Blocking scripts

Agreely provides three complementary blocking layers. Each targets a different use case.

#1. Declarative blocking: type="text/plain"

Convert your third-party script tags by replacing type="text/javascript" (or the absence of a type) with type="text/plain" and adding the data-agreely-category attribute:

<!-- Before (script fires immediately) -->
<script src="https://www.google-analytics.com/analytics.js"></script>

<!-- After (script blocked until the "analytics" category is granted) -->
<script type="text/plain"
        data-agreely-category="analytics"
        src="https://www.google-analytics.com/analytics.js"></script>

The banner replaces type="text/plain" with type="text/javascript" when the visitor grants the corresponding category, which triggers script execution. It preserves existing nonces during the unlock.

#Category values

data-agreely-category value	Agreely category
analytics	Analytics
marketing	Marketing
functional	Functional

Scripts tagged strictly_necessary do not need this attribute - they execute normally without blocking.

#Common tag examples

<!-- Google Analytics (GA4 via gtag) -->
<script type="text/plain"
        data-agreely-category="analytics"
        src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>

<!-- Meta Pixel -->
<script type="text/plain"
        data-agreely-category="marketing">
  !function(f,b,e,v,n,t,s) { /* Meta Pixel code */ }(window, ...);
</script>

<!-- Hotjar -->
<script type="text/plain"
        data-agreely-category="analytics">
  (function(h,o,t,j,a,r){ /* Hotjar code */ })(window, ...);
</script>

<!-- Intercom (functional) -->
<script type="text/plain"
        data-agreely-category="functional">
  window.intercomSettings = { app_id: "XXXXXXXX" };
</script>

Tip: the installation page in the Agreely dashboard automatically generates the tag rewrites for your scripts based on your site scan (detected cookies are categorized and the corresponding tag rewrites are proposed).

#2. Iframe placeholders

For third-party iframes (YouTube videos, map widgets, etc.), use data-agreely-src instead of src. The banner shows a bilingual placeholder with a per-category accept prompt until the visitor grants the category:

<!-- Before -->
<iframe src="https://www.youtube.com/embed/XXXXXXX"
        width="560" height="315"></iframe>

<!-- After -->
<iframe data-agreely-src="https://www.youtube.com/embed/XXXXXXX"
        data-agreely-category="marketing"
        width="560" height="315"></iframe>

The placeholder inherits the iframe dimensions and shows the bilingual category label. When the visitor accepts, the iframe loads normally.

#3. Dynamic injection guard

For scripts injected programmatically (via appendChild, insertBefore, etc.) from known tracker hosts, the banner intercepts the DOM insertion and neutralizes it until the category is granted. This guard is installed synchronously in the loader, before configuration is even fetched, so injections during load time are neutralized.

The guard operates against a built-in default list of common hosts (google-analytics.com, googletagmanager.com, connect.facebook.net, doubleclick.net, hotjar.com, clarity.ms, etc.) and extends it with the hosts detected by your site scan.

Honest limit. The injection guard intercepts standard DOM methods. document.write is out of scope; Consent Mode v2 default-deny is the fallback for that case.