GDPR Compliance Suite
Privacy rules only bite when someone asks you to prove what you did. This suite puts consent, cookies, data subject requests and the right of withdrawal inside your Magento store, and keeps a record of each one you can actually produce.
Latest version: 1.4.0 — changelog
Who it's for
- Stores selling to consumers in the EU, UK or EEA. The default model is opt-in: non-essential cookies and tags stay blocked until the shopper agrees.
- Stores selling into US opt-out states such as California. Switch a store view to the US opt-out model and it honors Global Privacy Control, shows a "Do Not Sell or Share" link, and records each opt-out.
- Merchants running several store views, languages or brands. Consent wording, visibility and evidence are kept per store view and per website, so each market asks its own questions and keeps its own records.
- Anyone selling goods or services online to EU consumers. The withdrawal function the EU has required since 19 June 2026 is built in, for Luma, Hyvä and GraphQL storefronts.
Why it matters
- Consent you can evidence, not just collect. Every acceptance and refusal is stored with the wording the shopper actually saw, a fingerprint of that wording, the linked document as it read at the time, and a shortened IP address. When a regulator or a customer asks what was agreed, you have the answer rather than a screenshot of today's banner.
- Cookies wait for permission. Non-essential cookies are refused by default, and a registered cookie in a refused category is removed in the server response as well as in the browser — so an HttpOnly cookie is caught where a browser script cannot reach it.
- Google tags obey the choice. Consent Mode is set before your Google tag or Tag Manager container loads, and the container is not even requested until the shopper allows analytics or advertising.
- Required consent holds on the server. Registration, contact, newsletter and checkout refuse a submission missing a required consent, with or without JavaScript.
See it in action
You write a consent that names its own document. Checkbox text
I agree to the {link}, link text Terms and Conditions, link URL
/terms-and-conditions.
→ Checkout shows I agree to the Terms and Conditions, linked to your terms
page, and the consent log records that exact label, the address it led to,
and a fingerprint of the page as it read when the box was ticked.
A shopper presses Deny All on a store running Google tags.
→ Google keeps analytics_storage, ad_storage, ad_user_data,
ad_personalization and functionality_storage at denied, with only
security_storage granted, and the tag is never requested. Allowing just
the Functionality category later grants functionality_storage and nothing
else.
You leave the banner text empty on a German store view.
→ The banner speaks the store view's language with no typing: /de/ shows
Ablehnen and Alle erlauben, /fr/ shows Refuser and
Tout autoriser, and /default/ shows Deny and Allow All.
A CMS page embeds a YouTube video. → The shopper sees a placeholder naming YouTube until they allow it, and no request reaches YouTube first. One click loads it once; another allows it for good, and the load is logged.
What you get
| Feature | Benefit |
|---|---|
| Cookie banner and Google Consent Mode | A banner shoppers can refuse as easily as accept, worded per store view, that runs EU stores opt-in and US stores opt-out, and drives Google Tag, Tag Manager or Yireo GTM through Consent Mode v2. |
| Cookie register | Keep the cookie list your banner shows accurate, and find the cookies your store sets that are missing from it. |
| Embedded content blocking | Maps, video and social embeds stay dark until their category is allowed, and a shopper can allow one in place. |
| Consents and evidence | Ask for consent on every form, word it per store view, prove each answer later, and hold back consent from minors with an age gate. |
| Privacy policy | Versioned policies per store view, accepted on the server, with re-acceptance when the version changes. |
| Privacy Center | One page in the customer account for cookie choices, consents, data downloads and requests. |
| Data subject requests | Access, export, rectification, erasure, restriction and objection handled as a workflow, not an inbox — with legal hold. |
| Right of withdrawal | The EU withdrawal function, eligibility rules, order cancellation or refund, and the notices it has to send. |
| Compliance dashboard and records | A compliance score, a readiness audit before go-live, your Article 30 record, and the whole audit trail as CSV. |
| REST and GraphQL | Policy acceptance checks and the right of withdrawal for headless and app storefronts. |
Competing solutions
The right-hand column describes common practice among marketplace extensions, not any particular vendor.
| Qoliber | Typical marketplace extension | |
|---|---|---|
| Packagist installation | Installed and updated with Composer from our private Packagist (qoliber.repo.packagist.com) | Varies by vendor |
| Slack access to the development team | A shared Slack channel with the developers who build and maintain the suite | Usually ticket-based |
| Unit tests | 911 PHPUnit unit tests (177 classes) in the repository | Not typically published |
| Integration tests | 244 Magento integration tests (72 classes), run before every release | Not typically published |
| E2E Playwright tests | 603 Playwright end-to-end tests (94 spec files) on Luma and Hyvä, run before every release | Not typically published |
| Documentation | Full docs portal: installation, configuration, usage, developer guide and API reference | Varies by vendor |
| Hyvä support | A native Hyvä companion module for every storefront surface | Varies by vendor |
| PHP / Magento range | PHP 8.1 to 8.5, magento/framework ^103.0 | Varies by vendor |
What sets it apart
- Hyvä-native. Every storefront surface has a real Hyvä implementation — Alpine and Magewire, not a Luma fallback — including the checkout consent step, and it runs under a strict Content Security Policy.
- API-first. REST endpoints for policy consent and withdrawals, and a GraphQL surface for withdrawals, so headless and app storefronts get the same behavior as Luma and Hyvä.
- No SaaS in the path. Consent, evidence, cookie decisions and requests are processed and stored inside your Magento installation. There is no third-party consent service to pay for or to trust with your shoppers' data.
- Translated. The admin and storefront ship in five languages, and the shipped banner copy is shown in each store view's own language.
Also available in: German, Polish, French and Spanish.
Good to know
- It supports compliance; it does not certify it. The suite gives you the mechanisms, the enforcement and the records. How you configure it, what your store collects and your lawful basis for it remain your responsibility — have privacy counsel review your setup.
- Withdrawal exceptions are yours to map. The statutory exceptions — custom-made goods, perishables, unsealed hygiene items, downloads and the rest — are not applied automatically. You exclude the product types, categories or attribute-flagged products that qualify.
- Cookies are matched by their exact name in 1.4.0. Each cookie in the
register needs its full name; a pattern such as
_ga_*does not match. - Product gallery videos are covered from 1.5.0. In 1.4.0, a YouTube or Vimeo video in the product gallery is not held back by embed blocking.
- Checkout consent needs the consent data to arrive. With the checkout consent step on, a third-party payment method that places orders outside Magento's own place-order path is refused until it carries the consent answers. Orders placed with an integration or admin token are unaffected.
Supported versions
PHP 8.1 through 8.5, on Magento Open Source and Mage-OS
(magento/framework ^103.0). Hyvä support requires the Hyvä theme module
1.3.11 or later, and Hyvä Checkout for the checkout consent step; Luma needs
nothing extra. Version 1.4.0 is tested end to end on Mage-OS with Luma and
Hyvä.