diff --git a/google_analytics.permissions.yml b/google_analytics.permissions.yml
index 946dbd7ef75541d0086ee88d3f659f8cf0d58481..03542ee96f1006142c7000a740d18aabb5e587b3 100644
--- a/google_analytics.permissions.yml
+++ b/google_analytics.permissions.yml
@@ -8,3 +8,7 @@ use PHP for google analytics tracking visibility:
   title: 'Use PHP for tracking visibility'
   description: 'Enter PHP code in the field for tracking visibility settings.'
   restrict access: true
+add JS snippets for google analytics:
+  title: 'Add JavaScript snippets'
+  description: 'Enter JavaScript code snippets for advanced Google Analytics functionality.'
+  restrict access: true
diff --git a/src/Form/GoogleAnalyticsAdminSettingsForm.php b/src/Form/GoogleAnalyticsAdminSettingsForm.php
index 79d6a119357cf52891743a9ceaf73c6eb89ccc72..b3c1817365c00990bb6936011098e223db347454 100644
--- a/src/Form/GoogleAnalyticsAdminSettingsForm.php
+++ b/src/Form/GoogleAnalyticsAdminSettingsForm.php
@@ -484,6 +484,8 @@ class GoogleAnalyticsAdminSettingsForm extends ConfigFormBase {
       ];
     }
 
+    $user_access_add_js_snippets = !$this->currentUser()->hasPermission('add JS snippets for google analytics');
+    $user_access_add_js_snippets_permission_warning = $user_access_add_js_snippets ? ' <em>' . $this->t('This field has been disabled because you do not have sufficient permissions to edit it.') . '</em>' : '';
     $form['advanced']['codesnippet'] = [
       '#type' => 'details',
       '#title' => $this->t('Custom JavaScript code'),
@@ -502,15 +504,17 @@ class GoogleAnalyticsAdminSettingsForm extends ConfigFormBase {
       '#type' => 'textarea',
       '#title' => $this->t('Code snippet (before)'),
       '#default_value' => $config->get('codesnippet.before'),
+      '#disabled' => $user_access_add_js_snippets,
       '#rows' => 5,
-      '#description' => $this->t('Code in this textarea will be added <strong>before</strong> <code>ga("send", "pageview");</code>.'),
+      '#description' => $this->t('Code in this textarea will be added <strong>before</strong> <code>ga("send", "pageview");</code>.') . $user_access_add_js_snippets_permission_warning,
     ];
     $form['advanced']['codesnippet']['google_analytics_codesnippet_after'] = [
       '#type' => 'textarea',
       '#title' => $this->t('Code snippet (after)'),
       '#default_value' => $config->get('codesnippet.after'),
+      '#disabled' => $user_access_add_js_snippets,
       '#rows' => 5,
-      '#description' => $this->t('Code in this textarea will be added <strong>after</strong> <code>ga("send", "pageview");</code>. This is useful if you\'d like to track a site in two accounts.'),
+      '#description' => $this->t('Code in this textarea will be added <strong>after</strong> <code>ga("send", "pageview");</code>. This is useful if you\'d like to track a site in two accounts.') . $user_access_add_js_snippets_permission_warning,
     ];
 
     $form['advanced']['google_analytics_debug'] = [
diff --git a/src/Tests/GoogleAnalyticsBasicTest.php b/src/Tests/GoogleAnalyticsBasicTest.php
index 24ad281fef00731b788e33fd8b4d5cd488bc9573..f6596065956e9866ac5191b3e12d9ac5661f744a 100644
--- a/src/Tests/GoogleAnalyticsBasicTest.php
+++ b/src/Tests/GoogleAnalyticsBasicTest.php
@@ -13,6 +13,13 @@ use Drupal\simpletest\WebTestBase;
  */
 class GoogleAnalyticsBasicTest extends WebTestBase {
 
+  /**
+   * User without permissions to use snippets.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $noSnippetUser;
+
   /**
    * Modules to enable.
    *
@@ -38,6 +45,8 @@ class GoogleAnalyticsBasicTest extends WebTestBase {
     ];
 
     // User to set up google_analytics.
+    $this->noSnippetUser = $this->drupalCreateUser($permissions);
+    $permissions[] = 'add JS snippets for google analytics';
     $this->admin_user = $this->drupalCreateUser($permissions);
     $this->drupalLogin($this->admin_user);
 
@@ -68,6 +77,26 @@ class GoogleAnalyticsBasicTest extends WebTestBase {
     $edit['google_analytics_account'] = $this->randomMachineName(2);
     $this->drupalPostForm('admin/config/system/google-analytics', $edit, t('Save configuration'));
     $this->assertRaw(t('A valid Google Analytics Web Property ID is case sensitive and formatted like UA-xxxxxxx-yy.'), '[testGoogleAnalyticsConfiguration]: Invalid Web Property ID number validated.');
+
+    // User should have access to code snippets.
+    $this->assertFieldByName('google_analytics_codesnippet_create');
+    $this->assertFieldByName('google_analytics_codesnippet_before');
+    $this->assertFieldByName('google_analytics_codesnippet_after');
+    $this->assertNoFieldByXPath("//textarea[@name='google_analytics_codesnippet_create' and @disabled='disabled']", NULL, '"Create only fields" is enabled.');
+    $this->assertNoFieldByXPath("//textarea[@name='google_analytics_codesnippet_before' and @disabled='disabled']", NULL, '"Code snippet (before)" is enabled.');
+    $this->assertNoFieldByXPath("//textarea[@name='google_analytics_codesnippet_after' and @disabled='disabled']", NULL, '"Code snippet (after)" is enabled.');
+
+    // Login as user without JS permissions.
+    $this->drupalLogin($this->noSnippetUser);
+    $this->drupalGet('admin/config/system/google-analytics');
+
+    // User should *not* have access to snippets, but create fields.
+    $this->assertFieldByName('google_analytics_codesnippet_create');
+    $this->assertFieldByName('google_analytics_codesnippet_before');
+    $this->assertFieldByName('google_analytics_codesnippet_after');
+    $this->assertNoFieldByXPath("//textarea[@name='google_analytics_codesnippet_create' and @disabled='disabled']", NULL, '"Create only fields" is enabled.');
+    $this->assertFieldByXPath("//textarea[@name='google_analytics_codesnippet_before' and @disabled='disabled']", NULL, '"Code snippet (before)" is disabled.');
+    $this->assertFieldByXPath("//textarea[@name='google_analytics_codesnippet_after' and @disabled='disabled']", NULL, '"Code snippet (after)" is disabled.');
   }
 
   /**