Webflow cookie consent under PDPL: inject scripts, block embeds, custom code

What is Webflow cookie consent under PDPL and what needs to be done?

Cookie consent in the PDPL context is the mechanism to request and record consent before setting/reading cookies or running non-essential trackers. With Webflow, obligations typically sit across three layers: the banner, blocking third-party scripts before consent, and storing logs to evidence consent.

If your site only has technical cookies to operate forms, login, carts, or security, you should still categorize them clearly. Meanwhile, Google Analytics, Meta Pixel, chat widgets, video embeds, heatmaps… usually trigger the obligation to clearly disclose purposes and obtain consent as required.

How do you insert scripts in Webflow so they don't run before consent?

The safest approach is not to attach tracking scripts directly to the default page load. Instead, separate scripts into groups—necessary, analytics, marketing—and only inject non-essential groups after the user has opted in.

Real-world example: if you use GA4 via Webflow custom code, wrap the injection in the condition “analytics = true.” If you use GTM, configure triggers based on consent state rather than loading the container up front.

How do you block YouTube, Maps, and chat widget embeds in Webflow?

Embeds are often overlooked because they look like embedded content but can actually fetch resources from third parties. With Webflow, you should replace direct embeds with placeholders until consent is given.

Practical implementation examples:

• YouTube: display a static thumbnail + “Watch video” button; only when clicked should you load the iframe.
• Google Maps: use a static map preview image; only load the live map after consent.
• Facebook/Instagram embeds: lock the iframe until the user agrees to the marketing/functional group depending on purpose.
• Chat widget: if the widget sets cookies or identifies users, only initialize it after the appropriate consent.

The important point is not to label any tool as “illegal”; the issue is that it triggers obligations to inform, categorize purposes, and record consent as required.

Where should Webflow custom code live to control consent?

In Webflow, you typically have three places to inject code: Project Settings, Page Settings, and the Embed element. For consent control, the fewer things that run early, the better.

Practical suggestions:

• Project Settings > Custom Code: leave only what is truly needed before consent, such as CSS or minimal operational scripts.
• Page Settings: avoid stuffing per-page trackers if you don’t have consent gating.
• Embed element: use for blocks that can be lazy-loaded; replace iframes with a button/placeholder.

If your dev team writes its own code, consider patterns like:

• create a window.consentState variable
• store choices in localStorage/an internal cookie
• only inject external scripts after the corresponding state is enabled
• provide a revokeConsent() function to unload or stop triggering new trackers (note: you cannot always delete data already sent to third parties, so disclose this clearly)

What proof should Webflow cookie consent under PDPL keep?

You need to store who agreed, to what, when, and under which notice/policy version. Many SMEs skip this because they only look at the on-screen banner.

If the site has lead-gen forms or user accounts, link the consent log to an internal identifier to support compliance checks. If you process sensitive personal data or transfer data overseas, review additional obligations under the rules and consult a lawyer.

What are the risks if you don't block correctly?

The risk isn’t just a “for show” banner. If trackers run before consent, the business may be unable to prove it provided proper notice and collected data on a valid basis. In complaints or audits, you will need to explain your script flow, consent logs, and public policies.

According to the Personal Data Protection Law (Law 91/2025/QH15), expected to take effect on 01/01/2026 and replacing Decree 13/2023/ND-CP, the enforcement authority is the Ministry of Public Security (A05). Specific penalties will be set out in the Government’s implementing decree; serious violations may be subject to criminal liability.

What’s a quick start implementation for a Webflow team?

You can start with the following minimal checklist:

• The banner has equally prominent “Decline” and “Accept” buttons.
• Clear cookie categories; don’t lump everything into a single “accept.”
• Analytics/marketing scripts only load after consent.
• Third-party embeds switch to placeholders.
• A “Manage cookies” link in the footer.
• Store consent logs and policy versions.
• Have a process to handle access/delete/rectification requests (DSAR).

If you build Webflow sites for clients, consent.vn can help standardize cookie banners, store consent evidence, and manage DSAR flows without patching each site by hand.

Source: the Personal Data Protection Law (Law 91/2025/QH15) and Decree 13/2023/ND-CP: thuvienphapluat.vn; Enforcement authority A05: bocongan.gov.vn