Quick Answer

Consentico automatically blocks most tracking scripts (Google Analytics, Meta Pixel, Klaviyo, etc.) until visitors consent. Scripts hardcoded in your theme HTML can't be blocked — those need manual fixes.

What gets blocked automatically

When a visitor hasn't given consent, Consentico blocks:

Analytics

Google Analytics (GA4, Universal Analytics)
Google Tag Manager
Hotjar
Microsoft Clarity
Heap
Mixpanel
Amplitude

Marketing

Meta Pixel (Facebook)
TikTok Pixel
Pinterest Tag
Snapchat Pixel
Twitter / X Pixel
LinkedIn Insight Tag
Microsoft Bing UET (Microsoft Ads)
Reddit Pixel

Email & CRM

Klaviyo (when loaded dynamically)
Mailchimp
Omnisend

Other

Intercom
Drift
Zendesk
Most third-party widgets

How blocking works

Consentico uses three layers of protection:

Script interception — We override document.createElement to catch scripts as they're added to the page
DOM monitoring — A MutationObserver watches for script tags being inserted
Manual tagging — Scripts marked with type="text/plain" are held until consent

This catches scripts that are loaded dynamically (via JavaScript), which is how most modern tracking works.

What we CAN'T block

Scripts that are hardcoded directly in your HTML or loaded via Shopify app embeds load before any JavaScript runs. This is a browser limitation — not specific to Consentico or any other consent app.

Example of a script we can't block:

<!-- In theme.liquid — loads immediately when the page loads -->
<script src="https://static.klaviyo.com/onsite/js/klaviyo.js"></script>

Example of a script we CAN block:

<!-- Loaded via JavaScript — we intercept this -->
<script>
  var s = document.createElement('script');
  s.src = 'https://static.klaviyo.com/onsite/js/klaviyo.js';
  document.head.appendChild(s);
</script>

This limitation applies to ALL consent management apps — CookieYes, Cookiebot, OneTrust, everyone. It's how browsers work.

Even when we can't block a script from loading, we can tell it to stop tracking. Consentico automatically signals your consent choice to these trackers:

Tracker	What happens when denied
Microsoft Clarity	Stops recording sessions, deletes cookies (ConsentV2 API)
Facebook Pixel	Enters limited data use mode
TikTok Pixel	Stops cookie-based attribution
Pinterest Tag	Pauses tracking
Snapchat Pixel	Stops tracking (`snaptr('consent', 'revoke')`)
Microsoft Bing UET	Enters denied `ad_storage` mode
Twitter / X Pixel	Enters denied consent state
Reddit Pixel	Stops tracking (`rdt('consent', 'revoke')`)
Hotjar	Receives a `consent_revoked` event
Klaviyo	Stops onsite tracking via `__kla_off` cookie
Google Analytics	Uses Consent Mode (cookieless pings only)

This means even if these scripts load before consent, they respect the visitor's choice once Consentico signals it.

Klaviyo uses two mechanisms: the __kla_off cookie (which we set) and Shopify's Customer Privacy API (which we also update). Both tell Klaviyo to stop tracking behavioral events like Viewed Product and Added to Cart.

How to check if scripts are leaking

How to fix unblocked scripts

Option 1: Check the app's settings

If the script comes from a Shopify app (like Klaviyo), check the app's settings for a "consent" or "privacy" option. Many apps can be configured to respect Shopify's Customer Privacy API.

Option 2: Use Google Tag Manager

Move your tracking into GTM with consent controls. This gives you full control over when scripts fire.

Set up GTM as a Shopify Custom Pixel
Add your tracking tags to GTM
Configure them to require consent before firing
Remove the hardcoded scripts from your theme

Option 3: Manual blocking (theme code only)

If the script is in your theme code (not from an app), you can mark it for blocking:

Before:

<script src="https://example.com/tracker.js"></script>

After:

<script type="text/plain" 
        data-cookie-category="marketing" 
        data-src="https://example.com/tracker.js"></script>

Consentico will activate this script only after the visitor accepts marketing cookies.

This only works for scripts in your theme code. You can't edit scripts that Shopify apps inject.

Google is special

Google scripts (Analytics, Ads, Tag Manager) work differently because of Google Consent Mode.

Even when consent is denied, Google scripts can load and send "cookieless pings" — anonymous data that Google uses to estimate your conversions. This is compliant because no personal data is collected without consent.

That's why you might see Google requests in DevTools even before consent. This is expected and correct behavior.

Learn more about Google Consent Mode →

Troubleshooting — common issues
Google Consent Mode — how Google tracking works with consent
Cookie scan — find all scripts on your store