On Squarespace, the FlowConsent snippet goes into the Header field of the Code Injection panel, which you open from Pages → Custom Code → Code Injection. Installation takes three steps. The main traps: code injection requires a Core, Plus or Advanced plan, and Squarespace's native cookie banner and its Google Analytics and Meta Pixel integrations must be switched off, otherwise they duplicate the banner or fire without waiting for consent.
Before you start
- An account on app.flowconsent.com (free Free plan, no credit card, up to 25,000 sessions per month).
- A banner created and deployed. On the Free plan, deployment goes through your own Cloudflare account (Cloudflare guide); on Pro and Enterprise, it is one click.
- A Squarespace site on a plan that includes code injection: Core, Plus, Advanced or some legacy plans. The Basic plan does not offer it.
Step 1: Copy the snippet
Open Builder → Deployment → Integration and copy the snippet from the HTML / No-code tab. It has two parts, in this order: the Google Consent Mode v2 stub (denied defaults), then the banner loader.
Step 2: Paste it in Code Injection → Header
- In the Squarespace editor, open the Pages panel.
- At the bottom of the panel, in the Custom Code section, click Code Injection. On a version 7.0 site, the option sits under Website Tools.
- Paste the snippet at the very top of the Header field, above any code already there.
- Click Save.
<script>
// FlowConsent Loader - place BEFORE any other script in the <head>
window.dataLayer=window.dataLayer||[];
function gtag(){dataLayer.push(arguments);}
gtag('consent','default',{
'ad_storage':'denied',
'analytics_storage':'denied',
'ad_user_data':'denied',
'ad_personalization':'denied',
'wait_for_update':500
});
gtag('set','url_passthrough',true);
gtag('set','ads_data_redaction',true);
</script>
<!-- FlowConsent CMP -->
<script src="https://YOUR-LICENSE-CODE.consent.flowconsent.com/cookie-manager.js?code=YOUR_LICENSE_CODE"></script>The Header field is injected into the <head> of every page on the site. If other tracking scripts are already there (Google Tag Manager, Google Analytics, ad pixels), keep them below the snippet, or better, remove them and declare them in Builder → Services. Do not use the Footer field: it is injected before </body>, far too late for prior blocking.
Step 3: Turn off the native banner and integrations
Squarespace's cookie banner. Two banners on one site means two conflicting consents. Open the Cookies & Data Privacy panel and switch off the Cookie banner toggle.
If you use Google Tag Manager, do not load FlowConsent from GTM (it would arrive too late): place the snippet above the GTM container in the Header field. Details in the Google Consent Mode guide.
Verify the installation
- Open the published site in a private window, outside the editor: the banner appears.
- In the developer tools Network tab, no request to any third party leaves before you click Accept.
- Run the setup wizard (Builder → Integration): it checks the live page (loader present with the right license code, Consent Mode stub present and placed before every Google tag).
- Finish with a decline scan from the Compliance tab (compliance verification).
Do it from your AI agent (MCP)
FlowConsent has an official MCP server, https://mcp.flowconsent.com, usable from Claude, ChatGPT or any MCP client. You connect with OAuth 2.0 using your FlowConsent account, no API key needed. Your agent fetches the snippet and placement instructions (get_banner_snippet, get_setup_instructions), verifies the installation with a real scan (verify_consent_compliance) and can set up recurring monitoring (monitor_compliance). You still paste the snippet into Squarespace yourself: the MCP server provides the snippet, the instructions and the verification.
Example request:
Give me my banner snippet for my Squarespace site and check that it is correctly installed on https://mysite.com
Learn more: MCP server and FlowConsent for AI agents.
Frequently asked questions
I can't find Code Injection. Why?
Your plan most likely does not include it: code injection is reserved for the Core, Plus and Advanced plans and some legacy plans. On a version 7.0 site, also look under Website Tools rather than Custom Code.
Can I use a code block on a page instead of Code Injection?
No. A code block renders in the body of a single page: too late, and not everywhere. The snippet must be in the <head> of every page, which only the Header field guarantees.
Should I keep Squarespace's cookie banner?
No. Two banners would collect two conflicting choices. Switch off Squarespace's banner under Cookies & Data Privacy once FlowConsent is installed.
Google Analytics still sends data after a decline.
The ID is probably still set under Developer tools → External API keys, so Squarespace injects the script itself. Clear that field and declare Google Analytics in Builder → Services.