Do Squarespace scripts require visitor consent on Squarespace-built sites?

No for core scripts. Squarespace's rendering, routing, cart, and CSRF scripts are essential infrastructure that cannot be blocked without breaking the site entirely. The SS_MID persistent analytics cookie requires disclosure in your cookie notice, and any third-party marketing integrations enabled in Squarespace settings require their own consent.

What cookies does Squarespace set by default?

Squarespace sets crumb (CSRF, session), SS_MID (2-year visitor analytics ID), SS_CVRT (conversion tracking), _orig_referrer (initial traffic source, session), and SQ_LANGUAGE_SESSION (language preference). SS_MID cannot be disabled — it is bundled into the platform and powers the analytics dashboard.

How does ConsentStack work with Squarespace sites?

ConsentStack on Squarespace sites manages optional third-party tools added via Squarespace's integrations panel, such as Google Analytics, Meta Pixel, or Klaviyo. Core Squarespace scripts are essential and cannot be gated. ConsentStack surfaces these integrations and ensures SS_MID is disclosed in your cookie notice.

What tracker domains does Squarespace use?

ConsentStack has catalogued tracker domains for Squarespace including squarespace.com. These are the network destinations Squarespace's scripts contact, which a consent platform blocks until a visitor agrees.

Squarespace - Website Builder Consent & Privacy Info

Back to Vendor Library

Overview

Squarespace is a website builder and all-in-one e-commerce platform hosting millions of businesses, creators, and portfolios. On Squarespace-built sites, its scripts are the foundational layer — they render the entire site template, manage routing, power the e-commerce storefront, and bundle analytics and scheduling (via Acuity) into the core platform. Unlike WordPress or other open platforms, Squarespace is a closed system: the site cannot function without its core scripts.

What This Script Does

Core Site Infrastructure

Bootstraps the entire site: template rendering, responsive layout, navigation, and page transitions
Manages client-side routing for single-page application navigation between Squarespace pages
Scripts are loaded from static1.squarespace.com (CDN) and assets.squarespace.com
Handles media delivery: images served through Squarespace's Imgix-backed image processing pipeline

E-Commerce and Checkout

Powers Squarespace Commerce: product catalog rendering, inventory display, shopping cart session management, and checkout flow
Processes payments via Squarespace Payments (Stripe-backed), PayPal, and Apple Pay integrations
Sets cart session cookies to persist cart state across page navigation

Cookies Set

crumb — CSRF protection token, first-party, session
squarespace-announcement-bar — tracks whether the visitor has dismissed the announcement bar, first-party, persistent
SQ_LANGUAGE_SESSION — language preference for multilingual sites, first-party, session
SS_MID / SS_CVRT — Squarespace's built-in visitor analytics identifiers, first-party, persistent (up to 2 years); powers the Squarespace Analytics dashboard for site owners
_orig_referrer — captures the initial referral source for traffic attribution, first-party, session
Cart cookies: session-scoped identifiers for cart persistence on commerce sites

Built-In Analytics (Squarespace Analytics)

Every Squarespace site includes built-in analytics that cannot be disabled — tracking page views, unique visitors, traffic sources, and sales data
The SS_MID cookie provides persistent visitor identification for this analytics system
Data is sent to Squarespace's analytics pipeline and displayed in the site owner's Squarespace dashboard
This analytics cannot be selectively blocked without breaking the site

Acuity Scheduling Integration

Sites using Acuity Scheduling (a Squarespace product) load additional scripts from acuityscheduling.com
Acuity scripts are treated as functional (see Acuity Scheduling vendor entry)

Consent & Compliance

Consent category: Essential / Functional

Squarespace's core rendering scripts, CSRF protection, and cart cookies are essential for any Squarespace-hosted site to function and are exempt from consent under the ePrivacy Directive. The SS_MID persistent analytics cookie is more nuanced — it is set by default for Squarespace's built-in analytics and persists for up to 2 years, technically requiring consent under a strict ePrivacy interpretation. However, because it cannot be disabled without breaking the platform, sites using Squarespace must disclose it in their privacy policy and cookie notice. Under GDPR, Squarespace acts as a data processor; the site operator is the controller. Squarespace is a US company and participates in the EU-US Data Privacy Framework.

Should You Block This Without Consent?

No. Squarespace scripts are the essential foundation of Squarespace-hosted sites. Blocking them would render the site non-functional. Squarespace's built-in analytics (SS_MID) cannot be disabled, so disclosure and a clear cookie notice are the appropriate compliance approach on Squarespace-built sites.

Is Squarespace GDPR compliant?

Squarespace typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Squarespace can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Squarespace, not on Squarespace itself.

Visit website

Consent Categories

Essential Functional

Also Known As

squarespace cookiessquarespace GDPRsquarespace trackingsquarespace analytics privacysquarespace e-commerce consentAcuity scheduling consent

Industries

Programming and Developer SoftwareComputers Electronics and Technology

Tracked Domains (1)

Squarespace's trackers are rarely seen, seen on under 1% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

squarespace.comEssential

squarespace.com is an essential domain operated by Squarespace, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.