Hold back tracking and advertising code by default until visitors accept its category

Paste each tracking, advertising, or chat script into the Vendor Scripts tab of the Cookie Consent kit, and by default it waits for the visitor to accept its category. Vendor scripts belong to the Cookie Consent kit in TermsFeed AutoTerms and have no kit of their own. Open TermsFeed > Compliance Kits in your WordPress admin, click the "Configure" button in the Cookie Consent box, and select the "Vendor Scripts" tab.

A turned-off Cookie Consent kit does not print the vendor scripts, so none of them runs, with or without consent. Turn the kit on and check the consent banner with Add a Cookie Banner to WordPress.

The 4 vendor script types and when each one runs

Every vendor script takes 1 of 4 Types, and each Type is a category of TermsFeed Free Cookie Consent 4.2.0. Match each Type to the moment its scripts run under the 2 Compliance preferences, with the page_load_consent_levels list each one sets: ["strictly-necessary"] under GDPR and all 4 categories under ePrivacy.

Type on the add form Category With the GDPR preference (express, default list) With the ePrivacy preference (implied, default list)
"Strictly Necessary (i.e. account login related cookies)" strictly-necessary Runs on every page load Runs on every page load
"Functionality (i.e. remembering user choices)" functionality Runs after the visitor accepts functionality Runs on every page load until the visitor turns it off
"Tracking and Performance (i.e. Google Analytics)" tracking Runs after the visitor accepts tracking Runs on every page load until the visitor turns it off
"Targeting and Advertising (i.e. Google AdSense, Google AdWords)" targeting Runs after the visitor accepts targeting Runs on every page load until the visitor turns it off

The visitor accepts the categories on the consent banner or in the Preferences Center. Put each tool in the category visitors expect with The 4 Cookie Categories in Free Cookie Consent.

How to add a vendor script

Fill in the "Add a new Vendor Script" form at the top of the tab, add the script to the list, and save the tab. Then check that the script waits for consent under the default GDPR preference.

  1. Type a Name, such as "Google Analytics". The plugin uses the Name in the page source to label the script.
  2. Choose a Type from the 4 categories.
  3. Paste the complete vendor code into Script, <script> tags included.
  4. Click the "Add vendor script" button. The script appears as a row of the "Vendor Scripts" table, with its Name, its category ID in the Type column, and its code.
  5. Click the "Save Changes" button. The plugin stores the list only on this click, so a row added without saving disappears when you leave the tab.
  6. Clear your page cache. Close every private window, open a new one, open Chrome DevTools, select the Network tab, type the vendor host in the filter box, and load your WordPress website. Under the GDPR preference, confirm that no request appears before you answer the consent banner, and that the request appears after you accept the category. A "Strictly Necessary" script sends its request at once.

Pressing Enter in the Name field or on a Type clicks the "Add vendor script" button for you. The "Save Changes" button adds the script of a filled-in form that you have not added yet, and stops the save with an alert when that script is incomplete. The "Save Changes" button ignores a form that holds only a Type, with an empty Name and Script.

The Vendor Scripts tab with the add form filled in for Google Analytics, the Add vendor script button marked, and a Meta Pixel row

Alerts of the "Add vendor script" form

The "Add vendor script" button refuses an incomplete entry with an alert and puts the cursor in the field to fix.

Alert Fix
"Please enter a Name for the vendor script." Type a Name.
"Please select a Type for the vendor script." Choose 1 of the 4 Types.
"Please enter Script code for the vendor script." Paste the vendor code into Script.
"Please enter the <script> code of the vendor script. Other HTML, such as <noscript> or <img>, cannot wait for consent and is not added to your website." Paste the <script> part of the vendor code and leave out the rest.
"A <script> tag in the Script code has no closing </script> tag, so that script would not be added to your website. Please paste the complete code of the vendor script." Copy the code again from the vendor and paste all of it.

What the plugin keeps from the vendor code you paste

The plugin prints every JavaScript <script> of the pasted code with its src, its attributes, and its code. It replaces the type of each one, so that the Cookie Consent script runs it only once its category is allowed to run. It adds an id to a script that has none. Compare the exact tags each vendor script gets in the page source in Cookie Banner Code on WordPress Pages.

The plugin handles vendor attributes and the special kinds of pasted code by these rules, and wraps or retypes some kinds of code.

  1. Vendor attributes stay. async, defer, data-* attributes, and the vendor id reach the page with their values, because vendor code often reads them. A pasted data-cookie-consent is the exception: the plugin replaces it with the Type you choose.
  2. Data blocks print as they are and never run. A script whose type is neither JavaScript nor text/plain, such as JSON-LD (application/ld+json), JSON, an import map, or a template, keeps its type and its text and needs no consent.
  3. A module runs as a module once its category runs. The plugin prints a <script type="module"> as a short classic script that adds the module, with its attributes and code, once its category runs.
  4. Code with no <script> tag becomes a single script. The plugin wraps the code in a <script> tag and leaves out HTML comments before the code, such as <!-- Hotjar -->.
  5. Scripts tagged for another consent tool wait for the Type you choose. A script that already carries type="text/plain" runs as JavaScript after the visitor accepts the category of its Type.

What the plugin drops from the vendor code you paste

From pasted code that holds a <script>, the plugin drops every other HTML element, because that markup runs or loads without consent. It drops any text outside the <script> tags too. A <noscript> fallback with a tracking pixel loads for visitors with JavaScript off, who never see the consent banner, so the plugin leaves it out.

Look for these parts when the page source shows less than you pasted.

  • <noscript> blocks, <img> pixels, <iframe> tags, and any other HTML outside a <script> never print.
  • Scripts inside HTML comments, such as a commented-out <!-- <script>...</script> -->, never print.
  • A <script> with no closing </script> never prints, and the rest of the code after it is left out with it.
  • Code with no <script> tag that starts with HTML or holds only comments prints nothing.
  • HTML comments between the scripts of a vendor snippet are dropped, while the scripts around them stay.

Warnings in the "Vendor Scripts" list

A row of the Vendor Scripts table shows a red warning when its code never reaches your WordPress website or never runs. Each warning names its fix, and a row without a warning prints every <script> it holds outside HTML comments.

Warning in the row What happens on the website Fix
"No Type: this script never loads. Choose a Type, then click Save Changes." The script prints with an empty category and never runs Pick a Type in the "- Select Type -" list of the row, then click the "Save Changes" button
"No <script> tag: this code is not added to your website. Delete it and add the <script> code of the vendor." For code that starts with HTML, only the 2 HTML comments with the Name, with nothing between them Delete the row and add the <script> code of the vendor
"Incomplete <script> tag (e.g. no closing </script>): this code is not added to your website, or only in part. Delete it and add the complete code of the vendor." The 2 HTML comments, with the scripts before the incomplete one or with nothing between them Delete the row and add the complete vendor code

A row without a warning runs once your Compliance preference or the visitor allows its category. Code made only of HTML comments with no <script> inside them is the exception: it does not show a warning but prints only the 2 HTML comments with the Name. Find every other reason a vendor script never runs in Vendor Script Never Runs in WordPress.

The id the plugin gives each vendor script

A vendor script without an id of its own gets termsfeed-autoterms-cookie-consent-vendor-script- followed by its Name in lower case, letters and digits only. The Name "Google Analytics" gives termsfeed-autoterms-cookie-consent-vendor-script-googleanalytics. The second script of the same entry adds -2, the third -3, and so on. Scripts with their own id keep it and still use up a number. Data blocks do not get an added id and are not counted.

Use the id to find a vendor script in the Elements tab, or to target it from a test. Each entry sits between 2 HTML comments that repeat its Name in capitals. Compare the full kit output in the page source with Cookie Banner Code on WordPress Pages.

How to reorder, delete, or change a vendor script

Use the "Move Up" and "Move Down" buttons to change the order, the "Delete" button to remove a script, and the "Save Changes" button after either one. The plugin prints vendor scripts in the order of the list, so put a script above the scripts of its category that depend on it. The "Delete" button asks "Are you sure you want to delete this Vendor Script?" before it removes the row. Read how the Cookie Consent script releases tagged scripts in Attributes of a Cookie Consent tagged script.

The list has no edit button, and the Code column is read-only. Replace the script to change it.

  1. Add the corrected code as a new vendor script.
  2. Delete the old row.
  3. Move the new row into place and click the "Save Changes" button.

A user without the WordPress unfiltered_html capability reorders and deletes the vendor scripts in the list. The plugin refuses any save by that user that adds new code, and keeps the whole list as it was. Ask a user who holds unfiltered_html, such as a Super Admin on a network, to add the code. Find the error and who lacks the capability in Code or HTML Not Saving in WordPress.

Add Google Analytics 4 as a vendor script

Add the Google tag of Google Analytics 4 as a tracking vendor script, and under the default GDPR preference Google Analytics 4 sends nothing before the visitor accepts tracking. Copy the code Google shows under Admin > Data collection and modification > Data streams > Web > your web stream > View tag instructions > Install manually.

Add the Google tag on the Vendor Scripts tab.

  1. Type the Name "Google Analytics" and choose "Tracking and Performance (i.e. Google Analytics)".
  2. Paste the code into the "Script" field and click the "Add vendor script" button.
  3. Click the "Save Changes" button.

The tag you copy looks like this, with your Measurement ID in place of G-XXXXXXXXXX.

<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());

  gtag('config', 'G-XXXXXXXXXX');
</script>

The plugin prints the 2 scripts in the footer of every page, tagged for the tracking category and with an id each. The plugin drops the leading comment of the Google snippet.

<!-- Cookie Consent by TermsFeed https://www.TermsFeed.com - GOOGLE ANALYTICS Vendor Script -->
<script type="text/plain" id="termsfeed-autoterms-cookie-consent-vendor-script-googleanalytics" data-cookie-consent="tracking" async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script type="text/plain" id="termsfeed-autoterms-cookie-consent-vendor-script-googleanalytics-2" data-cookie-consent="tracking">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());

  gtag('config', 'G-XXXXXXXXXX');
</script>
<!-- End of Cookie Consent by TermsFeed https://www.TermsFeed.com - GOOGLE ANALYTICS Vendor Script -->

Check the result in the page source and in the Network tab.

  1. Clear your page cache, open the page source of your WordPress website, and search for GOOGLE ANALYTICS Vendor Script to find the tagged scripts.
  2. Close every private window. Open a new one, open Chrome DevTools, select the Network tab, type googletagmanager.com in the filter box, and load any page of your WordPress website. With the GDPR preference, no request appears before you answer, and gtag/js returns status 200 after a click on the "I agree" button.

Google Consent Mode v2 needs default signals in the <head> and updates from the Callbacks of the kit. Write the updates with Cookie Consent Callbacks in WordPress.

Add only the default signals, because this vendor script already adds the Google tag. Copy the defaults into the <head> from Set the Google Consent Mode v2 defaults before the Google tag.