How to add a cookie consent banner to Squarespace (step by step)

Of all the site builders, Squarespace makes this the most frictionless: one Code Injection panel, one Header field, one paste. Zest fits it without bending anything.

Code injection is a plan feature, and Squarespace has renamed plans over the years. Their help center article on code injection lists which plans currently include the panel (Core, Plus, and Advanced at the time of writing).

What you need

• A Squarespace site whose plan includes Code Injection.
• Grab your Zest snippet from the playground first:

<script>
  window.ZestConfig = {
    position: "bottom",
    theme: "auto",
    policyUrl: "/privacy-policy"
  };
</script>
<script src="https://cdn.jsdelivr.net/npm/@freshjuice/zest/dist/zest.min.js"></script>

Inject the snippet

1. In the admin, open Settings. Newer accounts call this Website Tools.
2. Open Code Injection.
3. Paste the snippet into the Header field, which injects into the head of every page.
4. Save.
5. Open the live site in a private window.

Per-page code injection also exists (page settings → Advanced), but consent is a site-wide job. Use the Header field so the banner is everywhere from the first visit.

The built-in banner, or ours

Squarespace ships a cookie notice of its own under Settings → Cookies & data. It is a notice, not a consent tool: no categories, no blocking, nothing gated. Run both and visitors meet two banners. Pick one:

• Zest for category consent, script blocking, Google Consent Mode v2, GPC, and geo rules.
• The built-in notice if a minimal heads-up is genuinely all you need.

If you are reading a compliance guide at all, you probably want the first one, and it costs the same as the included notice: nothing.

Prove it works

Private window, live domain:

• First visit shows the banner; after choosing, reloads are banner-free.
• Tracking scripts pasted into the same Header field, or wired through Squarespace’s integrations, wait for consent once their domains are in Zest’s blocklist, the blockedDomains key in window.ZestConfig (details). The network tab shows them firing only after the matching category is accepted.

Snags

There is no Code Injection panel. Your plan lacks it. Check the plan list in Squarespace’s doc linked above, then upgrade or work around.

Two banners. The built-in cookie notice is still on. Switch it off under Settings → Cookies & data.

Code shows in the editor but does nothing. Injection runs on the published site. Check the live domain, not the preview.

Why this beats an app-store CMP

Subscription consent tools bill monthly and load from their servers. Zest is a 16KB open-source script pasted once: no quota, no vendor dependency, nothing to cancel. The Header field is the entire installation.

For the policy page, the free policy generator drafts one from six questions about your site.