How it works

Script blocking

How Consentico blocks tracking scripts until visitors give consent, and what to do when scripts slip through.

4 min read

Quick Answer

Consentico automatically blocks most tracking scripts (Google Analytics, Meta Pixel, Klaviyo, etc.) until visitors consent. Scripts hardcoded in your theme HTML can't be blocked — those need manual fixes.

What gets blocked automatically

When a visitor hasn't given consent, Consentico blocks:

Analytics

  • Google Analytics (GA4, Universal Analytics)
  • Google Tag Manager
  • Hotjar
  • Microsoft Clarity
  • Heap
  • Mixpanel
  • Amplitude

Marketing

  • Meta Pixel (Facebook)
  • TikTok Pixel
  • Pinterest Tag
  • Snapchat Pixel
  • Twitter Pixel
  • LinkedIn Insight Tag

Email & CRM

  • Klaviyo (when loaded dynamically)
  • Mailchimp
  • Omnisend

Other

  • Intercom
  • Drift
  • Zendesk
  • Most third-party widgets

How blocking works

Consentico uses three layers of protection:

  1. Script interception — We override document.createElement to catch scripts as they're added to the page
  2. DOM monitoring — A MutationObserver watches for script tags being inserted
  3. Manual tagging — Scripts marked with type="text/plain" are held until consent

This catches scripts that are loaded dynamically (via JavaScript), which is how most modern tracking works.

What we CAN'T block

Scripts that are hardcoded directly in your HTML load before any JavaScript runs. This is a browser limitation — not specific to Consentico or any other consent app.

Example of a script we can't block:

<!-- In theme.liquid — loads immediately when the page loads -->
<script src="https://static.klaviyo.com/onsite/js/klaviyo.js"></script>

Example of a script we CAN block:

<!-- Loaded via JavaScript — we intercept this -->
<script>
  var s = document.createElement('script');
  s.src = 'https://static.klaviyo.com/onsite/js/klaviyo.js';
  document.head.appendChild(s);
</script>

This limitation applies to ALL consent management apps — CookieYes, Cookiebot, OneTrust, everyone. It's how browsers work.

How to check if scripts are leaking

How to fix unblocked scripts

Option 1: Check the app's settings

If the script comes from a Shopify app (like Klaviyo), check the app's settings for a "consent" or "privacy" option. Many apps can be configured to respect Shopify's Customer Privacy API.

Option 2: Use Google Tag Manager

Move your tracking into GTM with consent controls. This gives you full control over when scripts fire.

  1. Set up GTM as a Shopify Custom Pixel
  2. Add your tracking tags to GTM
  3. Configure them to require consent before firing
  4. Remove the hardcoded scripts from your theme

Option 3: Manual blocking (theme code only)

If the script is in your theme code (not from an app), you can mark it for blocking:

Before:

<script src="https://example.com/tracker.js"></script>

After:

<script type="text/plain" 
        data-cookie-category="marketing" 
        data-src="https://example.com/tracker.js"></script>

Consentico will activate this script only after the visitor accepts marketing cookies.

This only works for scripts in your theme code. You can't edit scripts that Shopify apps inject.

Google is special

Google scripts (Analytics, Ads, Tag Manager) work differently because of Google Consent Mode.

Even when consent is denied, Google scripts can load and send "cookieless pings" — anonymous data that Google uses to estimate your conversions. This is compliant because no personal data is collected without consent.

That's why you might see Google requests in DevTools even before consent. This is expected and correct behavior.

Learn more about Google Consent Mode →

Was this page helpful? Let us know