Square Online cookie consent means holding analytics and marketing scripts back until visitors agree, while leaving Square's checkout and cart cookies alone. Square's own cookie setting may only show a notice, so check what it does before relying on it. To block trackers properly, add a consent tool's script through Square Online's code settings, which Kukie.io's installation guide says need a Square Online Plus or Premium plan, then scan the store to confirm nothing runs before a choice.
Why your Square Online store needs a cookie banner
Square Online sets cookies as soon as a visitor lands on your storefront. Some are strictly necessary for checkout and the cart. Others, such as analytics trackers and marketing pixels, fall under the ePrivacy Directive and the GDPR.
Article 5(3) of the ePrivacy Directive requires prior consent before storing or reading information on a visitor's device, unless the cookie is strictly necessary for a service the visitor explicitly asked for. If your store serves visitors in the EU, the UK or another place with an opt-in model, you need a banner that blocks non-essential cookies until the visitor gives clear, affirmative consent.
Enforcement is real. On 1 September 2025 France's CNIL fined SHEIN 150 million euros for placing advertising cookies before visitors made a choice. In the UK, the ICO reported on 4 December 2025 that 979 of the top 1,000 UK websites now passed its cookie checks after a year of letters and investigations. Smaller businesses are not exempt.
The cookies a Square Online store sets
Before configuring consent, find out exactly what your store stores in visitors' browsers. Square Online uses a mix of first-party and third-party cookies, and the exact names change with Square's platform and your integrations, so take them from a scan rather than a list.
| Category | Examples | Purpose | Consent needed? |
|---|---|---|---|
| Strictly necessary | Square's session, cart and security cookies | Checkout, shopping cart, security | No |
| Analytics | _ga, _ga_<container-id> | Google Analytics traffic measurement | Yes |
| Marketing | _fbp, _fbc, ad platform pixels | Remarketing, conversion tracking | Yes |
| Performance | Square's own analytics or testing, where set | Site performance, feature testing | Yes |
| Functional | Language preference, recently viewed items | Preferences | Depends on purpose |
The strictly necessary cookies that power checkout and the cart need no consent. Everything else does under the GDPR and the ePrivacy Directive. Under the CCPA, you must offer an opt-out for cookies that sell or share personal information.
If you have added Google Analytics, the Meta Pixel or other tracking through Square's integrations, those scripts set more cookies that need consent before they run.
Square Online's built-in cookie option
Square Online includes a cookie consent setting in its site settings. What it does depends on how Square has set it up for your site and plan, so check it on your own store: open the site in a private window, decline, and see whether analytics and marketing cookies still appear.
A banner that only informs visitors is not consent. To meet the EU and UK rules, the banner has to block non-essential cookies before a choice, offer a choice by category and keep a record of each consent. If the built-in option does none of these, you need a consent tool on top.
If the cookie banner option is greyed out
Readers often find the cookie banner or custom code options greyed out in Square Online. The usual cause is the plan: Kukie.io's Square Online installation guide notes that code injection is available on Square Online Plus and Premium, so a store on the free plan may need to upgrade before it can add a consent script. Square's own help centre has the current menu steps for your plan.
Adding a consent tool through code injection
Square Online's code settings are how you install a third-party consent tool. The exact menu names vary between Square's dashboard versions, so follow Square's help centre for the path. In outline:
- Sign in to your Square Dashboard and open your Square Online website.
- Open the site settings and find the code injection or header code option.
- Paste the consent tool's embed code into the header field. For Kukie.io, that is
<script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script>. - Save and republish the site.
The Kukie.io Square Online installation guide in the Help Centre walks through the same steps. Afterwards, run a cookie scan to find every cookie your store sets, including those from third-party scripts, embedded iframes and Square's own tracking.
Check that blocking works
After adding the script, make sure non-essential cookies are actually blocked until consent. Open Chrome DevTools, clear all cookies, reload the page and check the Application tab. If _ga or _fbp appear before you touch the banner, the set-up is not blocking scripts. The cookie audit guide for Chrome DevTools walks through it.
Payment cookies and the strictly necessary exemption
Online stores face a particular challenge: payment processing needs cookies, and blocking them would break checkout. Under Article 5(3) of the ePrivacy Directive, cookies strictly necessary for a service the visitor asked for are exempt from consent.
Square's payment cookies, such as session tokens, form protection and cart persistence, fall under that exemption. Do not block them behind a consent wall, or checkout will fail.
The line blurs with Square's own analytics and performance cookies. Cookies that track browsing across your store for internal analytics are not strictly necessary for checkout, so they need consent. A careful categorisation keeps the two apart.
GDPR, CCPA and other laws for Square stores
Your obligations depend on where your visitors are, not where your business is based. A Square Online store registered in Texas still needs consent under the GDPR if it offers goods to people in the EU.
| Law | Consent model | Key requirement |
|---|---|---|
| GDPR (EU) | Opt-in | Block non-essential cookies until explicit consent |
| UK GDPR and PECR | Opt-in, with some exceptions since February 2026 | Largely the same as the GDPR, enforced by the ICO |
| CCPA and CPRA (California) | Opt-out | A "Do Not Sell or Share" option |
| LGPD (Brazil) | Consent or another legal basis | Consent must be free, informed and unambiguous |
| PIPEDA (Canada) | Meaningful consent | Express for sensitive data, implied possible otherwise |
| POPIA (South Africa) | Opt-in for direct marketing | Consent for processing personal information |
The PIPEDA row follows Canada's guidelines for obtaining meaningful consent, which say consent should generally be express and can be implied only in strictly defined circumstances.
Penalties differ too. The California Privacy Protection Agency raised the CCPA fine limits from 1 January 2025 to 2,663 US dollars per violation and 7,988 US dollars per intentional violation or one involving a known consumer under 16.
Geo-detection lets you show different consent experiences by location: a full opt-in banner with categories for EU visitors, an opt-out notice where US state laws give opt-out rights, and the version you choose elsewhere. It applies the region rules you set, so the decisions stay yours.
Common consent mistakes on Square Online
A Square Online store with analytics and marketing integrations runs into several common problems.
Pre-ticked consent boxes. Under the GDPR, silence, pre-ticked boxes and inactivity are not consent. A banner that loads with categories already selected does not collect valid consent.
No reject option of equal weight. A large "Accept all" button next to a small "Manage preferences" link goes against freely given consent. Both choices must be equally visible, and regulators treat dark patterns in cookie banners as an enforcement priority.
Analytics running before consent. If Google Analytics or Meta Pixel scripts load before the visitor touches the banner, you collect data without consent. This is the most common problem. Use Google Consent Mode v2 alongside your consent tool for Google's tags.
No consent records. Article 7(1) of the GDPR requires you to show that consent was given. If a regulator asks, you need timestamped records of what each visitor accepted, which a plain notice cannot provide.
A cookie list that falls behind. Each new marketing integration adds cookies. Without regular scans, your banner's categories and your cookie policy go out of date.
Square Online compared with other e-commerce platforms
Square Online gives you fewer consent controls than Shopify or BigCommerce, which have their own built-in consent settings and larger app ecosystems. On Square, the code injection field is the main way to add a consent tool.
That limit is manageable. A consent tool added through Square's code settings blocks the same trackers it would on any other site. The key is to test after installing and to scan again whenever you add an integration.
Square Online cookie consent questions
Does Square Online set cookies that need consent?
Checkout and cart cookies are strictly necessary and need no consent. Analytics, marketing and some performance cookies, including those from integrations you add, need consent from EU and UK visitors.
Is the built-in Square cookie option enough for EU visitors?
Only if it blocks non-essential cookies before a choice, offers categories and records consent. Test it in a private window: if analytics or marketing cookies appear before you choose, add a consent tool through Square's code settings.
Why is the cookie banner option greyed out in Square Online?
Most often the plan. Kukie.io's installation guide notes that Square Online's code injection is available on the Plus and Premium plans, so a free-plan store may need to upgrade before it can add a consent script.
Do payment cookies on Square need consent?
No. Cookies strictly necessary for processing a payment or keeping a cart are exempt under Article 5(3) of the ePrivacy Directive. Do not block them behind a consent wall.
What can happen if a Square store sets cookies without consent?
EU regulators can fine up to 4% of annual global turnover under the GDPR. Under the CCPA, fines since 1 January 2025 reach 2,663 US dollars per violation, or 7,988 US dollars per intentional violation or one involving a minor under 16.
Scan your Square Online store before you rely on the banner
A banner that looks right can still let trackers through. The Cookie scanner loads your store like a visitor and lists every cookie it finds by name and category, so you can see what runs before a choice. The CCPA penalties guide explains what is at stake for US stores.
