SquarespaceCookie banner for Squarespace
A real consent layer for any Squarespace site. Blocks trackers until visitors opt in, from one snippet.
Squarespace's built-in cookie banner manages Squarespace's own cookies and records a preference. By Squarespace's own account, it restricts cookies from some third-party services, but not all, and tags you add yourself are yours to integrate. ConsentStack adds a real consent layer to any Squarespace site: it blocks those scripts until the visitor opts in and covers GDPR, CCPA, and 70+ other regulations.
Does the built-in Squarespace cookie banner block cookies?
Partly, and Squarespace says so itself. Its support documentation states that the banner "disables or restricts cookies placed by some third-party services connected to your site, but not all." It can hold back Squarespace's own non-essential cookies and some built-in integrations until a visitor accepts. Everything else on the page sits outside that guarantee.
The same support page gives an example: add tracking to an audio block and the banner will not stop it from placing analytics cookies. That is not a knock on Squarespace. The built-in banner was scoped to manage the cookies Squarespace controls, not every script a site owner can paste in.
What about tags you add through Code Injection?
Those are your responsibility. Squarespace's cookie banner guide notes that if custom code drops non-essential cookies, you "may want to ensure your cookie banner can interact with the code," and points to a sample snippet for wiring up Google Analytics by hand. Any tag you have not wired that way fires before the visitor has answered the banner.
In practice, Code Injection is exactly where tracking lives on a Squarespace site: Google Analytics, the Meta Pixel, TikTok, LinkedIn, heatmap tools. ConsentStack closes this gap automatically. It detects third-party scripts on the page and blocks them until the visitor consents, with no per-tag wiring. Read how script blocking works for the mechanics.
How do you check what fires before consent?
Test it rather than trusting any banner, ours included. Open your site in a private window, decline the banner, and watch the network tab for requests to domains like google-analytics.com or connect.facebook.net. Requests that appear after a decline mean tracking is running without consent. Our free compliance scanner runs the same check for you in a real browser.
The scanner loads your Squarespace site, interacts with the banner, and reports which trackers fired before and after consent, with the evidence attached. If you would rather check by hand, our testing and verification guide walks through it step by step.
When is the built-in banner enough?
If your site runs no added tracking at all, the built-in banner covers Squarespace's own cookies, and that can genuinely be enough. The moment you add analytics, ad pixels, or embedded widgets, you either integrate each tag with Squarespace's banner by hand or add a consent layer that blocks them automatically.
Regulations like GDPR expect non-essential trackers to stay silent until a visitor agrees. A banner that records a choice without enforcing it does not meet that bar, because what counts is what actually loads on the page, not what the banner says.
Why ConsentStack on Squarespace
- Covers GDPR, CCPA, and 70+ regulations from one snippet, not just Squarespace's own cookies.
- Third-party trackers actually stop when a visitor declines, and your consent log proves it.
- Flat pricing from $29/mo. No per-page or per-domain scanning fees.
- Pixel-perfect brand matching, so the banner looks built into your Squarespace site, never bolted on.
Add ConsentStack to Squarespace
In Squarespace, go to Settings > Advanced > Code Injection and paste the tags into the Header field.
<link rel="preconnect" href="https://cdn.consentstack.io" />
<script src="https://cdn.consentstack.io/consent.js?k=YOUR_SITE_KEY"></script>
<script src="https://cdn.consentstack.io/consent-core.js?k=YOUR_SITE_KEY"></script>Replace YOUR_SITE_KEY with the site key from your ConsentStack dashboard.
Code Injection is available on Squarespace Core, Plus, and Advanced plans, and some legacy billing plans.
Common questions
Yes. Squarespace's banner manages Squarespace's own cookies and, per its documentation, restricts cookies from some third-party services but not all. Scripts you add yourself, like Google Analytics or the Meta Pixel in Code Injection, can still fire before consent unless you wire them up by hand. ConsentStack blocks those scripts until the visitor opts in.
It depends on what your site loads. The banner can restrict Squarespace's own cookies until a visitor accepts, which fits GDPR's prior-consent model. But GDPR applies to every non-essential tracker on the page, and tags added through Code Injection are not controlled automatically. If you run analytics or marketing tags, those need to be blocked until consent too.
Add the three tags to Settings > Advanced > Code Injection > Header, then save. There is no plugin or build step. Code Injection is available on Core, Plus, Advanced, and some legacy billing plans.
The SDK is around 30 KB gzipped with zero dependencies and loads from a global CDN. It runs at parse time so it can catch trackers before they fire, without blocking your page from rendering.
100+ happy customers
Ship consent on Squarespace. In minutes.
Scan your site free to see what is firing before consent, then turn on real blocking from one install.