Script Blocking
On this page
Anchor link for Overview
By default, Cookie Control blocks all non-necessary scripts until the user has given consent. This happens before any consent decision is recorded — scripts do not run until the appropriate category is accepted.
There are two ways to tell Cookie Control which scripts to gate: using data attributes on existing HTML scripts, or declaring integrations and trackers in your configuration.
Anchor link for Script attributes
If you have scripts already present in your HTML — rather than loaded via an integration definition — you can annotate them with data-cmp-* attributes. Cookie Control reads these attributes at startup and gates each script on the appropriate category.
The attribute name follows the pattern data-cmp--{category}, where {category} matches the name of a category in your configuration.
<!-- Always allowed — aligns with the necessary category -->
<script src="/essential.js" data-cmp-category="necessary"></script>
<!-- Blocked until analytics consent is given -->
<script src="/analytics.js" data-cmp-category="analytics"></script>
<!-- Blocked until marketing consent is given -->
<script src="/ads.js" data-cmp-category="marketing"></script>Anchor link for Turning off blocking
Two mechanisms allow you to put Cookie Control into a permissive mode where scripts are not blocked, with importantly different characteristics.
Blocked scripts
blockScripts is a setting in your domain configuration, managed through your user area(opens in a new window). Setting it to false puts Cookie Control into a permissive mode where all scripts are allowed to run, while still displaying the consent banner and recording consent decisions.
This is useful for a phased rollout — similar to a Content Security Policy in report-only mode, you can observe what Cookie Control would block before enforcing it.
Allowed Scripts
Adding ?scripts=allow to the Cookie Control script tag URL in your HTML tells it immediately — before any network requests — not to block anything.
This does not require the config retrieval and therefore maintains original load order.
| blockScripts: false | ?scripts=allow | |
|---|---|---|
| Configured via | User area (no code change) | HTML script tag (code change) |
| Known at parse time | No — requires config fetch | Yes — immediate |
| Initial blocking window | Yes — block → fetch → allow | No — never blocks |
| Script load order preserved | Not guaranteed | Yes |