A user details a significant privacy and compliance flaw in Squarespace's cookie banner, noting that it fails to block third-party tracking pixels (from Meta, TikTok, Google Ads) added via Code...

{
  "signal_id": "bc6cfd82-97c6-5577-a260-09de3cff5af8",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-09-27T12:06:59+00:00",
  "company": {
    "name": "Squarespace",
    "domain": "squarespace.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "privacy",
      "compliance",
      "security",
      "cookies",
      "tracking pixels"
    ],
    "post_id": "1wrikpr",
    "summary": "A user details a significant privacy and compliance flaw in Squarespace's cookie banner, noting that it fails to block third-party tracking pixels (from Meta, TikTok, Google Ads) added via Code Injection from firing before a visitor gives consent.",
    "category": "security",
    "evidence": [
      "[post] Squarespace's own help page on the cookies it uses says it plainly: \"Adding a cookie banner disables or restricts cookies placed by some third-party services connected to your site, but not all.\"",
      "[post] A Meta Pixel, TikTok Pixel or Google Ads tag pasted there as a plain script runs on page load, banner or not, because nothing in it asks the banner first.",
      "[post] Why it matters in the US, where there's no general opt-in rule: California Invasion of Privacy Act suits over pixels center on that order, a tag sending visitor data before the banner was answered."
    ],
    "virality": "very_low",
    "post_date": "2026-09-27T12:06:59.000Z",
    "post_kind": "text",
    "post_text": "Squarespace's own help page on the cookies it uses says it plainly: \"Adding a cookie banner disables or restricts cookies placed by some third-party services connected to your site, but not all.\" Their example is tracking added to an audio block. The bigger one for most sites is Code Injection. A Meta Pixel, TikTok Pixel or Google Ads tag pasted there as a plain script runs on page load, banner or not, because nothing in it asks the banner first.\n\nAnd you won't notice from your own browser, because Squarespace says the banner doesn't display while you're logged in.\n\nA five-minute check:\n\nOpen your site logged out, in a private window, with dev tools on the Network tab. Reload.\n\nDon't touch the banner.\n\nFilter for facebook, doubleclick, googleadservices, google-analytics, tiktok and pinterest one at a time. Anything listed went out before the visitor chose.\n\nClick Decline, reload, filter again. Anything still there ignores the choice.\n\nIf something shows up, the fix is code, not a setting:\n\nIn Cookies & Data Privacy, set the banner type to Opt In and Out, the one with a decline button.\n\nWrap each pasted pixel so it only runs when window.getSquarespaceCookies() returns marketing as \"accepted\".\n\nRun that on page load for returning visitors, and again from window.onCookieBannerInteraction for visitors who accept now.\n\nGoogle's Analytics help has a Squarespace page with a ready...",
    "sentiment": "negative",
    "subreddit": "squarespace",
    "post_flair": [
      "Discussion"
    ],
    "post_title": "Squarespace's cookie banner restricts \"some\" third-party services, and a pixel pasted into Code Injection isn't one of them",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/squarespace/comments/1wrikpr/squarespaces_cookie_banner_restricts_some/",
    "entity_role": "vendor",
    "post_author": "Useful-Nobody5188",
    "upvote_ratio": 1,
    "mention_count": 9,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/squarespace/",
    "total_upvotes": 1,
    "comments_total": 0,
    "total_comments": 0,
    "other_companies": [
      {
        "name": "Meta",
        "role": "partner",
        "domain": "meta.com"
      },
      {
        "name": "TikTok",
        "role": "partner",
        "domain": "tiktok.com"
      },
      {
        "name": "Google",
        "role": "partner",
        "domain": "about.google"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/Useful-Nobody5188/",
    "signal_category": "feedback",
    "comments_included": 0,
    "products_mentioned": [
      "Code Injection",
      "Cookies & Data Privacy"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/bc6cfd82-97c6-5577-a260-09de3cff5af8 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"squarespace.com","limit":20}'