Blocking scripts

Agreely provides three complementary blocking layers. Each targets a different use case.

#1. Declarative blocking: type="text/plain"

Convert your third-party script tags by replacing type="text/javascript" (or the absence of a type) with type="text/plain" and adding the data-agreely-category attribute:

<!-- Before (script fires immediately) -->
<script src="https://www.google-analytics.com/analytics.js"></script>

<!-- After (script blocked until the "analytics" category is granted) -->
<script type="text/plain"
        data-agreely-category="analytics"
        src="https://www.google-analytics.com/analytics.js"></script>

When the visitor grants the corresponding category, the banner recreates the script without type="text/plain" (with its other attributes and its content), which triggers its execution. It preserves existing nonces during the unlock.

#Category values

data-agreely-category value	Agreely category
analytics	Analytics
marketing	Marketing
functional	Functional

Scripts tagged strictly_necessary do not need this attribute: they execute normally without blocking.

#Common tag examples

<!-- Google Analytics (GA4 via gtag) -->
<script type="text/plain"
        data-agreely-category="analytics"
        src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>

<!-- Meta Pixel -->
<script type="text/plain"
        data-agreely-category="marketing">
  !function(f,b,e,v,n,t,s) { /* Meta Pixel code */ }(window, ...);
</script>

<!-- Hotjar -->
<script type="text/plain"
        data-agreely-category="analytics">
  (function(h,o,t,j,a,r){ /* Hotjar code */ })(window, ...);
</script>

<!-- Intercom (functional) -->
<script type="text/plain"
        data-agreely-category="functional">
  window.intercomSettings = { app_id: "XXXXXXXX" };
</script>

Tip: the installation page in the Agreely dashboard automatically generates the tag rewrites for your scripts based on your site scan (detected cookies are categorized and the corresponding tag rewrites are proposed).

#2. Iframe placeholders

For third-party iframes (YouTube videos, map widgets, etc.), use data-agreely-src instead of src. Until the visitor grants the category, the banner hides the iframe and shows a placeholder in its place, in the banner's language, with an accept prompt for that category:

<!-- Before -->
<iframe src="https://www.youtube.com/embed/XXXXXXX"
        width="560" height="315"></iframe>

<!-- After -->
<iframe data-agreely-src="https://www.youtube.com/embed/XXXXXXX"
        data-agreely-category="marketing"
        width="560" height="315"></iframe>

The placeholder is a block inserted just before the hidden iframe; it carries the agreely-embed-ph class, which you can style (dimensions included) in your own CSS. It names the category and offers a button to accept it. Accepting from the placeholder records a consent decision for that category, as in the banner, then the iframe loads normally.

#3. Dynamic injection guard

For scripts injected programmatically (via appendChild, insertBefore, etc.) from known tracker hosts, the banner intercepts the DOM insertion and neutralizes it until the category is granted. This guard is installed synchronously in the loader, before configuration is even fetched, so injections during load time are neutralized.

The guard operates against a built-in default list of common hosts (google-analytics.com, googletagmanager.com, connect.facebook.net, doubleclick.net, hotjar.com, clarity.ms, etc.) and extends it with the hosts detected by your site scan.

Honest limit. The injection guard intercepts standard DOM methods. document.write is out of scope; Consent Mode v2 default-deny is the fallback for that case.