Install guide

Everything you need to put Optwise on a website and check it works.

Install

Add your website in the dashboard to get your site ID. Then paste this as the first element inside <head> on every page:

<script src="https://optwise.eu/c.js" data-site="your-site-id"></script>

It must come before Google Analytics, Google Tag Manager, pixels and any other tags. Scripts that run before it can’t be held back.

Everything else, such as colours, texts, languages and categories, is set in the dashboard and reaches your site within a minute.

Platforms

WordPress

Install a header-code plugin such as WPCode, add the line as a header snippet and give it the highest priority so it loads first. Or, in a child theme, add it to header.php directly after <head>, above wp_head(). If you use another cookie plugin, deactivate it.

Shopify

Online Store → Themes → ⋯ → Edit code → layout/theme.liquid. Paste the line directly after <head>. Remove Shopify’s own cookie banner if it’s switched on, so visitors don’t see two.

Webflow

Site settings → Custom code → Head code. Put the line at the top, then publish.

Wix, Squarespace, Framer

Add custom code to the site header, set to load on all pages. On Wix: Settings → Custom code → Add code → Head, all pages, load once. On Squarespace: Settings → Advanced → Code injection → Header. On Framer: Site settings → General → Custom code → Start of head tag.

Next.js

// app/layout.tsx
import Script from 'next/script';

export default function RootLayout({ children }) {
  return (
    <html lang="en">
      <head>
        <Script src="https://optwise.eu/c.js" data-site="your-site-id" strategy="beforeInteractive" />
      </head>
      <body>{children}</body>
    </html>
  );
}

Plain HTML or any other system

Edit the template that produces the <head> of every page and add the line at the top.

Hold back scripts

Known trackers (Meta, LinkedIn, TikTok, X, Pinterest, Snapchat, Microsoft Ads, Hotjar, Microsoft Clarity, Mixpanel, Segment, Amplitude) are held back automatically. For any other script, change its type to text/plain and say which category it belongs to:

<!-- before -->
<script src="https://example.com/stats.js"></script>

<!-- after -->
<script type="text/plain" data-category="analytics" src="https://example.com/stats.js"></script>

Inline scripts work the same way. Embeds use data-src instead of src:

<iframe data-category="marketing" data-src="https://www.youtube-nocookie.com/embed/VIDEO_ID" title="Video"></iframe>

Strictly necessary scripts, such as your shopping cart, login or load balancer, need no change.

Google tags and Tag Manager

Don’t change Google tags. Optwise sets Google Consent Mode v2 before they load: every signal starts as denied and is updated when the visitor chooses.

With Google Tag Manager, keep the GTM snippet as it is and put the Optwise line above it. Don’t load Optwise from inside GTM. In GTM, a consent_update event is pushed to the data layer whenever the choice changes, which you can use as a trigger for non-Google tags.

To check: open your site with Google Tag Assistant. Before choosing, the consent state should show “denied” for every type. After accepting, it should show “granted”.

Ad partners (IAB TCF)

If your site shows programmatic ads, for example through Google AdSense or Ad Manager, switch on Ad partners in the dashboard (Pro and Business plans). Visitors in the EEA, the UK and Switzerland then get the IAB Transparency & Consent Framework v2.3 banner, and your ad partners receive their choices through the standard __tcfapi interface.

1. In Dashboard → Ad partners, choose the ad companies you work with. Your ad network can tell you which; a short list is clearer for visitors.
2. If you use Google ad partners that aren’t on the IAB list, choose them under “Google ad partners”. Their choices are passed in Google’s Additional Consent string.
3. Use the install code with data-tcf, first in <head>, above your ad and Google tags:

   <script src="https://optwise.eu/c.js" data-site="your-site-id" data-tcf></script>

Visitors’ choices are stored in the standard euconsent-v2 cookie and in your consent log. Visitors outside Europe see your normal banner, and ad tags are told the framework doesn’t apply to them.

Settings link

After a visitor chooses, a small round button stays in the corner so they can change their mind. You can switch it off in the dashboard if you’d rather put a link in your footer:

<a href="#" data-cc-open>Cookie settings</a>

The law requires that withdrawing consent is as easy as giving it, so keep one of the two on every page.

JavaScript API

Optwise.has('analytics')        // true or false
Optwise.get()                   // { categories, regime, gpc, id, decided }
Optwise.on(function (detail) {  // called on every change
  if (detail.categories.marketing) { /* load something */ }
});
Optwise.open()                  // open the settings
window.addEventListener('consent:change', function (e) { console.log(e.detail); });

Rules by country

With the default setting, the script asks our server for the visitor’s country and applies:

• Opt-in in the EU, EEA, UK, Switzerland and every country not listed below: nothing optional runs until the visitor agrees. Accept all and Reject all are shown side by side, with the same look.
• Opt-out in the United States, Australia, Japan and New Zealand: scripts may run, and the visitor gets a notice with a way to say no. In the US the button reads “Do Not Sell or Share My Personal Information”, and Global Privacy Control signals are honoured automatically.

If the country can’t be found in time, the visitor gets opt-in. You can choose “Ask everyone first” in the dashboard to use opt-in everywhere.

Consent log

Every choice is recorded so you can show a regulator that consent was given. Each record holds a random consent ID, the choice, the time, the policy version, the language, the page, the browser, the country and the IP address with its last part removed. Records are chained with SHA-256 hashes, and the dashboard can check that none has been changed or removed.

Visitors can see their consent ID in the settings panel. If one asks what they agreed to, look it up under Consent log → Find a visitor’s record.

When you change what your site tracks, use Settings → Ask everyone again. Every visitor sees the banner again and new records carry the new policy version.

Go-live checklist

1. The line is the first thing in <head> on every page.
2. Other scripts are tagged, or are on the automatic list.
3. Your privacy and cookie policy lists each cookie, its purpose, provider and lifetime, and is linked in the banner settings.
4. In a private window, before clicking anything: no analytics or ad cookies appear in the browser’s developer tools (Application → Cookies).
5. After Reject all: still no analytics or ad cookies.
6. After Accept all: your tools load and Tag Assistant shows “granted”.
7. The settings button or footer link reopens the settings.
8. The Consent log in the dashboard shows your test choices.

Questions

Will it slow my site down?

The script is about 9 KB compressed. Returning visitors are handled immediately from their saved choice; the network is only needed for settings and the country.

What if your server can’t be reached?

The banner still appears using the strictest rules and default texts, and optional scripts stay blocked until the visitor chooses.

Does this make my site compliant?

It gives you what you need to collect valid consent and prove it. Compliance also depends on tagging your scripts correctly, an accurate cookie policy, and what you do with the data.

Where is data stored?

In the EU. See our sub-processors and data processing agreement.