Block trackers before they load

OptinStack blocks known third-party scripts and iframes from your published tracker inventory, plus resources you manually tag with consent categories, before they load. For known trackers it also intercepts writes to localStorage, sessionStorage, and document.cookie so storage is not written before consent. Unknown untagged resources are not universally blocked until they are scanned, classified, manually added, or tagged.

How blocking works

When the runtime loads, it wraps known tracker scripts and iframes so they do not execute until consent is granted. Each tracked resource is tagged with one of the four consent categories. When the visitor accepts a category, resources tagged to it are released.

Use the data-optinstack-categories attribute on both script and iframe elements. If you assign more than one category, the resource stays blocked until every listed category is granted.

Allowlisting a tracker

Some trackers are essential to how your site works and should run without waiting for consent. Add them to the necessary allowlist so they bypass blocking. Reserve this for scripts your site genuinely cannot function without, such as a load balancer or fraud signal.

<!-- Tag any existing script with its consent category -->
<script src="https://example-analytics.com/lib.js" data-optinstack-categories="analytics"></script>

Storage and cookies are covered too

Blocking is not limited to scripts and iframes. The runtime also patches Storage.prototype.setItem (covering both localStorage and sessionStorage) and the document.cookie setter, so a known tracker that tries to write storage or cookies before consent is recorded as blocked instead. When consent is later withdrawn, previously written blocked keys are purged. This is DOM and storage enforcement only; it does not intercept beacons, fetch, image pixels, or network-layer requests.