> Set up Webflow cookie consent that really blocks trackers: head code, the Google Analytics trap, embeds, Consent Mode v2 and testing, step by step. > > Canonical: https://www.flowconsent.com/en/blog/webflow-cookie-consent-gdpr-guide [Platform guides](https://www.flowconsent.com/en/blog?category=platforms) # Webflow cookie consent: add a GDPR cookie banner step by step By FlowConsent · Published 5 March 2026 · Updated 24 October 2026 · 12 min read In short Webflow cookie consent is your job, not Webflow's: the platform hosts your site but does not block the third-party scripts you add. As soon as a Webflow site loads Google Analytics, a Meta Pixel, HubSpot, Hotjar or a YouTube embed, you need a cookie banner that holds those scripts until the visitor accepts, records the choice and sends Google Consent Mode v2 signals. On Webflow, that means pasting a consent management platform (CMP) snippet at the top of **Site settings → Custom code → Head code**, removing the Google Analytics ID from **Apps & Integrations**, gating every embed, then testing the published site with consent refused. This guide walks through each step, compares the Webflow cookie banner options and links to our guides for every other platform. ## What Webflow cookie consent actually requires The rules do not depend on the tool that built your site. If your Webflow site is visited from the European Union, the ePrivacy Directive (cookie rules) and the GDPR (personal data) apply. In the United Kingdom, the ICO applies the same logic through PECR. The core requirement is short: any cookie or similar technology that is not strictly necessary for the service the visitor asked for needs prior, informed and freely given consent. In practice, a compliant Webflow cookie banner has to do five things: - **block non-essential scripts before consent**, not just display a message on top of them; - offer **Accept and Reject with equal prominence** on the first layer, as the CNIL and the EDPB have repeatedly stated; - let visitors **choose by purpose** (analytics, marketing, preferences) and change their mind later; - **keep proof** of each choice (what was shown, what was chosen, when); - **send consent signals** to Google through Consent Mode v2 if you use Google Analytics or Google Ads. The general rules behind each point are covered in our [GDPR cookie banner guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide). This article focuses on how to meet them on Webflow. ### Who is responsible on a Webflow site? You are. As the site owner, you decide which tools run on your pages, so you are the controller for the data they collect. Webflow acts as a hosting provider and processor for your site. Google, Meta or HubSpot are either processors or separate controllers depending on the tool. Regulators do not accept "the website builder did it" as a defence: the obligation sits with whoever publishes the site, whether it runs on Webflow, WordPress or Shopify. ## What cookies does a Webflow site set? Before choosing a banner, you need to know what it must control. A Webflow site has three layers of cookies and trackers. ### What Webflow sets by default A Webflow site with no third-party tool sets very little: technical cookies linked to security, form submission and, if you use them, logged-in areas and the Ecommerce cart. These are generally treated as strictly necessary and exempt from consent, subject to a case-by-case check. If your site truly has nothing else, read our analysis of [whether a Webflow site without Analytics still needs a banner](https://www.flowconsent.com/en/blog/cookie-banner-webflow-without-analytics): the answer depends on embeds, fonts and forms more than on analytics. ### What you add through custom code and integrations This is where almost all consent obligations come from. Google Analytics 4, Google Ads, the Meta Pixel, LinkedIn Insight Tag, HubSpot, Intercom, Hotjar, Clarity or Mixpanel all set their own cookies or identifiers, and all need prior consent. Classify each of them with the [four GDPR cookie categories](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) so your banner groups them correctly. ### Webflow-specific sources people forget Some trackers enter a Webflow site through channels that are easy to miss: - **Site settings → Apps & Integrations**: a Google Analytics Measurement ID set there is injected by Webflow itself, above your custom code. More on this trap below. - **Code Embed elements** inside pages, CMS templates and symbols: YouTube, Vimeo, Google Maps, Calendly, Typeform or chat widgets. Each can set cookies on load. For videos, read our guide to [youtube-nocookie and embedding without cookies](https://www.flowconsent.com/en/blog/youtube-nocookie-embed-videos-without-cookies-gdpr). - **Page-level custom code**, added in a page's settings, which a site-wide audit can overlook. - **Google Fonts** loaded from Google's servers. They do not set cookies, but they send the visitor's IP address to Google on every page view, and no banner fixes that. See [the Google Fonts risk on Webflow](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk). - **Interactions or scripts that send events** to third-party tools on scroll or click. The fastest way to see what your published site really does is to scan it. Check in 30 seconds which cookies your Webflow site sets with the [free cookie scanner](https://www.flowconsent.com/en/scan), run on your custom domain rather than the webflow\.io subdomain. ## Webflow cookie banner options compared Search "webflow cookie consent" and you will find four families of solutions. They are not equivalent: the difference is whether they block scripts and keep proof. ### A banner designed in the Designer Cloneable "GDPR cookie banners" are popular in the Webflow showcase. They look good and match your brand, but on their own they are a visual element: they show a message and hide when clicked. They do not stop Google Analytics or a pixel from loading. Without a script layer that holds and releases tags, they inform without protecting. ### Finsweet Cookie Consent Finsweet's attribute-based solution is widely used in the Webflow community. You style the banner in the Designer and mark scripts with attributes so they only run after consent. It works for basic blocking when it is wired correctly. Check what you need beyond that: a timestamped record of each consent, Consent Mode v2 for Google Ads, an automatic cookie list and monitoring are not things a front-end library provides on its own. ### Webflow Marketplace apps Several consent apps install from the Webflow Apps marketplace, such as Consentbit or Consent Pro. They are built around Webflow and usually set up quickly. Compare them on the same criteria as any CMP: effective blocking, proof, Consent Mode v2, languages and price per site. Our comparisons of [Consentbit vs FlowConsent](https://www.flowconsent.com/en/comparison/consentbit-vs-flowconsent) and [Consent Pro vs FlowConsent](https://www.flowconsent.com/en/comparison/consent-pro-vs-flowconsent) go through these points. ### A general-purpose CMP with a Webflow snippet If the term is new, start with [what a consent management platform is](https://www.flowconsent.com/en/blog/what-is-consent-management-platform-cmp). Platforms such as Cookiebot, CookieHub or FlowConsent work on any site and provide a snippet to paste in Webflow's head code. You get script blocking, proof of consent, cookie scanning and Consent Mode v2 in one tool, and the same setup if you also run sites on other platforms. See [CookieHub vs FlowConsent](https://www.flowconsent.com/en/comparison/cookiehub-vs-flowconsent), [Cookiebot vs FlowConsent](https://www.flowconsent.com/en/comparison/cookiebot-vs-flowconsent) or the full [comparison hub](https://www.flowconsent.com/en/comparison). ### How to choose Whatever the family, ask five questions: does it block scripts and embeds before consent, does it store proof you can export, does it send Consent Mode v2 signals, does it handle the languages of your Webflow Localization setup, and what does it cost at your traffic level? Our [CMP selection guide](https://www.flowconsent.com/en/blog/how-to-choose-consent-management-platform) details each criterion. If you already pay for a banner, compare the cost of your current CMP with the [CMP price comparator](https://www.flowconsent.com/en/compare) before renewing. ## How to add a cookie consent banner to Webflow, step by step The steps below apply to any CMP. Where a detail is specific to FlowConsent, it is stated. ### Step 1: list every tracker on the site Open **Site settings → Custom code** and copy what is in Head code and Footer code. Then open **Apps & Integrations** and note any tracking ID. Go through page settings for page-level code, and search the Designer for Code Embed elements in pages, CMS templates and components. Compare that list with a scan of the published site: the scan shows what actually loads, including what a tool loads in turn. Our [cookie audit guide](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) explains the method. ### Step 2: check your Webflow plan allows custom code Site-wide custom code is available on paid site plans. If your site is still on a free plan, you cannot add a CMP snippet in Head code, and you will need to upgrade before going further. ### Step 3: paste the CMP snippet first in Head code In **Site settings → Custom code → Head code**, paste the CMP snippet at the very top, before Google Tag Manager, GA4 or any pixel. Order matters: the CMP and its consent defaults must be in place before the scripts they control. Site-level code runs on every page, including CMS templates and Ecommerce pages; page-level code alone would leave gaps. With FlowConsent, the Webflow tab in **Builder → Deployment → Integration** generates the snippet. It has two parts: an inline Consent Mode stub that sets the four Google signals to denied while the page is parsed, then the banner loader. Keep them in that order. ### Step 4: remove the Google Analytics ID from Apps & Integrations This is the most common Webflow trap. If a Google Analytics Measurement ID is set in **Site settings → Apps & Integrations**, Webflow injects its own GA loader above your custom code. The GA configuration then reaches Google before your consent defaults, and analytics cookies are set whatever the visitor chooses. No CMP can win that race from custom code. The fix is to delete the ID from that panel and declare Google Analytics in your CMP instead, so it is injected only after consent. Read our guide on [whether Google Analytics is GDPR compliant](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) for the rest of the GA4 settings. ### Step 5: put every non-essential script behind consent Move each tracker out of plain custom code and let the CMP release it. Depending on the tool, that means one of three patterns: - the CMP injects the script itself after consent (with FlowConsent, you activate the service in **Builder → Services** and paste its script there); - the script stays in Webflow's custom code, but its type is changed so the browser ignores it until the CMP activates it; - the script is a tag in Google Tag Manager that fires only when the matching consent is granted. Our guide to [Google Tag Manager and Consent Mode v2](https://www.flowconsent.com/en/blog/google-tag-manager-consent-mode-guide) covers the triggers. ### Step 6: gate embeds YouTube, Vimeo, maps and booking widgets added through Code Embed must not load before consent. Replace them with a placeholder that loads the iframe after acceptance, or let your CMP handle them. With FlowConsent, you add a `data-service` attribute to the embed so the banner can hold it until the visitor agrees. ### Step 7: configure Google Consent Mode v2 If you use Google Analytics or Google Ads, Google expects consent signals for traffic from the European Economic Area. Check that `denied` defaults are sent before any Google tag and that an update follows the visitor's choice. Our [Google Consent Mode v2 guide](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) explains basic and advanced modes. ### Step 8: match the banner to your site and languages Use the same fonts and colours as the site, keep Accept and Reject at the same visual weight and avoid the [dark patterns regulators sanction](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited). If you use Webflow Localization with language folders such as /fr or /de, configure the banner to detect the language from the URL so each locale shows the right text. Link your [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) from the banner and the footer. ### Step 9: publish Custom code only ships when you publish. The Designer preview does not run it, so nothing you see there proves the banner works. ## How to test your Webflow cookie banner Test on the custom domain, not the webflow\.io staging subdomain: domains, cookies and some integrations behave differently there. 1. Open a private window with the developer tools on the **Network** and **Application** tabs. 2. Load the home page without touching the banner. No request should go to google-analytics.com, facebook.net, hotjar.com or similar, and no non-essential cookie should appear. 3. Click **Reject**. Browse a few pages, including a CMS template and a page with a video. Nothing non-essential should load. 4. Clear the site data, accept only analytics, and check that only analytics tools load. 5. Accept everything and check that each tool now works. 6. Reopen the banner from the footer link and withdraw consent. 7. Repeat on mobile. Manual tests catch today's problems, not tomorrow's. A colleague who re-enables the Google Analytics field or pastes a new pixel in footer code will reopen the leak. FlowConsent's [compliance verification](https://www.flowconsent.com/en/doc/compliance-verification) loads your published pages in a real browser, refuses consent and lists anything that still fires, including a tag injected by Webflow's site settings. Recurring [compliance monitoring](https://www.flowconsent.com/en/doc/compliance-monitoring) re-runs that check and alerts you when a page regresses. ## Webflow forms and GDPR Forms are the other half of "GDPR on Webflow", and a cookie banner does not cover them. A Webflow form that collects a name or an email processes personal data, so: - tell people, next to the form, who receives the data, why, and how long you keep it, with a link to your privacy policy; - only add a consent checkbox when the processing really relies on consent (a newsletter, for example), and never pre-tick it; - collect only the fields you need; - remember that submissions are stored in Webflow and often forwarded to other tools (HubSpot, Zapier, a CRM): list those recipients in your privacy policy and records of processing. If you enable reCAPTCHA on Webflow forms, Google's script loads on the page. Its status under consent rules is debated, so at minimum disclose it in your cookie policy and your banner's cookie list. ## Common Webflow cookie consent mistakes **Leaving the GA Measurement ID in Apps & Integrations.** Webflow loads Google Analytics before any consent default. Remove it and let the CMP manage GA. **Pasting tracking scripts above the CMP snippet.** Anything placed higher in Head code runs before the banner can act. **Using a visual banner with no blocking.** A cloned banner that only hides on click does not stop trackers. **Testing only on webflow\.io or in the Designer preview.** The preview does not run custom code, and staging is not your production domain. **Forgetting embeds in CMS templates.** A single blog template with a YouTube iframe can set cookies on hundreds of pages. **Loading Google Fonts from Google.** Self-host fonts in Webflow to stop the IP transfer. **Ignoring page-level code.** A landing page with its own pixel in page settings escapes a site-wide audit. **Never re-checking.** Sites change every week. Schedule scans or monitoring so a new script does not go unnoticed for months. ## Cookie consent on other platforms This guide is the hub of our platform series. Each guide below explains where scripts come from on that platform, its specific traps and how to install a banner that blocks them: - **WordPress**: [cookie consent on WordPress](https://www.flowconsent.com/en/blog/wordpress-cookie-consent-gdpr-guide), plugins, themes and caching ([install guide](https://www.flowconsent.com/en/doc/install-wordpress)). - **WooCommerce**: [WooCommerce and GDPR](https://www.flowconsent.com/en/blog/woocommerce-gdpr-compliance-guide), checkout, payment scripts and order data ([install guide](https://www.flowconsent.com/en/doc/install-woocommerce)). - **Shopify**: [Shopify cookies and GDPR](https://www.flowconsent.com/en/blog/shopify-cookies-gdpr-compliance-guide), the Customer Privacy API and app scripts ([install guide](https://www.flowconsent.com/en/doc/install-shopify)). - **Wix**: [Wix cookies and GDPR](https://www.flowconsent.com/en/blog/wix-cookies-gdpr-compliance-guide), the native banner and its limits ([install guide](https://www.flowconsent.com/en/doc/install-wix)). - **Squarespace**: [Squarespace cookies and GDPR](https://www.flowconsent.com/en/blog/squarespace-cookies-gdpr-compliance-guide), then [Consent Mode v2 on Squarespace](https://www.flowconsent.com/en/blog/squarespace-google-consent-mode-v2-setup) ([install guide](https://www.flowconsent.com/en/doc/install-squarespace)). - **HubSpot**: [HubSpot cookies and GDPR](https://www.flowconsent.com/en/blog/hubspot-cookies-gdpr-compliance), tracking code and forms ([install guide](https://www.flowconsent.com/en/doc/install-hubspot)). - **PrestaShop**: [PrestaShop cookies and GDPR](https://www.flowconsent.com/en/blog/prestashop-cookies-gdpr-compliance-guide), modules and themes ([install guide](https://www.flowconsent.com/en/doc/install-prestashop)). - **Next.js**: [Next.js cookie consent](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide), client-side navigation and script loading ([integration guide](https://www.flowconsent.com/en/doc/nextjs-integration)). - **Framer**: [Framer cookie banner](https://www.flowconsent.com/en/blog/framer-cookie-banner-gdpr-guide), the built-in component, plugins and custom code; the [Framer install guide](https://www.flowconsent.com/en/doc/install-framer) covers the snippet, SPA Mode and Framer's own banner. - **Webflow, special cases**: [a Webflow site without Analytics](https://www.flowconsent.com/en/blog/cookie-banner-webflow-without-analytics) and [Google Fonts on Webflow](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk). If your tags run through Google Tag Manager whatever the platform, the [GTM install guide](https://www.flowconsent.com/en/doc/install-google-tag-manager) applies on top of the platform guide. ## How FlowConsent handles cookie consent on Webflow FlowConsent installs on Webflow with one snippet in Head code, generated from the Webflow tab of the Builder, and takes about ten minutes. The inline Consent Mode v2 stub sets Google's signals to denied before any tag, then the banner blocks scripts and embeds until the visitor accepts. If a Google tag is injected above the snippet, typically by Webflow's Apps & Integrations panel, the banner logs an explicit console error and the installation check names the cause. Automatic cookie scans keep the cookie list accurate, each choice is stored as exportable proof, and data is hosted in Europe. FlowConsent is free up to 25,000 sessions per month, then €14.99 per month up to 100,000 sessions with Pro. Follow the [Webflow integration guide](https://www.flowconsent.com/en/doc/webflow-integration) to set it up. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fwebflow-cookie-consent-gdpr-guide) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fwebflow-cookie-consent-gdpr-guide) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Webflow have a built-in cookie consent banner? Webflow does not provide a built-in consent platform that blocks the third-party scripts you add, such as Google Analytics, the Meta Pixel or YouTube embeds. You need to add one: a CMP snippet in Site settings, a Webflow Marketplace app or an attribute-based library. Whatever you choose, check that it blocks scripts before consent, stores proof of each choice and sends Google Consent Mode v2 signals. ### Where do I paste the cookie banner code in Webflow? Paste it in Site settings, Custom code, Head code, at the very top, before Google Tag Manager, Google Analytics or any pixel. Site-level head code runs on every page, including CMS templates and Ecommerce pages. Then publish the site: custom code only ships on publish, and the Designer preview does not run it. Site-wide custom code requires a paid Webflow site plan. ### Why does Google Analytics still set cookies on Webflow after a refusal? Usually because a Measurement ID is set in Site settings, Apps & Integrations. Webflow then injects its own Google Analytics loader above your custom code, so the configuration reaches Google before your consent defaults and cookies are set whatever the visitor chooses. Remove the ID from that panel and declare Google Analytics in your CMP so it loads only after consent. ### Is Finsweet Cookie Consent enough for GDPR on Webflow? It can block scripts correctly when every tracker is marked with the right attributes and the banner offers a real reject option. What it does not provide on its own is a server-side, timestamped record of each consent, automatic cookie scanning or monitoring. If you need proof of consent for an audit, Consent Mode v2 for Google Ads or alerts when a new script appears, pair it with or replace it by a full CMP. ### Do I need a cookie banner on Webflow if I do not use analytics? Not always. If your site only sets the technical cookies Webflow needs and loads no third-party content, there may be nothing that requires consent. But YouTube or Vimeo embeds, maps, chat widgets, booking tools and some form services set cookies or identifiers on their own. Scan the published site before deciding, and remember that Google Fonts loaded from Google raise a separate GDPR issue a banner does not solve. ### Do Webflow forms need consent under GDPR? Not necessarily consent, but always information. A Webflow form that collects names or emails processes personal data, so you must explain who receives it, why and for how long, with a link to your privacy policy. A consent checkbox is only needed when the processing relies on consent, such as a newsletter, and it must never be pre-ticked. List the tools that receive submissions, such as a CRM or Zapier. ### Can I test my Webflow cookie banner on the webflow\.io domain? You can check that it displays, but not that it is compliant. Test on your custom domain after publishing: cookies are scoped to the domain, some integrations behave differently on staging, and the Designer preview does not run custom code at all. Use a private window, refuse consent and check the network panel for requests to analytics or advertising domains. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Platform guides · 19 March 2026](https://www.flowconsent.com/en/blog/cookie-banner-webflow-without-analytics) ### [Cookie banner on Webflow without Analytics: is it required?](https://www.flowconsent.com/en/blog/cookie-banner-webflow-without-analytics) [Does a Webflow site without Google Analytics need a cookie banner? Not always. Here are the CNIL exemption criteria and when it becomes mandatory.](https://www.flowconsent.com/en/blog/cookie-banner-webflow-without-analytics) [Read the article ](https://www.flowconsent.com/en/blog/cookie-banner-webflow-without-analytics)· [Platform guides · 24 October 2026](https://www.flowconsent.com/en/blog/framer-cookie-banner-gdpr-guide) ### [Framer cookie banner: how to set up GDPR cookie consent (2026)](https://www.flowconsent.com/en/blog/framer-cookie-banner-gdpr-guide) [When a Framer site needs a cookie banner, what Framer's built-in component really controls, and how to install and test a banner that blocks scripts before consent.](https://www.flowconsent.com/en/blog/framer-cookie-banner-gdpr-guide) [Read the article ](https://www.flowconsent.com/en/blog/framer-cookie-banner-gdpr-guide)· [Platform guides · 18 March 2026](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) ### [Google Fonts on Webflow: the GDPR risk you need to fix](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) [Google Fonts loaded from Google servers transmit your visitors' IP addresses without consent. Here is how to fix this on Webflow.](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) [Read the article](https://www.flowconsent.com/en/blog/webflow-google-fonts-gdpr-risk) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)