Injection points
Remote HTML: add scripts in template head
Local file: inject via build pipeline
Bridge APIs: load JS after document start
Avoid double-loading with the mobile site
WebView & hybrid appsCookie consent inside native WebViews in
|
Many apps load marketing sites or logged-in web experiences inside embedded browsers. Secure Privacy still needs to run in that HTML context: inject the published banner and installation scripts from Domains → Installation as early as possible in the document head—whether the HTML is served remotely or injected through a native bridge. You are responsible for ensuring the WebView allows JavaScript and that local storage/cookies behave per OS policies. Use the general new-domain installation checklist for script copy; involve mobile engineers for bridge timing and cookie partitioning (ITP, WebView storage).
HTML shell injection
Consent before native bridges
SOC2-ready CMP
65+ Laws
Capacitor · Cordova patterns
