Skip to content

Language

Documentation menu

Quick start

Install Cookiesh in minutes with plain HTML, Next.js or Google Tag Manager, then verify that third-party scripts stay blocked until visitors consent.

Last updated October 29, 2026

Cookiesh runs from a single script tag. Load it before any other tag on the page, mark the scripts that need consent with a category, and Cookiesh shows the right banner for each visitor’s region, blocks those scripts until the visitor agrees, and records the choice. Most sites are live in under five minutes.

Before you start

You need a Cookiesh account and a site. In the dashboard, open Domains → Add domain, enter your domain and copy the Site ID. It looks like ck_live_8f2a91.

Cookiesh sorts everything into four consent categories:

Category Default Typical use
necessary Always on Sessions, security, load balancing, the consent cookie itself
preferences Off Language, theme and other remembered settings
analytics Off Product and traffic analytics
marketing Off Advertising, retargeting and social pixels

Run your first cookie scan from the dashboard before going live. Cookiesh then knows which scripts and cookies belong to which category and can pre-fill your banner.

Install with HTML

Add the loader as the first script in <head>, so that it runs before anything that sets cookies:

<head>
  <script
    src="https://sdk.cookiesh.eu/v1/cookiesh.js"
    data-site-id="ck_live_8f2a91"
    async
  ></script>
  <!-- other tags below -->
</head>

Then change any script that needs consent from type="text/javascript" to type="text/plain" and add a data-cookiesh category. Cookiesh swaps the type back and runs the script once the visitor allows that category:

<script
  type="text/plain"
  data-cookiesh="analytics"
  src="https://analytics.example.com/script.js"
></script>

<script type="text/plain" data-cookiesh="marketing">
  // Inline scripts work the same way.
  initAdPixel();
</script>

Iframes such as embedded videos and maps can be blocked too. Use data-cookiesh-src instead of src and Cookiesh loads them after consent.

Install with Next.js

Install the React SDK:

npm install @cookiesh/react

Load the script in your root layout with the beforeInteractive strategy, so it runs before other scripts, and wrap the app in CookieshProvider:

// app/layout.tsx
import Script from 'next/script';
import { CookieshProvider } from '@cookiesh/react';

export default function RootLayout({ children }: { children: React.ReactNode }) {
  return (
    <html lang="en">
      <body>
        <Script
          src="https://sdk.cookiesh.eu/v1/cookiesh.js"
          data-site-id={process.env.NEXT_PUBLIC_COOKIESH_SITE_ID}
          strategy="beforeInteractive"
        />
        <CookieshProvider>{children}</CookieshProvider>
      </body>
    </html>
  );
}

Render consent-dependent code only when the category is allowed. useConsent() re-renders whenever the visitor changes their choice:

// app/analytics.tsx
'use client';

import Script from 'next/script';
import { useConsent } from '@cookiesh/react';

export function Analytics() {
  const { analytics } = useConsent();
  if (!analytics) return null;

  return <Script src="https://analytics.example.com/script.js" strategy="afterInteractive" />;
}

For logged-in products, pass userId to CookieshProvider to sync the visitor’s choice across devices.

Install with Google Tag Manager

Cookiesh’s Community Template sets Google Consent Mode v2 defaults before any tag fires and updates them when the visitor chooses.

  1. In your GTM container, open Templates → Tag templates → Search gallery and add Cookiesh CMP.
  2. Create a new tag from the template and paste your Site ID.
  3. Set the trigger to Consent Initialization – All Pages.
  4. Choose a default consent state for each region. Use denied for the EEA, the UK and Switzerland.
  5. For each Google tag, open Advanced settings → Consent settings. Leave built-in consent checks on, and require additional consent for non-Google tags.
  6. Publish the container.

If you load gtag.js without GTM, set the defaults yourself, before the Google tag:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    wait_for_update: 500,
  });
</script>

Cookiesh sends the matching gtag('consent', 'update', …) call as soon as the visitor makes a choice, and on every later page view.

Verify your installation

  1. Open your site in a private window. The banner should appear, and the browser’s developer tools should show no analytics or marketing cookies yet.
  2. Run Cookiesh.debug() in the console. It lists the detected region, the active banner, each blocked script and the current consent state.
  3. Accept analytics only and reload. Analytics scripts run, but marketing scripts stay blocked.
  4. In Google Tag Assistant, check that the Consent tab shows the default and update events in the right order.

Next steps