Guide
analytics

Configuring the cookie-consent banner

Show a GDPR-friendly cookie banner, organise tracking scripts into categories, and gate them behind visitor consent.

The cookie-consent banner asks visitors whether they accept cookies before any optional tracking scripts run. It is the tool that keeps your published site GDPR-friendly: Marketing scripts (Nua's own ad tracking, and for example a Meta Pixel you add as a custom script) only load after a visitor agrees.

You configure it per project, on the Cookie Consent screen.

Watch: set up the cookie-consent banner
  1. Open your project from the dashboard.
  2. In the left sidebar, click Cookie Consent.

If the banner has never been set up, you'll see a Not configured state. Enabling the banner is the first step.

Enable the banner

  1. On the Not configured screen, fill in the starter fields:
    • Banner Title — the heading shown in the banner (e.g. We use cookies).
    • Banner Description — a short explanation of why you use cookies.
    • Accept Button Label — e.g. Accept All.
    • Reject Button Label — e.g. Reject Optional.
  2. Click Enable Cookie Consent.

The banner is now active and the full Banner Settings become available.

Customise the banner

Once enabled, the Banner Settings card lets you adjust everything about how the banner looks and reads.

Text and buttons

Setting What it controls
Banner Title The banner's heading.
Banner Description The explanatory text shown to visitors.
Accept Button Label The wording on the accept button.
Reject Button Label The wording on the reject button.

Hide reject behind "More options"

Tick Hide reject behind "More options" to replace the reject button with a More options button that opens a preferences panel with per-category toggles. Use More Options Button Label to set its wording.

Use the Banner Position picker — a 3×3 grid — to choose where the banner appears on the page. You can place it at the top, center or bottom vertically, and left, center or right horizontally. The default is bottom center.

Cookie Settings Button Label names the small button visitors use to reopen the banner after they have answered: it is the button's tooltip and the name screen readers announce. Left empty, it is Nastavení cookies on a Czech site, Nastavenia cookies on a Slovak one and Cookie settings on any other (the site's language comes from the lang attribute of its pages). See Changing or withdrawing consent.

Preferences panel labels

When a visitor opens More options, they see a preferences panel with a toggle for each category. You can rename everything in the Preferences Panel Labels section:

  • Save Preferences Button Label — the button that saves their choices.
  • Necessary Label and Necessary Description.
  • Analytics Label and Analytics Description.
  • Marketing Label and Marketing Description.

The banner asks visitors about three categories. The category decides whether something runs before or after the visitor gives consent.

Category When it runs What it covers
Necessary Always, it can't be turned off. Your Necessary scripts, and the banner's own _cc cookie, which remembers the answer for a year.
Analytics Only after the visitor accepts. Your Analytics scripts (Google Analytics, Google Tag Manager and the like), and the identifiers Nua's analytics keeps in the browser: the _nua_vid visitor cookie and the _as session id (kept in the tab's session storage, not as a cookie).
Marketing Only after the visitor accepts. Your Marketing scripts, Nua's ad tracker with the ad click cookies (_fbp, _fbc, _nua_gclick, _nua_sznaiid), Seznam's measurement script for Sklik with its sid and udid cookies, and everything Nua sends to Meta, Google Ads and Sklik.

Two things the banner doesn't ask about, because they run for everyone:

  • Nua's own analytics, which stores nothing in the browser without consent. See below.
  • A/B tests: while a test runs, the _nua_ab_<test id> cookie keeps a visitor on the same version of the site, for 30 days after their last visit.

A visitor who hasn't answered yet counts as one who declined: until they accept, only Necessary, Nua's own analytics and A/B tests run.

The default descriptions explain each category to your visitors:

  • Necessary: Required for the website to function properly.
  • Analytics: Help us understand how visitors interact with our website.
  • Marketing: Used to deliver personalized advertisements.

Warning: Without the banner, no visitor can accept marketing cookies. Your custom scripts are removed along with it, and connected ad platforms (Meta, Google Ads, Sklik) stop receiving data. The dashboard asks you to confirm this before removing it.

Nua's own analytics (the numbers in your project's Analytics tab) runs for every visitor, whether they accepted, declined or haven't answered. Until a visitor accepts Analytics, it stores nothing in their browser: no cookie, no local or session storage.

What it records for such a visitor:

  • Page views with the page address and referrer, and UTM parameters from the address.
  • Time on page, how far down the page they scrolled and how many times they clicked.
  • Clicks on links, buttons, form fields, images and other clickable elements: the element, the first 50 characters of its text, the link target and the click position.
  • Form submissions and failed validations: the form and the names of its fields, never what the visitor typed.
  • Country, region and city, browser, operating system and device type, read from the request.

Visits and visitors are told apart on the server, from the request each page view sends:

  • Visit: a hash of the visitor's IP address and browser (user agent) with the site's hostname and a secret that changes every day. A visit ends after 30 minutes without activity, and always when the secret changes at midnight UTC (1:00 or 2:00 in Czechia).
  • Visitor: a hash of the IP address, user agent, preferred language, and the network provider, connection details and time zone that Cloudflare derives from the request, with a secret that changes every month. Nua can't recognise the visitor across months or across sites.

Only the hashes are stored, never the IP address or the user agent itself.

Once a visitor accepts Analytics, the _nua_vid cookie identifies the visitor instead of the hash, so a returning visitor is recognised for up to a year, and the _as session id makes two tabs count as two visits. See Reading your site analytics for what the numbers mean.

Visitors must be able to withdraw consent as easily as they gave it. Once a visitor has answered, every page of the site shows a small round button with a cookie icon in the bottom-left corner (bottom-right when the banner sits on the right). It reopens the banner, where the visitor can accept, reject or, with More options, change single categories. The preferences panel starts from their earlier answer. A visitor who reopened the banner can close it again without answering, with the round button or the Escape key.

The button's text is the Cookie Settings Button Label setting, see Cookie settings button.

A footer link is where many visitors look for cookie settings. Link it to #cookie-settings and it opens the banner:

<a href="#cookie-settings">Nastavení cookies</a>

The address must be exactly #cookie-settings: a link to /#cookie-settings or a full address doesn't open the banner. Any element with the data-nua-cookie-settings attribute works the same way. On a page with such a link, the round button is not shown, and a visitor closes the reopened banner by answering or with the Escape key. Keep a separate link to your cookie policy page: the settings link opens the banner, not the policy.

The link is part of your site's code, so it goes live with the site's next publish. In the editor, ask for a "Nastavení cookies" link to #cookie-settings in the footer, or add it to the code yourself.

What withdrawing deletes

When a visitor withdraws a category, the page reloads, so the scripts the category allowed stop running. A page they come back to with the Back button, or another tab of the site, reloads too when they return to it.

Withdrawn Deleted from the visitor's browser
Analytics The _nua_vid visitor cookie and the _as session id. Nua's analytics goes back to the hashes described above.
Marketing The ad click cookies _fbp, _fbc, _nua_gclick and _nua_sznaiid, on sites with an ad platform connected in Nua (Nua's ad tracker deletes them). Nua stops sending anything about the visitor to Meta, Google Ads and Sklik from that moment, also from the server.

The _cc cookie stays: it now holds the new answer. Seznam's sid and udid cookies, and cookies your own scripts wrote (for example a Meta Pixel's cookies on a site with no ad platform connected in Nua), stay until they expire, but the scripts that use them no longer run.

Following the answer from your own scripts

window.__nuaCookieConsent.get() returns the current answer, { necessary, analytics, marketing }, or null before the first one. window.__nuaCookieConsent.open() opens the banner. The page fires a cc:consent-changed event on document with the same object in event.detail whenever the visitor answers. The event for an answer given on an earlier visit fires at the end of the page's <head>, before scripts in the body run, so read the starting state with get(). A script placed earlier in <head> runs before window.__nuaCookieConsent exists: have it wait for DOMContentLoaded.

Ad platforms need the banner

Meta, Google Ads and Sklik receive data only from visitors who accept Marketing in the banner. Meta receives page views, form submissions and any events your site reports to it. Sklik receives page views from Seznam's script on the page and form submissions from Nua. Google Ads receives only form submissions. With a form submission each gets the hashed email and phone from the form. Meta gets the visitor's IP address and browser with every event, Sklik with form submissions. Nothing is sent for visitors who decline or don't answer. That is what EU and Czech law require for advertising cookies and for sharing visitor data with ad platforms.

This has two consequences:

  • You need the banner to connect an ad platform. Without it, the Ad Tracking pages ask you to set up the banner first, and a platform that was connected earlier receives nothing until the banner is back and the site is deployed.
  • Ad platforms report fewer conversions than your forms receive. Submissions from visitors who declined marketing cookies still reach you as form entries, but they are not reported as conversions in Meta, Google Ads or Sklik.

Add your own tracking scripts

Scripts you paste here are loaded according to their category, so consent is handled for you.

  1. In the Custom Scripts section, click Add Script.
  2. Give it a Script name (e.g. Google Tag Manager).
  3. Choose its category — Necessary, Analytics or Marketing.
  4. Paste the script code into the box (without the surrounding <script> tags).
  5. Repeat for any other scripts. Use the trash icon to remove one.

Save and publish

  1. Click Save.
  2. A green Configuration saved notice appears, reminding you that changes will take effect after the next deploy.
  3. Click Deploy now to publish the change immediately, or just continue working and let it go out with your next publish.

Note: Banner and script changes only reach visitors after a deploy. If something looks unchanged on the live site, deploy and check again.

Removing the banner

To turn the banner off, click Remove in the top corner of the Banner Settings card and confirm. Remember that connected ad platforms then stop receiving data; re-enable the banner to start sending again.