Joomla cookie consent from template to Consent Mode

To add a cookie banner to Joomla, paste your consent platform's script into the <head> of your template's index.php, or into a Custom HTML module in a head position, above every analytics and marketing tag. Joomla itself only sets a strictly necessary session cookie. Google Analytics, pixels and many extensions add cookies that need consent in the EU and the UK, so the banner has to hold those scripts back until the visitor chooses.

Why Joomla sites need cookie consent

Every Joomla installation sets at least one cookie the moment a visitor lands on your site. Joomla's session handler creates a browser cookie, with a random-looking name and value, linking the visitor to a server-side session record, to track user state, form tokens and authentication status. That session cookie is classified as strictly necessary and does not require consent under Article 5(3) of the ePrivacy Directive.

The problem starts when you add Google Analytics, Facebook Pixel, advertising tags, or third-party extensions that drop their own cookies. Cookies like _ga, _ga_<ID>, _fbp and _gcl_au fall into the analytics or marketing category. Under the GDPR and ePrivacy Directive, these require informed, freely given consent before they are set.

Enforcement has intensified. On 1 September 2025, the CNIL fined SHEIN EUR 150 million for cookies placed before visitors made any choice, and fined Google EUR 325 million over ads shown between Gmail emails and the consent it collected for ad cookies. Smaller operators are fined too: Condé Nast paid EUR 750,000 in November 2025 over cookies set after visitors refused. Running a smaller operation does not exempt a Joomla site from these rules.

Cookies commonly found on Joomla sites

Before configuring consent, you need to know what your site actually sets. A typical Joomla installation with a few popular extensions produces a mix of strictly necessary, analytics, and marketing cookies.

Google's list of GA4 cookies names only _ga and _ga_<container-id>, both kept for 2 years. Because the Joomla session cookie has no fixed name, look for a cookie with a long random-looking name in your browser's developer tools. Running a cookie scan on your Joomla site reveals the full picture, including cookies set by third-party scripts you may have forgotten about.

Legal requirements across jurisdictions

Your obligations depend on where your visitors are located, not where your server sits. The GDPR and ePrivacy Directive govern the EU. The UK applies its own version through UK GDPR and PECR. Brazil's LGPD takes a similar opt-in approach for personal data processing. In the United States, the CCPA and CPRA focuses on the right to opt out of sale and sharing rather than requiring prior consent.

The practical result: if your Joomla site receives traffic from multiple regions, you need a consent mechanism that adapts based on visitor location. A single "Accept All" banner does not meet the requirements of any of these frameworks.

Geo-targeted consent, showing different banner configurations to visitors based on their country, is the standard approach. Region rules and geo-detection allow you to display an opt-in banner to EU visitors while showing a simpler notice to visitors in jurisdictions without prior consent requirements.

Three ways to add cookie consent to Joomla

Joomla offers several integration points for adding a consent banner. The right method depends on your technical comfort level and whether you need script-blocking capabilities.

Option 1: a Joomla extension

The Joomla Extensions Directory lists several cookie consent plugins. Some are basic notification bars that display a message but do not actually block cookies before consent. Others provide full consent management with cookie categorisation and script blocking.

When evaluating extensions, check whether they actually prevent analytics and marketing cookies from loading until the visitor makes a choice. A banner that merely informs visitors about cookies, without blocking them, does not meet the GDPR consent standard. The EDPB has made clear that consent must be obtained before cookies are placed, not after.

Option 2: a Custom HTML module

Joomla's Custom HTML module lets you inject a script snippet into a specific template position. This approach works well with cloud-based consent platforms that provide a single JavaScript tag. You create a new Custom HTML module, paste the consent script into the editor (with the WYSIWYG editor disabled), and assign it to the position that loads in your template's <head> section or just before the closing </body> tag.

The Joomla installation guide in the Help Centre walks through this process step by step. With Kukie.io, the script to paste is <script src="https://cdn.kukie.io/s/YOUR_SITE_KEY/c.js" async></script>.

Option 3: a template override

For full control, edit your Joomla template's index.php file directly. Place the consent script tag in the <head> section, before any analytics or marketing scripts. This method guarantees the consent manager loads first and can intercept other scripts before they execute.

In Joomla 5, you can also use the Web Asset Manager to register and load the consent script as a dependency, ensuring correct load order across your entire site.

Blocking scripts until consent is given

Adding a banner is only half the job. You also need to prevent non-essential cookies from being set until the visitor actively opts in. There are two common approaches for Joomla sites.

The first is to change the type attribute on script tags from text/javascript to text/plain and add a data attribute identifying the cookie category, such as data-cc-category="analytics" with Kukie.io. The consent manager then re-enables matching scripts once the visitor grants consent for that category. This works for inline scripts and third-party tags you control directly.

The second approach uses automatic script blocking. Kukie.io's auto-blocking feature detects known tracking scripts and prevents them from executing before consent, without requiring manual changes to your template code. This is particularly useful on Joomla sites with multiple extensions that inject their own scripts.

Setting up Google Consent Mode v2 on Joomla

If your Joomla site uses Google Analytics 4 or Google Ads, Google Consent Mode v2 is relevant. Since March 2024, Google requires sites using personalised advertising in the EEA to implement Consent Mode. Without it, remarketing audiences and conversion tracking stop working for users who have not consented.

Consent Mode works by sending default consent states to Google's tags when the page loads, for four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. When a visitor grants consent through your banner, the consent state updates and Google's tags begin collecting full data. On Joomla, the order in the template is what matters:

1. In your template's index.php, or a Custom HTML module in the head position, put the consent script first in <head>. A CMP with a Consent Mode integration sets the default (denied) states from that script.

2. Place the Google tag (gtag.js) or the Google Tag Manager container after it, never above it. An extension that adds Google Analytics on its own may print its tag elsewhere, so check where it lands in the page source.

3. Turn on the Consent Mode integration in your CMP, so it sends the update when the visitor chooses.

4. Open your site with the Consent Mode checker to confirm the default comes before the first Google request and the update follows the visitor's choice.

Common mistakes on Joomla cookie banners

Several patterns regularly appear on Joomla sites that fail consent checks.

Pre-ticked consent boxes remain the most frequent violation. Some Joomla extensions default all cookie categories to "on" and require visitors to untick them. The GDPR explicitly prohibits this in Recital 32, silence or inactivity does not constitute consent.

Missing reject option is another common issue. Your banner must offer a way to refuse non-essential cookies that is equally prominent and requires the same number of clicks as accepting. A bold green "Accept All" button paired with a tiny grey "Manage Preferences" link buried in the banner text does not meet this standard.

Stale cookie declarations cause problems when extensions are added or removed without updating the consent configuration. A quarterly cookie scan catches new cookies that may have appeared since your last audit.

Cookie walls, which block access to content entirely unless the visitor accepts cookies, generally make consent invalid because it is not freely given, as the EDPB explains in its Guidelines 05/2020 on consent. National regulators judge paid alternatives ("consent or pay") case by case.

Comparing Joomla cookie consent approaches

Keeping consent accurate as your Joomla site changes

Consent is not a one-time task. Every time you install a new Joomla extension, update an existing one, or add a third-party marketing tag, your cookie footprint can change. Schedule regular scans to detect new cookies automatically.

Review your consent records periodically. Under GDPR Article 7(1), you must be able to demonstrate that each visitor gave valid consent. Your CMP should store timestamped proof of each consent decision, accessible for audit purposes.

Keep an eye on regulatory updates. The ePrivacy Regulation will not replace the Directive: the Commission withdrew the proposal in 2025, as the EUR-Lex procedure record shows, so the ePrivacy Directive and its national laws stay in force. As of October 2026, the EU is debating a Digital Omnibus proposal that would move the cookie rules into the GDPR, but it is not law.

Joomla cookie consent questions

Find out what your Joomla extensions set

If you are not sure which cookies your Joomla site sets, start with a scan. Kukie.io lists the cookies it finds, sorts them into categories, holds non-essential scripts until visitors choose and records each choice. The Free plan covers up to 5 websites.

Start free