# Install FlowConsent on Squarespace

Install FlowConsent on Squarespace: paste the snippet in Code Injection → Header, turn off the native cookie banner and remove the Google and Meta IDs.

> Canonical: https://www.flowconsent.com/en/doc/install-squarespace
> Last updated: 2026-10-01
On Squarespace, the FlowConsent snippet goes into the **Header** field of the **Code Injection** panel, which you open from **Pages → Custom Code → Code Injection**. Installation takes three steps. The main traps: code injection requires a Core, Plus or Advanced plan, and Squarespace's native cookie banner and its Google Analytics and Meta Pixel integrations must be switched off, otherwise they duplicate the banner or fire without waiting for consent.

## Before you start

- An account on [app.flowconsent.com](https://app.flowconsent.com) (free Free plan, no credit card, up to 25,000 sessions per month).
- A banner created and deployed. On the Free plan, deployment goes through your own Cloudflare account ([Cloudflare guide](/en/doc/cloudflare-deployment)); on Pro and Enterprise, it is one click.
- A Squarespace site on a plan that includes code injection: **Core, Plus, Advanced** or some legacy plans. The Basic plan does not offer it.

## Step 1: Copy the snippet

Open **Builder → Deployment → Integration** and copy the snippet from the **HTML / No-code** tab. It has two parts, in this order: the Google Consent Mode v2 stub (`denied` defaults), then the banner loader.

## Step 2: Paste it in Code Injection → Header

1. In the Squarespace editor, open the **Pages** panel.
2. At the bottom of the panel, in the **Custom Code** section, click **Code Injection**. On a version 7.0 site, the option sits under **Website Tools**.
3. Paste the snippet **at the very top of the Header field**, above any code already there.
4. Click **Save**.

```html title="Pages → Custom Code → Code Injection → Header"
<script>
// FlowConsent Loader - place BEFORE any other script in the <head>
window.dataLayer=window.dataLayer||[];
function gtag(){dataLayer.push(arguments);}
gtag('consent','default',{
  'ad_storage':'denied',
  'analytics_storage':'denied',
  'ad_user_data':'denied',
  'ad_personalization':'denied',
  'wait_for_update':500
});
gtag('set','url_passthrough',true);
gtag('set','ads_data_redaction',true);
</script>
<!-- FlowConsent CMP -->
<script src="https://YOUR-LICENSE-CODE.consent.flowconsent.com/cookie-manager.js?code=YOUR_LICENSE_CODE"></script>
```

The Header field is injected into the `<head>` of every page on the site. If other tracking scripts are already there (Google Tag Manager, Google Analytics, ad pixels), keep them **below** the snippet, or better, remove them and declare them in **Builder → Services**. Do not use the **Footer** field: it is injected before `</body>`, far too late for prior blocking.

## Step 3: Turn off the native banner and integrations

**Squarespace's cookie banner.** Two banners on one site means two conflicting consents. Open the **Cookies & Data Privacy** panel and switch off the **Cookie banner** toggle.

> [!WARNING]
> Squarespace's native integrations inject their own scripts, outside your snippet: FlowConsent cannot hold them back. Remove their IDs, then declare these services in **Builder → Services** so the banner only loads them after consent:
> - **Google Analytics**: in the **Developer tools → External API keys** panel, clear the **Google Analytics account number** field and save.
> - **Meta Pixel**: in the **Meta Pixel & Ads** panel, clear the **Pixel ID** field and save.

If you use Google Tag Manager, do not load FlowConsent from GTM (it would arrive too late): place the snippet **above** the GTM container in the Header field. Details in the [Google Consent Mode guide](/en/doc/google-consent-mode).

> [!NOTE]
> Squarespace checkout pages do not support code injection: the banner does not appear there, and visitors make their choice on the site before checkout. The field reserved for the order confirmation page is not the place for trackers that bypass consent.

## Verify the installation

1. Open the published site in a private window, outside the editor: the banner appears.
2. In the developer tools **Network** tab, no request to any third party leaves before you click **Accept**.
3. Run the [setup wizard](/en/doc/setup-wizard) (Builder → Integration): it checks the live page (loader present with the right license code, Consent Mode stub present and placed before every Google tag).
4. Finish with a decline scan from the **Compliance** tab ([compliance verification](/en/doc/compliance-verification)).

## Do it from your AI agent (MCP)

FlowConsent has an official MCP server, `https://mcp.flowconsent.com`, usable from Claude, ChatGPT or any MCP client. You connect with OAuth 2.0 using your FlowConsent account, no API key needed. Your agent fetches the snippet and placement instructions (`get_banner_snippet`, `get_setup_instructions`), verifies the installation with a real scan (`verify_consent_compliance`) and can set up recurring monitoring (`monitor_compliance`). You still paste the snippet into Squarespace yourself: the MCP server provides the snippet, the instructions and the verification.

Example request:

> Give me my banner snippet for my Squarespace site and check that it is correctly installed on https://mysite.com

Learn more: [MCP server](/en/doc/mcp-server) and [FlowConsent for AI agents](/en/mcp).

## Frequently asked questions

### I can't find Code Injection. Why?

Your plan most likely does not include it: code injection is reserved for the Core, Plus and Advanced plans and some legacy plans. On a version 7.0 site, also look under **Website Tools** rather than **Custom Code**.

### Can I use a code block on a page instead of Code Injection?

No. A code block renders in the body of a single page: too late, and not everywhere. The snippet must be in the `<head>` of every page, which only the Header field guarantees.

### Should I keep Squarespace's cookie banner?

No. Two banners would collect two conflicting choices. Switch off Squarespace's banner under **Cookies & Data Privacy** once FlowConsent is installed.

### Google Analytics still sends data after a decline.

The ID is probably still set under **Developer tools → External API keys**, so Squarespace injects the script itself. Clear that field and declare Google Analytics in **Builder → Services**.