How to gate a chat widget behind cookie consent on any website platform

Why this matters

Chat widgets almost always store something — a conversation ID at minimum — and under GDPR and similar regimes that usually requires consent before it happens, not after. The fix is not a banner on top of a widget that has already loaded; it is not loading the widget until consent exists. That means injecting the script from your consent callback rather than putting it in the page directly.

What you paste

<script>
  // Load the widget only once the visitor has accepted functional cookies.
  window.addEventListener("consent:accepted", function (event) {
    if (!event.detail || !event.detail.functional) return;
    var s = document.createElement("script");
    s.src = "https://example.com/widget.js";
    s.defer = true;
    s.dataset.site = "your_public_key";
    document.body.appendChild(s);
  });
</script>

The event name depends on your consent tool — Cookiebot, Osano, CookieYes and Google Consent Mode all expose something equivalent. The pattern is the same: nothing loads until consent fires.

Where it goes, by platform

The code is identical everywhere. The screen you paste it into is not, and neither is whether your plan allows it — 19 of 35 platforms require a paid plan for custom code.

How to check it worked

• Open the site in a private window, decline consent, and confirm no widget script appears in the Network tab.

• Check Application → Cookies and confirm no widget cookies exist before consent.

• Accept consent and confirm the widget then loads without a page refresh.

What goes wrong

• Loading the widget and hiding it with CSS. It has already set its cookies; hiding it changes nothing legally.

• Forgetting that a returning visitor's stored consent should load the widget on the next page load without waiting for the event.

• Blocking the widget so thoroughly that visitors who accept still cannot reach support.

Questions

Is a chat widget a functional or a marketing cookie?

Usually functional, since it exists to deliver a service the visitor asked for — but this depends on what the vendor stores and whether they use it for anything else. Read their cookie declaration rather than assuming, and take your own legal advice.

Does this apply outside the EU?

Increasingly yes. The UK, Brazil, and several US states have comparable rules. Consent-gating by default is the simpler position to maintain.