Embedded Deployment | DataGrail Documentation

On this page

In order to host the banner and manage your scripts and cookies, DataGrail needs to deploy a small piece of JavaScript on your site (consent.js). You have the option to deploy this JavaScript an embedded script, either alongside our Google Tag Manager (GTM) integration to manage scripts, or without it.

You may want to use an Embedded Deployment to load DataGrail Consent on your site in the following scenarios:

1. Site optimization: With an embedded script, you have more control over the loading order of DataGrail Consent. This is useful if you are running optimization software for A/B testing or other purposes.
2. Circumventing web browser blockers: Some browsers block googletagmanager.com from loading on your website, which may preemptively block DataGrail Consent. Embedded deployment will allow DataGrail to independently load DataGrail Consent on your website, instead of via GTM.

Each container has its own unique script tag, which looks like this:

<!-- DataGrail Consent Script -->

<script

type="text/javascript"

src="https://api.consentjs.datagrail.io/[CUSTOMER_ID]/[CONTAINER_ID]/consent-loader.js"

></script>

<!-- End DataGrail Consent Script -->

Key Concepts

Understanding the following key concepts will help make your Consent implementation easy.

Configure Containers

In order to host the banner and manage your scripts and cookies, DataGrail needs to deploy a small piece of JavaScript on your site (consent.js). We provide two Embedded Deployment options to create a container and deploy this code.

Embedded Containers & GTM

Deploying DataGrail consent as an embedded script with Google Tag Manager allows you to manage GTM tags directly, while allowing you to determine how/when DataGrail gets loaded on the page.

1. Integrate Google Tag Manager to DataGrail and ensure relevant containers are added.
2. Navigate to Consent Management, Settings, Containers, and select an existing GTM container.
3. Turn on the Embedded Deployment toggle.
4. Place the generated script at the first element of the <head> of your website, which we recommend doing before toggling the embedded deployment option and republishing the banner. This will ensure changes take effect with zero downtime.

Embedded Containers Without GTM

Deploying DataGrail Consent as an embedded script without Google Tag Manager removes the ability to manage GTM tags with DataGrail. We only recommend this option for complex implementations where GTM is not required.

1. Navigate to the Consent Management tab, select Settings, and then Containers.
2. Select Add a Container and then DataGrail Container from the dropdown.
3. Name and create the container.
4. Open the newly created container and select Copy Script.
5. Place this script at the first element of the <head> of your website, which we recommend doing before toggling the embedded deployment option and republishing the banner. This will ensure changes take effect with zero downtime.

Categorize Trackers

With your container and deployment method configured, you must categorize all tracking services on your site, allowing data subjects to customize consent preferences against specific categories, otherwise known as purposes.

DataGrail can manage a wide range of tracking services implemented through various mechanisms on your site.

• Google Tag Manager Tags
• Inline Scripts
• Cookies
• Facebook Pixels
• Shopify Tracking Services
• Webflow Tracking Services
• Custom Services Through Callback Functions

Scripts vs. Cookies

Prioritize managing trackers at the script level first. Scripts are the source that load or set most cookies; if you block a tracking script until consent is granted, its downstream cookies and network calls never occur.

After all scripts are audited, categorized, and gated by consent, perform a secondary review to identify any residual cookies that were not set from scripts. This top‑down approach reduces compliance risk and simplifies maintenance versus chasing individual cookies.

Script Identification

Identifying tracking scripts can vary widely depending on how they were implemented by your team; DataGrail provides multiple methods to help you achieve comprehensive, end‑to‑end tracker coverage.

Google Tag Manager

Google Tag Manager (GTM) is the preferred way to discover, organize, and control tracking scripts on your site. Whenever possible, deploy all tracking scripts through GTM. With the DataGrail integration, GTM tags are automatically imported, kept in sync, and surfaced for classification; new tags in GTM trigger updates in DataGrail for review.

Even outside DataGrail, adopting GTM is a widely accepted web development best practice because it centralizes tracking services, simplifies audits, and supports stronger compliance. If you are not using GTM yet, implementing it early reduces future migration effort.

Privacy Inspector

The DataGrail Privacy Inspector is a Google Chrome extension for your organization to review the trackers running on your website that may be selling or sharing information with third parties.

The Privacy Inspector is the best way to find tracking scripts that run outside Google Tag Manager. If a script does not appear as a GTM tag, it is likely being loaded inline from your site's source.

For each script you discover that is not in GTM (or if you do not use GTM):

1. Move it into GTM whenever possible (preferred for centralized control and easier auditing).
2. If it must remain inline, manage it with DataGrail's ScriptControl Plugin.

Script Classification

By assigning every script, tag, cookie, and tracking service to a category, you ensure only those aligned with a user's banner selections are activated.

To categorize your tracking services:

1. Set up and connect all relevant tracking services.
2. Navigate to the Tracking Services section of the Consent Management page.
3. For each uncategorized service (highlighted in yellow), select the relevant category from the dropdown.
4. Publish changes to your connected containers.

Default Categories

DataGrail offers four default categories based on the purposes as defined by the GDPR, but you can rename or relabel these when customizing your banner.

• Functional Services that enhance website usability and personalization, but are not strictly required. Examples: Services use code to remember language settings or a username and password to an account on that website. The website would still load if you did not have these services running.
• Marketing Services used for user tracking, advertising, and retargeting. These services, unlike similar analytics services, are used for online marketing by collecting information about data subjects to channel partners for extra revenue and a targeted ad experience. Examples: Services that use code to remember things a data subject has viewed or clicked on when browsing the website. This information is then passed to other organizations or used internally to market other-like products or services to the data subject. The website would still load if you did not have these services running.
• Performance Services used to measure and analyze website performance or user interactions; not how a user interacts with the website or to market to them. Examples: Volume of traffic on a website throughout the week, how long data subjects browse certain pages, and which parts of the website they frequent. The website would still load if you did not have these services running.
• Essential Services strictly necessary for the website to function. They enable core functionality such as security, authentication, and basic user interaction. Examples: Services that are utilized to allow a website to be loaded and navigated by data subjects. They serve no other functions and without them the website would not load.

Cookie Identification & Classification

After categorizing all scripts, review any cookies that do not originate from those managed scripts.

DataGrail automatically scans environments where consent is deployed to discover first‑party cookies. Each entry shows the first date seen and a total observation count to help determine relevance. Low counts often indicate a cookie set by a browser extension or a user customization and it is usually out of scope for consent management.

Third-Party Cookies Cannot Be Scanned and Managed Third‑party cookies (set on domains you do not control) cannot be discovered or blocked directly by any consent management solution. Control them by gating or removing the scripts or pixels that create them.

Configure Policies & Plugins

Consent Policies determine which consent categories are enabled on initial page load and whether the banner appears, based on the visitor’s automatically-detected location.

DataGrail provides a set of default policies for major global privacy regulations. Review and adjust these settings before launch to ensure they reflect your organization’s privacy posture.

Customize The Banner

With your tracking services categorized and managed, the last step is configuring consent is to customize the banner to ensure the language/styling matches your brand and privacy posture. You can construct location-specific banner notices that appear on your website to data subjects using the Layouts feature.

Advanced Customization Options

If you want to customize the layout to match your brand's design patterns, including using custom fonts and colors, you can follow our CSS Customization Guide. And if you need to localize the banner, you can check out our Localization Guide.

Publish & Test

Publishing is the process of deploying the DataGrail configuration to your connected containers. Think of this action as "going live" to any containers you may have selected.

To publish to an Embedded Container:

1. Select Review and Update in the upper-right of the page.
2. Use the checkboxes to select the relevant containers.
3. Select Publish.

Once your first publish is complete on a staging site or site in test mode, you can follow this guide to validate a successful implementation.

Subresource Integrity (SRI)

Subresource Integrity (SRI) is an optional security feature that lets browsers cryptographically verify that DataGrail consent scripts have not been tampered with before executing them. This is especially valuable for organizations in regulated industries or those with strict third-party script security requirements.

How It Works

When SRI is enabled, every script in the consent chain is integrity-verified:

1. Your script tag includes a SHA-384 hash for the consent loader — the browser verifies the loader before running it.
2. The loader fetches a configuration file (loader-config.json) containing SRI hashes for each consent script.
3. The browser verifies each consent script against its hash before execution.

If any script has been modified — whether by a CDN compromise, a supply chain attack, or a man-in-the-middle — the browser blocks it automatically.

Enabling SRI

1. Navigate to Consent Management, Settings, Containers, and select the container you want to secure.
2. Turn on the Subresource Integrity toggle in the Publishing Details section.
3. Publish the container by selecting Review and Publish.
4. After publishing, return to the container details and copy the updated script tag. The new tag includes the integrity and crossorigin attributes required for SRI verification.
5. Replace the existing script tag on your website with the updated one.

The updated script tag will look like this:

<!-- DataGrail Consent Script (SRI Enabled) -->

<script

type="text/javascript"

src="https://api.consentjs.datagrail.io/[CUSTOMER_ID]/[CONTAINER_ID]/consent-loader.js"

integrity="sha384..."

crossorigin="anonymous"

></script>

<!-- End DataGrail Consent Script -->

Monitoring SRI Failures

If SRI verification fails (for example, due to a network issue or a tampered script), the affected script will not execute. DataGrail provides a JavaScript API for monitoring these failures:

// Register before the consent-loader script loads

window.dgSriEvent = window.dgSriEvent || [];

window.dgSriEvent.push({

event: 'sri_failure',

callback: function(data) {

// Send to your monitoring service (e.g., Sentry, Datadog)

console.error('Consent SRI Failure:', data);

}
});

Disabling SRI

To disable SRI, turn off the Subresource Integrity toggle in the container settings and publish again. After publishing, you can revert to the standard script tag (without integrity and crossorigin attributes).