The deadline passed with little fanfare. In late February, the Interactive Advertising Bureau's mandatory migration to TCF v2.3—a technical specification governing how websites obtain user consent—reached its cutoff date. For publishers and engineering teams still running outdated consent infrastructure, the scramble was real. California had already flipped the switch on new Global Privacy Control display requirements in January 2026. And suddenly, the regulatory calendar looked a lot less theoretical.
Enter Inth, a London-based startup barely three people strong, fresh from Y Combinator's spring cohort and convinced that privacy compliance tooling has been fundamentally misbuilt. Founder Christopher Burns believes that the consent management platforms that dominated the 2010s—the OneTrusts and Osanos of the world—are relics. Too slow, too enterprise-y, too much friction. What if, he wondered, privacy infrastructure looked more like developer tooling?
It's an audacious pitch for a company that rebranded just weeks ago.
Burns announced the shift from Consent.io to Inth on April 13, positioning his operation not as another consent widget vendor but as what he calls "compliance automation infrastructure." Everything, he emphasized, would be anchored by open-source cores. Two days later, Inth shipped c15t 2.0—a complete ground-up rewrite of its consent framework. Then came an open-source DSAR SDK on April 16. The company dubbed the sprint "Relay," and the timing wasn't accidental. Teams had just crossed the TCF threshold; many were discovering their current tools couldn't keep up.
Whether Inth can deliver on that promise is the more interesting question.
Speed as Strategy
The c15t 2.0 release represents what Inth describes as a fundamental rearchitecture, though the company's own benchmarks require some scrutiny. Based on its own benchmarks, Inth claims the new framework runs with 59-millisecond load speeds and delivers bundles roughly 60% smaller on edge runtimes compared to its predecessor. Those figures tie back to CookieBench, an independent performance leaderboard that Burns himself created—a detail that complicates the "independent" characterization, even if the benchmarks appear methodologically sound.
Still, performance matters in this category for reasons that extend beyond user experience. Slow consent banners degrade Core Web Vitals, Google's page speed metrics that now factor into search rankings. As algorithm updates have made site speed a competitive liability, developers have grown increasingly allergic to heavyweight third-party scripts. Roboto Studio, a digital agency that reviewed c15t in late March, cited the framework's benchmarks as a primary adoption driver—though without deeper customer validation, it's hard to know how widespread that sentiment runs.
Under the hood, c15t 2.0 operates on what Inth calls a "policy-driven consent model." Developers define region-specific behavior through preconfigured rulesets—policy packs, in the company's terminology—that map jurisdiction requirements to consent logic. The framework includes IAB TCF v2.3 support (a $100 monthly add-on), a network-level script blocker, token-based styling for faster customization, and rebuilt DevTools. Inth relicensed the entire framework to Apache 2.0, removing licensing friction for commercial use.
It's a design philosophy borrowed more from infrastructure projects like Supabase than from traditional enterprise SaaS.
DSARs, Automated
Alongside the consent framework, Inth launched an alpha-stage toolkit for handling data subject access requests programmatically. The DSAR SDK—released mid-April under an Apache 2.0 license—provides a CLI, Node SDK, and OpenAPI surface for orchestrating user data requests across internal systems. The pitch is straightforward: GDPR, CCPA, and regional laws like Québec's Law 25 impose strict timelines and documentation requirements on businesses handling personal data, yet many engineering teams still manage DSARs manually or patch together internal scripts that lack audit trails.
Inth's approach treats compliance workflows as infrastructure problems rather than legal forms.
The SDK ships with what the company describes as a "legal clock" to track compliance deadlines, jurisdiction-specific policy packs, and end-to-end state machines for managing request lifecycles. Documentation shows integration options ranging from managed hosting to self-hosted and offline modes, aimed at teams needing programmatic control over how they fulfill erasure, portability, and access requests. Inth teased a managed DSAR service at the end of launch week but hasn't released pricing or availability—leaving early adopters to work with alpha-stage tooling and little visibility into the commercial roadmap.
Perhaps that's intentional. The company appears to be building in public, open-sourcing aggressively while figuring out where the managed services layer makes sense. Or perhaps it's a function of team size. Three people can only ship so fast.
Regulation as Tailwind
The IAB's TCF v2.3 transition created urgency Inth clearly capitalized on. The specification—released in mid-2025—became mandatory for IAB-registered vendors around late February and early March, forcing publishers to upgrade consent tooling or risk non-compliance. Inth's TCF support arrived in c15t 2.0 just as the deadline passed, offering a migration path for teams still running outdated implementations. Good timing, or strategic product planning? Likely both.
California's regulations added another wrinkle. The CPPA's final rules, effective at the start of 2026, require businesses to display whether an opt-out preference signal like Global Privacy Control was honored—a small but specific UI obligation that many CMPs struggled to implement cleanly. Inth's policy packs include preconfigured GPC handling, along with support for GDPR, UK GDPR, CCPA, ePrivacy, and Québec Law 25.
The company frames its jurisdiction-aware architecture as a hedge against future regulatory expansion. As U.S. states continue adopting privacy laws—Virginia, Colorado, Connecticut, and others have statutes now in effect—developers need systems that can adapt without requiring full rewrites. Inth's policy pack model attempts to decouple consent logic from presentation code, though whether that abstraction holds as privacy laws proliferate remains untested.
Developer Economics
Inth's pricing structure splits between free and paid tiers, metered on consent saves and sessions. The free plan includes 5,000 consent saves plus 5,000 sessions monthly; Starter ($20/month) bumps that to 25,000; Pro ($50/month) covers 100,000. Overage runs a tenth of a cent per request. Enterprise pricing requires direct contact. The IAB TCF add-on costs $100 monthly per project; custom policy packs—which include internationalization—run another $100.
For context, legacy enterprise consent platforms often price on a per-pageview or per-domain basis, with contracts starting in the thousands annually. Inth's developer-oriented model targets startups and mid-market teams that need compliance infrastructure without enterprise sales cycles—though it also means the company likely needs volume to make unit economics work.
The company claims adoption among "devtool companies, luxury hotels & gyms, and world-class dev agencies," and its homepage displays logos from Vercel, Expo, Zed, Infisical, Unkey, and others. Those logos appear as marketing claims; without independent confirmation, it's unclear whether they represent active customers, pilot users, or something more informal.
The Founder's Previous Act
Christopher Burns, Inth's founder, previously built Everfund, a charity fundraising developer platform that shut down late last year. He launched Consent.io in February of last year and created both c15t and CookieBench—the performance leaderboard the company frequently cites. Burns discussed the early vision for c15t in a January podcast on Scaling DevTools, framing consent infrastructure as much a performance problem as a legal one.
That framing makes sense given his trajectory. Everfund's shutdown suggests Burns understands product-market fit isn't guaranteed, even with developer-friendly tooling. Whether Inth finds traction may depend less on technical execution—which appears solid, if early—and more on whether the market is ready to rethink privacy infrastructure as open-source-first.
YC lists Inth's team size at three, with Andrew Miklas as the primary partner. CB Insights shows a $500,000 convertible note round from recent months, with Y Combinator listed as an investor. The company hasn't confirmed funding details publicly, and location references vary—YC and the Inth website cite London, while CB Insights lists a San Francisco address. Standard startup ambiguity.
What's Next—and What's Missing
Inth's launch week introduced a roadmap extending beyond consent management. The teased "Managed DSAR" service suggests the company plans to build a full privacy operations platform, competing not just with consent tools but with broader privacy management vendors like Transcend, Ethyca, and Ketch. Those companies offer DSAR orchestration, data mapping, and governance workflows—capabilities that often require months of enterprise implementation and dedicated customer success teams.
Whether Inth can compress that complexity into developer-friendly APIs remains an open question. The DSAR SDK, as of mid-April, had six GitHub stars—hardly a groundswell. The managed service lacks public pricing or availability. And the company's positioning—open-source infrastructure meets managed services—requires balancing community contributions with commercial viability, a tension that has tripped up plenty of infrastructure startups before.
But the product direction is clear: treat privacy compliance as infrastructure, make it fast, and let developers control the implementation. For engineering teams staring down the regulatory calendar, that proposition may be timely enough to gain traction. Or it may be another well-intentioned developer tool that solves an important problem for a market segment too small to sustain a business.
Time will tell. For now, Inth is shipping code, open-sourcing aggressively, and betting that the consent management status quo is brittle enough to crack.
