> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replo.app/llms.txt
> Use this file to discover all available pages before exploring further.
# Cookie Consent
> Ask visitors for consent before your tracking scripts load, so your pixels stay GDPR and CCPA compliant.
export const Screenshot = ({src, altText, width, shadow = true}) => {
const generateAltText = imageSrc => {
if (!imageSrc) return "Screenshot";
const filename = imageSrc.split("/").pop() ?? "";
const nameWithoutExt = filename.replace(/\.[^/.]+$/, "");
const readable = nameWithoutExt.replace(/[-_]/g, " ").replace(/\b\w/g, char => char.toUpperCase());
return readable === "" ? "Screenshot" : readable;
};
const finalAltText = altText ?? generateAltText(src);
const imageWidth = width ? `${width}px` : "100%";
return ;
};
Cookie consent asks each visitor whether your tracking scripts are allowed to run, and holds those scripts back until they answer. It lives in **Site settings**, under the **Scripts & Pixels** tab, and covers the pixels and analytics you add there. Turn it on when you sell into regions with privacy laws like GDPR (EU) or CCPA (California), where firing tracking cookies before a visitor agrees can put you out of compliance.
Replo handles this natively, with its own consent banner and category system, so you do not need a separate consent tool for the pixels you manage in Scripts & Pixels. If your store already runs Cookiebot, you can connect it as your consent platform instead, and Replo hands consent over to it (see "Using Cookiebot instead of Replo's banner" below).
## How it works
When cookie consent is on, Replo does not load your tracking scripts on the first page view. Instead a banner asks the visitor to accept or reject tracking. The script tags only enter the page once the visitor grants the matching category, so nothing fires beforehand. This is stricter than tag managers that load a script and then ask it to hold back: with Replo, the script is never added to the page until consent allows it.
Each managed script is tied to one or more consent categories. A script loads only after the visitor grants **all** of the categories it needs. With Replo's own banner, the choice is remembered in a `replo_consent` cookie so returning visitors are not asked again until it expires. (With Cookiebot connected, Cookiebot stores and replays the choice instead.)
## Consent modes
The **Cookie consent** control at the top of the Scripts & Pixels tab has three modes:
* **Off**: no banner, and every managed script loads immediately for every visitor. This is the default and matches how a site with no consent layer behaves.
* **Simple**: shows a banner with **Accept all** and **Reject all**. The visitor makes one choice that covers every category at once.
* **Per category**: shows the same banner plus a **Customize** option, where the visitor can grant some categories and deny others (for example, allow analytics but not marketing).
## What consent gates
With consent on, these load only after the visitor agrees:
* **Pixels**: Google Analytics 4, Google Tag Manager, Meta Pixel, TikTok Pixel, Pinterest Tag, Reddit Pixel, and Snapchat Pixel.
* **Behavior analytics**: Hotjar and Microsoft Clarity.
* **Attribution and data**: Triple Whale, Segment, and Northbeam.
* **Custom scripts** you add in Scripts & Pixels, gated by the categories you pick.
* **Replo's own analytics**, which power [Insights](/apps/insights), gated on the analytics category.
Each built-in pixel maps to a sensible category by default: analytics tools (GA4, Hotjar, Clarity) require the analytics category, and ad pixels (Meta, TikTok, Pinterest, Reddit, Snapchat) require marketing. Google Tag Manager requires both, since it can load either kind of tag.
## Consent categories
Replo groups scripts into these categories, matching the standard ones used across ecommerce privacy tools:
* **Necessary**: always on, and never shown as a choice. These are the scripts your site needs to function.
* **Analytics**: measurement and traffic tools.
* **Marketing**: ad pixels and retargeting.
* **Preferences**: scripts that remember visitor settings.
* **Sale of data**: tracking that shares data with third parties, the category CCPA's "Do Not Sell" rules apply to.
In **Simple** mode, accepting grants every category and rejecting denies all of them. In **Per category** mode, the visitor decides category by category.
## Turn on cookie consent
In the [Site Builder](/apps/website-builder), open the **⋯ more-options menu** in the top bar, choose **Site settings**, and select the **Scripts & Pixels** tab.
Open the **Cookie consent** dropdown at the top of the tab and pick **Simple**
or **Per category**. Leave it on **Off** if you do not want a banner.
Any pixel or custom script added through Scripts & Pixels is consent-managed
automatically. If you see scripts listed under **Unmanaged scripts**, those
were pasted directly into your site and load regardless of consent. Use
**Convert to managed** on each one so consent covers it too.
Publish your site for the consent banner and gating to go live. Changes to scripts and consent settings apply to your published site on your next publish.
## Custom scripts and consent
When you add a custom script in Scripts & Pixels, and consent is on, Replo asks which consent categories it needs. The script loads only after the visitor grants every category you selected, so pick the narrowest set that fits (for example, marketing for an ad pixel, analytics for a measurement tool). You can also ask Replo in chat to add a script and tell it which category to gate on.
## Scripts that bypass consent
Consent only covers scripts Replo manages. A script pasted straight into your site's code, outside of Scripts & Pixels, loads for every visitor no matter what they choose. Replo flags these under **Unmanaged scripts** with a warning so you can spot them, and offers **Convert to managed** to bring them under consent. If you use tracking that you added outside Scripts & Pixels, convert it so your consent banner actually governs it.
## Customizing the banner
The banner Replo installs has default copy ("We value your privacy"), an **Accept all** and **Reject all** button, a **Customize** flow in Per category mode, and a link to your privacy policy. You can ask Replo to restyle it, reword it, or point the privacy policy link at your own page. Keep the banner in place while consent is on, since it is what collects the visitor's choice.
## Using Cookiebot or another consent platform instead of Replo's banner
If your store already standardizes on Cookiebot, connect it under **Consent Management** in the Scripts & Pixels tab with your **Domain Group ID (CBID)**, found in the Cookiebot dashboard under Settings. Once connected, Cookiebot owns consent for the site:
* Cookiebot's banner collects the visitor's choice, and Replo's native banner stays out of the way.
* Every managed script in Scripts & Pixels is tagged for Cookiebot automatically, so it stays inert until the visitor consents to its category. Replo's own analytics follows Cookiebot's answer too.
* If you already pasted Cookiebot's script into your site yourself, remove it once you connect Cookiebot here — two copies of the loader fight over consent, and the tab flags this for you.
* Connecting Cookiebot turns Replo's own **Cookie consent** control **Off** automatically, so visitors see one banner, not two. If you turn it back on later, the tab warns you about the double-banner conflict.
* Raw scripts pasted directly into your site bypass the platform's tagging and load regardless of consent. The tab flags them, and **Convert to managed** brings each one under the platform's control.
Other consent platforms that support per-script manual blocking (Termly, CookieYes, and similar) can be connected by asking Replo in chat — the agent configures the platform's loader and script-tagging attributes from that platform's documentation. Cookiebot is the fully built-in option; for others, verify the platform's banner appears and your scripts stay held until consent.
## FAQ
Yes. Turning consent on or off, changing the mode, and adding or converting scripts all apply to your live site on your next publish. You can check the behavior in preview before you publish.
No. With Replo's banner, the visitor's choice is stored in a `replo_consent`
cookie that lasts about six months, so the banner does not reappear until it
expires or the visitor clears it. If a visitor changes their mind and revokes
a category, Replo reloads the page so the now-disallowed scripts stop running.
With Cookiebot connected, Cookiebot stores the choice and handles revocation
itself; Replo's cookie is not used.
Cookiebot has first-class support: connect it in Scripts & Pixels with your
Domain Group ID and it becomes your site's consent platform, gating every
managed script automatically (see "Using Cookiebot instead of Replo's banner"
above). Do not add Cookiebot as a custom script, and set Replo's own cookie
consent to **Off** once it is connected, so visitors see only Cookiebot's
banner. Other consent tools like OneTrust are not integrated this way; for
those, Replo's built-in cookie consent is the simpler path since it already
gates the pixels you add in Scripts & Pixels. Use one consent system or the
other, never both.
No. When consent is on, the banner shows to every visitor. If you only need it
for certain regions, that is a good reason to keep the banner simple and
applicable everywhere rather than trying to show it conditionally.
It changes what you can measure to what visitors allow, which is the point of compliance. Visitors who accept are tracked exactly as before. The tradeoff is that data from visitors who decline is not collected, so expect your pixel and analytics counts to reflect consent rates rather than total traffic.
## Next steps
Add pixels and custom scripts, site-wide or per page.
Connect GA4, Meta, TikTok, and other tracking tools.
Read your traffic and sales after you launch.
Publish your site so consent settings go live.