Cookie Consent for
Drupal That Closes
the Module Gap.
Drupal CMS 1.0 ships with Klaro built in. The EU Cookie Compliance module has been installed millions of times. But both carry the same critical limitation: they cannot block external JavaScript — so GA4, Meta Pixel, Hotjar, and every other third-party tracking script fires regardless of what your visitor chose. ConsentPixel — Privacy · Verified closes this gap with one script tag. No module. No Composer dependency. No code review cycle.
The Critical Gap in Drupal's Built-In Privacy Modules
Drupal has a strong open-source privacy culture and a rich module ecosystem for consent management. Drupal CMS 1.0, released in January 2025, made Klaro Cookie & Consent Manager a built-in component — the most significant native privacy feature in Drupal's history. The EU Cookie Compliance module has been installed on over a million Drupal sites. For a CMS built on community trust and enterprise reliability, these tools represent a genuine commitment to privacy.
But both carry a limitation that Drupal's own documentation acknowledges explicitly — and that most site owners do not notice until they run a compliance audit or receive a regulatory inquiry.
The EU Cookie Compliance module's own documentation states: "Important: This module can only prevent cookies from being set on the current site. External JavaScripts will still be able to set their own cookies."
This is not a bug — it is an architectural limitation of how Drupal-native cookie management works. The module can control cookies your Drupal theme and modules set directly. It cannot intercept and block JavaScript loaded from external domains — like ga4, fbq (Meta Pixel), Hotjar's script, or any GTM tag — before those scripts fire and transmit data to third-party servers.
✗ GA4 still fires
Google Analytics 4 loaded via Google Tag Manager or a Drupal GA module fires on page load regardless of the visitor's consent choice in the EU Cookie Compliance banner.
✗ Meta Pixel still fires
The Meta Pixel and any other social advertising tag loaded externally executes before and after consent — sharing browse behaviour with Meta's ad network unconditionally.
✗ Hotjar / Clarity still fire
Session-replay scripts added via the theme or a Drupal module run regardless of consent state — creating $5,000/visitor CIPA exposure for every California visitor.
✗ GTM tags still fire
Every tag inside a Google Tag Manager container — conversion pixels, remarketing, analytics — fires in full regardless of what the visitor chose on the consent banner.
Klaro in Drupal CMS 1.0 addresses this better for Drupal-managed content — embedded maps, YouTube iframes, and features Drupal CMS controls natively. But external JavaScript loaded via GTM or directly injected into the theme still falls outside Klaro's blocking scope. For any Drupal site with a real marketing and analytics stack, neither module provides the technical script blocking that GDPR actually requires.
Trackers Commonly Running on Drupal Sites
Drupal's enterprise, government, media, and higher education user base means its sites tend to carry sophisticated analytics configurations — often including multiple measurement tools, accessibility tools, marketing pixels, and third-party content embeds. These are the most common tracking integrations found on Drupal sites and the specific privacy law exposure each creates.
Drupal Modules vs. ConsentPixel — What Each Actually Does
| Capability | EU Cookie Compliance Module | Klaro (Drupal CMS 1.0) | ConsentPixel |
|---|---|---|---|
| Blocks external JS before consent | ✗ Documented limitation | ⚠ Drupal-managed only | ✓ All registered scripts |
| Blocks GA4 / GTM tags | ✗ No | ✗ No | ✓ Yes |
| Google Consent Mode v2 (all 4 params) | ✗ No | ✗ No | ✓ All plans |
| Global Privacy Control (GPC) detection | ✗ No | ✗ No | ✓ Auto-detected |
| CIPA session-replay blocking | ✗ No | ✗ No | ✓ Yes |
| US state law opt-out (19 states) | ✗ No | ✗ No | ✓ All plans |
| Consent audit log (timestamped) | ⚠ Basic | ⚠ Basic | ✓ Full log, exportable |
| Blocks Drupal-managed embeds (maps, video) | ⚠ Partial | ✓ Yes (Drupal CMS features) | ✓ When registered |
| No module install / Composer required | ✗ Module required | ✗ Built into Drupal CMS | ✓ Script tag only |
| No Drupal core update dependency | ✗ Must maintain with Drupal | ✗ Tied to Drupal CMS | ✓ Independent deployment |
See what fires on your Drupal site despite your consent module
ConsentPixel scans your Drupal site in a fresh session — no cache, no prior consent — and shows every external script transmitting data before any consent is recorded.
How to Install ConsentPixel on Drupal
ConsentPixel installs on Drupal as a single script tag in the document head — no Drupal module installation, no Composer package, no code review process. It must load before all other scripts in the head to ensure pre-consent blocking works correctly. There are three approaches depending on your Drupal version and access level.
Create your ConsentPixel account and scan your site
Sign up at consentpixel.com, add your Drupal site domain, and run the auto-scanner. ConsentPixel maps every tracker and external script across your site — including those loaded via GTM, Drupal modules, and custom theme code. Copy your unique pixel snippet from the dashboard.
Method A — Theme template (recommended for Drupal 8/9/10)
Add the ConsentPixel snippet to your theme's html.html.twig file as the very first element inside the <head> tag — before your GTM snippet, before the Drupal {{ head }} variable, before all other script output.
<head>
{# ConsentPixel — must be first script in head #}
<script
src="https://pixel.consentpixel.com/YOUR-SITE-ID.js"
async></script>
{# Drupal head output below — includes GTM, GA4 modules etc. #}
{{ head }}
...
Placing the snippet before {% raw %}{{ head }}{% endraw %} ensures ConsentPixel fires before any module-injected head scripts including the Google Analytics module and GTM module outputs.
Method B — Drupal admin JavaScript injection (no theme edit needed)
In the Drupal admin, navigate to Admin → Appearance → Settings → your active theme. Scroll to the JavaScript Code / Additional JavaScript field (if your theme supports this setting) and paste the ConsentPixel snippet. Save the configuration and clear Drupal's cache.
Alternatively, use the Administration menu → Configuration → Development → JavaScript aggregation settings to add a custom head script. The exact path varies by Drupal version and installed modules — your site's admin or developer will know the correct location.
Method C — Drupal 7: page.tpl.php
For Drupal 7 sites, add the snippet to your theme's page.tpl.php file as the first element inside the <head> tag:
<head>
<!-- ConsentPixel — first script in head -->
<script
src="https://pixel.consentpixel.com/YOUR-SITE-ID.js"
async></script>
<?php print $head; ?>
...
Register your external scripts and configure GCM v2
In the ConsentPixel dashboard, register each external tracking tool by consent category: Analytics (GA4, Adobe Analytics), Marketing (Meta Pixel, LinkedIn, TikTok), Functional (live chat, marketing automation), Session Recording (Hotjar, Clarity). ConsentPixel will block each category until the visitor consents.
Enable Google Consent Mode v2. ConsentPixel injects all four GCM v2 parameters before any Google tag loads — including before your GTM module output fires. This is the correct firing sequence that Drupal's GTM module cannot guarantee on its own.
Decide how to handle Drupal's existing consent modules
You have two options. Option A — Layered approach: Keep Klaro (for Drupal CMS embedded content) or EU Cookie Compliance (for Drupal-native cookies) running alongside ConsentPixel, which handles all external scripts. This maintains Drupal CMS's native privacy features while adding true external script blocking. Option B — ConsentPixel only: Disable EU Cookie Compliance or Klaro, and let ConsentPixel handle all consent including Drupal-native features. This provides a single unified consent experience and a single consent log. Either approach eliminates the external JavaScript gap.
{{ head }} Twig variable renders. Placing ConsentPixel before {{ head }} in your template ensures it loads first. Verify load order with DevTools Network tab: ConsentPixel's domain must appear before googletagmanager.com or google-analytics.com in the waterfall — if not, check the template position and clear Drupal's render cache.
What ConsentPixel Does for Your Drupal Site
Closes the external JS gap
Intercepts and blocks external tracking scripts — GA4, Meta Pixel, GTM tags, Hotjar, LinkedIn — before consent is established. Addresses the documented limitation of EU Cookie Compliance and Klaro that cannot block externally hosted JavaScript.
Google Consent Mode v2 — correct head order
Injects all four GCM v2 parameters as the first head script, before Drupal's GTM module or GA4 module output fires. Protects Google Ads conversion measurement for EU and UK visitors — the gap Drupal's module-injected GCM v2 implementations frequently miss.
GPC browser signal detection
Automatically detects the Global Privacy Control signal and suppresses targeted advertising scripts for California, Colorado, Virginia, and Connecticut visitors — a requirement Drupal's built-in modules do not address at all.
CIPA session-replay protection
Blocks Hotjar, Clarity, and session-replay tools before consent — critical for enterprise and media Drupal sites that use these tools for UX research and receive California traffic. Eliminates $5,000/visitor CIPA exposure.
Government and institution data compliance
Drupal powers thousands of government, university, and healthcare websites. These organisations face elevated GDPR accountability obligations and often handle special category data. ConsentPixel's consent log provides the GDPR Article 5(2) accountability documentation these organisations require.
No Drupal update dependency
ConsentPixel deploys independently of your Drupal update cycle. Module updates, security patches, and Drupal version upgrades do not affect your consent configuration or consent logs. Compliance continues without coordination with your development team.
Drupal Privacy Compliance Checklist (2026)
Frequently Asked Questions
{{ head }} Twig variable. For Drupal 7, add it to page.tpl.php before the <?php print $head; ?> output. No Drupal module installation, no Composer package, no code review cycle required. Clear Drupal's render cache after adding, and verify load order in DevTools Network tab.One script tag in your Twig template.
Every external script covered.
ConsentPixel — Privacy · Verified blocks the external JavaScript that Drupal's EU Cookie Compliance module and Klaro cannot touch — GA4, GTM tags, Meta Pixel, session-replay — while passing all four GCM v2 parameters and detecting GPC signals. No module. No Composer. No update dependencies.