Skip to content
Start free Sign in

Script blocking until consent

Trackers wait for a yes.

Kukie.io holds third-party tags back until the visitor allows their category, then loads them at once. It recognises 30+ known trackers with no setup, and holds any other tag you add in Cookies & Scripts.

Start free (opens in a new tab) Scan your website

Why it matters

A banner on its own blocks nothing.

A banner asks the question and blocking makes the answer count. Without blocking, analytics, ad pixels and heatmaps run on the first page load, before anyone reads the banner.

  • Ignored refusal

    A Reject all that changes nothing

    A visitor selects Reject all, the banner closes and the tags carry on as before, because nothing was connected to the answer. It lasts longer than any other failure, because from the outside the site looks fine and the dashboard looks healthy.

  • Enforcement

    Evidence anyone can collect

    Tracking before consent shows up in any browser, for anyone, in under a minute. Complaints about it arrive with the proof attached, which is why it is one of the most common findings in cookie enforcement across the EU.

  • Forgotten tags

    Tags nobody remembers adding

    An older site has usually collected a pixel from a campaign that ended, a chat widget from a trial nobody cancelled and a snippet a former agency pasted in. Each one sends your visitors to a third party, and you cannot decide about a script you do not know is there.

Check a page with the Script audit

How it works

Four ways a script waits for consent.

Two cover the tags most sites have. Two more cover the edges: services no list recognises and tags written into your own HTML.

  • On from the start

    Auto-block: the known trackers

    Auto-block is on for every new site. Kukie.io watches the page as it builds, and when a script it recognises as a known tracker appears, it holds the script back. When the visitor allows the matching category, the held scripts load. If they refuse, the scripts stay held.

    The list covers 30+ known trackers, each already sorted into its category. Google Analytics and Hotjar count as analytics. Meta Pixel, the TikTok and LinkedIn advertising tags and HubSpot count as marketing. You do not name any of them.

  • Under your control

    Cookies & Scripts: everything else

    Cookies & Scripts keeps a list of the third-party code your site runs. You paste a snippet once, name it and attach it to a consent category. It then leaves your page source: Kukie.io adds it to the page only after a visitor allows that category, so it works for a script no list recognises.

    • Any tag, not a fixed menu. Scripts, tracking pixels, inline snippets and stylesheets.
    • Suggested by a scan. Kukie.io recognises services such as Google Analytics or the Meta Pixel from the cookies a scan finds, and suggests them for you to add.
    • Cleaned when saved. Only the script and noscript tags are kept, without inline event handlers or javascript: and data: sources. The code inside a script tag runs as you pasted it, so paste only code you trust.
    • Paused without deleting. Turn a tag off and keep it, to pause a vendor during a review without losing its snippet.

Custom blocking domains

For a service neither list knows, add the domain its loader script or iFrame comes from in Banner Editor > Integrations > Custom services. Kukie.io holds it until the visitor allows that service, whatever the auto-block switch says.

Learn more about iFrame blocking

A category on a tag in your HTML

A tag written into your page's HTML can start loading before the banner script runs, and no list can stop that. Give it type="text/plain" and a data-cc-category attribute, and it waits for its category every time.

Load order

Four places a tag can load.

Some vendors need their snippet to run first, others only once the page is drawn. Each script in Cookies & Scripts gets one of 4 positions, to match its documentation.

If you are unsure, leave it at Head (end). Most vendor documentation assumes it, and a new script starts there.

The 4 positions a script in Cookies & Scripts can load at, and when to use each
Position Where the tag lands Use it for
Head (start) First inside the page head A tag that other tags expect to find in place by the time they run
Head (end) At the end of the head, before the body opens The default, and the right choice for most analytics and tag manager snippets
Body (start) First inside the body Vendor instructions that say to paste directly after the body opens, common for pixels and noscript fallbacks
Body (end) Last on the page Chat widgets, session recording and anything that does not need to run before the visitor sees the content

Google Consent Mode v2

Consent Mode changes how Google tags load.

When Google Consent Mode v2 is on for your site, Kukie.io stops blocking the scripts served by Google Tag Manager and Google Analytics, including gtag.js, and lets them load. That is deliberate: blocking them as well would make your measurement worse without making your visitors any more private.

Google built Consent Mode so its tags could sit on a page without setting cookies. With Consent Mode on, a Google tag loads in a restricted state: it writes no advertising or analytics cookies and identifies nobody until a consent signal says it may. Kukie.io sends that signal as soon as the visitor answers the banner. If they refuse, the tag stays restricted for the whole visit.

Blocking the tag outright would mean Google never hears about the refusal: nothing is recorded, and you lose the conversions Google can model from the restricted signals. Every other tracker on the list, including Google's DoubleClick and AdSense scripts, stays blocked as usual. With Microsoft UET Consent Mode on, Microsoft's UET tag is treated the same way.

In short
Consent Mode on
Google tags load, restricted and cookieless, and hear the answer as soon as there is one.
Consent Mode off
Google tags are treated like any other known tracker and held back until the category is allowed.
Either way
No advertising or analytics cookie is written for a visitor who refused. What changes is whether Google hears about the refusal.

Getting started

From a scan to controlled tags.

You do not need to know what your site loads before you start. The usual route takes 4 steps and no code beyond the embed code that installs Kukie.io.

  1. Step 1: Scan your site

    An automated browser opens your pages the way a visitor would and records the cookies and third-party code that appear. You get a list instead of a guess.

  2. Step 2: Review the suggestions

    Kukie.io recognises common services, such as Google Analytics and the Meta Pixel, from the cookies in the scan and suggests each one with its category.

  3. Step 3: Accept, correct, add

    You have the final say on every category. Anything the scan missed, or a tag you have not added to the site yet, goes into Cookies & Scripts by hand.

  4. Step 4: Choose the position and publish

    Pick one of the 4 positions and save. The tag leaves your page source and waits for consent. If you change its category later, the change applies on the next page load.

Once it runs, every visitor's choice is stored, so you can see which categories visitors allow instead of assuming. That view is in consent analytics and records.

When it matters most

Where blocking does the most good.

Any site with a tracking tag needs blocking. These are the situations where a banner without it does the most damage.

  • You run advertising

    Ad pixels are the tags regulators look at first and the ones visitors refuse most often. Getting the signal right protects the visitor and your reporting, which is what the Consent Mode handling is for.

    Learn more about Google Consent Mode

  • Your site has been around a while

    Older sites collect tags over the years. A scan followed by a pass through Cookies & Scripts is often the first time anyone sees the full list, and it is common to remove 2 or 3 vendors nobody uses any more.

    Learn more about cookie scanning

  • Somebody else changes your site

    An agency, a freelancer or a marketing team adding tags without telling anyone is normal. Tags in Cookies & Scripts sit in one list and wait for consent by default, whoever pasted them.

  • You embed video, maps or social posts

    These are visible boxes, not invisible scripts, and blanking them leaves a hole in your page. iFrame blocking replaces each one with a placeholder the visitor can use to load it.

    Learn more about iFrame blocking

Questions about script blocking

How do I block scripts before consent?
Auto-block recognises 30+ known tracking scripts and holds them back with no setup, and it is on from the start. For anything the list does not recognise, paste the snippet once into Cookies & Scripts and choose the consent category that must be allowed before it runs. You can also add blocking domains to a service, or mark a tag in your own HTML with its category.
What happens if analytics runs before a visitor accepts cookies?
The measurement cookie is written and the first pageview is sent before anyone has agreed to anything. It is one of the most common findings in cookie enforcement across the EU, and anyone can check it from a browser, so complaints about it tend to arrive with the evidence attached. The visitor may then reject the category, but the data has already left.
Does Google Tag Manager need to be blocked before consent?
It depends on how you send consent signals. With Google Consent Mode v2 turned on in Kukie.io, Google Tag Manager, Google Analytics and the gtag.js loader are exempt from blocking: they load but stay in a restricted, cookieless state until consent arrives, because that is the mechanism Google built for this. With Consent Mode off, Tag Manager is treated like any other known tracker and held back until the analytics category is allowed.
Can I block a third-party script Kukie.io does not recognise?
Yes, in Cookies & Scripts. No list of known trackers can cover every vendor, so you can add any script, pixel, inline snippet or stylesheet by hand and attach it to a consent category. It then loads only after a visitor allows that category, at the position on the page you choose.
How do I check whether my tags still fire before consent?
Load your site in a private browsing window, refuse the banner and look at what the browser requests. To check without doing that by hand, the free Script audit loads a public page of your site and reports which third-party scripts run before any consent is given. It is the quickest way to find out whether the blocking you expect is the blocking you have.
Will blocking scripts break my website?
It should not break the code that makes your pages work. Blocking applies to known third-party tags, and your own scripts are untouched unless you add them in Cookies & Scripts. The list also holds reCAPTCHA and the Google Maps loader until the Functional category is allowed, so a form or map that depends on them loads once the visitor allows that category. Embedded video players and maps are handled by iFrame blocking, which shows a placeholder instead of leaving a gap.

Hold your tags until visitors choose.

Auto-block and Cookies & Scripts come with every plan, including Free. Auto-block is on from the start, and you add the rest in Cookies & Scripts.

Start free (opens in a new tab) See pricing

Features that work with this one

Blocking sits between finding your tags and recording each choice. These features cover both sides.

See all features

More on conditional tag loading

Practical guides to holding tags back, setting up a tag manager and checking that the blocking works.

See all articles

Disclaimer

Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.

Listed on

Kukie.io on Trustpilot (opens in a new tab) Kukie.io on G2 (opens in a new tab) Kukie.io on SaaSHub (opens in a new tab) Kukie.io on AlternativeTo (opens in a new tab)