Website privacy checkup

Homepage privacy/legal links: Skilmálar; persónuverndarsíðuna. If cookies and third parties are only mentioned in passing, visitors may not get a clear list.

What to do: On Duda: Add a short cookie notice or a section in the privacy policy listing cookies, purposes, and vendors, and link it from the banner.

Written for Duda.

1. Add a cookie section, or a short cookie notice, that lists cookies, purposes, and vendors. This checkup is not a substitute for legal review.
2. You already have a legal page in some cases (for example a ‘Skilmálar’ / terms URL). Add a clear cookie list there, or a dedicated privacy page, and link it in the footer and the banner — not only as a small ‘learn more’ inside a notice.

Visible banner wording (truncated): Við notum vefkökur til að tryggja að við gefum þér bestu upplifunina á vefsíðunni okkar. Til að læra meira, sjá persónuverndarsíðuna. ×

What to do: On Duda: Where GDPR/ePrivacy applies, give reject or essential-only the same prominence as accept, and do not require a visit to a second layer just to say no.

Written for Duda.

1. Duda’s built-in cookie notification is often an information bar (text + a close control) and does not delay marketing scripts. Replace it with a real choice: Accept and Reject (or essential only) at the same prominence.
2. In Site settings / Header HTML, paste the Consent Mode default above Google Tag Manager or Analytics.
3. Find every marketing script in custom header/footer code and widgets. Those scripts run on first load today — take them out of the global head.
4. Load the Meta Pixel only after Accept, using the snippet below. Leaving connect.facebook.net in the global header will keep firing before a choice.
5. Keep GTM in the head only if the Consent Mode default sits above it and GTM tags wait for granted signals. Otherwise load GA4 / Ads after Accept.
6. Edit the privacy / terms page so it lists cookies, purposes, and vendors, and link it from both the footer and the banner.
7. Test in a fresh private window: do nothing, click Reject, and click Accept. Only Accept should set analytics or ads cookies such as _ga, _gid, _gcl_au, _fbp.

<!-- Paste in the <head>, ABOVE any Google Tag Manager or gtag.js snippet. -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){ dataLayer.push(arguments); }
  gtag('consent', 'default', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied',
    functionality_storage: 'granted',
    security_storage: 'granted',
    wait_for_update: 500
  });
</script>

<!-- Call this only after the visitor opts in (Accept / save preferences). -->
<script>
  gtag('consent', 'update', {
    ad_storage: 'granted',
    ad_user_data: 'granted',
    ad_personalization: 'granted',
    analytics_storage: 'granted'
  });
</script>

<!-- Call this when the visitor chooses Reject / essential only. -->
<script>
  gtag('consent', 'update', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    analytics_storage: 'denied'
  });
</script>

<!-- Do not put the Meta Pixel in the <head> so it loads on every visit.
Load it only after marketing consent. Replace PIXEL_ID. -->
<script>
  function loadMetaPixel(pixelId) {
    if (window.fbq) return;
    !function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
    n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
    n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;
    t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}
    (window, document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');
    fbq('init', pixelId);
    fbq('track', 'PageView');
  }
  // Example: after Accept / marketing opt-in
  // loadMetaPixel('PIXEL_ID');
</script>