Agreely Docs
FR EN

Troubleshooting

Cookies still present after refusal

Symptom: after clicking "Refuse all", certain cookies are still visible in the browser DevTools.

Likely explanation: these are httpOnly cookies or cookies set by your server. JavaScript cannot read or delete httpOnly cookies. The Agreely banner does not claim otherwise.

Solution: read the agreely_consent cookie server-side and stop emitting non-essential cookies before the HTTP response is sent. See the Server side chapter.

If third-party cookies persist after refusal and they are not httpOnly, verify that their script tags have been converted to the type="text/plain" data-agreely-category="..." format (see Blocking scripts). Also run the enforcement scan (see Self-test) to identify violations by name.

CSP error in the console

Symptom: the browser console shows an error like Refused to load script from 'https://cdn.agreely.ca/...' because it violates the Content Security Policy.

Solution: add the three required directives to your Content-Security-Policy:

script-src  https://cdn.agreely.ca ;
connect-src https://cdn.agreely.ca ;
img-src     https://cdn.agreely.ca ;

If you use a nonce-based policy, pass your nonce via data-nonce="..." on the loader tag (see Installation).

connect-src error specifically: if the banner module loads but the configuration fetch fails, check that connect-src includes https://cdn.agreely.ca: the configuration fetch and the consent submission go through connect-src.

No style-src needed. Agreely emits no inline styles and no external <style> elements; style-src does not need any Agreely entry.

The banner is not showing

Check the following in order:

  1. Is the tag present in <head>? View the page source (Ctrl+U) and search for cdn.agreely.ca/e/v1/loader.js.
  2. Is the site verified and published? In the banner app, confirm the key in the tag is the site's current key (a rotated key stops working 24 hours later), that the site is verified and that a banner version is published (Publishing page). Until then, the network response for /e/v1/config/{key} carries "active": false and the banner shows nothing.
  3. Does the domain match? Consent is only accepted from the registered domain, its subdomains and the declared staging origins. Another origin does not prevent the banner from displaying, but consent submission is refused there (403, with a console warning).
  4. Does the visitor already have an active decision? If the agreely_consent cookie is present and valid, the banner does not reappear. Delete that cookie to test again.
  5. Is the loader blocked by an ad blocker? Test by disabling browser extensions or using private mode.

Testing on staging

  1. Add your staging URL (e.g., https://staging.yourdomain.com) under your site > Settings > Staging origins.
  2. Deploy the same HTML tag (same site key) to your staging environment.
  3. The banner displays and consent submissions are accepted from that origin.
  4. You can run an enforcement scan against the staging origin from the dashboard.

The banner reappears on every visit

Likely cause: the agreely_consent cookie is being blocked, expired, or deleted.

  • Check that your server is not emitting a Clear-Site-Data header or deleting the agreely_consent cookie in your session logic.
  • Check the lifetime: 183 days. If your SameSite policy or cookie settings are more restrictive, the cookie may be rejected.
  • Safari, like some privacy-focused browsers, limits how long cookies written by JavaScript can last (7 days or less). On those browsers, the banner may ask for consent again before the planned duration (183 days) has run out. The banner rewrites the cookie on each visit, with its original expiry: a person who comes back before the browser's limit keeps their choice.
  • On http:// (non-HTTPS), the cookie is issued without the Secure flag but remains functional. HTTPS is recommended in production.

Reporting an issue

If your issue is not listed here, write to [email protected], including your site key, the URL of the affected page, and a screenshot of the DevTools console.