How to Use iubenda to Block Trackers Until Consent

The short answer: on a site under 25,000 pageviews a month, Essentials at €4.99 a month billed yearly covers this setup (pricing page, checked on 26 October 2026), and the order matters more than the tier: generate the cookie policy, configure the banner, turn on auto-blocking, decide between Basic and Advanced Consent Mode, paste the snippet as the first element in the head, let the Claude or ChatGPT connector scan for trackers you missed, then test with consent refused.

Disclosure: I may earn a commission through some links on this site. It does not change what this page says.

Article 5(3) of the ePrivacy Directive (EUR-Lex) allows storing or reading information on a visitor's device only after consent, unless it is strictly necessary for the service the visitor asked for. A banner that asks while the tags fire anyway does not meet that. Prior blocking does the work, and iubenda itself calls its automatic version experimental, so most of this guide sits there. For plans and rivals, see the iubenda glossary entry.

What you need first:

• An iubenda account. Free works up to 5,000 pageviews a month, but at the cap the banner is deactivated for the rest of the month (free plan limits).
• Access to the site's head, a Google Tag Manager container, or a CMS plugin: iubenda has plugins for WordPress, Joomla, PrestaShop and Magento (configurator guide).
• A list of what fires today. Export the tags in your Tag Manager container and note any hard-coded scripts; you will check iubenda's scan against it.
• Someone who owns the Consent Mode decision, usually the privacy lead, because Step 4 is a legal judgment as much as a setting.

Step 1: Generate the cookie policy

In the dashboard, open your site, then Privacy and Cookie Policy, and click Edit. In the right-hand column, click Activate cookie policy and save; the cookie policy is built from the privacy policy's configuration, per the installation guide. Add a clause for each service you run: the free plan allows 3, and the pricing page up to 20 on Essentials and 30 on Advanced.

Step 2: Configure the banner

Under Privacy Controls and Cookie Solution, click Generate now. The configurator guide walks through territorial scope (where you and your users are), compliance settings that it preselects from those answers and flags if you switch off something that applies, then style and text, and finally Complete the configuration.

Step 3: Turn on auto-blocking

Click the settings icon in the site info panel, open the tab Block scripts prior to consent and enable Automatic blocking, as the auto-blocking guide shows. Three toggles decide what it catches: scripts the site scanner detected, scripts of services listed in your policy, and well-known trackers, a fixed list that includes Google Analytics 4, Google Ads and Facebook Ads conversion tracking, YouTube and Vimeo embeds, and Google Fonts. Blocking custom domains the scanner missed is an advanced setting that needs a paid upgrade.

Step 4: Choose Basic or Advanced Consent Mode

New installs start on Basic: Google services stay blocked until the visitor consents. Ticking "Do not block Google's services that adhere to Consent Mode" switches to Advanced, where Google tags load at once and adapt to the visitor's choice; the same guide warns that data such as IP addresses can still reach Google when consent is refused. iubenda's Consent Mode page describes the trade from the other side: cookieless pings that keep Google's conversion modelling fed. Write the choice down, with who made it.

Step 5: Paste the snippet first in the head

Saving sends you to the embedding section. Copy the snippet and paste it at the very beginning of the head of every page, before any other script. Most later changes in the configurator reach the site through remote configuration, but switching auto-blocking on or off changes the code itself, so re-embed after that, per the installation guide.

Step 6: Let an assistant look for what you missed

Add iubenda as a connector in Claude or ChatGPT; other clients connect over MCP at https://mcp-server.iubenda.com/mcp with OAuth, per the connector page. Ask: "Scan my site and tell me what trackers are running," then "Check what's already set up on my site."

The human check: compare the assistant's list with your Tag Manager export. Anything new gets a policy clause and a category before a person approves the change, and the connector asks for that approval before it finalises or deletes anything.

Step 7: Test with consent refused

Open the site in a private window and refuse everything. In the browser's developer tools, watch the Network tab and the stored cookies: no analytics or advertising requests should leave before consent, or, on Advanced, only Google's cookieless pings. iubenda's own guide says auto-blocking "remains experimental, and its accuracy may not be flawless", so this test is not optional. Then run the free Consent Mode check on the Consent Mode page.

Step 8: Fix the categories

Services sit in five categories, from Necessary to Marketing. Moving one to Necessary makes it load without consent, so keep that category for what the site cannot run without, per the auto-blocking guide.

Where setups go wrong

• A snippet that loads second. Anything that runs before it runs unblocked.
• A toggled auto-blocking setting with the old code still live. The embedded snippet no longer matches the configuration.
• A free plan on a growing site. The banner stops at 5,000 pageviews, and so does the consent.
• Reading Advanced mode as no data before consent. Google tags load first and adapt afterwards.

iubenda meters the banner by pageview, counting every load and reload whether or not the visitor answers it, so its revenue grows with your traffic rather than with your consent rate. At €0.05 per 1,000 extra pageviews the meter is cheap, which is why the tier names track traffic and the tier you need tracks features (pricing page).

FAQ

Should I pick Basic or Advanced Consent Mode?

Basic blocks Google tags until consent; Advanced loads them and sends cookieless pings when consent is refused. The auto-blocking guide calls Advanced flexible but in need of careful consideration, so decide it with your privacy lead.

Do I have to re-paste the snippet after every change?

No. Remote configuration applies most configurator changes on its own; switching auto-blocking on or off is the change that needs a new embed.

Which scripts are blocked without any setup?

The well-known list in the auto-blocking guide: Google Fonts, Font Awesome, Google Analytics and GA4, Facebook Ads and Google Ads conversion tracking, and YouTube and Vimeo embeds.