Blocking scripts

Consent modes

Mode	What happens
Log only (default)	Records what visitors choose, but lets every tracker keep running. Safe for a first install; not compliance on its own.
Strict — block until consent	Known tracking scripts are held until the visitor accepts the category they belong to.

Set the mode in Settings. Strict is one of the checks in your dashboard’s compliance score.

Cookie categories

Category	Code name	Notes
Strictly Necessary	necessary	Always on — visitors cannot refuse it.
Functional	functional
Analytics	analytical
Marketing	marketing

What is held back automatically

In Strict mode, scripts, iframes and images whose address matches CookieRay’s built-in list of known trackers are held until the visitor consents to their category.

• A blocked iframe (an embedded video, a map) shows “This content is blocked until you accept cookies.” in its place.
• Cookies from categories the visitor refused are prevented and swept away.

Blocking uses the built-in tracker list. If a scan finds a script that is not on it, mark that script by hand (below).

Marking a script you pasted yourself

The browser fetches a script written straight into your HTML before any banner can stop it. To keep one inert until consent, make three changes:

1. Change src to data-cmp-src.
2. Add type="text/plain".
3. Say which category it belongs to with data-cmp.

<!-- Before -->
<script src="https://example.com/analytics.js"></script>

<!-- After: waits for Analytics consent -->
<script type="text/plain" data-cmp="analytical" data-cmp-src="https://example.com/analytics.js"></script>

Valid categories are analytical, marketing and functional. In Log only mode, marked scripts are released straight away.

Scripts that must never be blocked

Payment, security and other essential scripts can be excluded explicitly. They run untouched, even in Strict mode:

<script src="https://js.stripe.com/v3" data-cmp="ignore"></script>

Cookies with no category

Settings → Cookies With No Category decides what happens to a cookie that has not been categorised yet: Always block (the default) or Treat as marketing. Categorising every cookie found by a scan is another check in your compliance score.