Set up a compliant cookie banner on Squarespace, Wix or WordPress (with Consent Mode v2)

A cookie banner has three jobs: stop non-essential trackers until the visitor answers, make refusing as easy as accepting, and remember the answer. This tutorial shows how to add a cookie banner to a website built on Squarespace, Wix or WordPress, how to pass the visitor’s choice to Google with Consent Mode v2, and how to check in your own browser that it really works.

Most of the sites I build for clients run on Squarespace, so I start there. The rules behind each setting (which cookies need consent, what France’s CNIL and the UK’s ICO check) are in my guide to cookie banner requirements in 2026, part of my GDPR guide for small teams. This tutorial is practical information, not legal advice.

It is not only for EU businesses. A UK, Swiss or Canadian company whose site tracks visitors in the EU should plan the same banner for them; my article on GDPR for companies outside the EU sets out when the rules reach you.

Before you start: list what your site loads

A banner can only hold back what you know about. Before you change any setting, list everything on your site that may store or read something in a visitor’s browser:

• Analytics: Google Analytics, your website builder’s own statistics, Microsoft Clarity.
• Advertising: the Google Ads tag, the Meta Pixel, the LinkedIn Insight Tag.
• Embeds: YouTube videos, Google Maps, booking and chat widgets.
• Pasted code: code injection on Squarespace, custom code on Wix, a header-and-footer plugin on WordPress.

Where each item was added decides whether a built-in banner can control it:

A consent management platform (CMP) is a service that shows the banner, blocks scripts until the visitor answers, records each choice and passes it on to tools such as Google’s. One more point to settle first: in the UK, since February 2026, analytics used only for statistics can run without consent if you explain it and make objecting easy, but advertising still needs consent. With visitors on both sides of the Channel, one banner built to the EU standard keeps things simple.

How to add a cookie banner to a website built on Squarespace

Squarespace’s built-in banner controls Squarespace’s own non-essential cookies and Google Analytics when it is connected through the built-in integration. It does not hold back code you paste into code injection, and Squarespace’s own list of cookies says the banner restricts some third-party services, not all. I usually add a little custom code to my clients’ Squarespace sites, which is exactly the part the built-in banner leaves out.

1. In Settings, open the Cookies & Data Privacy panel (older guides call it Cookies & Visitor Data) and switch on the cookie banner.
2. Switch on the Manage cookies button. According to Squarespace’s cookie banner guide, this is what keeps non-essential cookies such as Google Analytics off visitors’ devices until they consent.
3. Switch on the Decline All button, so that refusing takes one click on the first screen, like accepting. The disclaimer text and the button labels can be edited in the same panel.
4. For the link that lets visitors change their minds later, choose the Subfooter or Pill layout, not Hidden.
5. Connect Google Analytics through Squarespace’s built-in integration, by saving your measurement ID, rather than pasting Google’s code: the integration follows the banner.

Squarespace’s help pages do not all use the same labels for these options, so go by what each one does. If your site is not built yet, start with my Squarespace tutorial.

When code injection is involved

Google Ads, the Meta Pixel, Clarity or a booking widget pasted into code injection will run whatever the visitor answers. Squarespace’s guide points to example code on its forum for Google Ads, but Squarespace does not support code-based changes. As soon as you have more than one such script, a CMP is the cleaner route:

1. Choose a CMP that documents a Squarespace installation (CookieHub and iubenda, for example, publish guides) and run its cookie scan.
2. Paste its script at the very top of the Header field of code injection, which needs the Core plan or above. My guide to Squarespace code injection shows where the field is and how to undo a mistake.
3. Tag your other scripts the way the CMP asks, often by giving each <script> tag type="text/plain" and a category attribute, so that they wait for consent.
4. Switch off Squarespace’s own banner, so that visitors answer one banner, not two.

Wix: add the Usercentrics banner and classify your custom code

As of 19 October 2026, Wix no longer offers its original cookie banner to new sites; banners already in place keep working. New sites get Usercentrics for Wix, a consent platform that Wix says supports Google Consent Mode v2. Wix’s guide to the Usercentrics banner has the full detail.

1. In your site’s dashboard, open Privacy & Cookies and click Add to Site next to “Add a cookie consent banner”, then accept the terms.
2. In the Cookie Consent Banner section, adjust the layout and theme, and check that the first screen shows a button to refuse next to the one to accept.
3. Keep the privacy trigger, the button that reopens the settings, on every page.
4. Check the languages. According to Usercentrics, the free plan includes unlimited banner views, Google Consent Mode v2 and one default language; a site in English and French needs the paid plan to show each visitor the banner in their language.

Then go to Settings > Custom Code and open each snippet. Set its Code Type to Analytics or Marketing when it measures or advertises, or to Functional for preferences; for a script that does both, Wix’s developer documentation says to pick the stricter category. Wix’s consent log does not cover custom code, so keep that list short.

If you connect Google Tag Manager through Wix’s integration, Wix fires its tags after consent. In Tag Manager, set each non-Google tag to “Require additional consent” with the matching type: ad_storage, analytics_storage or functionality_storage.

WordPress: install a consent plugin

WordPress has no cookie banner of its own. It is not the platform I recommend to owners who update their site themselves, but on this point it is well served: consent plugins do most of the work. Here are three common ones, with what their WordPress.org pages list for the free version as of 19 October 2026:

The set-up follows the same pattern whichever you choose:

1. Remove any older cookie notice plugin, so that only one banner remains.
2. In Plugins > Add New Plugin, search for the plugin, then install and activate it.
3. Follow its set-up wizard to the end. Some connect to an online account, others run entirely inside WordPress. Choose the regions you serve, run the scan and check the category of each cookie.
4. Turn on its Google Consent Mode v2 option.
5. Check that a refuse button sits next to the accept button on the first screen.
6. Add the plugin’s way of changing the choice to your footer: a menu link, a shortcode or a floating button, depending on the plugin.
7. Compare the scan with your list from the first step. A script added by your theme or another plugin that the scan missed will run before consent until you declare it.

Google Consent Mode v2: what it sends and how to turn it on

Consent mode passes the visitor’s answer to Google’s tags. Version 2, introduced in November 2023, uses four signals: ad_storage and analytics_storage (may Google’s tags use cookies for ads or for analytics), ad_user_data (may data be sent to Google for advertising) and ad_personalization (may it be used for personalised ads). Google’s EU user consent policy covers visitors in the EEA, the UK and Switzerland, and accounts that send no v2 signals can lose remarketing, ad personalisation and part of their conversion measurement.

Each signal starts as denied and changes to granted only when the visitor accepts. A CMP does this for you once its Google option is on. Squarespace’s help says its built-in Google Analytics integration needs only your measurement ID and the banner, and calls consent mode a Google feature; Google tags added by code need a CMP with that option. On Wix, Usercentrics says no extra set-up is needed once consent mode is on in your Tag Manager configuration. On WordPress, it is the plugin’s option. If you write it yourself, the default must run before the Google tag, as Google’s consent mode guide shows:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied'
  });
</script>
<!-- the Google tag (gtag.js or Tag Manager) comes after this -->

When the visitor accepts, the banner sends the update:

gtag('consent', 'update', {
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted',
  'analytics_storage': 'granted'
});

Loading Google’s tag straight away with these defaults is advanced mode: while consent is denied, the tag sends cookieless pings. In basic mode, the CMP holds the tag back until the visitor accepts, so nothing reaches Google before then, which is the cautious choice in France.

Microsoft Clarity, which I use to see where visitors engage and where they leave, has its own signal. Since 31 October 2025, it sets no cookies for visitors from the EEA, the UK and Switzerland without one. My Microsoft Clarity tutorial shows how to connect it to your banner.

Test your cookie banner in a private window

A banner can look right and still let trackers through. In September 2024, the ICO took action against Sky Betting and Gaming for advertising cookies set before visitors could make a choice (the ICO’s announcement). The check takes a few minutes:

1. Open a private window, so that no earlier choice is stored, and go to your site. Do not touch the banner yet.
2. Open the developer tools (F12, or Cmd+Option+I on a Mac). In Chrome or Edge, go to Application > Storage > Cookies; in Firefox, to the Storage tab. Select your domain.
3. Before any choice, you should see strictly necessary cookies only. Look for _ga and _ga_… (Google Analytics), _gcl_au (Google Ads), _fbp (Meta Pixel), _clck and _clsk (Clarity): none of them should be there.
4. Click Refuse all, reload the page and check again: the list should not grow. If your banner has a close button, closing it should work like refusing, as in the CNIL’s sample banner.
5. In the Network tab, filter on collect. After a refusal in basic mode, no request should reach Google Analytics; in advanced mode, cookieless Google requests are expected. Clarity can also send cookieless requests if your banner loads it with consent denied instead of blocking it.
6. Open a new private window, click Accept all and check that the cookies now appear. If they do not, the banner blocks too much and your statistics will stay empty.
7. Use the footer link to change your mind, refuse, and check that the tags stop.

On Google’s side, Tag Assistant shows the consent state your page sends with each event. Repeat the test in a phone-sized window, and again after every new plugin, pixel or embed.

Final checklist, and when to hand it over

• One banner, with refuse and accept side by side on the first screen.
• Nothing non-essential before a choice, checked in the developer tools.
• A footer link or button to change the choice.
• Consent Mode v2 and Clarity’s signal switched on.
• A cookies section in your privacy policy that matches what the scan found; my guide to what a privacy policy must say covers it.
• A new test after every new tool.

The rules may move. As of 19 October 2026, the EU’s Digital Omnibus, which could change some cookie rules, is still a proposal, so set up for today’s rules.

On a Squarespace or Wix site with built-in analytics only, you do not need me for this: the steps above are within reach of anyone who updates their own site. A lawyer or a DPO is worth paying for when your business depends on advertising data, when you handle sensitive data such as health information, or when a regulator has written to you. And if you would rather hand over the banner, the privacy page and the tests, they are part of the websites I build.