Skip to main content

Third-party embeds and your consent banner

Testimonial Widgets and Cookie Consent Banners

Your consent manager wants every script sorted into a category, and the testimonial widget is one more line nobody has classified. Put it in the wrong bucket and either the widget vanishes for everyone who clicks "Reject", or it runs before consent when it should not. This page does not tell you which bucket it belongs in, because that depends on what the script actually stores on your visitors’ devices and on the law where you operate. It gives you the audit to find out and the questions to settle with whoever owns privacy.

  • Audit what the embed stores before you classify it
  • Checks drawn from UK regulator guidance we read
  • Plan for visitors who decline as well as accept
Use the free toolStart free (opens in a new tab)
Testimonial widget consent audit
2 of 14 done14%
  • Open the page with the widget in a private window, with your banner still undecided, and record every cookie and local storage entry that appears.
  • In the browser’s network panel, list every domain the widget contacts, starting with the embed script’s own domain.
  • Play a video or audio testimonial and record anything new that appears in storage after you press play.
  • Ask StoryProof support in writing what, if anything, the embed stores or reads on a visitor’s device, and keep the reply with your audit.
  • If your audit finds nothing stored or read on the device, record that finding and the date, and note what you tested.
Free tool, no sign-upTry it below

The problem, solved

Where consent banners and testimonial widgets collide

StoryProof has no verified claim about cookies or device storage from its widget, so none of these fixes says what the script stores. They make the audit and the configuration easier.

  • Problem 1

    We do not know what the widget loads

    The consent manager asks for a category and nobody can say what the script does, so someone guesses.

  • Problem 2

    Every page loads the script differently

    When the script is pasted page by page, a consent rule written for one template misses the others.

  • Problem 3

    Visitors who decline see an empty box

    If the script is held back until consent, the space reserved for testimonials sits blank for everyone who clicked "Reject".

  • Problem 4

    Legal wants the provider named in the notice

    A cookie notice that says "selected partners" does not tell a visitor whose code is on the page.

  • Problem 5

    Clips might behave differently from quotes

    Media players often load more than a text card does, so a widget full of clips can need a different answer from one with written quotes.

Audit finding and the question to settle

A starting point for the conversation with your privacy owner, not a ruling.

Based on UK guidance read on 2026-11-13. EU, US state and other rules differ. Have counsel confirm before you rely on any row.
What your audit foundQuestion to settleRegulator page to read
Nothing stored or read on the deviceIs that true on every page and for every widget layout you use?ICO: how do we comply with the PECR rules
Storage needed only to show the testimonialsIs it strictly necessary for content the visitor asked for?ICO: what are the exceptions
Storage only after pressing play on a clipDoes the embedded content approach fit, and are visitors told before they press play?ICO: what are the exceptions
Anything that tracks the visitorConsent first: how does the banner hold the script back, and what shows instead?ICO: cookies and similar technologies

In StoryProof

Run the audit and apply it

  1. 1

    Load the script in one place

    Move embed.js into your shared footer so every page loads it the same way and one consent rule can apply.

  2. 2

    Audit before and after interaction

    With the banner undecided, record storage on page load, then again after scrolling through and playing a clip. Note the domains the embed contacts.

  3. 3

    Get the provider’s answer in writing

    Send your findings to StoryProof support and ask what the embed stores and why. Keep the reply with the audit.

  4. 4

    Classify with sign off

    Agree the category with your privacy owner using the table above, and configure the consent manager to match.

  5. 5

    Give decliners a route

    Add a link to your Wall of Love next to the widget and test the page with "Reject" selected.

What happens next: Rerun the audit whenever you change layouts, add clips or update your consent manager. A classification is only as current as the test behind it.

Before you start

What this page cannot settle

What this does not cover, and what to check on your side. Better to know now than after launch.

  1. 01

    No storage claim from StoryProof

    There is no verified statement on this site about what the widget stores on a device. Your audit and the provider’s written reply are the evidence, not this page.

  2. 02

    Not legal advice

    The checklist summarises UK ICO guidance we read on 2026-11-13. How it applies to your site is a question for your privacy owner or counsel.

  3. 03

    Other jurisdictions differ

    EU member states, US states and other countries have their own rules and regulators. Check the guidance where your visitors are.

  4. 04

    The fallback page is hosted elsewhere

    The Wall of Love is a hosted page. A visitor who opens it reaches a different site, which your notice should explain.

  5. 05

    Audits go stale

    Browser changes, new layouts and updates to the script can change what loads. Date every audit and recheck on a schedule.

FAQ

Questions people ask

Short answers to what usually comes up next.

Does the StoryProof widget set cookies?

This site has no verified statement either way, so we do not make one here. Run the audit above on your page and ask StoryProof support to confirm in writing.

Should the widget wait for consent?

That depends on what it stores and why, and on the law that applies to you. The ICO guidance links in the checklist set out the questions; your privacy owner makes the call.

What happens to the widget when a visitor rejects cookies?

If your consent manager blocks embed.js, the widget div stays empty for that visitor. Add a short line and a link to your Wall of Love so the space is not blank.

Do I need to name StoryProof in my cookie notice?

If your audit shows the embed stores or reads anything on the device, the ICO guidance says to name the third party rather than refer vaguely to partners. Confirm with your privacy owner.

Still have a question? Ask the StoryProof team or book a demo.

Add testimonials your privacy owner has checked

Start with a widget on a test page, run the audit, then go live with a classification you can explain.

Start free (opens in a new tab)

Sources

  1. Cookies and similar technologies (Guide to PECR), Information Commissioner’s Office (UK). Checked 2026-11-13.
  2. How do we comply with the PECR rules? (Guidance on the use of storage and access technologies), Information Commissioner’s Office (UK). Checked 2026-11-13.
  3. What are the exceptions? (Guidance on the use of storage and access technologies), Information Commissioner’s Office (UK). Checked 2026-11-13.

Last updated 2026-11-13.