Ghost CMS PDPL cookie consent: code injection, block analytics/embeds

What is Ghost CMS PDPL cookie consent and why do it?

You need to do it because Ghost CMS commonly allows scripts to be embedded via Code Injection, which can inadvertently load cookies/trackers before the user consents. With the Personal Data Protection Law (Law 91/2025/QH15, expected to take effect 01/01/2026), businesses must control consent, provide transparent notices, and retain consent evidence as required.

Real example: a blog using Ghost injects Google Analytics, Meta Pixel, and YouTube embeds in the header/footer. If scripts load as soon as the page opens, cookies may be set before consent. The right approach is to branch scripts by consent status and only load when the user selects “Accept”.

How do you add a cookie banner into Ghost CMS with code injection?

You can inject the banner/consent logic via Code Injection in Ghost Admin, typically in Site Header or Site Footer, then control script loading based on the user’s choices.

Sample logic to block scripts in Ghost

You can use the simple sample below in Code Injection (Footer) to control script loading after consent:

<script>
  function loadScript(src) {
    var s = document.createElement('script');
    s.src = src;
    s.async = true;
    document.head.appendChild(s);
  }

  function getConsent() {
    try { return JSON.parse(localStorage.getItem('cookie_consent') || '{}'); }
    catch (e) { return {}; }
  }

  function applyConsent() {
    var c = getConsent();
    if (c.analytics) {
      loadScript('https://www.googletagmanager.com/gtag/js?id=GA_MEASUREMENT_ID');
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);} gtag('js', new Date());
      gtag('config', 'GA_MEASUREMENT_ID', { anonymize_ip: true });
    }
    if (c.marketing) {
      loadScript('https://connect.facebook.net/en_US/fbevents.js');
    }
  }

  document.addEventListener('DOMContentLoaded', applyConsent);
</script>

Note: this is only a technical sample. For a production implementation, verify the notice requirements, processing purposes, and withdrawal-of-consent mechanisms under the regulations.

How do you block analytics and embeds until consent is given?

The safe approach is not to let third-party scripts auto-load. For analytics, only load after the user agrees to the “analytics” group. For embeds like YouTube/Maps, use a placeholder and only swap in the real iframe after consent.

Comparison table of common blocking methods

With Ghost, a common practical approach is: keep the original content in Markdown, but replace the embed with a placeholder block and a button “Allow third-party content to load.” When the user clicks, JavaScript creates the corresponding iframe or script.

How should you store consent evidence on Ghost?

You should store at least: the consent timestamp, the banner/policy version, the categories selected, and how the user consented. If accounts exist, you can link consent to the user ID; if the user is a guest, store via cookie/localStorage with a technical ID.

A key point for SMEs: don’t just “show a banner.” Under the regulations, you must be able to prove consent was captured and retrievable for internal requests or audits. If you use a consent management platform, make sure exportable logs exist, not just storage in the browser.

In what order should you implement Ghost CMS PDPL cookie consent?

Recommended order: inventory trackers, classify cookies, default-block, implement the banner, store logs, then test again on the live site. If you have complex integrations such as multiple themes or multiple staging/production environments, standardize with a shared snippet.

Remember: when a personal data breach occurs, businesses must issue a breach notification within 72 hours from discovery. Serious violations may face criminal handling; specific penalties will follow the Government’s guiding decree.

If you need a banner template, policy text, or ready-to-paste snippets for Ghost, consent.vn can help standardize them for the cookie consent flow and store consent evidence.

Source: the Personal Data Protection Law (Law 91/2025/QH15) and Decree 13/2023/ND-CP: https://thuvienphapluat.vn ; Ministry of Public Security (A05): https://bocongan.gov.vn