Content Security Policy (CSP) & Consent: Hardening Your Privacy Defense

# Content Security Policy (CSP) & Consent: Hardening Your Privacy Defense **Date:** May 20, 2026 **Author:** Alex Kowalski, Platform Architect **Category:** Technical **Reading Time:** 15 min --- Most cookie banners rely on JavaScript to block scripts. This is "Soft Blocking." If your JavaScript fails, or if a developer hardcodes a tag, the tracker fires. **Content Security Policy (CSP)** offers "Hard Blocking." It is a browser-level security feature that tells the browser exactly which domains are allowed to run scripts. By combining CSP with GetCookies, you create a "Privacy Firewall" that is technically enforceable, not just a UI overlay. ## How CSP Works with Consent CSP is a text header sent by your server: `Content-Security-Policy: script-src 'self' https://js.getcookies.io;` If a developer accidentally pastes a `facebook.net` script, the browser will refuse to load it because it is not on the allowlist. ## The Challenge: Dynamic CSP The problem is that consent is dynamic. * **User Accepts Marketing:** You need to allow `facebook.net`. * **User Rejects Marketing:** You must *block* `facebook.net`. Standard CSP headers are static. You cannot change them after the page loads. ## Solution: The "Strict-Dynamic" & Nonce Approach The modern approach uses a cryptographic **Nonce** (number used once). 1. **Server:** Generates a random nonce `nonce-12345` and puts it in the CSP header. 2. **HTML:** ``. 3. **GetCookies:** When GetCookies loads (authorized by nonce), it becomes a "trusted loader." Any script *it* injects is automatically trusted. ## Implementation Guide ### 1. Configure the Header In your Nginx, Vercel, or Netlify config: ```text Content-Security-Policy: script-src 'nonce-{RANDOM}' 'strict-dynamic' https:; object-src 'none'; base-uri 'none'; ``` ### 2. Trust the CMP Give GetCookies the nonce. ```html ``` ### 3. Let the CMP Handle the Rest Do **not** whitelist `facebook.net` in your header. Instead, configure GetCookies to load Facebook. Because GetCookies has the nonce, the browser allows it to spawn child scripts. ## Reporting Violations Use `report-uri` to see when scripts are blocked. If you see blocked requests to `tiktok.com`, it means a developer added a pixel outside of the CMP. The CSP caught the leak. ## Conclusion CSP + Consent is the gold standard for enterprise security. It turns privacy from a "promise" into a "guarantee."