Consentl on Squarespace

Add Consentl with Squarespace code injection, move Google Analytics out of the built-in integration, turn off Squarespace's cookie banner and see what runs first.

Loader first in <head>: No — read the limitations

Can the loader be first in <head>? No. Squarespace outputs the Header code injection after its own head content (site context, bundles, Squarespace analytics).

Requirements

Code injection is available on the Core, Plus and Advanced plans (and some legacy Business / Commerce plans), not on Basic (formerly Personal).
Your Consentl site key, on your site's Setup page in the dashboard. Add the site's hostname in the Domains field; www. and the bare domain count as the same site, so there is no need to add www. separately.

What your Consentl plan covers

Free: banner, consent log and manual blocking only.
Pro: adds Google Consent Mode v2.
Business: adds automatic blocking of known trackers and the blocking rules you add in the dashboard.

On Free and Pro, only tags you mark manually are held back.

Install

Open the Code Injection panel. The fastest way is to search "Code injection" in the dashboard search. Depending on your dashboard version it is under Website → Pages → Custom Code → Code Injection, Settings → Developer tools → Code injection, or Settings → Advanced → Code Injection.
In Header, paste the loader as the first line:
```
<script src="https://api.consentl.com/v1/loader.js?k=SITE_KEY&l=en"></script>
```
If the site also uses the Consentl GTM template, add &gcm=ext to the URL so that only the template sends Consent Mode commands.
Click Save.
Move Google Analytics out of Squarespace's built-in integration: remove the measurement ID from Settings → Developer tools → External API keys (Google Analytics), and add GA (gtag.js) or GTM in the Header code injection below the Consentl line instead. Squarespace's own cookie banner gates its built-in Google Analytics integration and YouTube embeds. Once that banner is off (next step), Squarespace no longer waits for consent, and Consentl cannot hold a tag that Squarespace injects before it.
Switch off Squarespace's own banner in the Cookies & Data Privacy panel (/settings/website/cookies): Cookie banner → off. Only one consent banner may be active. Then decide Non-essential cookies: Restrict:
- Off: a built-in GA integration you did not remove runs before any consent.
- On: Squarespace's built-in GA and its own analytics cookies never run, even after the visitor accepts in Consentl (Squarespace: visitors "won't be able to opt in").
- With GA moved to code injection (step 4), Restrict no longer affects GA; turn it on only if you want Squarespace's own non-essential cookies off for everyone.
Check YouTube embeds in Squarespace video blocks. If they load before consent, replace them with a Code block that Consentl holds:
```
<iframe data-consentl="marketing" data-src="https://www.youtube-nocookie.com/embed/ID" title="Video"></iframe>
```
Optional: add a footer link with the URL #consentl, labelled "Cookie settings". Links whose URL ends in #consentl or #consentl-preferences, and any element with the attribute data-consentl-open, open the preferences.
Optional: on your cookie policy page, add a Code block with the declaration:
```
<div data-consentl-declaration data-api="https://api.consentl.com" data-key="SITE_KEY" data-locale="en"></div>
<script src="https://api.consentl.com/v1/blocks.js" defer></script>
```
Use data-consentl-request or data-consentl-withdrawal instead for the privacy request form or the EU withdrawal form. The withdrawal form needs the Pro plan or higher and must be switched on in the dashboard; otherwise it stays empty.

Check that it works

Open the site in a private window. Code injection also runs in the editor preview; if a script misbehaves there, use Disable Scripts in Preview or add /safe to the editor address.

The visitor's region comes from their IP address: Consentl looks up the country in memory on each page view (nothing is stored) and applies your dashboard rule for it. US states are not told apart: US visitors get your rule for the whole US or, without one, your first US-state rule. An unknown country gets your rule for unknown regions (opt-in by default).

Per-page code and languages

Page-specific code: page Settings → Advanced → Page Header Code Injection. It is added in addition to the site-wide Header. Do not put the loader there: keep one loader, with the same URL, on every page.
Squarespace has no native multilingual sites. Leave out &l= to use the dashboard's default language.

Limitations

Not first in head. Squarespace's own scripts, including Squarespace Analytics, load before Consentl and cannot be blocked by it. Restrict them with Squarespace's "Non-essential cookies" setting if needed (see step 5 for the effect on the built-in GA). Third-party tags loaded by code below the Consentl line, or in blocks, are held back when they are recognised trackers (Business plan and higher); on Free and Pro, only tags you mark manually are held.
Hard-coded tags. A <script src>, <img> pixel or <iframe> written in code injection or a Code block is fetched by the browser before any script can stop it, even when Consentl prevents it from running. Mark such tags manually and remove <noscript> pixels:
```
<script type="text/plain" data-consentl="marketing" src="https://ads.example.com/tag.js"></script>
<iframe data-consentl="marketing" data-src="https://www.youtube-nocookie.com/embed/ID" title="Video"></iframe>
<img data-consentl="marketing" data-src="https://tracker.example.com/pixel.gif" alt="" width="1" height="1">
```
Tags loaded by code (GTM, a pixel's JavaScript loader) are held without a request when automatic blocking is on.
Checkout pages do not support custom code; the banner does not appear inside checkout. Only the Order Confirmation and Order Status page fields exist.
Version 7.0 templates with AJAX loading may not run code again on in-site navigation. That is fine for the loader, which stays loaded; client-side navigation does not lose the banner.

Stuck? Write to [email protected] — we answer in English on business days.