Script Blocking

CookieBoss can prevent third-party scripts from executing until the visitor consents to the relevant cookie category. This is the most reliable way to ensure GDPR compliance.

How it works

  1. You add data-cookieboss-category and type="text/plain" to scripts you want to block
  2. CookieBoss reads these attributes and keeps scripts blocked until consent is given
  3. When the visitor consents, CookieBoss replaces the blocked scripts with executable versions
  4. A MutationObserver watches for dynamically-added scripts, blocking them too

Basic usage

Add two attributes to any script you want to control:

html 
<!-- Before: uncontrolled script -->
<script src="https://example.com/analytics.js"></script>

<!-- After: blocked until analytics consent -->
<script
src="https://example.com/analytics.js"
type="text/plain"
data-cookieboss-category="analytics"
></script>

The type="text/plain" prevents the browser from executing the script. CookieBoss changes it back to text/javascript when the visitor consents to the specified category.

Categories

Use these category values in data-cookieboss-category:

CategoryUse for
analyticsGoogle Analytics, Plausible, Mixpanel, Hotjar
marketingMeta Pixel, Google Ads, LinkedIn Insight, TikTok Pixel
functionalChat widgets, video embeds, personalization tools

Scripts with no data-cookieboss-category attribute are not blocked — they run normally.

The necessary category cannot be blocked. Scripts essential for your site to function should not have the data-cookieboss-category attribute.

Examples

Google Analytics

html 
<script
async
src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"
type="text/plain"
data-cookieboss-category="analytics"
></script>
<script type="text/plain" data-cookieboss-category="analytics">
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-XXXXXXX');
</script>

Meta (Facebook) Pixel

html 
<script type="text/plain" data-cookieboss-category="marketing">
!function(f,b,e,v,n,t,s)
{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t,s)}(window, document,'script',
'https://connect.facebook.net/en_US/fbevents.js');
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');
</script>

HubSpot

html 
<script
type="text/plain"
data-cookieboss-category="marketing"
id="hs-script-loader"
async
defer
src="//js.hs-scripts.com/YOUR_HUBSPOT_ID.js"
></script>

Inline scripts

Inline scripts work the same way:

html 
<script type="text/plain" data-cookieboss-category="functional">
// This code only executes after functional consent
initChatWidget({ apiKey: 'xxx' });
</script>

Dynamic scripts

CookieBoss uses a MutationObserver to watch for scripts added to the DOM after page load (e.g. by other JavaScript). If a dynamically-inserted script has data-cookieboss-category, it will be blocked until consent is given.

Combine with Google Consent Mode

For Google tags specifically, you can use Google Consent Mode V2 instead of script blocking. GCM lets Google tags run in a restricted mode rather than blocking them entirely, which preserves conversion modeling.