Skip to content

Early-bird lifetime licence: $199 once, for the first 200 buyers only. See the offer

All docs

Cookie consent for scripts Pro

Pro · This feature is part of Snipfire Pro. Plans

In the EU and many other places, analytics and marketing tags (Google Analytics, Meta Pixel, Hotjar…) may only run after the visitor agrees in a cookie banner. Snipfire handles this for JavaScript and HTML snippets:

  • The snippet waits until the visitor accepts the cookie category you chose.
  • The moment they click Accept, it runs, without a page reload, in the right order.
  • It works with page caching: every visitor gets the same page, and the decision happens in their browser.
  • It works with the consent tool you already have.
  1. Open a JavaScript or HTML snippet.
  2. In the settings panel, set Cookie consent to the category it needs:
    • Wait for: Statistics (analytics) for analytics (Google Analytics, Matomo, Hotjar…)
    • Wait for: Marketing for advertising and retargeting (Meta Pixel, Google Ads, TikTok…)
    • Wait for: Preferences for things that remember choices
    • Wait for: Functional for functional cookies. Most consent tools treat these as always allowed (Cookiebot, CookieYes, Borlabs Cookie and Google Consent Mode do), so with them the snippet runs straight away.
  3. Save.

The sidebar marks the snippet Consent, and the settings panel tells you what will happen, for example Runs only after the visitor accepts "Statistics (analytics)" in Complianz, straight away, without a reload. Only on the public site.

Not needed (the default) runs the snippet normally.

Example: Google Analytics

Create an HTML snippet in Site header (wp_head), paste the tag exactly as Google gives it, and set Cookie consent to Wait for: Statistics (analytics):

<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script>
    window.dataLayer = window.dataLayer || [];
    function gtag(){dataLayer.push(arguments);}
    gtag('js', new Date());
    gtag('config', 'G-XXXXXXX');
</script>

Snipfire finds your consent tool by itself. Tools & Safe Mode → Cookie consent shows which one it found.

  • Complianz
  • CookieYes
  • Cookiebot
  • Borlabs Cookie
  • Any tool that uses the WP Consent API
  • Any tool that sends Google Consent Mode v2, which covers Real Cookie Banner and most other consent tools

With Google Consent Mode, Snipfire reads the categories like this: analytics_storage → Statistics, ad_storage → Marketing, functionality_storage and personalization_storage → Preferences.

Complianz, CookieYes, the WP Consent API and Google Consent Mode have been tested against the real tools. Cookiebot and Borlabs Cookie follow their published APIs.

Choose what happens under Tools & Safe Mode → Cookie consent: Without a consent tool, snippets that need consent:

  • don't run (safest for EU sites), the default, or
  • run for everyone.

When you save a snippet that waits for consent and no tool is found, Snipfire reminds you which of the two applies.

If a consent tool is installed but hasn't loaded yet on a page, Snipfire always waits for it: it never falls back to "run" while a known consent tool is active.

Global Privacy Control

Global Privacy Control (GPC) is a signal some browsers and browser extensions send on the visitor's behalf: "don't sell or share my data". California and several other US states require sites to honour it.

Snipfire respects it by default. Visitors whose browser sends Global Privacy Control never get snippets that wait for Marketing, even if they accept marketing cookies in your banner. Snippets that wait for Statistics, Preferences or Functional aren't affected. The Cookie consent given condition treats these visitors the same way: Marketing counts as not given.

To change it, go to Tools & Safe Mode → Cookie consent and tick or untick Respect Global Privacy Control, then click Save. Or from the command line:

wp snipfire consent gpc off   # ignore Global Privacy Control
wp snipfire consent gpc on    # respect it again (the default)

How it works

The snippet is printed in the page in an inactive form: scripts as <script type="text/plain">, HTML inside a <template>. A small loader (added only on pages that need it) listens to your consent tool. When the visitor accepts the category, it activates the held-back snippets in page order. A script file finishes loading before the next held-back snippet runs, and scripts inside held-back HTML keep their own type (JSON-LD stays JSON-LD).

Because the page is the same for everyone, it's safe with any page cache.

Only on the public site

Consent applies on the front end. In the admin area and on the login page, snippets run without waiting. Snipfire warns you if you set Cookie consent on a snippet that runs there.

PHP runs on the server, before the banner is ever shown, so it can't wait for a click. For PHP (and for any snippet that must decide on the server) use the Cookie consent given condition. It reads your consent tool's cookie, so it applies from the next page view after the visitor accepts, and it varies per visitor (mind your page cache).

For JavaScript and HTML, the Cookie consent setting is better: it's instant and cache-safe.

Without Pro

If Snipfire Pro isn't active, a snippet that waits for consent doesn't run at all, rather than running without consent.

From the command line 

wp snipfire consent                       # the consent tool found, how many snippets wait, and Global Privacy Control
wp snipfire consent fallback allow        # without a consent tool: run for everyone
wp snipfire consent fallback block        # without a consent tool: don't run
wp snipfire consent gpc on                # respect Global Privacy Control (the default); "off" to ignore it
wp snipfire update 12 --consent=statistics

This isn't legal advice: check with your own advisor which scripts need which consent on your site.

Something unclear or missing? Tell us