Does Squarespace have a built-in cookie banner?

Yes. Squarespace's banner manages Squarespace's own cookies and, per its documentation, restricts cookies from some third-party services but not all. Scripts you add yourself, like Google Analytics or the Meta Pixel in Code Injection, can still fire before consent unless you wire them up by hand. ConsentStack blocks those scripts until the visitor opts in.

Is the built-in Squarespace cookie banner GDPR compliant?

It depends on what your site loads. The banner can restrict Squarespace's own cookies until a visitor accepts, which fits GDPR's prior-consent model. But GDPR applies to every non-essential tracker on the page, and tags added through Code Injection are not controlled automatically. If you run analytics or marketing tags, those need to be blocked until consent too.

How do I add a cookie banner to Squarespace?

Squarespace has a built-in banner under Settings > Website > Cookies & Data Privacy, which covers Squarespace's own cookies and some integrations. To block the tags you added yourself, paste the three ConsentStack tags into Website > Website Tools > Code Injection, in the Header field, and save. There is no plugin or build step. Code Injection is available on Core, Plus, Advanced, and some legacy billing plans.

Will it slow my Squarespace site down?

The SDK is ~46 KB gzipped (stub plus core) with zero dependencies and loads from a global CDN. It runs at parse time so it can catch trackers before they fire, without blocking your page from rendering.

Cookie Banner for Squarespace

Squarespace's built-in cookie banner manages Squarespace's own cookies and records a preference. By Squarespace's own account, it restricts cookies from some third-party services, but not all, and tags you add yourself are yours to integrate. ConsentStack adds a real consent layer to any Squarespace site: it blocks those scripts until the visitor opts in and covers GDPR, CCPA, and 195+ other regulations.

Does the built-in Squarespace cookie banner block cookies?

Partly, and Squarespace says so itself. Its support documentation states that the banner "disables or restricts cookies placed by some third-party services connected to your site, but not all." It can hold back Squarespace's own non-essential cookies and some built-in integrations until a visitor accepts. Everything else on the page sits outside that guarantee.

The same support page gives an example: add tracking to an audio block and the banner will not stop it from placing analytics cookies. That is not a knock on Squarespace. The built-in banner was scoped to manage the cookies Squarespace controls, not every script a site owner can paste in.

What about tags you add through Code Injection?

Those are your responsibility. Squarespace's cookie banner guide notes that if custom code drops non-essential cookies, you "may want to ensure your cookie banner can interact with the code," and points to a sample snippet for wiring up Google Analytics by hand. Any tag you have not wired that way fires before the visitor has answered the banner.

In practice, Code Injection is exactly where tracking lives on a Squarespace site: Google Analytics, the Meta Pixel, TikTok, LinkedIn, heatmap tools. ConsentStack closes this gap automatically. It detects third-party scripts on the page and blocks them until the visitor consents, with no per-tag wiring. Read how script blocking works for the mechanics.

How do you check what fires before consent?

Test it rather than trusting any banner, ours included. Open your site in a private window, decline the banner, and watch the network tab for requests to domains like google-analytics.com or connect.facebook.net. Requests that appear after a decline mean tracking is running without consent. Our free compliance scanner runs the same check for you in a real browser.

The scanner loads your Squarespace site, interacts with the banner, and reports which trackers fired before and after consent, with the evidence attached. If you would rather check by hand, our testing and verification guide walks through it step by step.

When is the built-in banner enough?

If your site runs no added tracking at all, the built-in banner covers Squarespace's own cookies, and that can genuinely be enough. The moment you add analytics, ad pixels, or embedded widgets, you either integrate each tag with Squarespace's banner by hand or add a consent layer that blocks them automatically.

Regulations like GDPR expect non-essential trackers to stay silent until a visitor agrees. A banner that records a choice without enforcing it does not meet that bar, because what counts is what actually loads on the page, not what the banner says.

Why ConsentStack on Squarespace

Covers GDPR, CCPA, and 195+ regulations from one snippet, not just Squarespace's own cookies.
Third-party trackers actually stop when a visitor declines, and your consent log proves it.
Flat pricing from $29/mo. No per-page or per-domain scanning fees.
Pixel-perfect brand matching, so the banner looks built into your Squarespace site, never bolted on.

Add ConsentStack to Squarespace

Squarespace has no plugin step. You paste three tags into Code Injection once, and they apply to every page on the site.

head

<link rel="preconnect" href="https://cdn.consentstack.io" />
<script src="https://cdn.consentstack.io/consent.js?k=YOUR_SITE_KEY"></script>
<script src="https://cdn.consentstack.io/consent-core.js?k=YOUR_SITE_KEY"></script>

Replace YOUR_SITE_KEY with the site key from your ConsentStack dashboard.

Open Code Injection
In your Squarespace site, go to Website > Website Tools > Code Injection. On older sites the same panel sits under Settings > Advanced > Code Injection.
Paste the tags into the Header field
Put all three tags at the very top of the Header field, above anything already there. Squarespace injects that field into the <head> tag on every page, which is what puts ConsentStack ahead of your other scripts. Do not add defer or async.
Turn off Squarespace's own banner
Two banners means two prompts and two disagreeing records. Open Settings > Website > Cookies & Data Privacy and switch off the toggle beside Cookie banner, then save.
Check it in a private window
Reload your site, decline the banner, and watch the network tab for requests to domains like google-analytics.com. Anything that fires after a decline is tracking without consent. The free compliance scanner runs that check for you and attaches the evidence.