Installing FlexyConsent

FlexyConsent is one script tag. Once it is on the page it shows the banner, records the visitor's choice, holds trackers back where the visitor's region asks for consent, and speaks the consent standards your other tools already understand — IAB TCF, IAB GPP, US Privacy, Google Consent Mode v2, Google Additional Consent and Microsoft UET — without any further configuration.

1. Create a project

Sign in to the FlexyConsent dashboard and create a project for your domain. A project holds one site's settings, its cookie declarations and its banner design.

2. Copy your script tag

The project's install snippet looks like this, with your own 40-character script ID:

<script src="https://flexyconsent.com/d/6/1/9/61946a9bb1d7c74ae4e8776ba1a13df0cb0cf835.js"></script>

The first three path segments are simply the first three characters of the ID.

3. Put it FIRST in `<head>`

This is the one placement rule that matters, and it is not a style preference.

FlexyConsent blocks trackers by intercepting the browser APIs they use — script injection, cookies, storage, workers, network calls. It can only intercept what has not already happened. Put the tag above every other script in <head> and blocking starts at parse time, before a single tracker has run. Put it lower and everything above it has already loaded, set its cookies and sent its first request, and no consent tool can take that back.

<head>
  <meta charset="utf-8">
  <script src="https://flexyconsent.com/d/…/<your-id>.js"></script>
  <!-- everything else: analytics, tag managers, pixels, fonts -->
</head>

Load it synchronously — no async, no defer. Both hand control back to the parser, which is exactly the gap the script exists to close.

4. Check it is working

Open your site and look at the browser console. Every load prints one line naming the running version:

FlexyConsent CMP v1.0.30 — consent script started (part 1, generated)

The version number will be whichever is current; the line itself is what you are looking for.

If that line is missing, the tag is not on the page or its ID is wrong. If you see the banner but not the line, you are looking at a cached copy of an older script — hard-reload.

Then check the standard APIs answer, in the same console:

__tcfapi('ping', 2, console.log);   // cmpId 317, cmpStatus "loaded"
__gpp('ping', console.log);          // signalStatus "ready"
__fcapi('getConsentState', console.log);

Platform integrations

WordPress — install the FlexyConsent plugin and paste your project ID. The plugin places the tag correctly for you.
Shopify — install the FlexyConsent app. It registers the script through Shopify's own consent APIs, so Shopify's customer privacy state follows the banner.
Google Tag Manager — see Google Tag Manager. GTM can host the tag, but the page source is the better placement for the reason above.
Anything else — the plain script tag works on any site you can edit the HTML head of.

What you get without configuring anything

IAB TCF — __tcfapi, TCF v2.4 (TC string v2, policy version 5), IAB Europe certified CMP ID 317. A TC String is created only when the visitor acts, never before.
IAB GPP — __gpp, including the EU and Canadian TCF sections, the US national section and the US state sections.
US Privacy — __uspapi, for anything still reading the older signal.
Google Consent Mode v2 — the seven consent types, set as defaults before your tags fire and updated the moment the visitor chooses. See Google Tag Manager.
Google Additional Consent v2 — for ad technology providers that are not on the IAB vendor list.
Microsoft UET — consent signals for Microsoft Advertising.
Tracker blocking before consent — where the visitor's region asks for consent (for example the EU/EEA, the UK and Switzerland), first-time visitors get essential trackers only, enforced from parse time; tags that read a consent signal themselves (IAB TCF vendors, Google's and Microsoft's Consent Mode tags) are left to that signal. Elsewhere the project's region settings and relaxed mode (on by default) decide what loads.
The banner in the visitor's own language, detected from their browser.

Google AdSense and Ad Manager

With IAB TCF on for the EU / EEA, the UK and Switzerland, FlexyConsent — a Google-certified CMP — passes the visitor's choice to Google, so Google's own fallback consent message is not needed.

In Google's Privacy & messaging, under European regulations > Settings, turn off Allow Google to maximize message coverage. Otherwise visitors can see two consent messages wherever Google's ad tag loads before FlexyConsent.

Your own code

To gate your scripts on the visitor's choice — under any privacy regime, including ones with no industry signal such as Brazil's LGPD or Türkiye's KVKK — use the publisher consent API.