Cookie Consent
Cookie consent controls what runs in a visitor's browser before they have agreed to it.
Where to find it
Architect Panel → Security:
- Cookie Consent — the console — categories, banner and what each category gates
Architect Panel → Configuration:
- Site Settings — where analytics and tracking tags are configured
Why this replaced what came before
The platform previously shipped two bolt-on banners. Neither blocked anything: they drew a banner while the analytics and pixel tags loaded regardless of the answer.
That is the one thing a consent tool has to get right. A banner that records a refusal and then loads the tracker anyway is worse than no banner — it creates a record showing you were told no and did it anyway.
Categories gate tags
Consent is organised into categories — strictly necessary, analytics, marketing and so on — and each category gates the tags assigned to it. A tag in a category the visitor has not accepted does not load.
Strictly necessary cannot be refused, and should contain only what genuinely is: the session cookie, the consent record itself. Anything you would like to have is not strictly necessary.
Setting it up
- Define your categories, keeping them few and comprehensible.
- Assign each tag or tracker to a category. Anything you cannot categorise is a good sign you should not be running it.
- Configure the banner text. Say what the categories do in plain terms.
- Make refusing as easy as accepting — a prominent Accept with a buried Reject is a pattern regulators have been explicit about.
- Test with a fresh browser profile and confirm, in developer tools, that a refused tag genuinely does not load.
Test that it actually blocks
This is the step that matters and the one most often skipped. Open the site in a private window, refuse everything, and look at the network requests. If your analytics endpoint is still being called, the configuration is wrong — and you will not discover it any other way, because the banner looks correct.
Recording consent
The consent decision is recorded, which is what lets you demonstrate compliance. Keep those records — the ability to show what somebody was asked and what they chose is the point of the exercise.
Worked example
A site runs analytics and an advertising pixel. Both are assigned to non-necessary categories. A visitor refusing analytics gets a site that works identically, minus the measurement. The team verified this by refusing consent and confirming no request was made to either endpoint before shipping the change.
Recommendations
- Verify blocking in the browser, not by reading the configuration.
- Keep strictly necessary genuinely necessary.
- Make reject as easy as accept.
- Re-test after adding any new tag. A new tag with no category is the usual leak.