To set up cookie consent on Squarespace, start with what Squarespace offers: a built-in cookie banner with "Accept all", "Decline all" and "Manage cookies" that restricts Squarespace's own analytics cookies. It does not hold back every third-party script, so a site with embeds, pixels or code-injected tags also needs a consent tool added through Code Injection. For EU and UK visitors, the GDPR and the ePrivacy Directive expect analytics and marketing cookies to wait until the visitor agrees.
What Squarespace does (and does not do) about cookies
Squarespace sites set cookies from the moment a visitor loads a page. The platform's own analytics cookies, ss_cid, ss_cvr, ss_cvisit, ss_cvt and ss_cpvisit, track unique visitors and their sessions. If you have connected Google Analytics 4, _ga and _ga_<container-id> join them. Add a Meta Pixel, and _fbp appears too.
Squarespace offers a built-in cookie banner in the Cookies & Data Privacy panel. Its banner help article, updated on 14 January 2026, describes a "Decline all" button that rejects all non-essential cookies and a "Manage cookies" button that lets visitors customise their preferences.
The limit is third-party content. Squarespace's cookie list says the banner disables or restricts cookies from some third-party services but not all of them, and that it will not block some embedded content, which could then place analytics cookies. For sites with specific requirements, Squarespace itself recommends a specialist third-party cookie consent management tool.
Where the built-in banner stops
Under Article 5(3) of the ePrivacy Directive, storing or reading information on a visitor's device needs prior consent unless the cookie is strictly necessary for the service the visitor asked for. The GDPR adds that consent must be freely given, specific, informed and unambiguous.
The Squarespace banner covers Squarespace's own cookies well. Three gaps remain for most sites: it cannot hold every third-party script or embed until consent, its categories may not match the scripts you added by hand, and it does not give you a log of each visitor's choice with a timestamp. Regulators can ask for that proof.
Enforcement is not theoretical. On 1 September 2025 the CNIL fined SHEIN 150 million euros for placing advertising cookies before visitors made a choice and for continuing after a refusal. In the UK, the ICO reported on 4 December 2025 that 979 of the UK's top 1,000 websites now passed its cookie checks, and that it had issued 17 preliminary enforcement notices to sites that did not improve.
Small sites are not exempt. The rules apply to any website that targets EU or UK visitors, whatever the company's size or revenue.
Cookies commonly found on Squarespace sites
Before configuring consent, find out what your site actually sets. Below is a typical breakdown for a Squarespace site with Google Analytics and a social pixel, with durations from Squarespace's own list for the Squarespace cookies. You can look up any name in the cookie database.
| Cookie | Category | Duration | Purpose |
|---|---|---|---|
ss_cid | Analytics | 2 years | Tracks unique visitors and their sessions |
ss_cvr | Analytics | 2 years | Tracks unique visitors and their sessions |
ss_cvisit | Analytics | 30 minutes | Tracks the current session |
ss_cvt | Analytics | 30 minutes | Tracks the current session |
crumb | Necessary | Session | Protects Squarespace forms against cross-site request forgery |
PHPSESSID | Necessary | 1 month | Keeps the server session |
_ga | Analytics | 2 years | Google Analytics client identifier |
_fbp | Marketing | 3 months | Meta Pixel browser identifier |
Your site may have more or fewer cookies depending on the integrations you use. The key point: analytics and marketing cookies both need consent before they are set, and that includes Squarespace's own ss_ analytics cookies.
Adding a consent banner through Code Injection
Squarespace supports custom code through Settings > Developer Tools > Code Injection. This is how you add a third-party consent tool that holds cookies back until a visitor makes a choice.
Step 1: Turn off the built-in banner
In the Cookies & Data Privacy panel, switch off the Squarespace cookie banner. Two banners at once confuse visitors and can conflict over which scripts are blocked.
Step 2: Add the consent script to the header
Paste your consent tool's embed code into the Header field of Code Injection, so it loads before any other tracking script. With Kukie.io, that is one line: <script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script>.
Step 3: Configure cookie categories
Set up your cookie categories, usually Necessary, Analytics, Marketing and Functional. Map each cookie and script to the right category. Necessary cookies load without consent, and everything else waits for a positive choice.
Step 4: Scan your site
Run an automated cookie scan to find every cookie your site sets. It catches third-party cookies you may not know about, including those set by embedded content blocks.
Step 5: Test the banner
Open your site in a private window and check that no analytics or marketing cookies appear before you interact with the banner. Use Chrome DevTools (Application > Cookies) to confirm. Reject all cookies and check again: only strictly necessary cookies such as crumb should remain.
Google Consent Mode on Squarespace
How Google Analytics reacts to consent on Squarespace depends on how you added it. For the official integration, Squarespace's cookie help says to save your measurement ID and then enable the cookie banner, and it notes that providers such as Google offer Consent Mode so visitors can pass on their choices. For Google Analytics or Google Ads added through Code Injection, Squarespace points to its code injection guide and treats the custom code as outside its support.
That second case is where a consent tool does the work. Google Consent Mode v2 needs a default state, usually denied, before any Google tag sends data, and an update once the visitor chooses. Your consent tool should send the four signals, ad_storage, analytics_storage, ad_user_data and ad_personalization, to Google for you.
If your consent tool supports script blocking, you can also stop the GA script from loading at all until consent is given. This is the stricter approach: no Google request leaves the page until the visitor agrees.
GDPR, UK GDPR and CCPA: which rules apply
The answer depends on where your visitors are, not where your business is based. The GDPR's territorial scope covers any site that offers goods or services to people in the EU or monitors their behaviour. If your Squarespace site gets traffic from Europe, the GDPR applies to you.
The UK GDPR and PECR set near-identical cookie consent requirements for UK visitors. The CCPA takes a different approach: it does not require opt-in consent for cookies, but it does require a clear opt-out and disclosure of data collection. A growing list of other US states has similar opt-out laws.
A consent tool with geo-detection handles this. It shows an opt-in banner to EU and UK visitors, an opt-out notice to California visitors, and can hide the banner in places without cookie rules. If you are still choosing a platform, the comparison of Shopify vs Squarespace covers how each handles consent.
Common mistakes on Squarespace sites
Running the built-in Squarespace banner and a third-party consent tool at the same time is the most frequent error. The two conflict, and cookies may load before either banner appears.
Another common mistake is adding tracking scripts in Code Injection without routing them through the consent tool. Every script that sets a non-essential cookie must be managed by the consent tool, or it runs before consent and the banner does nothing for it. The guide to conditional script loading shows how.
Ignoring Squarespace's own analytics cookies is a third pitfall. ss_cid and ss_cvr are not strictly necessary: Squarespace lists them as analytics and performance cookies, so they need consent under the GDPR.
Quick answers for Squarespace site owners
Does Squarespace have a built-in cookie consent banner?
Yes. Squarespace's banner, in the Cookies and Data Privacy panel, can show Accept all, Decline all and Manage cookies. It restricts cookies from Squarespace and some third-party services, but Squarespace says it will not block some embedded content.
Is the Squarespace cookie banner enough for EU visitors?
It can be for a site with no third-party scripts or embeds. Sites with pixels, embeds or code-injected tags usually need a consent tool that holds those scripts until consent and keeps a record of each choice, which Squarespace itself suggests for sites with specific requirements.
How do I add a third-party cookie banner to Squarespace?
Use Code Injection under Settings > Developer Tools > Code Injection. Paste the consent tool's script into the Header field so it loads before other scripts, and turn off the built-in banner first to avoid conflicts.
What cookies does Squarespace set automatically?
Squarespace's analytics cookies include ss_cid, ss_cvr, ss_cvisit, ss_cvt and ss_cpvisit, and its necessary cookies include crumb and PHPSESSID. Connected third-party services add their own cookies on top.
Can I use Google Analytics on Squarespace without a cookie banner?
Not for EU and UK visitors. Google Analytics sets _ga and _ga_ cookies, which are analytics cookies that need consent before they are set. Google Consent Mode v2 can send cookieless pings while consent is denied, but full tracking still needs a banner.
List the cookies your Squarespace site sets
Squarespace's own cookies are documented. The ones your embeds, pixels and injected code add are not. The Cookie scanner loads your site like a visitor and lists every cookie it finds by name and category, so you can check what still runs before a choice.
