Cookie Consent for
Magento & Adobe Commerce
That Actually Works.
Magento's built-in Cookie Restriction Mode displays a notice bar while every tracking script on your store continues firing in the background. Google Analytics, Meta Pixel, Adobe Analytics, session-replay tools, marketing automation — all transmitting visitor data without consent. ConsentPixel — Privacy · Verified fixes this with one script tag. No extension. No Adobe Marketplace installation. No PHP.
Why Magento Stores Face Serious Privacy Exposure
Magento and Adobe Commerce power some of the most complex eCommerce operations in the world — mid-market and enterprise brands with sophisticated marketing stacks, extensive analytics configurations, and often international multi-store architectures. That power comes with a compliance challenge that simpler platforms do not face to the same degree: a typical Magento store runs more third-party integrations, with more data sharing, across more jurisdictions, than almost any other eCommerce platform.
The tracking stack on an enterprise Magento store often includes: Google Analytics 4 via a dedicated extension, Google Tag Manager with dozens of tags, Adobe Analytics (for Adobe Commerce merchants in the Experience Cloud), Meta Pixel, TikTok, Microsoft Ads UET, Klaviyo or Dotdigital for email marketing, Hotjar or FullStory for session analysis, and a CRM integration — all firing by default on every page, for every visitor, without consent gating.
Magento Cookie Restriction Mode — What It Does and Does Not Do
Cookie Restriction Mode is enabled under Stores → Configuration → General → Web → Default Cookie Settings → Cookie Restriction Mode. Understanding exactly where it falls short is important for any compliance conversation with a Magento developer or agency.
Cookie Restriction Mode was built to satisfy a basic EU cookie law notice requirement — not the GDPR consent standard that has been in force since 2018, and certainly not the technical requirements of US state privacy laws enacted in 2022–2026.
✗ No script blocking
All registered tracking extensions — GA4, Meta Pixel, GTM tags — continue executing the moment a visitor lands, before and regardless of any interaction with the notice bar.
✗ No Google Consent Mode v2
Cookie Restriction Mode passes no GCM v2 parameters to Google tags. EU/UK visitors who decline are invisible to your campaigns, conversion modelling, and smart bidding.
✗ No GPC signal detection
Cookie Restriction Mode cannot read the Global Privacy Control browser signal. California, Colorado, Virginia, and Connecticut visitors with GPC active are not automatically opted out.
✗ No consent audit log
No record of when visitors interacted with the notice, what they were shown, or what they chose. Under GDPR's accountability principle, you cannot demonstrate consent was obtained.
Trackers Commonly Running on Magento Stores
These are the tracking tools found most frequently across Magento and Adobe Commerce stores — installed via extensions from the Adobe Commerce Marketplace, via GTM, or via direct theme integration — and the specific privacy law exposure each creates.
Magento Cookie Restriction Mode vs. ConsentPixel
| Capability | Magento Cookie Restriction Mode | ConsentPixel |
|---|---|---|
| Technically blocks scripts before consent | ✗ No — notice only | ✓ Always |
| Google Consent Mode v2 (all 4 parameters) | ✗ No | ✓ All plans |
| Global Privacy Control (GPC) detection | ✗ No | ✓ Auto-detected |
| Multi-store per-channel configuration | ✗ No | ✓ Full support |
| CIPA session-replay blocking on checkout | ✗ No | ✓ Yes |
| US state law opt-out (19 states) | ✗ No | ✓ All plans |
| Consent audit log (timestamped) | ✗ No | ✓ All plans |
| Automatic tracker scanning | ✗ No | ✓ Continuous |
| Reject All at first layer (dark pattern-free) | ✗ No Reject option | ✓ Always equal to Accept |
| No Magento extension required | N/A | ✓ One script tag |
See exactly what fires on your Magento store before consent
ConsentPixel scans your store in a fresh session — no cache, no prior consent — and shows every script firing before your visitors have any opportunity to accept or decline.
How to Install ConsentPixel on Magento
ConsentPixel installs on Magento as a single script tag in the document head — no Adobe Commerce Marketplace extension, no Composer package, no PHP deployment. There are two approaches depending on your store's theme and developer access level. Both take under five minutes.
Create your ConsentPixel account and scan your store
Sign up at consentpixel.com, add your Magento store domain, and run the auto-scanner. ConsentPixel maps every tracker and cookie across your store — including those installed via Magento extensions, GTM containers, and third-party integrations. Copy your unique pixel snippet from the dashboard.
For multi-store or multi-website Magento setups, create a separate site in ConsentPixel for each store view or website that requires its own consent configuration, and generate the corresponding pixel snippet for each.
Method A — Layout XML (recommended for developers)
Add the ConsentPixel snippet to your theme's default_head_blocks.xml file. This ensures it loads before all other scripts on every page, including before GTM and any GA4 extension output. Create or edit the file at:
<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
<head>
<!-- ConsentPixel — must be first script in head -->
<script src="https://pixel.consentpixel.com/YOUR-SITE-ID.js" async="true"/>
</head>
</page>
After saving, run bin/magento cache:flush and bin/magento setup:static-content:deploy to apply the change.
Method B — Admin HTML Head Scripts (no developer access needed)
In the Magento admin, navigate to Content → Design → Configuration. Select your store view and click Edit. Under HTML Head → Scripts and Style Sheets, paste the ConsentPixel snippet. Save the configuration and flush the cache.
<!-- ConsentPixel — paste as the first script --> <script src="https://pixel.consentpixel.com/YOUR-SITE-ID.js" async></script>
If your store uses Varnish caching, purge the Varnish cache after saving. For multi-store setups, apply the appropriate snippet to each store view from the store view scope in Design Configuration.
Confirm load order — ConsentPixel before GTM and all Google extensions
The critical requirement is that ConsentPixel loads before any Google tag. In particular: if you use a Magento GTM extension (MagePal, Mirasvit, WeltPixel), that extension typically injects the GTM container snippet via a layout XML block. ConsentPixel must appear earlier in the head than that block.
Use the Layout XML method (Method A) and verify load order by opening DevTools → Network → filter for gtm.js and your ConsentPixel domain. ConsentPixel's domain must appear first in the waterfall — before googletagmanager.com, before google-analytics.com, before any advertising pixel.
Register your extensions and configure Google Consent Mode v2
In the ConsentPixel dashboard, register each Magento extension and third-party integration by category: Analytics (GA4, Adobe Analytics), Marketing (Meta Pixel, TikTok, Klaviyo), Functional (live chat, search widgets), and Session Recording (Hotjar, Clarity, FullStory).
Enable Google Consent Mode v2. ConsentPixel automatically injects all four GCM v2 parameters before any Google tag loads — protecting your Google Shopping and Google Ads conversion measurement for EU and UK visitors. This works regardless of which Magento GA4 extension you use, because ConsentPixel fires the default block at the head level before any extension output reaches the browser.
Verify and disable Magento's Cookie Restriction Mode
Once ConsentPixel is live and verified, disable Magento's native Cookie Restriction Mode to prevent two banners appearing simultaneously. Go to Stores → Configuration → General → Web → Default Cookie Settings → Cookie Restriction Mode → No. Flush the cache. Verify in incognito that only the ConsentPixel banner appears and no scripts fire before interaction.
What ConsentPixel Does for Your Magento Store
True pre-consent script blocking
Every registered integration is held at head level — product pages, category pages, checkout, order confirmation, CMS pages. Nothing fires before the visitor's consent state is established. Replaces Cookie Restriction Mode with actual blocking.
Multi-store per-view consent
Each Magento store view gets its own consent configuration. GDPR opt-in for EU store views, CCPA opt-out for US stores, UK GDPR for British views — managed centrally, applied automatically per store view.
Google Consent Mode v2 — correct firing order
ConsentPixel fires all four GCM v2 parameters at document head level — before any Magento extension output, before GTM, before GA4. The only CMP that guarantees correct firing sequence regardless of extension load order.
Session-replay blocking on checkout
Hotjar, Clarity, FullStory, and Lucky Orange are blocked until explicit consent — eliminating $5,000/visitor CIPA checkout exposure. Consent-gates recording scope on all Magento checkout, account, and form pages.
Consent audit log per store view
Every consent decision is timestamped with banner version, category choices, and signal source. Maintained per store view for jurisdiction-specific audit records. Exportable for GDPR accountability documentation.
Continuous extension scanning
ConsentPixel scans your store on a schedule and alerts you when new trackers appear — including those introduced by Magento extension updates or new GTM tag deployments. Your consent configuration stays current automatically.
Magento Privacy Compliance Checklist (2026)
Frequently Asked Questions
Your extensions. Your customers.
Actually protected.
One script tag in your Magento head — before GTM, before GA4, before everything. No extension. No Marketplace installation. Full GDPR, CCPA, CIPA, and 19-state US compliance — with multi-store support, correct GCM v2 firing order, and session-replay protection on checkout.