Consent-Gated Customer Reviews on Abinod.de

The objective

A consent banner should change website behavior, not just disappear. On the German business website www.abinod.de, the optional VeriNodo customer-review embed should remain unloaded until marketing consent is granted. Visitors should be able to revisit their decision and have that decision recorded.

Integration: three components, one explicit boundary

Abinod.de hosts the review section. PureConsent manages choices and activates explicitly tagged scripts. The local testimonials loader then requests VeriNodo’s external widget. Marketing is the category chosen for this embed; that label does not mean the integration was found to perform advertising tracking.

We installed the banner on 16 public pages, verified the exact www.abinod.de origin through DNS, and disabled the previous banner’s initialization while retaining its implementation and styles for rollback. Old banner cookies were not treated as PureConsent permissions. The .com site was outside this rollout.

<!-- Use your own verified website ID -->
<script src="https://com.pureconsent.de/consent.js"
  data-site="YOUR-SITE-ID" defer></script>

<!-- Replaces the active testimonials script -->
<script type="text/plain" data-consent="marketing"
  data-src="/assets/testimonials.js"></script>

Replacing the active tag matters: a banner cannot stop an ordinary script tag that has already executed. The marked local loader is the entry point to the external service. Navigation, the contact form and other essential site functions remain available.

What was verified

Browser storage and network evidence

The supplied DevTools captures show a site-specific localStorage entry containing a pseudonymous consent ID, notice version, expiry, category choices and pending receipt state. After rejection, necessary was true and analytics and marketing were false. Browser preferences last up to 180 days; the configured server record retention for this site was 30 days. These are separate lifetimes.

// Simplified, anonymized illustration — not a raw visitor record
{
  "consentId": "REDACTED",
  "version": 3,
  "choices": { "necessary": true, "analytics": false, "marketing": false },
  "pending": null
}

The installation checks found no VeriNodo script before consent or after rejection, one after acceptance, and none after withdrawal and reload. The supplied network capture also shows PureConsent configuration and impression traffic. An impression is quota accounting, separate from optional analytics consent. A single screenshot is not a complete request trace; it cannot prove that all third-party connections are absent.

The capture includes browser-extension activity and font requests. Those must be attributed to their actual initiators, not automatically to PureConsent. Reproduce network checks in a clean browser profile. The empty cookie table does not imply that localStorage is absent or that hosting providers never process IP addresses.

Consent ledger and CSV export

Production dashboard captures show accept, reject, custom and withdraw events with category choices, German language and notice version 3. The provided CSV capture shows those event types in the downloaded file. The following is an anonymized summary of observed states, not a reproduced record sequence. Identifiers and exact timestamps are omitted.

id,siteId,createdAt,action,version,language,analytics,marketing

These are the inspected CSV columns. There are no IP-address or browsing-history columns. Consent payloads are encrypted in application storage; the downloaded CSV is readable plaintext, not an encrypted export. Treat exported files as sensitive operational data. Browser-submitted events do not independently verify a person’s identity, and these test events are not customer conversion statistics.

Reproduce the checks on your own site

1. Verify the exact origin, install once per page and replace every active optional loader, including duplicates in tag managers.
2. Use a clean profile. Inspect network requests and storage before any choice, then reject and confirm the optional provider remains unloaded.
3. Allow only the relevant category. Check its loader and requests, reopen settings, revoke it and inspect the new page after reload.
4. Refresh the consent ledger, compare actions and notice versions, and inspect the CSV. Test unavailable storage, failed receipt delivery and provider-specific cleanup separately.

Scope and implementation references

This case study establishes an explicit consent boundary for one review integration. It is not a site-wide privacy audit, a performance benchmark, an EU-only hosting guarantee or a compliance certification. Actual scripts, notices, infrastructure logs, provider arrangements and cleanup behavior still require deployment-specific review.

• Abinod.de installation commit
• Widget activation and withdrawal implementation
• Script gating and withdrawal guide
• Storage and retention details

The screenshots were supplied from the production test session on 26 October 2026. Only an identifier-free public-site capture is published here. Authenticated dashboards, raw storage identifiers and raw CSV rows are intentionally excluded.