1
185 KB
EU CMP 2
148 KB
Blitzkeks
17 KB

Median p95 TTFB on /cmp/v1/loader.js from Frankfurt; bundle sizes from the network panel of each vendor's live demo. Measured April 2026, same region, same browser, no cache.

Sovereignty

Sovereign means: it stays in Europe.

Origin in Nuremberg, edge cache on 36 EU-PoPs, every byte of visitor data stays inside the EU legal perimeter. No transatlantic data trip, no third-country clauses in the GDPR documentation. A European product with a European backbone.

Visitor data path

Everything touching visitor data lives in the EU.

  • Nuremberg, DE Origin + Postgres
    Netcup · CNPG encrypted-at-rest
  • 36 EU PoPs Edge cache
    Bunny (SI) · EU-only routing
  • Slovenia, SI Backup storage
    Bunny Storage · 30-day retention
  • Luxembourg, LU GeoIP lookup
    db-ip.com MMDB · CC-BY-4.0
Tooling plane · publicly disclosed

Three US tools, outside the path.

Honest instead of dogmatic: these are tools we use, not subprocessors that see visitor data. All documented, all swappable — Pulumi Cloud (IaC state), GitHub (source + ghcr), Let's Encrypt (TLS certs).

Full subprocessor list ↗
Capabilities

Everything you expect from a CMP.
Plus the bits others leave out.

  • Standards

    IAB TCF v2.2 + Google CMv2

    Full Tech Lab spec, Consent Mode v2 out of the box. No tag-manager heroics required.

  • Catalog

    GVL v155 · hourly sync

    998 IAB vendors, nightly sync. When IAB Europe publishes a new GVL version, your banner catches up within an hour.

  • Scale

    Multi-site dashboard

    One account, any number of domains. Sites list, filtering, per-site analytics, bulk config.

  • Access

    WCAG 2.2 AA · keyboard-first

    Tab-reachable, screen-reader sound, respects prefers-reduced-motion. Contrast validated before you can save.

Pricing

Private free. Commercial free for now, too.

If you run Blitzkeks on a personal blog, association or non-profit site: free. If you deploy it commercially: currently free during the trial phase — pricing is coming, we'll write you 30 days in advance. Questions: hallo@blitzkeks.de.

Free
Hobby · Association · NPO

Private

€0 no credit card
  • ✓Unlimited sites
  • ✓Unlimited impressions
  • ✓All customizer features
  • ✓IAB TCF v2.2 + Google CMv2
  • ✓DPA template · Art. 28 GDPR
  • ✓Email support · 48h
Open dashboard →
Trial phase · pricing coming

Commercial

€0 · for now until pricing launches
  • ✓Everything from Private
  • ✓Commercial use explicitly permitted
  • ✓Priority support · 24h
  • ✓30 days of written notice before pricing lands
  • ✓Early-bird terms or 12-month grandfathering
  • ✓SLA conversation on request
Start free →

When in doubt: commercial. It's free during the trial anyway — zero risk.

Questions

Answers, no marketing padding.

Missing one? hallo@blitzkeks.de.

  • Compliance Is Blitzkeks TCF v2.2 conformant? +

    Fully. Encoder in the banner uses @iabtechlab/iabtcf-core (Apache-2.0), decoder on the Go origin uses LiveRamp/iabconsent (MIT). GVL v155 hourly sync. Google Consent Mode v2 signals baked in. IAB CMP-ID registration in flight (placeholder 3999 until final).

  • Sovereignty Does any visitor data ever leave the EU? +

    Never. Origin + Postgres + backups in Nuremberg (DE). Edge cache on 36 Bunny EU-PoPs with EU-only routing. Three US vendors (Pulumi Cloud for IaC state, GitHub for source, Let's Encrypt for TLS) sit on the tooling plane — they hold metadata, not visitor data. Documented in the public subprocessor list.

  • Pricing What does this actually cost? +

    Private and non-commercial use (hobby, association, non-profit, school, personal blog): free, no credit card. Commercial use: also free for now — Blitzkeks is in its trial phase and no price list is published yet. When pricing lands (Phase 6) you get 30 days of written notice and fair early-bird terms or 12 months of grandfathering. Questions: hallo@blitzkeks.de.

Behind Blitzkeks

A solo developer from Frankfurt, tired of established CMPs.

Started because an established US CMP was adding 1,200 ms TTFB to a private site — a third of the Lighthouse budget for a few hundred bytes of JSON. There had to be a better way.

Blitzkeks is an attempt to think of consent as a fast, European product. No US backbone, no VC-driven feature bloat, no cookie pop-ups begging for acceptance.

Everything is free to use right now — private and commercial both during the trial phase, before pricing lands. 30 days of written notice before anything changes.

Built in Go (origin), vanilla TypeScript (banner), Next.js (dashboard), Astro (this site). Source on GitHub. If you can't live with a human building this, an established enterprise CMP is probably the right answer — no shame.

Deutsche Version →