# Non-essential scripts only load after consent is granted for their category
- **Pattern:** `ab-000801` (`cookie-consent-compliance.consent-enforcement.scripts-conditional-on-consent`)
- **Severity:** critical
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000801
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000801)
## Why it matters
ePrivacy Art. 5(3) prohibits accessing or storing information on a device without prior consent. GDPR Art. 6(1)(a) requires a lawful basis — and for non-essential tracking, consent is the only available basis. When GA4, Facebook Pixel, or Segment loads via a static `
```
For scripts without Consent Mode support (Segment, Hotjar, Facebook Pixel), inject them into the DOM only inside the consent callback in `src/lib/consent-scripts.ts`. Never place them as static `
// 2. Then load the GA4 library (it respects the denied default)
// 3. In your consent save handler, update consent state:
// gtag('consent', 'update', { analytics_storage: 'granted' })
```
For all other scripts (Facebook Pixel, Segment, Hotjar, etc.) that do not support Consent Mode, use the dynamic loading pattern:
```ts
// lib/consent-scripts.ts
export function loadApprovedScripts(consent: ConsentState) {
if (consent.analytics) {
// Load Segment only after consent
import('@segment/analytics-next').then(({ AnalyticsBrowser }) => {
const analytics = AnalyticsBrowser.load({ writeKey: process.env.NEXT_PUBLIC_SEGMENT_KEY! })
window.__analytics = analytics
})
}
if (consent.marketing) {
// Load Facebook Pixel only after consent
const script = document.createElement('script')
script.textContent = `
!function(f,b,e,v,n,t,s){/* fbq snippet */}
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');
`
document.head.appendChild(script)
}
}
```
- **Cross-reference:** For third-party script security and CSP configuration, see the Security Headers audit.
---
## External references
- eprivacy Art. 5(3)
- gdpr Art. 6(1)(a)
- ccpa §1798.135
- cwe CWE-284
Taxons: privacy-consent, regulatory-conformance
HTML version: https://auditbuffet.com/patterns/ab-000801