Vendor Recipes for Free Cookie Consent

Find the category, the code, and the check for each tool on your site

Look up the TermsFeed Free Cookie Consent category of each tool, the code to paste, and the check of what the tool sends and stores before the answer. Each recipe gives the code for one tool, a check in the Network and Application tabs, and the mistakes that make the tool run too early or not at all.

Category and Network filter for each vendor recipe

Tag each tool with its category in data-cookie-consent, or grant the vendor signal from a callback once the visitor accepts that category, as its recipe shows. Type the Network filter in the Network tab of DevTools to list the requests of that tool.

Advanced consent mode loads the Google tag untagged, so collect requests with gcs=G100 appear before the answer and do not store cookies. Clarity loaded untagged (Approach 2 of its recipe) sends cookieless requests before the answer too, and the HubSpot recipe that grants with setHubSpotConsent loads hs-scripts before the answer. For these untagged setups, check the cookies the recipe names in the Application tab, such as _ga or __hstc, instead of the absence of requests. The untagged Meta and TikTok base code downloads the pixel library before the answer. The Meta and TikTok consent commands hold the pixel events, so check that no event request appears before the grant.

Check the category of each tool against what it does on your site, because each recipe describes the common use. HubSpot used only to measure visits takes tracking, and the same tracking code used to build advertising audiences belongs to targeting. Map each category onto the Google, Microsoft Clarity, Meta, TikTok, and HubSpot signals with Map Categories to Vendor Consent Signals.

How to tag a tool that is not listed

Tag any tool that runs from a classic <script> element in your own markup: change its type to text/plain and add data-cookie-consent with the category the tool takes. Cookie Consent runs the script with its other attributes once the visitor accepts that category. The checks assume express consent with page_load_consent_levels left out or at the generator value ["strictly-necessary"]. Tag each such tool by its category, then check that its requests start only after a click on the "I agree" button.

1. Choose the category from what the tool does: functionality for a service the visitor uses, tracking for analytics and session recording, and targeting for advertising and marketing audiences.
2. Find every <script> element the vendor gives you, inline and external, and tag each one with that category, because an untagged part keeps running.
3. Keep the tagged scripts in the page HTML, in the order the vendor gives them. Keep async on external scripts, unless inline code in the same category depends on the library.
4. Publish the change and clear any page cache. Close every private window, open a new one, open DevTools on the Network tab filtered on the hostname the tool loads from, and load the page. Check that no request appears before you click the "I agree" button, and that the requests appear after the click.

Cookie Consent does not hold iframes, images, or stylesheets, or scripts a plugin, an app, or a tag manager adds after it starts. A module script you tag runs as a classic script on consent, so one that uses import or export fails. Put an iframe behind a placeholder with Block Embeds and Iframes Until Consent, and read every rule of tagging in Block Scripts Until Consent.

Why vendor noscript fallbacks stay out of the page

Delete the <noscript> element a vendor adds to its code, such as the image pixels of the Meta Pixel and the LinkedIn Insight Tag. The browser shows a <noscript> element only to visitors with JavaScript turned off. Cookie Consent is a script, so those visitors never see the consent banner, and the image in the <noscript> element sends a page view to the vendor without consent.

Why server-side event sending bypasses the consent banner

Cookie Consent holds scripts in the browser, so an event your server sends to a vendor never passes through the consent banner. Server-side tools (the Meta Conversions API, the TikTok Events API, the Google Analytics 4 Measurement Protocol) send data from your server or from the platform, whatever the visitor chose. A withdrawal does not recall events your server already sent.

Check the saved choice on your server before each event. The cookie_consent_level cookie holds the 4 categories as URL-encoded JSON and reaches your server with requests from your own pages. It is SameSite=Strict, so the browser leaves it out of the first request of a visitor who arrives from another site. Read it in PHP, Python, Node.js, and other server languages with Read the Consent State.