How to add a cookie consent banner to Magento and Adobe Commerce

Where to paste the snippet in Magento

Magento (Magento Open Source and Adobe Commerce share the same admin) has a field for scripts in the head of every page:

1. Go to Content, then Design, then Configuration.
2. Click Edit on the store view you want. Editing the Global row covers every store view that does not override it.
3. Under Other Settings, expand HTML Head and paste the snippet at the top of Scripts and Style Sheets:

html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>

1. Click Save Configuration, then refresh the invalidated caches under System, then Cache Management.

Adobe documents that this field prints before the closing head tag. That is early enough on a standard theme, because Magento's own storefront scripts, including its Google Analytics module, load later through RequireJS. If you build your own theme, you can add the tag in a layout file instead; the admin field is the quickest route and survives theme changes.

How to replace Cookie Restriction Mode

Magento's built-in cookie notice is Cookie Restriction Mode: a bar with an Allow Cookies button that hides once accepted, with no reject button and no categories. Turn it off so visitors see one banner: Stores, then Settings, then Configuration, then General, then Web, expand Default Cookie Settings, set Cookie Restriction Mode to No, save and refresh the caches.

The Google Analytics module checks that mode. With it off, the module loads gtag.js by creating a script with JavaScript, which is exactly what Cookiequiet's auto-blocker holds: with data-auto-block="1" the tag waits for analytics consent, and with data-consent-mode="1" Google's consent defaults are set to denied before it runs. Purchases tracked by the module are then measured after the visitor accepts. Tags you paste yourself, in the same HTML Head field or a CMS block, get type="text/plain" and a data-cq-category, as described in the guide to blocking scripts until consent.

Adobe Commerce with Product Recommendations or Live Search. Their event collector honors Cookie Restriction Mode, and Adobe documents a do-not-track cookie, mg_dnt, for other consent tools. Add this after the snippet to set it until analytics is granted:

html
<script>
  if (document.cookie.indexOf('cq_consent=') < 0) document.cookie = 'mg_dnt=true; path=/';
  window.addEventListener('cq:consent', function (e) {
    var ok = e.detail.categories.indexOf('analytics') >= 0;
    document.cookie = ok ? 'mg_dnt=; path=/; max-age=0' : 'mg_dnt=true; path=/';
  });
</script>

Which cookies does Magento set itself?

Adobe's cookie list marks PHPSESSID (the shopper's session) and form_key (protection against cross-site request forgery) as needed for the store to work, and mage-cache-storage as local storage for visitor-specific content. These need no consent. Adobe Commerce adds add_to_cart and remove_from_cart for Google Analytics, which follow the analytics choice. Extensions add the rest; the free cookie scanner lists what your store actually sets.

Why does the banner not show on checkout?

Since version 2.4.7, Magento enforces its Content Security Policy in restrict mode on payment pages (checkout in the storefront), and only allowed scripts run there. Adobe's page setup documentation says scripts in the HTML Head field must be allowed in the CSP to run on checkout. Add cookiequiet.com to script-src and connect-src in the csp_whitelist.xml of a small custom module, deploy, and check the browser console on the checkout page for CSP errors.

How to add the Cookie preferences link

Add an anchor with href="#cq-preferences" to the footer: in Luma, the simplest place is a CMS block shown in the footer (Content, then Blocks), or the Miscellaneous HTML field of the Footer section in the same design configuration. Cookiequiet opens the preferences centre from any link with that address.

How to test

1. Open the store in a private window and click Reject all.
2. Check the cookies: cq_consent, PHPSESSID, form_key, and no _ga or _fbp.
3. Add a product to the cart and reach the payment step: the banner script loads without CSP errors in the console.
4. Clear the cookies, click Accept all, reload: Google Analytics loads. Check the consent log in the dashboard.

Cookiequiet is free for one store with geo-targeting included, and Starter is €3 per website per month with no pageview limit, see pricing.