# How to add a cookie consent banner to Magento and Adobe Commerce

> In Magento Open Source and Adobe Commerce, paste the snippet in Content, then Design, then Configuration, under HTML Head, then Scripts and Style Sheets, and flush the cache. Turn off Magento's Cookie Restriction Mode so visitors see one banner, allow cookiequiet.com in the Content Security Policy for checkout, and the built-in Google Analytics module then waits for consent.

Source: https://cookiequiet.com/platforms/magento
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **Copy your snippet** In the Cookiequiet dashboard, open your website and copy the install snippet: one script tag with your site key, data-consent-mode and data-auto-block set to 1, and defer.
2. **Open the design configuration** In the Admin, go to Content, then Design, then Configuration, and click Edit on the row of your store view (or the Global row to cover every store view).
3. **Paste the snippet in HTML Head** Under Other Settings, expand HTML Head, paste the snippet at the top of the Scripts and Style Sheets field and click Save Configuration.
4. **Turn off Cookie Restriction Mode** Go to Stores, then Settings, then Configuration, then General, then Web. Under Default Cookie Settings, set Cookie Restriction Mode to No and save, so Magento's own notice no longer shows.
5. **Allow the script on checkout** Since 2.4.7, payment pages enforce the Content Security Policy. Add cookiequiet.com as an allowed host for script-src and connect-src in a module's csp_whitelist.xml, or the banner will not run on checkout.
6. **Flush the cache** Go to System, then Cache Management, and refresh the invalidated caches, then purge Varnish or your CDN if one sits in front of the store.
7. **Add the link and test** Add a link to #cq-preferences in the footer. In a private window, click Reject all and check that no _ga or _fbp cookie is set, then go through the cart and checkout.

## Where to paste the snippet in Magento

Magento (Magento Open Source and Adobe Commerce share the same admin) has a field for scripts in the head of every page:

1. Go to **Content**, then **Design**, then **Configuration**.
2. Click **Edit** on the store view you want. Editing the **Global** row covers every store view that does not override it.
3. Under **Other Settings**, expand **HTML Head** and paste the snippet at the top of **Scripts and Style Sheets**:

```html
<script src="https://cookiequiet.com/cq.js" data-site="YOUR_SITE_KEY" data-consent-mode="1" data-auto-block="1" defer></script>
```

4. Click **Save Configuration**, then refresh the invalidated caches under **System**, then **Cache Management**.

Adobe documents that this field prints before the closing head tag. That is early enough on a standard theme, because Magento's own storefront scripts, including its Google Analytics module, load later through RequireJS. If you build your own theme, you can add the tag in a layout file instead; the admin field is the quickest route and survives theme changes.

## How to replace Cookie Restriction Mode

Magento's built-in cookie notice is **Cookie Restriction Mode**: a bar with an **Allow Cookies** button that hides once accepted, with no reject button and no categories. Turn it off so visitors see one banner: **Stores**, then **Settings**, then **Configuration**, then **General**, then **Web**, expand **Default Cookie Settings**, set **Cookie Restriction Mode** to **No**, save and refresh the caches.

The Google Analytics module checks that mode. With it off, the module loads gtag.js by creating a script with JavaScript, which is exactly what Cookiequiet's auto-blocker holds: with `data-auto-block="1"` the tag waits for analytics consent, and with `data-consent-mode="1"` Google's consent defaults are set to denied before it runs. Purchases tracked by the module are then measured after the visitor accepts. Tags you paste yourself, in the same HTML Head field or a CMS block, get `type="text/plain"` and a `data-cq-category`, as described in the [guide to blocking scripts until consent](/guides/block-scripts-until-consent).

**Adobe Commerce with Product Recommendations or Live Search.** Their event collector honors Cookie Restriction Mode, and Adobe documents a do-not-track cookie, `mg_dnt`, for other consent tools. Add this after the snippet to set it until analytics is granted:

```html
<script>
  if (document.cookie.indexOf('cq_consent=') < 0) document.cookie = 'mg_dnt=true; path=/';
  window.addEventListener('cq:consent', function (e) {
    var ok = e.detail.categories.indexOf('analytics') >= 0;
    document.cookie = ok ? 'mg_dnt=; path=/; max-age=0' : 'mg_dnt=true; path=/';
  });
</script>
```

## Which cookies does Magento set itself?

Adobe's cookie list marks `PHPSESSID` (the shopper's session) and `form_key` (protection against cross-site request forgery) as needed for the store to work, and `mage-cache-storage` as local storage for visitor-specific content. These need no consent. Adobe Commerce adds `add_to_cart` and `remove_from_cart` for Google Analytics, which follow the analytics choice. Extensions add the rest; the free [cookie scanner](/tools/cookie-scanner) lists what your store actually sets.

## Why does the banner not show on checkout?

Since version 2.4.7, Magento enforces its Content Security Policy in restrict mode on payment pages (checkout in the storefront), and only allowed scripts run there. Adobe's page setup documentation says scripts in the HTML Head field must be allowed in the CSP to run on checkout. Add `cookiequiet.com` to `script-src` and `connect-src` in the `csp_whitelist.xml` of a small custom module, deploy, and check the browser console on the checkout page for CSP errors.

## How to add the Cookie preferences link

Add an anchor with `href="#cq-preferences"` to the footer: in Luma, the simplest place is a CMS block shown in the footer (**Content**, then **Blocks**), or the **Miscellaneous HTML** field of the Footer section in the same design configuration. Cookiequiet opens the preferences centre from any link with that address.

## How to test

1. Open the store in a private window and click **Reject all**.
2. Check the cookies: `cq_consent`, `PHPSESSID`, `form_key`, and no `_ga` or `_fbp`.
3. Add a product to the cart and reach the payment step: the banner script loads without CSP errors in the console.
4. Clear the cookies, click **Accept all**, reload: Google Analytics loads. Check the consent log in the dashboard.

Cookiequiet is free for one store with geo-targeting included, and Starter is €3 per website per month with no pageview limit, see [pricing](/pricing).

## Questions

### Should I keep Magento's Cookie Restriction Mode?

No. It shows a notice with an Allow button and no Reject option. Turn it off so visitors see one banner; the Google Analytics module then waits for consent through Cookiequiet's auto-blocker and Consent Mode.

### Why does the banner disappear on the checkout page?

Since Magento 2.4.7, payment pages enforce the Content Security Policy and block scripts from hosts that are not allowed. Add cookiequiet.com to script-src and connect-src in a module's csp_whitelist.xml.

### Does this work on Adobe Commerce as well as Magento Open Source?

Yes. Both use the same admin paths for the HTML Head field and Cookie Restriction Mode. Adobe Commerce stores using Product Recommendations or Live Search should also add the mg_dnt bridge from this guide.

### Do PHPSESSID and form_key need consent?

No. Adobe lists them as needed for the store to work: one keeps the shopper's session and cart, the other protects forms. They are strictly necessary.

## Sources

- [Adobe Commerce Admin: Page setup (HTML Head, Scripts and Style Sheets)](https://experienceleague.adobe.com/en/docs/commerce-admin/content-design/design/page-setup)
- [Adobe Commerce Admin: Cookie law compliance (Cookie Restriction Mode and cookie list)](https://experienceleague.adobe.com/en/docs/commerce-admin/start/compliance/privacy/compliance-cookie-law)
- [Adobe Commerce: Content security policy overview](https://experienceleague.adobe.com/en/docs/commerce-operations/security-and-compliance/content-security-policy)
- [Adobe Commerce: Product Recommendations, handle cookie restrictions (mg_dnt)](https://experienceleague.adobe.com/en/docs/commerce/product-recommendations/developer/setting-cookie)
- [Magento source: GoogleGtag module storefront script](https://github.com/magento/magento2/blob/2.4-develop/app/code/Magento/GoogleGtag/view/frontend/web/js/google-analytics.js)