How to set up Cloudflare Zaraz: step by step with Google Analytics and a cookie banner

You set up Cloudflare Zaraz entirely in the Cloudflare dashboard. If your domain runs through the Cloudflare proxy, Zaraz adds its script to every page by itself, and you don’t have to touch your source code. In this guide, you add Google Analytics 4, turn on the cookie banner and check that no tool starts before the visitor says yes.

What you need first

• A Cloudflare account that holds your domain. Zaraz is included in every plan, including the free one.
• The proxy turned on for your domain (the orange cloud in the DNS records). Without the proxy, Zaraz only works through a separate subdomain that runs through Cloudflare.
• The measurement ID of your Google Analytics 4 property. It starts with “G-” and sits in Google Analytics under Admin, Data streams.
• A list of every tracking script that currently sits directly in your source code or in Google Tag Manager. You’ll remove those later, or you’ll measure everything twice.

Step 1: Open Zaraz for your domain

In the Cloudflare dashboard, you’ll find Zaraz under Tag Management, Tag Setup. Since February 2025, Zaraz lives there at account level. If you have several domains in the account, pick the one you want to set up at the top.

Step 2: Test first, then publish

Out of the box, Zaraz applies every change to all visitors immediately. So before you add the first tool, turn on “Preview & Publish Workflow” under Tag Management, History. Your changes then land in a preview that only you can see, and they go live when you click “Publish”. As a bonus, you get a version history you can restore older versions from.

Step 3: Add Google Analytics 4 as a tool

Under Third-party tools, choose “Add new tool”, then Google Analytics 4 from the catalog. Enter your measurement ID and leave the page view action on. It uses the “Pageview” trigger that comes with Zaraz. Save, and you’re done.

One limitation is worth knowing up front: Google Analytics enhanced measurement, meaning scrolls, downloads and outbound links, doesn’t run automatically through Zaraz. By default, Zaraz only reports page view, session start and first visit. You set up everything else as a custom event with its own trigger in Zaraz.

Step 4: Turn on the cookie banner and give every tool a purpose

This is the step where most setups fail. Under Tag Management, Consent, turn on “Enable Consent Management” and enter the text for your banner. Then create your purposes under Purposes, for example “Analytics” and “Marketing”, each with a one-sentence description.

Under “Assign purpose to tools”, every tool now gets exactly one purpose. In Zaraz, a tool without a purpose starts without consent, and the banner has no say in it. Cloudflare says so in its own documentation. So check the list every time you add a tool, including helper scripts in Custom HTML.

The banner speaks several languages and follows the browser language. You adjust its look with your own CSS. Cloudflare doesn’t document the selectors for that, which is why I built the Zaraz Consent Banner Designer. You set colors, fonts and position there and copy the finished CSS into Zaraz.

Step 5: Set Google Consent Mode v2

For Google Analytics 4 and Google Ads, Zaraz supports Consent Mode v2 out of the box. Under Tag Management, Settings, check “Set Google Consent Mode v2 state”. Every visit then starts with “denied” for all categories. After the click in the banner, Google gets the new state. You’ll see whether it arrives in step 8.

Step 6: Send less data to Google

On the same page, you’ll find four switches under Privacy. The two most important ones: “Trim IP addresses” shortens the IP address before Zaraz passes it to a tool. “Remove URL query parameters” strips parameters such as search terms or email addresses from the URL. Both cost a little accuracy for location and campaigns. Decide this with your data protection officer.

Step 7: Custom paths against ad blockers

Out of the box, Zaraz loads through paths under /cdn-cgi/zaraz/. Many ad blockers know these paths and block them, and then no data arrives even from visitors who agreed. That’s why you give Zaraz custom paths on your domain under Settings, Endpoints.

If your website has a Zaraz loader built in by hand anywhere, move it to the new path in the same step. Otherwise it points nowhere, and banner and tracking disappear without an error message. Websites on Cloudflare Workers with static assets are a special case: Cloudflare doesn’t add the script there automatically. You turn off “Auto-inject script” and put the loader into the page head yourself.

Step 8: Test in three states, then publish

Copy your debug key under Settings. Open your website in a private window, then the developer tools and the console. The command zaraz.preview with your key in parentheses reloads the page with your preview and the Zaraz debugger. Check three states:

1. Before the yes: In the network tab, only the Zaraz script loads from your domain. No request to Google, Meta or any other vendor.
2. After the yes: The debugger shows the requests to Google Analytics. They run through Cloudflare, not from the browser. With Consent Mode v2, they carry the “gcd” parameter.
3. After withdrawal: Open the banner again, withdraw consent and reload the page. Nothing should go to Google again.

Only when all three are right do you click “Publish” in the dashboard. Then remove the old scripts from the source code or from Tag Manager. By the way, browser extensions such as Meta Pixel Helper don’t see tools that Zaraz runs on Cloudflare. Rely on the debugger.

Five mistakes I find in finished Zaraz setups

1. A tool has no purpose and starts before the yes. Often affected: HubSpot, embedded forms, Custom HTML.
2. Zaraz loads through /cdn-cgi/zaraz/ and loses every visitor with an ad blocker.
3. The path was renamed, but a loader in the source code wasn’t.
4. Click triggers register a second time after consent, so every click counts twice in Google Analytics.
5. The banner says “no cookies”, but by now a tool runs that sets cookies.

If you’d rather not check this yourself, I’ll set up Zaraz for you or audit your existing setup.

Zaraz or Google Tag Manager?

For a website with Google Analytics, Google Ads, the Meta pixel and LinkedIn, Zaraz is enough, and the cookie banner is already included. If your team builds custom tags every day or uses tools Zaraz has no integration for, Google Tag Manager stays the better choice. You’ll find the detailed comparison with load sizes and costs under Zaraz vs. Google Tag Manager.