Third-Party Script Compliance | Blue Frog Docs

Third-Party Script Compliance

Ensuring third-party scripts comply with privacy regulations and consent requirements.

Third-Party Script Compliance

What This Means

Third-party scripts (analytics, advertising, social plugins) often set cookies and collect user data. Loading these scripts before obtaining consent violates privacy regulations like GDPR.

Common non-compliant scripts:

How to Diagnose

1. Network Tab Analysis

  1. Open a private browser window
  2. Open DevTools > Network tab
  3. Visit your site (DON'T interact with consent banner)
  4. Look for these domains loading:
    • google-analytics.com
    • googletagmanager.com (if firing tags pre-consent)
    • connect.facebook.net
    • analytics.tiktok.com
    • hotjar.com
    • Any advertising/tracking domains
  1. DevTools > Application > Cookies
  2. Before interacting with consent banner, check for:

3. GTM Preview Analysis

  1. Open GTM Preview Mode
  2. Check Tags Fired before consent trigger
  3. Non-essential tags should show as "Not Fired" initially

General Fixes

Step 1: Add consent initialization

Add to your page before GTM loads:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'analytics_storage': 'denied',
    'ad_storage': 'denied',
    'wait_for_update': 500 // Wait for CMP
  });
</script>

Step 2: Configure tag consent settings

In GTM:

  1. Go to each tag
  2. Click "Advanced Settings" > "Consent Settings"
  3. Add required consent types (analytics_storage, ad_storage)

2. Use CMP with GTM Integration

Most CMPs integrate with GTM:

  • Cookiebot + GTM
  • OneTrust + GTM
  • Osano + GTM

The CMP handles:

  • Displaying consent banner
  • Storing user preferences
  • Firing GTM consent update events

3. Script Type Modification

For manually added scripts:

Before (non-compliant):

<script src="https://tracking-script.js"></script>

After (compliant):

<script type="text/plain" data-cookieconsent="statistics">
  // Script content here
</script>

The CMP changes type to text/javascript after consent.

4. Defer Script Loading

function loadTrackingAfterConsent() {
  // Only call after consent granted
  var script = document.createElement('script');
  script.src = 'https://tracking-script.js';
  document.head.appendChild(script);
}

Script Categorization

Categorize scripts for granular consent:

Category Examples Default
Essential Authentication, cart, security Allowed
Functional Chat, preferences, language Ask consent
Analytics GA4, Hotjar, Amplitude Ask consent
Marketing Meta Pixel, Google Ads, TikTok Ask consent

Testing Compliance

  1. Clear all cookies
  2. Visit site in incognito
  3. Check Network/Cookies - should be minimal
  4. Decline consent
  5. Navigate site - tracking should not fire
  6. Clear cookies
  7. Revisit and accept consent
  8. Verify tracking now works

Regression Testing

After CMS or site updates:

  • Re-test consent flow
  • Check for new scripts added
  • Verify consent still blocks properly

Platform-Specific Guides

Platform Guide
Shopify Shopify Privacy
WordPress WordPress GDPR Plugins
Webflow Webflow Consent

Further Reading

↑ Back to top
// SYS.FOOTER