Newbold Connect uses a custom-built cookie consent system that gives visitors full control over what data is collected. This solution is built specifically for your site โ it is not a third-party plugin. It runs across the entire platform: every website page, product page, landing page, and checkout page, because it loads from the site's global header scripts.
How It Works โ The Big Picture
The cookie consent engine works on a principle called pre-consent blocking. This means that before a visitor makes a choice, all non-essential cookies and tracking scripts are held back. Nothing is sent to Google, Facebook, or any analytics service until the visitor explicitly clicks "Accept all" or enables specific categories.
Here is the sequence of what happens when someone visits the site:
- First visit: The script loads immediately in the page header. It intercepts the browser's cookie-writing mechanism so that any non-essential cookie that tries to set itself is caught and held in a queue โ it never reaches the browser
- Banner appears: A privacy panel slides up from the bottom of the screen. It scans the page for all active cookies and shows the visitor exactly what is running, organised into four categories
- Visitor makes a choice: They can click "Accept all", "Essential only", or expand the categories and toggle individual groups on or off, then click "Save my choices"
- Choice is remembered: The selection is saved to the browser's localStorage (not as a cookie) under the key
nc_cookie_consent. This means the choice persists across sessions โ the visitor will not see the banner again unless they clear their browser data or you update the consent version
- Scripts are released or blocked: Based on the visitor's choice, Google Analytics, Facebook Pixel, and Kajabi's own marketing trackers are either loaded or permanently blocked for that session
- Return visits: On subsequent visits, the script silently reads the stored choice and applies it immediately โ no banner shown. A small "Cookies" pill appears in the bottom-left corner (after scrolling or 4 seconds) so the visitor can reopen the panel and change their mind at any time
The Four Cookie Categories
Every cookie on the site is classified into one of four categories. The visitor can control each independently (except Strictly Necessary, which cannot be disabled).
1. Strictly Necessary (Always On)
These keep the platform running. They handle login sessions, security tokens, payment processing, and server infrastructure. Without them, the site would not function. They include Kajabi session cookies, Cloudflare security cookies, Stripe payment cookies, and AWS load balancer cookies. The visitor cannot disable these โ they are required under GDPR Article 6(1)(f) for legitimate platform operation.
2. Analytics & Performance (Toggleable)
These help you understand how visitors use the site โ which pages they visit, how long they stay, and where they drop off. This category includes Google Analytics (GA4) cookies and Kajabi's own visitor tracking cookies. When disabled, the Google Analytics script is never loaded at all, and Kajabi's analytics cookies are blocked from being written.
3. Marketing & RudderStack Analytics (Toggleable)
These track the effectiveness of marketing campaigns and outreach. They include Facebook Pixel, Google Ads conversion tracking, and RudderStack (Kajabi's built-in analytics platform). When this category is disabled, the script intercepts all RudderStack SDK calls and queues them โ they are silently discarded rather than sent to external servers.
4. Functional (Toggleable)
These remember visitor preferences such as video player settings (volume, quality, captions). They are non-essential but improve the user experience on return visits.
How Long Does the Choice Last?
The visitor's consent choice is stored in the browser's localStorage, which persists indefinitely โ it does not expire like a cookie would. The choice remains active until one of the following happens:
- The visitor clears their browser data or localStorage
- The visitor clicks the "Cookies" pill and changes their selection
- You (the administrator) update the consent version number in the script configuration โ this forces all visitors to re-consent, which is useful after adding new tracking tools or making policy changes
Newbold Tip: If you update the Privacy Policy or add a new analytics tool, bump the consentVersion value in the script configuration (e.g., from '2.2' to '2.3'). This forces all returning visitors to see the consent banner again and make a fresh choice.
How Cookie Blocking Works Technically
The script uses two blocking mechanisms that work together:
Cookie Write Interception
The script overrides the browser's document.cookie setter โ the mechanism that all JavaScript uses to write cookies. Every time any script on the page tries to set a cookie, the consent engine checks: (a) which category does this cookie belong to, and (b) has the visitor granted consent for that category? If consent has not been given, the cookie write is silently blocked and logged in the browser console. If consent is later granted, all queued cookie writes are released.
Deferred Script Loading
Analytics and marketing scripts (Google Analytics, Facebook Pixel) are not included in the page at all until consent is given. The consent engine contains the loader code for these scripts internally. When a visitor accepts the Analytics category, the Google Analytics script tag is dynamically injected into the page. If they never accept, the script is never loaded โ no network request to Google is ever made.
RudderStack Interception
Kajabi uses RudderStack as its analytics platform, and it loads before the consent engine can prevent it. To handle this, the consent engine creates a proxy that intercepts all RudderStack SDK calls (page views, identify, track, etc.) and queues them in memory. If the visitor accepts Marketing, the queue is released to the real RudderStack SDK. If they decline, the queue is discarded.
Google Analytics โ Setup & Configuration
The cookie consent script manages Google Analytics loading internally. This means:
Where to Add Your GA4 Tracking ID
- Open the cookie consent script file:
nc-cookie-consent-v12.js in your theme assets
- Near the top of the file, find the
CONFIG object (within the first 35 lines)
- Replace
'G-XXXXXXXXXX' with your actual GA4 Measurement ID (e.g., 'G-ABC123DEF4')
- Save the file and upload it back to your theme assets
Do NOT Add Google Analytics in Kajabi Settings
- Important: Do not paste the Google Analytics tracking code into Kajabi's Settings โ Site Details โ Header Scripts area separately
- The consent engine already contains the GA4 loader and will inject it only when the visitor consents to Analytics cookies
- If you add GA4 in both places, it will fire twice โ once without consent (violating GDPR) and once with consent. This defeats the purpose of the consent system
- All Google Analytics configuration should go through the
CONFIG.ga4Id field in the consent script
Newbold Approach: The consent engine loads GA4 with anonymize_ip: true enabled by default, which means visitor IP addresses are anonymised before being sent to Google. This is best practice for UK and EU data protection compliance.
Facebook Pixel (Optional)
If you ever need to add a Facebook Pixel for advertising campaigns, it works the same way. In the CONFIG object, set fbPixelId to your Pixel ID. The script will only load the Facebook tracking code when the visitor consents to Marketing cookies.
Where the Script Lives & How It Loads
- The script file (
nc-cookie-consent-v12.js) is stored as a theme asset: Website โ Theme โ Assets
- It is loaded via a single
<script> tag in Settings โ Site Details โ Header Page Scripts
- Because it is in the header scripts, it runs on every page of the site โ website pages, product pages, landing pages, checkout pages, and login pages
- The script is self-contained โ it generates its own CSS, HTML panel, and all interactive behaviour. There are no external dependencies
The Reopen Pill
After a visitor makes their choice, a small pill-shaped button labelled "Cookies" appears in the bottom-left corner of the screen. It appears either after the visitor scrolls 80% of the page or after 4 seconds, whichever comes first. Clicking it reopens the full privacy panel so the visitor can review and change their preferences at any time. This ensures ongoing compliance with GDPR's requirement that consent must be as easy to withdraw as it is to give.
Maintenance Checklist
- โ Ensure
CONFIG.ga4Id contains your real GA4 Measurement ID (not the placeholder)
- โ Do NOT add a separate GA tracking code in Kajabi's header scripts โ the consent engine handles it
- โ After updating the Privacy Policy or Cookies Policy, bump the
consentVersion value to force re-consent
- โ Periodically review the browser console on the live site โ the script logs blocked and released cookies for transparency
- โ If adding new third-party tools that set cookies, register them in the script's
REGISTRY object under the appropriate category
- โ Test the consent flow regularly: clear localStorage, visit the site, and verify the banner appears and all three buttons work correctly