How to add cookie consent to Squarespace

Squarespace has a barebones cookie banner built in, but it is hard to make compliant and impossible to make fun. Here is how to add a proper GDPR consent banner with Code Injection in a few minutes.

A guide by The Cookie Shooter. Practical guidance, not legal advice.

Before you start: plan requirements

Site-wide Code Injection requires a Squarespace plan that includes it, currently Business and above. On Personal plans you cannot add custom site-wide scripts, which any custom consent solution needs.

Step 1: host the script (or go inline)

Squarespace does not host arbitrary JavaScript files, so pick one:

• Inline (simplest): paste the entire widget code directly into Code Injection. No hosting needed.
• Hosted: upload the-cookie-shooter.js to any static host you control (Netlify, Cloudflare, your own domain) and reference it with a script tag.

Step 2: paste into Code Injection

Go to Settings → Developer Tools → Code Injection and add this to the Footer field:

<script>
  window.TheCookieShooterConfig = {
    siteName: "My Site",
    cookiePolicyUrl: "/cookie-policy",
    lang: "auto"
  };
</script>
<script src="https://your-host.example/the-cookie-shooter.js" defer></script>

The Footer injection loads on every page, so you add it once. If you chose the inline route, paste the widget code in a script tag instead of the src line.

Step 3: turn off the built-in banner and gate your tags

• Disable Squarespace's own banner under Settings → Cookies and Visitor Data, so visitors see one prompt, not two.
• If you added Google Analytics through Squarespace's built-in field, consider moving it to a tagged script in Code Injection instead, so it waits for consent:

  <script type="text/plain" data-consent="analytics"
          src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>

• For Google tags, add Consent Mode v2 defaults in the Header injection so signals start denied and flip to granted on accept.

Test it

Open the site in a private window. The banner should appear, and no tagged trackers should fire before you accept (check the Network tab). Accept, reload, and confirm the choice is remembered.

Frequently asked questions

Which Squarespace plan do I need?

Code Injection requires a plan that includes it, currently Business and above.

Can I replace Squarespace's built-in cookie banner?

Yes. Turn it off under Settings, Cookies and Visitor Data, and let the widget handle consent so visitors only see one prompt.

Where do I host the JavaScript file?

Paste the code inline in Code Injection, or host the file on any static host or CDN you control and reference it with a script tag.