DPDPEnforced May 13, 2027Checklist →
Book demo
++

Cookie & Tracker Blocking

Stop analytics and marketing scripts from running before consent under the DPDP Act. Mark scripts by category and keep your cookie inventory current.

Updated October 12, 2026

Under the DPDP Act, consent has to come before processing. For a website, that means analytics, advertising and other non-essential scripts must not run, and must not set cookies, until the visitor has opted in.

Two ways to block scripts

  1. Automatic. ConsentPlix watches scripts added to the page and holds back known trackers (Google Tag Manager and Analytics, Meta Pixel, Microsoft Clarity, Hotjar, TikTok, Mixpanel and Segment) until their category is allowed.
  2. Manual markup. You mark each script yourself. This is the most reliable option and works with any tag.

We recommend using manual markup for every script you control, and keeping automatic blocking on as a safety net.

Manual markup

Change the script’s type to text/plain so the browser does not run it, and add data-cp-category with the purpose it belongs to:

<!-- Google Analytics: runs only after 'analytics' consent -->
<script
  type="text/plain"
  data-cp-category="analytics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXX"
></script>

<!-- Meta Pixel: runs only after 'marketing' consent -->
<script type="text/plain" data-cp-category="marketing">
  !function(f,b,e,v,n,t,s){...}(window, document, 'script',
  'https://connect.facebook.net/en_US/fbevents.js');
  fbq('init', 'YOUR_PIXEL_ID');
</script>

When the visitor allows a category, ConsentPlix runs the matching scripts straight away. If they later withdraw, those scripts will not run again on the next page load.

Iframes and other embeds

For YouTube videos, maps or other embeds, put the address in data-cp-src instead of src. ConsentPlix sets the real src once the category is allowed:

<iframe data-cp-src="https://www.youtube.com/embed/VIDEO_ID" data-cp-category="marketing"></iframe>

ConsentPlix uses three categories: essential (always on), analytics and marketing.

Keep your inventory current

Sites change. A marketing team adds a new tag, or a plugin starts setting cookies, and your notice is suddenly out of date. This is called cookie drift.

The ConsentPlix scanner crawls your site regularly, lists every cookie and third-party script it finds, and flags anything that is not assigned to a category. Review those flags and assign each item before it reaches visitors.

Checklist

  • Every analytics and marketing script is marked with type="text/plain" and a data-cp-category.
  • The ConsentPlix script loads before all of them.
  • Google Consent Mode defaults are set to denied (see the Quickstart).
  • The scanner shows no uncategorised cookies or scripts.