Fix guide · Webflow · medium · about 30 min

OpenAI Pixel fires before cookie consent on Webflow

For the finding “OpenAI Pixel fires before cookie consent”. Also for: Any website, Shopify, WordPress, Framer.

What this means

Your Webflow site shows a cookie banner, but the OpenAI Pixel (the ChatGPT Ads Measurement Pixel, which loads oaiq.min.js from bzrcdn.openai.com) sent events to OpenAI while the banner was still waiting for an answer.

Two things make this common on Webflow:

  • Webflow has no built-in integration for the OpenAI Pixel, as it has for the Meta Pixel, and no built-in cookie banner for third-party scripts (its own consent settings only cover Webflow Analyze and Optimize). The pixel is in custom code, a Code Embed or Google Tag Manager (GTM), and the banner comes from a separate consent tool. That tool only controls the scripts it knows about.
  • OpenAI’s pixel starts with consent set to true unless your code sets it to false or the pixel finds a stored denial. OpenAI’s installation snippet, pasted unchanged into Head code, measures from the first page load.

Why it costs you money:

  • If you advertise to people in the EU, sending marketing data before consent is a legal risk you probably did not intend to take. We report the technical behaviour only; we cannot tell you whether your setup is compliant.
  • The banner and the pixel are not connected. A rushed fix often causes the opposite problem: the pixel stops sending anything and ChatGPT Ads lose their conversion data.

How to confirm it yourself

Our check runs from a browser in the EU. Consent tools on Webflow can show different banners per region, so if you are outside the EU, use a VPN or ask a colleague there. Consent Pro’s debugger (Test it on live website in the app) can also simulate an EU visitor.

  1. Open your published site on the domain your ads link to (not only the webflow.io staging address) in a private (incognito) window.
  2. Open developer tools (F12), go to the Network tab and type bzr.openai.com into the filter box.
  3. Reload the page. Do not click the cookie banner.
  4. Open each request’s payload: it holds a list of events, each with a type. A page_viewed or conversion event (for example lead_created) while the banner is open means the pixel measures before consent. Service messages whose type starts with openai:: or oai:: do not count (at the time of writing the SDK sends these on its own; OpenAI does not document them).
  5. Under Application > Cookies (Chrome) or Storage > Cookies (Firefox), an __obref cookie before you answer the banner also means the pixel runs with consent switched on.

The general guide explains these checks in more detail.

How to fix

Adding custom code or Code Embeds needs a Core, Growth, Agency or Freelancer Workspace, or an active Site plan.

  1. Find every place the pixel is installed. Search the published page source for oaiq.min.js and oaiq(, then check:

    • Site settings > Custom code: Head code, Footer code, and any code added there by installed Apps.
    • Page settings > Custom code (Inside <head> tag and Before </body> tag) of individual pages, including CMS template pages. With Webflow Localization, check every locale: a locale whose page code was edited no longer follows the primary locale.
    • Code Embed elements, including embeds inside components used on every page, and code in Rich text or CMS items.
    • Your GTM container: Custom HTML tags with oaiq, OpenAI’s own GTM template, and Stape’s OpenAI Ads Pixel tag.

    The fix only works if every copy goes through your consent setup.

  2. Pick one way to gate the pixel and remove the other copies.

    A. Your consent tool holds back the whole snippet. Paste OpenAI’s snippet into Site settings > Custom code > Head code, below your consent tool’s script. OpenAI’s installation snippet sends no measurement events by itself, so add oaiq("measure", "page_viewed", { type: "contents" }); after init inside the same script; it then runs when the script is released.

    • Consent Pro (Finsweet’s Webflow app): version 2 scans your site and blocks detected trackers automatically, and the category set in the app wins over any attribute. After adding the pixel, scan again, check that the OpenAI script is listed under Marketing (move it there if it is not), and publish. The pixel is new, so do not assume the scanner recognizes it. If you turned on Load Script Async, mark the script yourself:

      <script type="fs-consent" fs-consent-categories="marketing">
  /* OpenAI installation snippet, unchanged, plus your page_viewed call */
</script>

    • OneTrust app for Webflow: paste the snippet into the app’s Blocked Scripts section (Manage blocked scripts), not into Webflow’s custom code.

    • Cookiebot (manual blocking): type="text/plain" and data-cookieconsent="marketing".

    • CookieYes and others: follow the tool’s guide to blocking scripts before consent, using its advertising or marketing category.

    Do not add oaiq("consent", false) to a snippet the consent tool already holds back: it would run after Accept and switch measurement off again. Other code that calls oaiq(...), such as a form script, must first check that window.oaiq exists.

    B. The pixel’s own consent command, connected to your consent tool. The script loads on every page, but measures only after consent. Replace OpenAI’s snippet in Head code (below your Consent Pro script) with this version. The first part is OpenAI’s loader, unchanged; the oaiq("init", ...) call moves into the function below it:

    <script>
  (function (w, d, s, u) {
    if (w.oaiq) return;
    var q = function () {
      q.q.push(arguments);
    };
    q.q = [];
    w.oaiq = q;
    var js = d.createElement(s);
    js.async = true;
    js.src = u;
    var f = d.getElementsByTagName(s)[0];
    f.parentNode.insertBefore(js, f);
  })(window, document, "script", "https://bzrcdn.openai.com/sdk/oaiq.min.js");

  var oaiStarted = false;
  var oaiGranted = false;
  function oaiApplyConsent(marketing) {
    marketing = marketing === true;
    if (oaiStarted && marketing === oaiGranted) return;
    oaiq("consent", marketing);
    if (!oaiStarted) oaiq("init", { pixelId: "<YOUR-PIXEL-ID>" });
    oaiStarted = true;
    oaiGranted = marketing;
    if (marketing) oaiq("measure", "page_viewed", { type: "contents" });
  }
  window.FinsweetConsentPro = window.FinsweetConsentPro || [];
  window.FinsweetConsentPro.push(["consent", function (consentPro) {
    oaiApplyConsent(consentPro.consents.marketing);
  }]);
  document.documentElement.addEventListener("consentpro:consent-updated", function (event) {
    oaiApplyConsent(event.detail.choices.marketing);
  });
</script>

    What it does: on each page it reads the visitor’s stored choice from Consent Pro, so returning visitors who accepted start with true and keep their __oppref click cookie (OpenAI says oaiq("consent", false) deletes the pixel’s cookies). When the visitor clicks Accept, it switches consent on and sends page_viewed on the same page; OpenAI says events blocked while consent is false are not replayed. If the visitor withdraws consent, it switches measurement off. The consent callback runs when Consent Pro is ready; Consent Pro reports later changes as the consentpro:consent-updated event.

    Consent Pro version 2 detects and blocks scripts automatically, so it may hold back this script, or the oaiq.min.js file it loads, even though the script is not marked. After a scan, check which category the app gave it, then test the result as described under “How to verify the fix”.

    With other tools, call oaiApplyConsent from their hooks instead: OneTrust runs OptanonWrapper() on each page load and whenever consent changes (check OnetrustActiveGroups for your targeting category, often C0004); Cookiebot fires CookiebotOnConsentReady when a stored or new choice is ready (read Cookiebot.consent.marketing).

    C. Google Tag Manager. Put the GTM snippet in Head code (do not mark it for consent) and install the pixel only as a GTM tag. In the tag’s Advanced Settings > Consent Settings, choose Require additional consent for tag to fire and add ad_storage. This works only if your consent tool sends Google Consent Mode updates to GTM; Consent Pro’s GTM template does, and its guide asks you to fire marketing tags on its consent-updated Custom Event. OpenAI’s own template (imported from GitHub) makes no consent call, and its per-event opt-out flag does not stop sending, so the Consent Settings are what hold it back. Stape’s template has a Consent Granted field and Enable GTM consent mode support, which waits for ad_storage.

  3. Load the consent tool’s script first, at the top of Head code, above the OpenAI code.

  4. Publish to your custom domain, not only to the staging domain. Custom code does not go live until you publish.

Common causes

  • OpenAI’s snippet was pasted into Head code unchanged, and the banner was added later.
  • Consent Pro: the pixel was added after the last scan, the scan did not put it under Marketing, the site was not republished, or Load Script Async is on and the script was not marked by hand.
  • OneTrust: the snippet is in Webflow’s custom code instead of the app’s Blocked Scripts.
  • A second copy in a page’s custom code, a Code Embed or a locale version of a page was never gated.
  • The pixel is a GTM tag with no consent requirement. Consent Mode only controls Google tags automatically.
  • oaiq("consent", false) runs after init and the first measure call, so the page view leaves first.

How to verify the fix

  1. In a private window on the published custom domain (from the EU or through a VPN): no page_viewed or conversion events and no __obref cookie before you answer the banner.
  2. Click “Accept”: a page_viewed event leaves within a few seconds, on the same page.
  3. In a fresh private window, click “Reject”: no measurement events at all.
  4. Re-run the check on IsPixelWorking. The issue should be gone, and “OpenAI Pixel does not fire after consent” should not appear in its place.

Questions people ask

Version 2 blocks the scripts its scan detects and categorises. Whether it recognizes the OpenAI Pixel depends on its tracker database, so check the app after a scan: the OpenAI script should be listed under Marketing.

Sources

Guides for your consent tool