Docs

Add cookie consent

Add cookie consent

Analytics and ad tags (Google Analytics, Google Ads, Meta Pixel, TikTok, LinkedIn, Hotjar …) store cookies and send visitor data to third parties. In the EU, the ePrivacy rules and the GDPR mean that, as a rule, they may only run after the visitor agrees. A site that loads them straight away is the most common finding in cookie complaints, and since March 2024 Google also expects Consent Mode v2 for ads measurement and remarketing for visitors from the EU.

The site checklist flags a page that loads tracking codes without a consent banner (a CMP, consent management platform) or Google Consent Mode. This guide covers the technical setup. Which tags need consent and how the banner must be worded is a legal question for your privacy policy, not something a checklist can decide.

What the checklist looks for

Result Meaning
OK The page's HTML loads a known consent banner (Cookiebot, CookieYes, OneTrust, Usercentrics, Complianz, Borlabs Cookie, iubenda, CookieFirst, Didomi and others) or sets a Consent Mode default with gtag('consent', 'default', …).
Unknown Neither is in the HTML, but the page loads Google Tag Manager. The banner may load from there; open the Tracking tab to see what the container holds.
Warning Tracking codes are on the page, and there is no banner and no Consent Mode.
Not applicable No tracking codes were found.

The banner is recognised by its provider's script address. A banner built into a theme or a site builder, or written by hand, may work and still not be recognised: check it in the browser as described below.

Check it yourself

Look for a consent script or a Consent Mode default in the page. Replace example.com with your site:

curl -s https://example.com | grep -ioE "cookiebot|cookieyes|cookielaw|usercentrics|complianz|borlabs|iubenda|gtag\(\s*.consent.\s*,\s*.default." | sort -u

Any line of output means the setup is visible in the HTML. Then check the part that matters, in a private browser window:

  1. Open the site and do not click the banner yet. Open the developer tools (F12) → Network.
  2. Reload. Filter by collect, facebook, tiktok or linkedin. Before you accept, there should be no ad pixel requests. With Consent Mode, Google tags may still send cookieless requests: a gcs=G100 parameter in a collect request means storage is denied, which is what you want.
  3. In Application → Cookies (Chrome) or Storage → Cookies (Firefox), there should be no _ga, _gcl_au or _fbp before you accept.
  4. Accept, and watch the tags start.

How to fix

There are two parts, and you usually need both:

  • A consent banner (CMP) that asks the visitor and remembers the answer. Certified CMPs (Google's list of certified partners includes Cookiebot, CookieYes, Usercentrics, OneTrust, iubenda and Complianz) also send the answer on to Google.
  • Consent Mode v2, which tells Google tags to start in a "denied" state and wait for the banner. It does not replace the banner: something still has to ask.

Most CMPs set up Consent Mode for you. Pick what fits the site.

WordPress

Install a consent plugin and let it handle the banner, script blocking and Consent Mode:

  • Complianz – GDPR/CCPA Cookie Consent: free, runs a setup wizard, scans the site for cookies and blocks known scripts until consent.
  • CookieYes and Cookiebot: free plugins for their hosted services (free plans have page or traffic limits).
  • Borlabs Cookie: paid, popular in German-speaking countries.

After the wizard, turn on the plugin's Google Consent Mode option if it has one, and check that your tags are registered through it. A tag pasted straight into the theme or a header-and-footer plugin can bypass the blocking.

If your tags come from Google Tag Manager, either let the plugin load the GTM container, or load the CMP inside GTM as described under Through Google Tag Manager below. Do not do both.

Clear the page cache afterwards (WP Rocket, LiteSpeed Cache, your host's cache), or the old page without the banner keeps being served.

Static HTML

Put the Consent Mode default first in <head>, before Google Tag Manager or gtag.js, then the CMP script your provider gives you, then your tags:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'wait_for_update': 500
  });
</script>
<!-- Then the CMP script from your provider, then GTM or gtag.js. -->

ad_user_data and ad_personalization are the two signals added in v2. wait_for_update gives the banner half a second to report a returning visitor's earlier choice before tags fire.

Tags that are not from Google (Meta Pixel, TikTok, Hotjar) ignore Consent Mode. Let the CMP block them: most providers do this when you change the tag's <script> to type="text/plain" with an attribute they name in their docs.

Node.js and Next.js

In Next.js, load the Consent Mode default and the CMP before any tag. With the App Router, in app/layout.js:

import Script from 'next/script';

export default function RootLayout({ children }) {
    return (
        <html lang="en">
            <body>
                <Script id="consent-default" strategy="beforeInteractive">{`
                    window.dataLayer = window.dataLayer || [];
                    function gtag(){dataLayer.push(arguments);}
                    gtag('consent', 'default', {
                        ad_storage: 'denied', ad_user_data: 'denied',
                        ad_personalization: 'denied', analytics_storage: 'denied',
                        wait_for_update: 500
                    });
                `}</Script>
                {/* Then the CMP script from your provider, also beforeInteractive. */}
                {children}
            </body>
        </html>
    );
}

beforeInteractive puts the script into the server-rendered HTML, so the checklist can see it. Load Google Tag Manager or gtag.js after it, for example with @next/third-parties.

Shopify

Shopify has its own banner: Settings → Customer privacy → Cookie banner. Turn it on for the regions you sell to. Shopify's own analytics and apps that use the Customer Privacy API respect the choice, and the Google & YouTube app passes it to Google as Consent Mode.

Code you pasted into the theme by hand (theme.liquid) does not wait for that banner. Move tags into apps or Customer events pixels, or use a CMP app from the Shopify App Store (Cookiebot, CookieYes, Consentmo and others) that blocks them.

The checklist may not recognise Shopify's built-in banner. Check it in the browser as described above.

Wix

Wix has a built-in cookie banner: in the site's dashboard open Settings and the cookie banner settings. When it is on, tags added through Marketing integrations (Google Analytics, Google Ads, Meta Pixel) wait for consent and Wix sets Google Consent Mode for them.

Code added under Settings → Custom code has a category setting: mark analytics and ad code as Analytics or Advertising, not Essential, or it runs before consent.

Webflow

Webflow has no full consent banner built in. Add a CMP, either from the Webflow Apps marketplace or by pasting your provider's script into Site settings → Custom code → Head code, above the Google tags. Put the Consent Mode default (see the Static HTML tab) at the very top of the same field. Publish the site afterwards: custom code only goes live on publish.

Squarespace

Squarespace has a cookie banner under Settings → Cookies & visitor data (on newer sites Settings → Privacy & security). Turn on Cookie banner and choose the opt-in type, so visitors have to accept.

The banner covers Squarespace's own analytics. Code you added through Code injection is not blocked by it. For third-party tags, use a CMP script in Code injection → Header instead, with the Consent Mode default from the Static HTML tab at the top.

Through Google Tag Manager

If your tags are in Google Tag Manager, the CMP can be loaded there too:

  1. In GTM, open Admin → Container settings and turn on Enable consent overview if it is not on yet.
  2. Tags → New → Tag configuration → Discover more tag types in the Community Template Gallery and add your CMP's template (Cookiebot, CookieYes, Usercentrics, iubenda and others publish one). Set the Consent Mode defaults to Denied in the template.
  3. Trigger it with Consent Initialization – All Pages. That trigger runs before every other one.
  4. In the consent overview (the shield icon on the Tags page), check that every Google tag has built-in consent checks and every other tag requires ad_storage or analytics_storage.
  5. Preview, test, then Submit.

In this setup the banner is not in the page's HTML, so the checklist shows Unknown rather than OK. That is expected: the Tracking tab lists what the GTM container holds, and the browser test above confirms it works.

Pitfalls

  • Cookieless analytics. Plausible, Fathom and Umami set no cookies and are often run without a banner. The checklist still lists them as tracking codes, because it cannot judge your legal basis. If they are your only tags and your privacy review agrees, you can leave this item as it is.
  • Two banners. A plugin banner and a host's or theme's banner at the same time confuse visitors and may record different answers. Keep one.
  • Tags outside the CMP. A tag pasted into the footer, a theme option or a second GTM container runs regardless of the banner.

Confirm the fix

Run the curl command and the browser test from Check it yourself again, then open the target in PulseKeeper and click Check now on the Checklist tab. The item turns OK within a few minutes instead of at the next daily run. The Tracking tab shows the consent banner and Consent Mode next to your other codes.