Blocking scripts and embeds

Automatic blocking

Cookiemark knows the scripts and embeds of common services. When one of them appears on your page, the script holds it back until the visitor allows its category. You do not have to set anything up. It works as soon as the script sits first in your head.

The script watches the page in two ways, because neither catches everything alone.

• It intercepts scripts that other code creates. When such a script gets the address of a known service, Cookiemark changes its type before it is added, so the browser never runs it.
• It watches everything the browser adds to the page while it reads your HTML. A known script gets a type the browser does not run, and a known frame loses its address until the visitor agrees.

When the visitor allows the category, Cookiemark runs the held scripts again in their original order. An external script finishes loading before the next one starts, so code that depends on it still works.

The services Cookiemark recognises

With Google Consent Mode set to advanced, the three Google services above are not held back. They load straight away and follow the consent state themselves. Google Consent Mode v2 explains the difference.

Switching a service off

Open the site, then Cookies, and look under Services. Each service has a switch. When you switch one off, its scripts and frames load without asking. Only do that for a service that sets no cookies and collects nothing, or one you hold back another way.

Your own rules

For a service we do not know, add a rule under Cookies, Your own rules. A rule is a piece of text and a category. Any script or frame whose address contains that text waits for the category. Use a part that is unique to the service, such as widget.example-chat.com, so you do not catch other scripts by accident.

Marking a script yourself

You can mark any script in your HTML so it waits for consent. Change its type to text/plain and add data-cookiemark with the category. The browser does not run a script with that type, and Cookiemark runs it once the category is allowed.

<script type="text/plain" data-cookiemark="statistics"
  src="https://analytics.example.com/tracker.js"></script>

Inline scripts work the same way. Automatic blocking only looks at addresses, so an inline snippet always needs this markup.

<script type="text/plain" data-cookiemark="marketing">
  // This code runs once the visitor allows marketing.
  startMyPixel('1234567');
</script>

For a script that has to run as a module, add data-cmk-type="module". Cookiemark gives the script that type when it runs it.

<script type="text/plain" data-cookiemark="statistics"
  data-cmk-type="module" src="/js/stats.js"></script>

Combining categories

The attribute takes one category or a combination of them.

The categories are preferences, statistics and marketing. A script marked necessary runs straight away.

Markup from the plugin and from Cookiebot

Cookiemark also reads data-cookieconsent in place of data-cookiemark. That is the attribute of the CookieConsent plugin and of Cookiebot. Scripts and frames you marked for either of them keep working when you switch.

Iframes and other embeds

An embedded video, map or post from a known service gets the same treatment as a script. Cookiemark removes its address, hides the frame and shows a placeholder in its place. The placeholder names the category and has a button that allows it.

To hold back a frame Cookiemark does not know, write its address in data-src in place of src and add the category.

<iframe data-src="https://www.youtube-nocookie.com/embed/VIDEO-ID"
  data-cookiemark="marketing" data-cmk-label="YouTube"
  width="560" height="315" title="Our product in two minutes"></iframe>

The optional data-cmk-label puts the name of the service on the placeholder. Give the frame a width and a height, and the placeholder takes the same shape. The page then does not jump when the video loads. Images with data-src and the same attribute are released in the same way, without a placeholder.

The placeholder

The button on the placeholder allows the category of that embed and keeps the rest of the visitor's choice as it was. It is a real choice, so it is stored and logged like any other. Frames that nobody can see, such as a tracking pixel of one by one pixels, get no placeholder. They stay held back without one.

You can change the texts of the placeholder under Texts. The text holds %s where the name of the category goes.

When a visitor withdraws

A script that already ran cannot be stopped. So when a visitor switches off a category they allowed before, Cookiemark reloads the page by default. Before the reload it removes the cookies of that category that your cookie list names, on your domain and its parent domains. You can switch the reload off under Settings.

Cookies that a third party set on its own domain are out of reach of any script on your site. They expire on their own.

What blocking in the browser cannot stop

Cookiemark runs in the visitor's browser, so it can only act on what happens after it starts. Be aware of these limits.

• A script placed above the Cookiemark line runs before Cookiemark exists. Keep the line first in the head.
• An inline script without a src is never recognised automatically. Mark it yourself.
• A request that a script already sent cannot be called back. That is why a withdrawal reloads the page.
• A tag that runs inside Tag Manager is not a script on your page. Tag Manager decides when it runs, so give it a consent trigger.

A scan shows what still slips through. It lists every cookie your pages set before a visitor chooses, and who sets it.