A consent banner loads before many visitors see the product, which makes it part of perceived performance. Benchmarks cited by c15t's ecosystem reported 30 ms LCP for c15t and 491 ms for OneTrust, with bundles of 0.6 KB and 1.1 KB respectively. Those numbers should be reproduced on the target site, but they expose a category teams often exclude from performance work.
c15t is open source and headless. The application controls the interface while integrations cover React, Next.js, Vue, Svelte, Astro, GTM, PostHog, and advertising pixels. It supports SSR, strict opt-in, geolocation, audit logs, and internationalization, and runs under GPL-3.0 on the team's own domain.
The comparison has a hard boundary. OneTrust is a privacy-governance suite with legal review, cookie scanning, compliance reporting, and support. A lightweight consent layer does not automatically replace those services. It competes when the actual requirement is controllable consent orchestration without a large third-party runtime.
Measure the banner in the same test as the rest of LCP
The 30 ms for c15t and 491 ms for OneTrust come from CookieBench. They show that the consent script sits on the LCP path. They do not close the decision by themselves. The number that matters is the one on your site, on a first visit, with a cold cache, in the geography where traffic actually arrives.
In that slice the banner competes with the hero, fonts, and whatever marketing already put in the <head>. If the team already works with a mobile LCP cap, the CMP has to fit inside it. Measuring only an authenticated home, or only a visit that already accepted cookies, hides the spike: it happens for the new visitor.
Beyond LCP, look at request origins, the extra TLS handshake, main-thread JavaScript bytes, and INP on the dialog itself. c15t ships as a package in the application bundle. OneTrust, in the cited benchmark, arrives as a third-party runtime. The operational gap is there: one goes through your build, the other opens a new connection before content.
Repeat the test after every GTM change. Teams that trim KB in the app and leave the tag container loose lose the gain the following week. Field data (CrUX or RUM) confirms the lab; the lab alone dresses a slide.
Who keeps the record after the script leaves the CDN
Pulling the CMP off a third-party domain moves where the proof lives. c15t can run on your domain, with audit logging and geo-detection. That helps. It also pulls the question in-house: where the record lives, for how long, who queries it after an incident, which policy version was in force at that click.
Storing the choice only in the browser covers previews and static sites. It does not, by itself, answer a request for evidence of a specific user's opt-in months later. If the team needs that trail, it needs its own backend, c15t hosted, or another system of record. That choice is about data, not banner CSS.
A headless UI helps the design system. It does not write the policy. Someone still drafts the categories (necessary, analytics, marketing), the copy, the under-age behavior, and what happens on refusal. Without that, the component matches the layout and the site still fires the pixel.
Name an owner for policy, one for implementation, and one for audit. If all three are "frontend", the record will rot in localStorage until the first enterprise questionnaire.
Pixels and GTM load only after the choice
The repository lists GTM, PostHog, Meta Pixel, TikTok, and LinkedIn integrations. That value appears only if loading is actually gated. A GTM container with All Pages tags ignores the banner, whatever the library.
The rule is dull to audit: no measurement or ads script loads before explicit opt-in, in the GDPR slice the product adopted. That includes the "just a test" tag, third-party chat, and heatmaps. Review has to look at the initial HTML, GTM, and the client imports that pull SDKs.
If marketing depends on Consent Mode v2, the CMP swap has to keep default denied signals and the update after the choice. Otherwise performance improves and attribution breaks. Or attribution continues and opt-in becomes theatre.
Tree-shaking and TypeScript shrink the bundle surface. The tag inventory still belongs in a table with origin, consent category, and owner. Without an owner, the tag returns. SSR in c15t avoids a banner flash without state; it does not stop an orphan useEffect from importing the pixel.
The privacy suite covers work the banner does not do
OneTrust, in market practice, is a governance platform: legal review, cookie scanning, reports, support. c15t does not promise that package. If legal already runs on those reports, removing the suite because LCP is high opens a hole the next day.
The pieces can split. Banner and orchestration on the frontend; scanning and vendor lists in another tool; DSRs and contracts where they already live. Performance, proof of consent, and a legal opinion are three costs. c15t competes on the first and, with a backend, on the second. On the third, only if the internal team absorbs the work.
Before npm install, legal reads the repository license and the DPO describes what counts as sufficient proof. Without that conversation, engineering optimizes milliseconds and compliance learns about the swap next quarter, on top of a customer questionnaire.
A criterion for leaving the third-party script this quarter
The swap enters the sprint when four things coincide: RUM or CrUX shows poor LCP on first visit; frontend already owns the <head>; legal accepts records in the application stack; someone owns the tag inventory. If the third is missing, the team gains milliseconds and loses the compliance story.
Start with one site, not all of them. Compare a week of field data before and after, on the same traffic channel. If first-visit LCP does not move, the CMP may not have been the villain. If it moves and pixels still fire without opt-in, the swap was cosmetic.
GitHub stars and a March 2026 release say the project is active. They do not say support will meet your DPO on an incident deadline. The performance budget and the legal-risk budget belong in the same meeting. Without that, each group optimizes its own metric and the banner remains the script nobody questions.
If your company is weighing something similar, reach me on LinkedIn or WhatsApp.
