Guide · June 17, 2026
Squarespace cookie consent under PDPL: how to implement
PDPL-compliant cookie consent for Squarespace: code injection, platform limits, block tracking, and store consent evidence.
Quick answer
What is Squarespace cookie consent under the PDPL and why does it need to be done right?
Squarespace cookie consent under the PDPL means you set up a mechanism to request and record consent before loading non-essential cookies or scripts—especially analytics, ads, heatmaps, chat, and re-marketing. Under the Personal Data Protection Law (Law 91/2025/QH15), businesses must comply with personal data processing principles; violations can be handled under implementing decrees, and some serious cases may be criminally prosecuted.
With a Squarespace website, the practical issue is the platform does not always give you deep control like self-hosted CMSs. Therefore, you should design the flow so that tracking is not activated without consent, and once consent is given, you must have logs to prove it.
Does Squarespace have a built-in cookie banner, or do you need to build your own?
Squarespace offers some cookie and privacy options, but they are often insufficient for PDPL compliance at a Vietnamese business practice level, particularly if you use multiple third-party trackers. If you only enable a “cookie banner” but still let Google Analytics, Meta Pixel, Hotjar, or marketing scripts run before a user consents, you are still missing a critical compliance step.
Key point: don’t just ask “is there a banner?”—ask “are we blocking tracking before consent?” and “are we storing consent evidence?”
| Item | Possible on Squarespace | PDPL compliance notes | |
|---|---|---|---|
| Cookie banner | Yes, but limited | Must describe purposes clearly; no pre-ticked consent | |
| Block scripts before consent | Possible, but often requires Code Injection / external CMP | This is the most important part | |
| Cookie categorization | Can be done via script/CMP | Separate necessary, analytics, marketing | |
| Store consent evidence | Must design yourself | Include timestamp, banner version, choice state | |
| Withdraw consent | Must be supported | Should be as easy as, or easier than, consenting |
How to implement cookie consent on Squarespace with Code Injection?
If you need a practical implementation path, follow this process:
Inventory trackers in use:
list all scripts on Squarespace: analytics, ads, chat, form embeds, video embeds, maps, A/B testing. Note which scripts only collect technical data and which serve marketing.
Disable auto-loading of non-essential scripts:
for third-party scripts, do not insert them directly into the header/site-wide if they will run on page load. Instead, keep scripts in a “waiting for consent” state.
Use Code Injection or a CMP that supports Squarespace:
inject consent management code in the Header/Footer or via a CMP. The goal is to load trackers only after the user opts in by category.
Clear cookie categories:
at minimum, have “Necessary Cookies,” “Analytics,” and “Marketing.” Necessary cookies can operate to run the website; the other categories only run with appropriate consent.
Store consent evidence:
record the timestamp, selection state, banner content version, and the website/page where the user consented. This is critical operational data for audits later.
Allow consent withdrawal:
place a “Manage cookies” button in the footer or in the privacy policy so users can change choices. When withdrawn, the corresponding trackers must stop and not reload on subsequent page loads.
Practical example for a Squarespace store in Vietnam
A cosmetics shop using Squarespace typically embeds Meta Pixel, Google Analytics, and Messenger Chat. A proper approach is: when the user lands, show only the banner; only after they consent to “Analytics” or “Marketing” do you load Pixel/GA/Chat. If they refuse, the website still operates but does not load those scripts.
Important: don’t “hide the banner but still fire the pixel.” Under the regulations, collecting/sharing data via trackers can trigger obligations to notify, obtain consent, and contract with processors or data recipients, depending on your setup. When unsure, have a lawyer review the configuration.
How do Squarespace platform limitations affect PDPL compliance?
Squarespace is easy to use, but it offers less control than a self-hosted website. You may encounter limitations such as:
- difficulty controlling script load order;
- difficulty fully separating certain third-party embeds;
- difficulty building a native consent log without an external CMP;
- difficulty auditing all tracking from integrated apps.
Therefore, if your website has traffic in Vietnam or collects data from Vietnamese users, treat Squarespace as the presentation layer only. The PDPL compliance layer must sit in your script strategy, banner, consent logs, and day-to-day operations.
What should you note about data breach notification on the website?
If incidents occur—such as misconfigured trackers, form data exposure, or third-party scripts leaking personal information—the business must assess and notify the data breach within 72 hours of discovery as required. With a Squarespace website, do not overlook external dependencies like form embeds, CRM, email marketing, or chat widgets, as these are common failure points.
Short copy template for a cookie banner on Squarespace
You can start with this template and adjust for your site:
“We use necessary cookies to operate the website and analytics/marketing cookies to improve your experience and measure performance. You can accept all, reject non-essential, or manage your choices at any time.”
Buttons: Accept all | Reject non-essential | Manage cookies
If you need to store consent evidence or run a multilingual banner on Squarespace, consent.vn can help standardize consent and DSAR flows in a more operable way for SMEs.
- If your website processes personal data of Vietnamese users and uses non-essential cookies/trackers, you need a mechanism to obtain and record consent under the PDPL.
- Yes, but it typically requires additional configuration via Code Injection or an external CMP; just placing a banner without blocking scripts is not sufficient.
- If GA is not strictly necessary for basic operation and collects personal/identifying data or tracks behavior, you should obtain consent and explain the purpose clearly.
- You need to let them change their choices easily, stop loading the corresponding trackers on subsequent page loads, and update the logs as required.
Source: the Personal Data Protection Law (Law 91/2025/QH15) and Decree 13/2023/ND-CP: thuvienphapluat.vn. Enforcement authority A05: bocongan.gov.vn.
Get started — set up in 5 minutes.
Need help with PDPL compliance?