How to add a cookie consent banner to a Ruby on Rails app

Where does the snippet go in Rails?

Rails renders every view inside a layout, app/views/layouts/application.html.erb by default. Paste the snippet in its head, above the tags that load your JavaScript (javascript_importmap_tags with importmap-rails, javascript_include_tag with jsbundling-rails):

erb
<!DOCTYPE html>
<html>
  <head>
    <title><%= content_for(:title) || "My app" %></title>
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <%= csrf_meta_tags %>
    <%= csp_meta_tag %>
    <script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
    <%= stylesheet_link_tag "application", "data-turbo-track": "reload" %>
    <%= javascript_importmap_tags %>
  </head>
  <body>
    <%= yield %>
  </body>
</html>

The site key is public (it appears in every page), so writing it in the layout is fine. If other layouts exist, for example for mailers or an admin area, add the snippet only to those that visitors see.

How do I block my tags until consent?

Paste tracking tags under the snippet and change their opening tag:

html
<script type="text/plain" data-cq-category="marketing">
  /* Meta Pixel base code, unchanged */
</script>

Cookiequiet runs marked tags when the category is granted, and at once on later visits where the stored choice includes it. The Meta Pixel guide shows the full base code, and the Google Analytics 4 guide the Google tag with its Consent Mode alternative. To print them only in production, wrap them in <% if Rails.env.production? %>. Scripts that your JavaScript or a library creates at runtime are held by the auto-blocker when they come from one of the about 80 trackers it knows.

What changes with Turbo Drive?

Turbo Drive, on by default in new Rails apps, turns link clicks into fetches. The Turbo handbook says it replaces the body with the new page's body and merges the heads, and that a script in the head runs only the first time it appears. Three consequences:

• The snippet runs once per full load and the stored choice stays applied across visits.
• Marked tags belong in the head. Cookiequiet activates them on load and after each choice, not on each Turbo visit.
• The banner's container is appended to the body, which Turbo replaces. Cookiequiet puts it back into the new body, so a banner waiting for an answer, the preferences button and showPreferences() keep working without extra code.

For code that runs per page, such as page views, Turbo fires turbo:load after the first load and after every visit; send the page view there only when the cq:consent event Cookiequiet dispatches on window has granted analytics.

How do I allow Cookiequiet in the Content Security Policy?

Rails defines the policy in config/initializers/content_security_policy.rb. Add the origin to the two directives the banner needs:

ruby
Rails.application.configure do
  config.content_security_policy do |policy|
    policy.script_src  :self, "https://cookiequiet.com"
    policy.connect_src :self, "https://cookiequiet.com"
  end
end

script-src loads cq.js; connect-src covers the configuration, the geo lookup and the consent records. If the policy uses nonces, give marked inline scripts nonce="<%= content_security_policy_nonce %>": Cookiequiet copies the nonce to the script it runs after consent, so the policy lets it through.

How do I add the Cookie preferences link?

html
<a href="#cq-preferences" data-cq-show-preferences data-turbo="false">Cookie preferences</a>

Cookiequiet handles the click and opens the preferences centre; data-turbo="false" keeps Turbo from treating it as a visit.

How do I test it?

1. Run bin/rails server or bin/dev, open the app in a private window and view the source: cq.js comes before your JavaScript.
2. Click Reject all. The cookies are cq_consent and the session cookie Rails sets (named after the app, such as _myapp_session), which is strictly necessary.
3. Clear the cookies, reload, and follow a link before choosing: the banner stays visible.
4. Click Accept all, reload: the marked tags run.
5. Check the consent log in the dashboard.

There is no gem to install. Cookiequiet is free for one website with geo-targeting; Starter is €3 per website per month with unlimited pageviews.