Cookie Consent for
Squarespace That
Blocks Real Scripts.
Squarespace's built-in Cookie Banner shows a notice and can defer Squarespace's own analytics — but it does not block the GA4, Meta Pixel, Hotjar, and GTM scripts you add through Code Injection. Those fire on every page regardless of what your visitor chose. ConsentPixel — Privacy · Verified blocks every registered script with one code injection, on any Squarespace plan.
The Gap in Squarespace's Built-In Cookie Banner
Squarespace includes a Cookie Banner in its Analytics & SEO settings, and on higher plans it can defer Squarespace's own cookies and the Squarespace-managed Google Analytics connection until a visitor accepts. For a closed, hosted platform this is a reasonable baseline.
The problem is that most tracking on a real Squarespace site is added through Code Injection — the header, footer, and per-page code fields where you paste a GTM container, a Meta Pixel, a Hotjar snippet, or an email-marketing tag. Squarespace's Cookie Banner does not block code you inject. Those scripts fire on page load regardless of the banner.
Squarespace's banner can defer Squarespace-native cookies and the built-in Google Analytics integration. It has no control over scripts added via Code Injection, which is where almost all marketing and advertising tags on a Squarespace site actually live.
A visitor can dismiss the banner, decline cookies, and still have a Code-Injection GA4, Meta Pixel, and Hotjar transmitting data — because the banner never had a hook into those scripts.
✗ Code-Injection GTM still fires
A GTM container in your header Code Injection initialises and fires all tags regardless of the visitor's banner choice.
✗ Meta Pixel still fires
A Meta Pixel pasted into header or footer Code Injection executes on load — the Cookie Banner cannot hold it.
✗ Hotjar / Clarity still fire
Session-replay snippets in Code Injection run before consent — $5,000/visitor CIPA exposure for California traffic.
✗ No GCM v2 / GPC handling
Squarespace's banner does not set Google Consent Mode v2 parameters or detect the Global Privacy Control browser signal.
The Cookie Banner is also gated by plan: full deferral behaviour is not available on every Squarespace tier, and even where it is, it never extends to injected code. For any Squarespace site running a marketing stack, the injected scripts — the ones regulators focus on — are left firing before consent.
Trackers Commonly Running on Squarespace Sites
Squarespace's audience is heavy on small businesses, creators, photographers, and service providers — who typically add analytics and marketing pixels through Code Injection. These are the most common integrations and the privacy exposure each creates.
Squarespace Cookie Banner vs. ConsentPixel
The native Cookie Banner and ConsentPixel address different layers. The banner manages Squarespace-native cookies; ConsentPixel blocks the injected external scripts the banner cannot reach.
| Capability | Squarespace Cookie Banner | ConsentPixel |
|---|---|---|
| Blocks external JS before consent | ✗ Not supported | ✓ All registered scripts |
| Blocks GA4 / GTM tags | ✗ No | ✓ Yes |
| Google Consent Mode v2 (all 4 params) | ✗ No | ✓ All plans |
| Global Privacy Control (GPC) detection | ✗ No | ✓ Auto-detected |
| CIPA session-replay blocking | ✗ No | ✓ Yes |
| US state law opt-out (19 states) | ✗ No | ✓ All plans |
| Timestamped consent audit log | ⚠ Basic / none | ✓ Full log, exportable |
| Page-scoped consent enforcement | ✗ No | ✓ Yes |
| Works without platform plan upgrade | ⚠ Often gated | ✓ Any plan |
See what fires on your Squarespace site despite the banner
ConsentPixel scans your live Squarespace site in a fresh session — no cache, no prior consent — and shows every injected script transmitting data before any consent is recorded.
How to Install ConsentPixel on Squarespace
ConsentPixel installs on Squarespace through Code Injection — a single script in your site header. It must load first so pre-consent blocking works. Code Injection requires a Business plan or higher on Squarespace; on lower plans you can add it per-page where code fields are available.
Create your ConsentPixel account and scan your site
Sign up at consentpixel.com, add your Squarespace domain, and run the auto-scanner. ConsentPixel maps every tracker across your site — including header, footer, and per-page Code Injection scripts. Copy your unique pixel snippet.
Add the snippet to Squarespace header Code Injection
In Squarespace, go to Settings → Advanced → Code Injection (7.1) or Settings → Advanced → Code Injection in the legacy panel (7.0). Paste the ConsentPixel snippet at the very top of the Header field, before any GTM, GA4, or Meta code.
<!-- ConsentPixel — must be first --> <script src="https://pixel.consentpixel.com/YOUR-SITE-ID.js" async></script> <!-- Your GTM / GA4 / Meta code below -->
Header Code Injection is available on the Business plan and above. On lower plans, add the snippet to the per-page code field (Page Settings → Advanced) on each page that loads trackers.
Save and confirm it is live
Click Save. Code Injection applies immediately to the live site. Open your site in an incognito window to confirm — Code Injection does not run inside the Squarespace editor preview.
Register your external scripts and configure GCM v2
In the ConsentPixel dashboard, register each tool by category: Analytics (GA4), Marketing (Meta, Pinterest, TikTok), Functional (chat, scheduling), Session Recording (Hotjar, Clarity). ConsentPixel holds each category until consent.
Enable Google Consent Mode v2 — ConsentPixel sets all four GCM v2 parameters before any Google tag loads, the firing order Squarespace's Cookie Banner cannot guarantee.
Decide how to handle the native Cookie Banner
Layered: keep Squarespace's banner deferring its native cookies and let ConsentPixel handle all injected scripts. ConsentPixel only: turn off the native banner and let ConsentPixel handle all consent, for one unified banner and one exportable consent log. Either way the injected-script gap is closed.
What ConsentPixel Does for Your Squarespace Site
Blocks your injected scripts
Intercepts GA4, Meta Pixel, GTM tags, Hotjar, and email-marketing scripts added through Code Injection — the scripts the native Cookie Banner cannot reach — and holds them until consent.
Google Consent Mode v2 — correct order
Sets all four GCM v2 parameters before any Google tag loads. Protects Google Ads conversion measurement for EU and UK visitors — something the Squarespace banner does not do.
GPC browser signal detection
Honours the Global Privacy Control signal for California, Colorado, Virginia, and Connecticut visitors automatically — a requirement no native Squarespace setting addresses.
CIPA session-replay protection
Blocks Hotjar, Clarity, and Lucky Orange before consent — removing the $5,000/visitor CIPA exposure California traffic creates on Squarespace sites running these tools.
Right for creators and small business
Squarespace's core users — photographers, artists, consultants — rarely have a developer on call. ConsentPixel needs one snippet and a dashboard, no code maintenance after install.
No plan-gated deferral logic
Unlike Squarespace's native deferral, ConsentPixel's blocking does not depend on your Squarespace tier. The same full protection applies whether you're on Business or Commerce.
Squarespace Privacy Compliance Checklist (2026)
Frequently Asked Questions
One code injection.
Every injected script covered.
ConsentPixel — Privacy · Verified blocks the GA4, GTM tags, Meta Pixel, and session-replay scripts your Squarespace Code Injection loads — while passing all four GCM v2 parameters and honouring GPC signals. One snippet, any plan, no code maintenance.