Squarespace and Google Consent Mode v2: setup guide

Squarespace makes it easy to publish a site, but its privacy tooling was designed for its own features first. If you run Google Ads, track conversions or use several marketing tags, it is worth understanding exactly where the native options stop. This guide walks through that boundary, the four Consent Mode v2 signals, a step-by-step setup with a CMP, and the checks that prove it works.

What Squarespace does (and does not do) for Consent Mode

Squarespace ships a native cookie banner, configured in the Cookies & Data Privacy panel. According to Squarespace's own help centre, you can add a Manage cookies button so visitors customise their preferences and a Decline all button so they can reject all non-essential cookies. When the banner is enabled, Squarespace restricts some non-essential cookies until the visitor responds, and the choice is remembered for 30 days before the banner reappears.

For Google, the key point is in Squarespace's Google Analytics documentation: if you connect GA4 through the built-in field (Developer tools > External API keys, measurement ID starting with G-) and switch on both the cookie banner and the Decline all button, Squarespace shares visitors' consent choices with Google through consent mode. No script is needed for that path.

The limits matter just as much:

• Code injection is on you. Squarespace states that if custom code drops non-essential cookies, you should make sure it interacts with the banner, and that code-based solutions such as Google Tag Manager fall outside the scope of its support.
• Google Ads is not part of the built-in integration. Squarespace points users who added Google Ads through code injection to example code on its community forum, not to a native setting.
• The signals sent are not documented in detail. Squarespace does not publish which consent types it sets or when, so you should verify the behaviour yourself rather than assume all four v2 parameters are covered.
• Two categories only. Squarespace's cookie documentation describes necessary cookies and analytics and performance cookies, so fine-grained purposes (advertising vs. personalisation) are not mapped out of the box.

In short: a site that uses only the built-in GA4 connection can rely on Squarespace's banner. A site with Google Ads, GTM, Meta Pixel or other third-party scripts needs a proper CMP. For the wider compliance picture on the platform, see our Squarespace and GDPR cookies guide.

Consent Mode v2 in two minutes

Consent Mode is Google's API for telling its tags what the visitor agreed to. Version 2 relies on four consent types, documented in Google's consent mode setup guide:

• ad_storage: storage (such as cookies) related to advertising.
• analytics_storage: storage related to analytics, for example visit duration.
• ad_user_data: consent for sending user data related to advertising to Google.
• ad_personalization: consent for personalised advertising, such as remarketing.

The mechanism always has two steps. First a default command, for example gtag('consent', 'default', {...}) with all four values set to denied, which must run high in the page, synchronously, before any Google tag. Then an update command, gtag('consent', 'update', {...}), sent by your banner when the visitor accepts some or all purposes. Google warns that if the code runs out of order, the defaults will not work.

Google also describes two implementation styles. In basic mode, Google tags do not load at all until the visitor interacts with the banner. In advanced mode, tags load immediately with denied defaults and send cookieless pings when consent is refused, which feeds advertiser-specific conversion modelling. Which one fits your risk appetite is covered in basic vs advanced Consent Mode. Remember that Consent Mode does not replace the legal requirement: under the UK and EU rules, non-essential cookies still require prior, freely given consent, as the ICO's guidance on cookies explains.

Before you start: prerequisites

• A plan with code injection. Squarespace offers code injection on the Core, Plus and Advanced plans and on some legacy plans. Without it you cannot add a CMP script to the site header.
• Your Google IDs. The GA4 measurement ID (G-XXXXXXX) and, if you advertise, the Google Ads tag ID (AW-XXXXXXX) plus your conversion labels.
• An inventory of your tags. List everything that loads on the site: analytics, ads, pixels, chat widgets, embedded videos. A cookie scan gives you a starting point in a few seconds.
• One banner only. Decide now which tool owns consent. Running the Squarespace banner and a CMP side by side confuses visitors and produces contradictory signals.

Step-by-step setup with a CMP

The goal is simple: consent defaults first, then the Google tags, then the banner sending updates. Here is the order to follow on Squarespace.

1. Remove the early Google tag. If your GA4 ID is in Developer tools > External API keys, clear it once the CMP is ready to take over, otherwise Squarespace keeps loading GA4 through its own channel, potentially before your consent defaults.
2. Turn off the native cookie banner in Cookies & Data Privacy, so only your CMP asks for consent.
3. Open the Code Injection panel and use the site-wide Header field. Squarespace injects it into the <head> of every page, which is what Consent Mode needs. Avoid per-page header injection for this: consent has to be in place on every page.
4. Paste the CMP script at the very top of the Header field. It must run before any Google tag so the default command lands first. If your CMP does not set Consent Mode defaults itself, add a small inline script before everything else that defines dataLayer, the gtag() function and a gtag('consent', 'default', {...}) call with the four values set to denied.
5. Add the Google tag below it. Paste the standard gtag.js snippet from GA4 or Google Ads, with gtag('config', 'G-XXXXXXX') and, if needed, gtag('config', 'AW-XXXXXXX'). One Google tag can serve both.
6. Declare your other scripts in the CMP (Meta Pixel, LinkedIn, Hotjar and so on) so they are blocked until the matching consent is given. Consent Mode only governs Google tags.
7. Save, publish and test on the live site. Squarespace notes that injected code does not run inside the site editor, so always test the public URL, ideally in a private window.

Option A: a CMP with Consent Mode built in

This is the lightest route on Squarespace. With FlowConsent, for example, you paste one script in the Header field: Google Consent Mode v2 is built in, so the four signals start as denied and the banner sends the update when the visitor decides. Other scripts are blocked before consent, an automatic cookie scan keeps the declaration up to date, and consent records are kept for 13 months as proof. No Google Tag Manager is required. The Consent Mode documentation details the exact snippet order.

Option B: Google Tag Manager

If your team already manages tags in GTM, paste the GTM container snippet at the top of the Header field. Then configure consent inside GTM: a CMP template or a custom tag on the Consent Initialization trigger sets the defaults, and each Google tag relies on its built-in consent checks. It works well, but it adds a layer that Squarespace will not support. Our Google Tag Manager and Consent Mode v2 guide covers the GTM side in detail.

How to verify that it really works

Never assume. Google's consent mode verification guide recommends Tag Assistant, and a quick look at the browser's developer tools completes the picture.

1. Open Tag Assistant, enter your Squarespace URL and connect. The site opens in a new tab with the banner.
2. In the Summary, select the earliest Consent event. In the API Call section, check that ad_storage, analytics_storage, ad_user_data and ad_personalization are present and set to denied.
3. Accept cookies in the banner, then select the latest Consent event: the values you accepted should now show as granted (the On-page Update column in the tag's Consent tab).
4. Open the Tags view and check that each tag behaved according to the consent state.
5. Repeat in a fresh private window, this time clicking Reject. Nothing should switch to granted.

In the browser's developer tools, look at the Application > Cookies panel before you click anything: GA4's _ga cookies and Google Ads cookies should not exist yet. In the Network tab, filter on collect or googleadservices to see which requests leave the page before and after consent. If Tag Assistant's Consent tab is empty, Google says it means consent mode is not implemented on the page or the Google tag was blocked from loading. In Google Ads, the conversion diagnostics also report the consent mode status of your tags after some traffic.

Common mistakes on Squarespace

• Leaving the GA4 ID in the built-in field while also adding gtag.js by code. You get two GA4 loaders, duplicated data and a tag that may fire before your consent defaults.
• Placing the CMP below the Google tag. The config command is processed without restrictions and cookies are set before any default exists.
• Using the Footer field for the CMP. The footer runs at the end of the body, far too late for consent defaults.
• Only setting the two original signals. Without ad_user_data and ad_personalization, Google cannot use your EEA traffic for ad personalisation and some measurement features.
• Forgetting non-Google scripts. Consent Mode does nothing for Meta Pixel, TikTok or embedded YouTube videos: they must be blocked by the CMP.
• Testing in the editor. Injected code does not run there, so the results are meaningless.

Conclusion

Squarespace's banner is enough if all you use is the built-in GA4 connection, but as soon as Google Ads, GTM or other marketing tags enter the picture, you need a CMP that sets Consent Mode v2 defaults first and blocks everything else until the visitor agrees. Follow the order above, verify with Tag Assistant, and retest every time you add a tag. Want to see what your Squarespace site loads before consent today? Run a free scan and compare the results with your tag inventory.