Use this guide to make the Knock2 script load only when your consent management platform (CMP) allows it. It covers Cookiebot, OneTrust, and Osano, plus custom setups without Google Tag Manager (GTM).
Important: Knock2 does not provide a consent banner. Your team chooses the CMP, configures the privacy choices, and decides which consent category applies to your use of Knock2. This guide explains how to connect Knock2 to the CMP you already have.
Before you start
Copy your snippet from the Knock2 dashboard. Use the exact script URL shown there, including your custom domain if your workspace has one. Do not reuse an older snippet or build the URL by hand.
Pick one installation path. Install Knock2 either through GTM or directly in your site code, not both. An unconditional copy anywhere on the page bypasses your consent gate.
Choose the consent category. Many customers use Analytics or Performance. If your CMP has a separate Marketing category for sales and advertising tools, that may be the better fit, since Knock2 is used for sales outreach. Do not classify Knock2 as Strictly Necessary; it is not required to deliver your website.
Default the category to denied if you need opt-in consent, so Knock2 stays off until the visitor accepts.
Test in staging before publishing.
The examples below use the Analytics or Statistics category. Substitute the category your team has approved.
What the Knock2 script uses
Use this list when classifying Knock2 in your CMP.
Item | Details |
Visit information | IP address (read server-side), pages viewed and time on each, referrer, browser and device information (user agent), and UTM parameters |
Browser storage | Random visitor and session identifiers, session timestamps, and page history, stored in |
Activity signals | Counts of mouse, scroll, key, touch, and click events, used to filter out bots. Knock2 counts that a key was pressed; it does not record what was typed. |
Identification partners | Scripts from Knock2's data partners, which may store or read information on the device. Whether they load depends on your workspace and the visitor's location. |
Optional features | The Knock2 chat widget and a link to an existing PostHog session, only if enabled for your workspace |
Because localStorage counts as storing information on a visitor's device, EU and UK rules apply to it the same way they apply to cookies. If your CMP blocks unrecognized scripts or you run a strict content security policy, contact support@knock2.ai for the list of domains to classify or allowlist.
Built-in privacy signals
Global Privacy Control (GPC). Knock2 honors GPC automatically, with no setup. When a visitor's browser sends a GPC signal, Knock2 does not load its identification-partner scripts, and our servers enforce the same rule. That visitor is not identified as an individual. Company-level identification continues, so you still see that an organization visited.
Do Not Track. Knock2 does not act on the older Do Not Track setting. GPC is the signal that carries legal weight.
GPC works alongside your CMP, not instead of it. It limits individual identification for visitors who send the signal, but the Knock2 script itself still loads. If you need Knock2 to wait for consent, use one of the setups below.
Option 1: Cookiebot with Google Tag Manager
These steps assume Cookiebot is installed with its official GTM template.
Confirm the Cookiebot CMP tag fires on Consent Initialization - All Pages.
Create a Custom HTML tag named Knock2 and paste your dashboard snippet.
Under Advanced Settings > Tag firing options, choose Once per page.
Under Consent Settings, choose Require additional consent for tag to fire and add
analytics_storage(or the consent type that matches your chosen category, such asad_storagefor Marketing).Create a Custom Event trigger with event name
cookie_consent_update, firing on all custom events.Attach that trigger to the Knock2 tag and remove any All Pages trigger.
The cookie_consent_update event covers both a visitor accepting mid-page and a returning visitor whose choice is already saved. An All Pages trigger alone would miss visitors who accept after the page loads.
Use Cookiebot's consent settings rather than searching the raw CookieConsent cookie for text.
If you don't use Cookiebot's Consent Mode integration, Cookiebot also offers category events such as cookie_consent_statistics and cookie_consent_marketing. Use one approach, not both.
Option 2: OneTrust with Google Tag Manager
These steps assume OneTrust is installed and pushing to the GTM data layer.
Create a Custom HTML tag named Knock2 with your dashboard snippet. Set Tag firing options to Once per page.
Create a Data Layer Variable named
OnetrustActiveGroups(capitalization matters).Create a Custom Event trigger with event name
OneTrustGroupsUpdated.Choose Some Custom Events and add the condition:
OnetrustActiveGroupsmatches RegEx(^|,)C0002(,|$)Replace
C0002with your category's ID from the OneTrust dashboard. C0002 is OneTrust's usual Performance ID, but yours may differ.Attach the trigger to the Knock2 tag and remove any All Pages trigger.
The regular expression matches the whole category ID, so C0002 can't accidentally match an ID like C00021. OneTrust fires this event on page load and whenever preferences change.
If the category is set to active by default in OneTrust, it will appear in the active groups before the visitor chooses anything. For opt-in, set it to inactive by default.
Option 3: Osano script blocking
Osano works best by blocking the Knock2 script directly, rather than through a GTM event. Script blocking is not included in Osano's free tier, so confirm your plan includes it.
Install Osano directly in your page's
<head>, before GTM and any tracking scripts, following Osano's installation guide.Install Knock2 once, either through GTM or in your site code. Osano will block the script request until consent is given, even if GTM reports the tag as fired.
In Osano, find the Knock2 script under your discovered scripts, or add a rule matching your dashboard script URL. Assign your chosen category and publish.
Classify Knock2's identification-partner scripts and
localStorageitems the same way. Osano configures local storage separately from scripts.Make sure Osano is in an enforcing mode, not Discovery or Listener mode, for production.
Note: earlier versions of this article referenced an osano-consent-changed GTM event. That is not a built-in GTM event, and this setup doesn't need it. If your developer wants to react to Osano consent in code, Osano's JavaScript API offers osano-cm-consent-saved (a saved choice) and osano-cm-analytics (Analytics accepted). These are JavaScript events, not GTM events, so they need custom code to reach GTM.
Other CMPs and installs without GTM
Use your CMP's script-blocking feature if it has one. Otherwise, have your developer load the dashboard snippet only after the required consent is available. Your implementation should:
Handle both a new choice on this page and a choice saved from a previous visit.
Load Knock2 no more than once per page.
Keep Knock2 blocked while consent is missing or denied.
There is no standard browser event for consent that works across all CMPs, so use the event or callback your CMP documents.
If a visitor withdraws consent
These setups control when Knock2 starts. If a visitor accepts and later withdraws on the same page, the script that already loaded keeps running until the page is closed or reloaded. On the next page load, your consent gate applies and Knock2 won't load.
If your CMP can reload the page after a visitor changes their preferences, turn that on. If you need Knock2 to stop immediately without a reload, contact support@knock2.ai before deploying.
Test before publishing
Use a private browser window, GTM Preview mode, and your browser's Network and Application panels.
Test | Expected result (opt-in setup) |
New visitor, no choice made | No Knock2 script request and no new Knock2 |
Visitor rejects your chosen category | Knock2 stays blocked |
Visitor accepts your chosen category | Knock2 loads once |
Visitor accepts a different category only | Knock2 stays blocked |
Returning visitor who accepted | Knock2 loads without another banner interaction |
Returning visitor who rejected | Knock2 stays blocked |
Preferences changed several times | Knock2 never loads twice |
Visitor withdraws, then reloads or navigates | Knock2 does not load on the next page |
With script blocking (Osano), GTM showing "Fired" is not enough. Check the Network panel to confirm whether the Knock2 script actually loaded.
Keep your ad tags separate
Apply these trigger and consent changes to the Knock2 tag only. Don't copy them onto Google Ads, GA4, or conversion tags, which have their own consent behavior. If you change or switch CMPs, have whoever manages your ad measurement test conversions separately.
Update your privacy policy
Deploying behind a CMP doesn't replace disclosing Knock2 in your privacy policy. See Adding Knock2 to Your Privacy Policy for suggested language.
FAQ
Will requiring consent reduce identification?
Yes. Visitors who decline or ignore the banner won't be identified. How much depends on your traffic and banner design, so check your CMP's consent rates to estimate the impact.
Does Knock2 require a particular CMP?
No. Any CMP that can gate a GTM tag or block a script will work.
Does Google Consent Mode control Knock2 automatically?
No. Knock2 is a Custom HTML tag, so it needs an explicit gate: GTM's additional consent checks with a consent-update trigger (as in Options 1 and 2), or CMP script blocking. Sending Consent Mode signals on their own is not enough.
Can I install Knock2 both directly and through GTM?
No. Use one path. A direct, unconditional copy bypasses your GTM consent gate and can double-count visits.
Does Knock2 honor GPC and Do Not Track?
Knock2 honors GPC automatically (see Built-in privacy signals above). It does not act on Do Not Track.
Need help? Email support@knock2.ai with your CMP, how Knock2 is installed, screenshots of your tag and trigger, and which test is failing. Please don't include API keys or visitor data.