How to add a cookie consent banner to a Joomla site

Where to paste the snippet in Joomla

Joomla has no global field for head code, so the snippet goes in the template. Cassiopeia, the default site template of Joomla 4, 5 and 6, prints the head of every page from index.php:

html
<head>
  <script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
  <jdoc:include type="metas" />
  <jdoc:include type="styles" />
  <jdoc:include type="scripts" />
</head>

Putting the snippet above the jdoc:include tags means it loads before every script that Joomla and your extensions register through the web asset manager.

Do not edit Cassiopeia's own index.php: a Joomla update replaces core template files. Use a child template instead:

1. Go to System, then Site Templates, open Cassiopeia Details and Files and click Create Child Template. Give it a name and leave the additional styles empty.
2. Still in the parent, open index.php and copy its whole content.
3. Open the child template, click New File, create index.php in the root folder and paste the copy. Joomla documents that a child uses its parent's files except those with the same name in the child.
4. Add the snippet on the line after <head> and save.
5. Go to System, then Site Template Styles, and click the star next to the child's style to make it the default.
6. Clear the cache under System, then Clear Cache, and purge any page cache or CDN in front of the site.

Joomla 6 also ships a ready-made child, Cassiopeia Extended, which has its own index.php; add the snippet there if you use it. Commercial template frameworks often have a field for code in the head in their template options; it works if it prints the snippet before the other tags, which you can check in the page source.

Which cookies does Joomla set itself?

Joomla sets a session cookie with a hashed name for every visitor, guests included. It carries the session (login, form tokens, cart in shop extensions) and is strictly necessary, so it needs no consent. Joomla's privacy tools (the Privacy component and the Privacy Consent plugin) handle data requests and consent checkboxes on forms, not cookies: there is no cookie banner in core to turn off. Extensions add the rest, which is why the free cookie scanner is the quickest way to list what your site actually sets.

How to handle the tags your extensions add

• Tags you paste in the template. Place them below the snippet and mark them. For the Google tag, both script tags change:

html
<script type="text/plain" data-cq-category="analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script type="text/plain" data-cq-category="analytics">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXX');
</script>

The Meta Pixel gets data-cq-category="marketing". The guide to blocking scripts until consent covers the other common tags.

• Analytics extensions. An extension that prints its own Google tag cannot be marked from outside. Either replace it with the marked tag above, or load Google through Google Tag Manager with Consent Mode.
• Widgets injected with JavaScript. With data-auto-block="1", Cookiequiet holds the scripts and iframes of about 80 known trackers (Hotjar, Clarity, chat widgets, pixels) until their category is granted.
• Videos in articles. The editor stores YouTube embeds as plain iframes that load at once. Replace src with data-cq-src in the article's code view; the player loads after consent. Some editor configurations strip unknown attributes, so check the saved HTML.

Disable or uninstall any other cookie consent extension after the switch, so there is one banner and one consent log.

How to add the Cookie preferences link

Go to Menus, open the menu shown in your footer, click New, choose the menu item type System Links, then URL, enter #cq-preferences as the link and "Cookie preferences" as the title, and save. Cookiequiet opens the preferences centre from any link with that address. In a Custom module, an anchor with the same href does the same job.

How to test

1. Open the site in a private window. The banner shows with Accept all and Reject all of the same size.
2. Click Reject all and check the cookies in the developer tools: cq_consent, Joomla's session cookie, and nothing from Google, Meta or Hotjar.
3. Clear the cookies, reload, click Accept all: the marked tags run and their cookies appear.
4. Check the consent log in the Cookiequiet dashboard.

If the banner is missing, search the page source for cq.js. Usually the child style is not the default, a menu item is assigned to another template style, or the cache was not cleared.

What is specific to Joomla

• Template styles per menu item. A menu item can be assigned to a different template style. Pages that use another template need the snippet in that template too.
• Multilingual sites. One snippet covers every language: the banner picks its language from the visitor's browser, with every string editable per language in the dashboard.
• Price. Cookiequiet is free for one website with geo-targeting included; Starter costs €3 per website per month with no pageview limit, see pricing.