Magento 2 GDPR Extension

Cookie Notice and Cookie Consent Banner

Magento's built-in Cookie Restriction Mode shows one notice with an Allow Cookies button. This extension replaces it with a cookie consent banner: visitors can agree to all cookies, pick cookie groups in the settings, or decline the optional ones. By default, only essential cookies are allowed until they choose.

You split cookies into required groups (for example, Magento core cookies) and optional ones, such as statistics and marketing, and edit the cookie notice text and the link to your cookie policy. Lock Screen keeps visitors from using the store until they make a choice.

• The banner shows only in the countries and US states you select. The country comes from a GeoIP database shipped with the extension, so visitor IPs aren't sent to an outside service.
• You can have the banner ask visitors again when you add a cookie group or a cookie.
• Visitors can change their choice later from a footer button, a widget you place anywhere, or their account.
• Turn on the log of blocked cookies to spot cookies from a new extension and add them to a group. It records real traffic and doesn't scan your site.

Google Consent Mode v2

Google Consent Mode v2 is built into the extension, with no add-on to buy. Once you turn it on, the default state (denied or granted) goes to the data layer before your Google Tag Manager container loads, and the update follows as soon as the visitor makes a choice.

Cookie groups map to the seven consent signals: statistics to analytics_storage, marketing to ad_storage, ad_user_data and ad_personalization, functionality to functionality_storage and personalization_storage, essential to security_storage. Google tags then adjust what they collect. The extension doesn't stop the tags from loading.

To send full ecommerce events to GA4 and Google Ads under these consent signals, pair it with our GA4 and Google Tag Manager extension.

Consent Checkboxes and Consent Records

Add required consent checkboxes, such as accepting your privacy policy, to four forms: registration, checkout, newsletter sign-up and Contact Us. You can add several checkboxes per form, each with its own text and store views. None of them is ticked in advance.

Each consent is recorded in the admin with its type, date, time and IP, and customers see their current consents in their account. Cookie choices are recorded for signed-in customers; a guest's cookie choice stays in the guest's browser.

Let Customers Delete Their Account and Download Their Data

Customers open the privacy dashboard in their account and handle requests themselves, instead of emailing your support. Every action asks for their password again.

• Download: a CSV file with their account details, addresses and order details, available right away
• Anonymize: names, addresses and phone numbers in the account and orders are replaced right away; not available while the customer has open orders
• Delete account: the request waits for your approval. The admin shows a notice about pending requests, and you can approve or reject several at once. After approval, the extension anonymizes the orders and deletes the account.

Automatic Data Retention

The GDPR says not to keep personal data longer than you need it. Rather than cleaning the database by hand, set the periods once:

• Orders older than the period you set (730 days by default) are anonymized every night, guest orders included, so they stay in your sales reports without names and addresses.
• Accounts without orders for a set period (365 days by default) get a deletion request, which you approve like any other.

Need records for your accountant? Order Information Protection keeps recent orders, customer accounts and addresses from being anonymized or deleted at a customer's request for the number of days you set.

Among stores using the extension, few turn on automatic deletion, and many more turn on automatic anonymization. Agree on the periods with your legal advisor.