Install CookieHawk
Choose a platform and insert the generic snippet. Shopify, Wix, Squarespace and Webflow have only been tested as local static insertion patterns. We have not tested real accounts, themes, apps, native consent management or checkout. Resolve these before publishing.
1. Snippet and order
Place the loader as the first script in head, before GTM and tracking scripts. Do not use async/defer. Change data-policy-url to your privacy page. Choose banner language nb, nn, sv or en; the guide language does not change the banner language. Use only one banner installation.
<script src="https://cookiehawk.com/loader.js" data-core="https://cookiehawk.com/cmp.js" data-lang="nb" data-policy-url="/personvern.html" data-strict-gtm="1"></script>2. Mark static scripts
Tracking scripts directly in HTML require type=text/plain, data-cookiehawk-cat and data-cookiehawk-src. The example uses statistics; choose marketing for ads and functional for optional features. Inline code uses the same type and category, keeping its code between script tags. Unknown categories are not released.
<script type="text/plain" data-cookiehawk-cat="statistics" data-cookiehawk-src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>3. Platform guides
HTML
Plain HTML: insert the code immediately after the opening head tag in each page template. Mark static tags. Test first visits and reloads with a saved choice.
Shopify
Shopify: duplicate the theme. Open the online store theme → Edit code → layout/theme.liquid. Put the code first in head and mark your own static tracking scripts. This covers theme HTML only. The snippet does not integrate Customer Privacy API, app pixels, customer accounts or checkout. Do not replace Shopify consent management without resolving and testing these flows.
Wix
Wix: open Settings → Custom Code → Add Custom Code. Select head and all pages. On a published test page, verify that the loader runs before your tracking code and only once per document. Wix may load code dynamically; the local test does not establish actual load order, Wix Analytics or app behaviour. An HTML iframe is not a site-wide installation.
Squarespace
Squarespace: open Code Injection and place the snippet at the top of Header. Requires a plan with code injection. Check the published page order and mark your static scripts. Checkout, built-in integrations and navigation without full page loads are not verified.
Webflow
Webflow: Site settings → Custom code → Head code. Place the snippet before your tracking code, save and publish to a test domain. Check every page template and any Page settings code. Designer preview is not sufficient. Ecommerce and integrations are not verified.
WordPress
WordPress: download the ZIP, open Plugins → Add New → Upload, install and activate. Under Settings → CookieHawk Consent, select language and privacy page. Avoid duplicate theme/GTM installation. Activate logging using the customer configuration we provide.
Google Tag Manager
GTM: install the loader directly in head, not inside GTM. Mark the container statistics|marketing. It can load for either choice; each tag must check its own category. Custom HTML must require cookiehawk.marketing=true or cookiehawk.statistics=true on cookiehawk_consent_update. The event alone is not consent. Remove bypass triggers and optional noscript iframes.
<script type="text/plain" data-cookiehawk-cat="statistics|marketing" data-cookiehawk-src="https://www.googletagmanager.com/gtm.js?id=GTM-XXXX"></script>Google Consent Mode v2: six consent-controlled signals control advertising and analytics storage, ad data, ad personalisation, functionality and personalisation. Correctly configured Google Ads and GA4 tags follow consent. security_storage is granted; the other six start as denied.
Microsoft UET
Microsoft UET: the banner sends consent/default with ad_storage=denied and consent/update following marketing consent, including stored choices and withdrawal. Mark the UET tag marketing. This setup retains strict blocking; it does not promise Microsoft Advanced Consent Mode or modelled conversions. Verify actual UET traffic on the customer site.
4. Test before publishing
Use a clean browser session and Network log. Before choice and after rejection: no requests from marked optional tags. Also test statistics-only and marketing-only. After acceptance: allowed tags run once. Reload to check the stored choice. Withdraw and verify reload and cessation of optional calls. Test multiple pages, mobile, keyboard and the privacy link. Loader/cmp must return 200. Consent status alone does not prove network blocking.
Limits and further setup
fetch/XHR/beacon, Workers, shadow DOM, srcdoc and server-side tracking need separate measures. A local snippet test does not certify a platform. Logging and export require registered customer setup, archived banner information and verification of received events. Contact us for activation.