Add a Cookie Banner to Squarespace

Step-by-step install for Squarespace. Paste three tags into Code Injection, keep or replace Squarespace's built-in banner, and block trackers until visitors consent.

Squarespace ships a cookie banner of its own, and it does a narrower job than most site owners expect. This page covers what the built-in banner actually controls, how to install ConsentStack alongside or instead of it, and how to check the result. For the product overview, see Cookie consent for Squarespace.

Squarespace's cookie banner documentation describes the banner's purpose as preventing "Squarespace, and some third party integrations, from placing non-essential cookies on visitors' browsers until visitors accept them."

The scope is the part worth reading twice. Squarespace's cookies reference states that the banner "disables or restricts cookies placed by some third-party services connected to your site, but not all."

Tags you add yourself sit outside that. Squarespace's own guidance is that if your site "has custom code injection that drops non-essential cookies, you may want to ensure your cookie banner can interact with the code," and it notes that custom code modifications fall outside the scope of Squarespace support.

In practice, Code Injection is exactly where tracking lives on a Squarespace site: Google Analytics, the Meta Pixel, TikTok, LinkedIn, heatmap tools. Those fire on page load unless something holds them back.

Install ConsentStack

Copy your install tags

Get your site key from the ConsentStack dashboard, then take these three tags:

<link rel="preconnect" href="https://cdn.consentstack.io" />
<script src="https://cdn.consentstack.io/consent.js?k=<YOUR_SITE_KEY>"></script>
<script src="https://cdn.consentstack.io/consent-core.js?k=<YOUR_SITE_KEY>"></script>

Open Code Injection

In your Squarespace site, go to Website > Website Tools > Code Injection. On older sites the same panel appears under Settings > Advanced > Code Injection.

Code Injection is available on the Core, Plus, and Advanced plans, and on some legacy billing plans. If you do not see the panel, your plan does not include it.

Paste into the Header field

Paste all three tags into the Header field, at the very top, before anything already there. Squarespace injects this field into the <head> tag on every page of your site, which is what puts ConsentStack ahead of your other tags.

Do not add defer or async to either script tag, and keep both ahead of any other scripts in the Header field. The SDK installs its script observer at parse time. Anything that runs before the observer is active can fire before the visitor has consented.

Save and reload

Click Save, then open your site in a private window. The banner appears on first load. Trackers stay blocked until the visitor chooses.

Running both banners shows visitors two consent prompts, which is confusing and makes your consent record ambiguous. Pick one.

Turn Squarespace's banner off if you want ConsentStack to be the single consent layer, which is the usual choice. Open Settings > Website > Cookies & Data Privacy and switch off the toggle beside Cookie banner, then click Save.

Keep Squarespace's banner on only if you specifically want Squarespace's own cookies governed by Squarespace's own toggle. Note that a visitor can then accept in one banner and decline in the other, and the two records will disagree.

Check what actually fires

Trust the network tab, not the banner. Open your site in a private window, decline consent, and watch for requests to domains like google-analytics.com or connect.facebook.net. Requests that appear after a decline mean tracking is running without consent.

The free compliance scanner runs that check for you. It loads your Squarespace site in a real browser, interacts with the banner, and reports which trackers fired before and after consent with the evidence attached. The testing and verification guide covers the manual version step by step.

Squarespace-specific notes

Tags added after the first page load are still caught. Some Squarespace templates swap page content without a full browser refresh, and plenty of embeds inject their scripts late. ConsentStack watches the page for scripts added after parse time and holds them to the same consent rules as the ones that were there at load.

The Header field is site-wide. Squarespace injects it into the <head> tag on every page, so a single paste covers your whole site. There is no per-page install to repeat.

What's next

Cookie consent for Squarespace. The product overview, including how the built-in banner compares.
Script Blocking. How third-party tags are held until the visitor consents.
Platform Integrations. Native consent signaling for Google, Meta, TikTok, and more.
SDK Installation. The full install reference.