Content Security Policy (CSP) & Consent: Hardening Your Privacy Defense

Date: May 20, 2026 Author: GetCookies Team Category: Technical Reading Time: 15 min

---

Most cookie banners rely on JavaScript to block scripts. This is "Soft Blocking." If your JavaScript fails, or if a developer hardcodes a tag, the tracker fires.

Content Security Policy (CSP) offers "Hard Blocking." It is a browser-level security feature that tells the browser exactly which domains are allowed to run scripts.

By combining CSP with GetCookies, you create a "Privacy Firewall" that is technically enforceable, not just a UI overlay.

How CSP Works with Consent

CSP is a text header sent by your server: Content-Security-Policy: script-src 'self' https://js.getcookies.io;

If a developer accidentally pastes a facebook.net script, the browser will refuse to load it because it is not on the allowlist.

The Challenge: Dynamic CSP

The problem is that consent is dynamic.

• User Accepts Marketing: You need to allow facebook.net.
• User Rejects Marketing: You must block facebook.net.

Standard CSP headers are static. You cannot change them after the page loads.

Solution: The "Strict-Dynamic" & Nonce Approach

The modern approach uses a cryptographic Nonce (number used once).

1. Server: Generates a random nonce nonce-12345 and puts it in the CSP header.
2. HTML: <script nonce="nonce-12345" src="..."></script>.
3. GetCookies: When GetCookies loads (authorized by nonce), it becomes a "trusted loader." Any script it injects is automatically trusted.

Implementation Guide

1. Configure the Header

In your Nginx, Vercel, or Netlify config:

Content-Security-Policy: script-src 'nonce-{RANDOM}' 'strict-dynamic' https:; object-src 'none'; base-uri 'none';

2. Trust the CMP

Give GetCookies the nonce.

<script 
  src="https://js.getcookies.io/v1/loader.js" 
  data-domain-id="XXX" 
  nonce="nonce-12345">
</script>

3. Let the CMP Handle the Rest

Do not whitelist facebook.net in your header. Instead, configure GetCookies to load Facebook. Because GetCookies has the nonce, the browser allows it to spawn child scripts.

Reporting Violations

Use report-uri to see when scripts are blocked. If you see blocked requests to tiktok.com, it means a developer added a pixel outside of the CMP. The CSP caught the leak.

Conclusion

CSP + Consent is the gold standard for enterprise security. It turns privacy from a "promise" into a "guarantee."