Agreely
FR EN

Troubleshooting

Cookies still present after refusal

Symptom: after clicking "Refuse all", certain cookies are still visible in the browser DevTools.

Likely explanation: these are httpOnly cookies or cookies set by your server. JavaScript cannot read or delete httpOnly cookies. The Agreely banner does not claim otherwise.

Solution: read the agreely_consent cookie server-side and stop emitting non-essential cookies before the HTTP response is sent. See the Server side chapter.

If third-party cookies persist after refusal and they are not httpOnly, verify that their script tags have been converted to the type="text/plain" data-agreely-category="..." format (see Blocking scripts). Also run the enforcement scan (see Self-test) to identify violations by name.

CSP error in the console

Symptom: the browser console shows an error like Refused to load script from 'https://cdn.agreely.ca/...' because it violates the Content Security Policy.

Solution: add the three required directives to your Content-Security-Policy:

script-src  https://cdn.agreely.ca ;
connect-src https://cdn.agreely.ca ;
img-src     https://cdn.agreely.ca ;

If you use a nonce-based policy, pass your nonce via data-nonce="..." on the loader tag (see Installation).

connect-src error specifically: if the banner module loads but the configuration fetch fails, check that connect-src includes https://cdn.agreely.ca. SRI requires a CORS fetch that goes through connect-src.

No style-src needed. Agreely emits no inline styles and no external <style> elements; style-src does not need any Agreely entry.

The banner is not showing

Check the following in order:

  1. Is the tag present in <head>? View the page source (Ctrl+U) and search for cdn.agreely.ca/e/v1/loader.js.
  2. Is the site key valid? In the Agreely dashboard, confirm the key is not revoked and the domain is verified.
  3. Does the domain match? The banner only accepts submissions from declared origins (main domain and any extra_origins). An undeclared subdomain or origin blocks consent submission but does not prevent the banner from displaying. Look at the network response for /e/v1/config/{key} for an error message.
  4. Does the visitor already have an active decision? If the agreely_consent cookie is present and valid, the banner does not reappear. Delete that cookie to test again.
  5. Is the loader blocked by an ad blocker? Test by disabling browser extensions or using private mode.

Testing on staging

  1. Add your staging URL (e.g., https://staging.yourdomain.com) under **Cookies

    your site > Settings > Additional origins**.

  2. Deploy the same HTML tag (same site key) to your staging environment.
  3. The banner displays and consent submissions are accepted from that origin.
  4. You can run an enforcement scan against the staging origin from the dashboard.

The banner reappears on every visit

Likely cause: the agreely_consent cookie is being blocked, expired, or deleted.

  • Check that your server is not emitting a Clear-Site-Data header or deleting the agreely_consent cookie in your session logic.
  • Check the lifetime: 183 days by default. If your SameSite policy or cookie settings are more restrictive, the cookie may be rejected.
  • On http:// (non-HTTPS), the cookie is issued without the Secure flag but remains functional. HTTPS is recommended in production.

Reporting an issue

If your issue is not listed here, open a ticket from the Agreely dashboard (? > Support), including your site key, the URL of the affected page, and a screenshot of the DevTools console.