Platform & operations

Block scripts before consent,
release them the moment it arrives

Script blocking stops third-party tags running until the visitor has agreed to the category they belong to. Kukie holds back 30+ known trackers automatically, with no setup, and the Script Centre lets you attach any other tag to a consent category and a position on the page, so it fires only once that category is allowed.

Start free → See what loads before consent

A banner that does not block anything is decoration

Most site owners assume that adding a consent banner stops the tracking. It does not, on its own. A banner is a question. Blocking is the part that makes the answer mean something. Without it, your analytics tag, your advertising pixel and your heatmap tool all run on first page load, and by the time anyone reads the banner the cookies are already written.

The reject button that changes nothing

A visitor clicks reject. The banner disappears. The tags carry on exactly as before, because nothing was ever wired to the answer. This is the failure mode that survives longest, because from the outside the site looks compliant and the dashboard looks healthy.

Evidence anyone can collect

Pre-consent tracking is visible in any browser, by anyone, in under a minute. Complaints about it therefore arrive with proof already attached, and there is no version of events in which the tag did not fire. That is what makes it the most common finding in cookie enforcement across the EU.

Tags nobody remembers adding

A site three years old has usually collected a marketing pixel from a campaign that ended, a chat widget from a trial nobody cancelled and a snippet a former agency pasted in. Each one is a third party receiving your visitors. You cannot make a decision about a script you do not know is there.

If you are not sure which of those describes your site, the free third-party script audit loads a public page and reports what runs before any consent is given. Kukie supplies the technical infrastructure for consent management; whether your site is compliant depends on how you configure it and may need additional legal measures specific to your organisation.

The two ways Kukie stops a script from running

One is automatic and covers the tags almost every site has. The other is deliberate and covers everything else. They run side by side, and most sites end up using both.

Nothing to configure

Auto-block mode: the known trackers

Switch it on and Kukie watches the page as it builds. When a script it recognises as a known tracker appears, it is neutralised before it can run and put in a queue. When the visitor allows the matching category, the queue is released and the scripts load normally. Refuse, and they stay where they are.

The recognition list covers 30+ known trackers, each already sorted into the category it belongs to. Google Analytics and Hotjar count as analytics. The Meta Pixel, the TikTok and LinkedIn advertising tags and HubSpot count as marketing. You do not name any of them; they are recognised on sight.

Where it stops. No recognition list can name every vendor on the internet, and a new tool your marketing team signs up for tomorrow will not be on it. Auto-block is the safety net for the tags everybody has. The Script Centre is how you take charge of the rest.

Under your control

The Script Centre: everything else

The Script Centre is a list of the third-party code your site runs. You paste a snippet once, give it a name, and attach it to a consent category. From then on it is not in your page source at all: Kukie injects it, and only after a visitor has allowed that category. This is conditional tag loading, and it is the only version of blocking that works for a script nobody has a pattern for.

Any tag, not a fixed menu. Scripts, tracking pixels, inline snippets and stylesheets are all supported.
Pulled in from a scan, not retyped. Scripts a cookie scan found can be brought straight into the Script Centre.
Sanitised on the way in. Every snippet is cleaned before it is stored and before it is injected, so a pasted block cannot smuggle in something you did not intend.
Switched off without deleting. A tag can be deactivated and kept, which is how you pause a vendor during a review without losing its snippet.

Where on the page should a tag load?

Order matters more than people expect. Some vendors insist their snippet runs before everything else; others only work once the page is drawn. Every script in the Script Centre is given one of four positions, so a tag lands exactly where its documentation says it should.

The four positions a Kukie-managed script can be injected at, and when to use each
Position	Where the tag lands	Reach for it when
Head, start	The very first thing inside the page head	A tag that other tags expect to find already in place by the time they run
Head, end	After the rest of the head, just before the body opens	The default, and the right answer for most analytics and tag manager snippets
Body, start	Immediately inside the opening body tag	The vendor instructions say to paste directly after the body opens, which is common for pixels and noscript fallbacks
Body, end	The last thing on the page	Chat widgets, session recording and anything that does not need to run before the visitor can see the content

If you are unsure, leave it at head end. It is the position most vendor documentation assumes, and it is what a new script is given unless you change it.

Why Google's own tags are deliberately not hard-blocked

This is the part that confuses people, so it is worth stating plainly. When Google Consent Mode v2 is enabled on your site, Kukie stops hard-blocking Google's scripts and lets them load. That is not an oversight. It is the correct handling, and switching it off would make your measurement worse without making your visitors any more private.

Google built Consent Mode precisely so that its tags could be present on a page without behaving badly. With Consent Mode active, a Google tag loads into a restricted state: it does not write advertising or analytics cookies and it does not identify anybody until a consent signal says it may. Kukie sends that signal the instant the visitor answers the banner. Refuse, and the tag stays restricted for the whole visit.

Hard-blocking the same tag would mean Google never receives the refusal at all, which is worse on both counts: nothing is recorded, and you lose the modelled conversions Google can reconstruct from the restricted signals. Every non-Google tracker on the recognition list is unaffected and stays blocked in the ordinary way.

In short

Consent Mode on: Google tags load, restricted and cookieless, and are told the answer as soon as there is one.
Consent Mode off: Google tags are treated like any other known tracker and held back until the category is allowed.
Either way: No advertising or analytics cookie is written for a visitor who refused. What changes is whether Google hears about the refusal.

From "no idea what is on my site" to controlled tags

You do not have to know what your site loads before you start. The usual route takes four steps and no code beyond the one script tag that installs Kukie.

1

Scan the site

A headless browser opens your pages the way a visitor would and records the cookies and third-party code that appear. You get a list instead of a guess.
2

Let the detectors sort it

Thirteen built-in service detectors recognise common services in the scan results and propose the category each one belongs in, so the first pass is done for you.
3

Accept, correct, add

You have the final say on every category. Anything the scan missed, or a tag you have not added to the site yet, gets pasted into the Script Centre by hand.
4

Choose the position and publish

Pick one of the four page positions, save, and the tag is out of your page source and behind consent. Change the category later and the change takes effect on the next page load.

Once it is running, every decision a visitor makes is stored, so you can see which categories are actually being allowed rather than assuming. That view lives in consent analytics and records.

When does script blocking matter most?

Any site with a tracking tag needs it. These are the situations where the gap between having a banner and having blocking does the most damage.

You run advertising

Advertising pixels are the tags regulators look at first and the ones visitors are most likely to refuse. Getting the signal right protects both the visitor and your reporting, which is exactly what the Consent Mode exception above is for.
Your site has been around a while

Older sites accumulate tags the way lofts accumulate boxes. A scan followed by a pass through the Script Centre is usually the first time anyone has seen the full list, and it is common to remove two or three vendors nobody is using any more.
Somebody else changes your site

An agency, a freelancer or a marketing team adding tags without telling anyone is normal, not negligent. Tags held in the Script Centre are visible in one place and are governed by consent by default, rather than depending on whoever pasted them remembering the rules.
You embed video, maps or social content

Those are not scripts, they are visible boxes on the page, and blanking them leaves a hole where your content was. They belong to iFrame blocking, which swaps the embed for a placeholder the visitor can unlock. The two features cover different halves of the same problem and are designed to be used together.

Auto-block mode and the Script Centre are part of the consent configuration on every site you add. Compare plans if you need more sites, more scanned pages or longer consent retention, or start with the free cookie scanner to see what you are dealing with first.

Features that work with this one

Blocking is one link in the chain. These are the pieces on either side of it.

iFrame blocking

Embeds wait for consent

Cookie scanner

Find every cookie automatically

Analytics

Consent rates and records

See the full feature set

Script blocking questions

What site owners ask before they turn blocking on, and after they turn it on and something looks different.

How do I block scripts before consent?

Two ways, and most sites use both. Auto-block mode recognises 30+ known tracking scripts and holds them back with no per-script setup, so a site that only runs mainstream analytics and advertising tags is covered the moment it is switched on. Anything the list does not recognise goes into the Script Centre, where you paste the snippet once and choose which consent category has to be allowed before it runs.

What happens if analytics runs before a visitor accepts cookies?

The measurement cookie is written and the first pageview is sent before anyone has agreed to anything, which is the single most common finding in cookie enforcement across the EU. It is also easy for anyone to verify from a browser, which is why complaints about it tend to arrive with evidence already attached. The visitor may then reject the category, but the data has already left.

Does Google Tag Manager need to be blocked before consent?

It depends on how you send consent signals. If Google Consent Mode v2 is switched on in Kukie, Google tags including Tag Manager are deliberately exempt from hard blocking: they load but stay in a restricted, cookieless state until consent arrives, because that is the mechanism Google built for this. If Consent Mode is off, Tag Manager is treated like any other known tracker and held back until the analytics category is allowed.

Can I block a third-party script Kukie does not recognise?

Yes, and that is what the Script Centre is for. A list of known trackers can never cover every vendor on the internet, so any script, pixel, inline snippet or stylesheet can be added by hand and attached to a consent category. It then loads only after a visitor allows that category, at whichever of the four page positions you choose.

How do I check whether my tags are still firing before consent?

Load your site in a private browsing window, refuse the banner, and look at what the browser has actually requested. If you would rather not do that manually, the free third-party script audit loads a public page of your site and reports which third-party scripts run before any consent is given. It is the fastest way to find out whether the blocking you think you have is the blocking you actually have.

Will blocking scripts break my website?

Blocking is scoped to third-party tracking and marketing tags, not to the code that makes your pages work. Your own scripts are untouched unless you deliberately add them to the Script Centre. The visible break people worry about is embedded content such as video players and maps, and those are handled separately by iFrame blocking, which shows a placeholder in place of the embed rather than leaving a gap.

Stop your tags firing before anyone has agreed

Free plan, no card required. Switch on auto-block, add the rest in the Script Centre.

Start Free → View pricing

Block scripts before consent,
release them the moment it arrives

A banner that does not block anything is decoration