An OpenCart store needs cookie consent for its analytics and marketing tags, not for its own session cookie. OpenCart's session cookie is OCSESSID, which keeps the cart and is strictly necessary. OpenCart 4's built-in cookie notice asks visitors to agree or disagree but blocks nothing, so a store that runs Google Analytics, a Meta Pixel or similar tags needs a consent tool that holds them until the visitor opts in.
The cookies OpenCart sets by default
Every OpenCart installation sets a few cookies as soon as a visitor lands on your store. Some are strictly necessary for the site to function. Others sit in a grey area that trips up many store owners.
The core session cookie is OCSESSID. OpenCart names its session this way in its default configuration (the session_name setting), in both OpenCart 3 and 4. Without it, the shopping cart would forget its contents between page loads. OpenCart also sets a currency cookie to remember the currency the visitor chose. OpenCart 3 adds a language cookie for the language choice, and a tracking cookie when a visitor arrives through an affiliate link.
Most stores add more.
Google Analytics (_ga, _ga_<container-id>), the Meta Pixel (_fbp) and remarketing tags all add marketing cookies and analytics cookies that follow visitor behaviour. Payment provider redirects, live chat widgets and embedded product videos can each set their own cookies too. The exact number depends on your extensions, which is why a scan of your own store is the reliable count.
Which OpenCart cookies need consent
Under Article 5(3) of the ePrivacy Directive, you need consent before placing any cookie that is not strictly necessary for the service the visitor explicitly asked for. The GDPR then governs how that consent is collected: freely given, specific, informed and unambiguous.
Not every cookie needs a consent prompt. Strictly necessary cookies can be set without permission.
| Cookie | Purpose | Category | Consent needed? |
|---|---|---|---|
OCSESSID | Session identifier for the cart and sign-in | Strictly necessary | No |
currency | Stores the selected currency | Functional | Depends on jurisdiction |
language (OpenCart 3) | Stores the selected language | Functional | Depends on jurisdiction |
policy (OpenCart 4) | Stores the answer to the built-in cookie notice | Strictly necessary | No |
_ga, _ga_<container-id> | Google Analytics | Analytics | Yes |
_fbp | Meta Pixel | Marketing | Yes |
_gcl_au | Google Ads conversion linking | Marketing | Yes |
| Payment provider cookies | Fraud detection, session handover | Strictly necessary | No (during checkout) |
The currency and language cookies sit in a grey zone. A choice the visitor made actively is often treated as part of the service they asked for, but if your store auto-detects the location and sets these cookies before any choice, a consent mechanism is the safer route.
Checkout and payment cookies
Payment gateway cookies used during checkout, such as fraud-detection tokens from Stripe, PayPal or Klarna, generally count as strictly necessary when they are essential to complete the transaction the visitor started. Put them in a clearly labelled category and document their purpose in your cookie policy.
OpenCart 4 and OpenCart 3: built-in cookie handling
OpenCart 4 includes a basic cookie notice. When you choose a cookie policy page in the store settings, the storefront shows a notice that links to it, with Agree and Disagree buttons. Its source code stores the answer in a policy cookie for one year.
That is all it does. It does not hold back analytics or marketing scripts, whatever the visitor answers. It offers no category choices, so visitors cannot accept analytics while declining marketing cookies, which the GDPR's requirement for "specific" consent expects. There is no consent log, no rules by region and no link to Google Consent Mode v2.
OpenCart 3 and earlier have no built-in cookie notice. Store owners rely on extensions or an external consent tool.
What European regulators expect from online stores
Enforcement has moved fast. On 23 January 2025 the UK's ICO said it had assessed the top 200 UK websites and raised concerns with 134 of them. By 4 December 2025 it reported that 979 of the top 1,000 met its checks, and it had issued 17 preliminary enforcement notices. In France, the CNIL sanctioned 21 organisations over trackers in 2025, including a 150 million euro fine against SHEIN for placing advertising cookies before visitors made a choice.
The rules themselves have not moved. The European Commission announced in February 2025 that it would withdraw the proposed ePrivacy Regulation, and the withdrawal was published in the Official Journal on 6 October 2025, so the 2002 ePrivacy Directive and the national laws based on it remain the framework for cookies.
Regulators look for several specific things on online stores.
Prior consent comes first: analytics and marketing scripts must not run until the visitor actively opts in. Pre-ticked boxes, scrolling or continued browsing do not count as consent. The banner must offer a real reject option that is as easy to reach as "Accept all", and dark patterns such as hiding the reject button behind extra clicks draw enforcement action. Consent records must be kept and retrievable, because under Article 7(1) of the GDPR you must be able to show that consent was given.
Three ways to add cookie consent to OpenCart
You have three main approaches.
OpenCart Marketplace extensions
The OpenCart Marketplace lists several cookie consent extensions. They install through the Extension Installer and add a banner to your store's front end.
Quality varies. Check whether an extension blocks scripts before consent (not just after), supports separate categories, logs consent records and still receives updates for your OpenCart version.
An external consent tool through a script tag
An external consent tool works by adding one script tag to your theme's header template. The script shows the banner, stores the choice and controls when other scripts run. Consent logic stays separate from your store code, so updates to the consent tool do not mean editing OpenCart files.
Kukie.io works this way: one line of embed code in the OpenCart header covers cookie scanning, banner display, geo-detection and script blocking. The line is <script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script>, and the OpenCart installation guide shows where to paste it.
Manual implementation
Building your own consent mechanism is technically possible but rarely practical. You would need script blocking, consent storage, categories, rules that vary by region and consent logging, all kept current as the rules change. For most store owners, the maintenance outweighs the savings.
How to install a cookie banner on OpenCart
The steps differ slightly by OpenCart version, but follow the same pattern.
For OpenCart 3.x, open catalog/view/theme/YOUR_THEME/template/common/header.twig (or .tpl in older versions). Paste the consent script tag high in the <head>, before any analytics or marketing script. In OpenCart 4.x the default theme keeps it in catalog/view/template/common/header.twig.
After adding the script, run a cookie scan to find every cookie your store sets. Assign each cookie to the right category: strictly necessary, functional, analytics or marketing. Write your banner text, then set up region rules so visitors from the EU see an opt-in banner and visitors elsewhere see the version their rules call for.
Test the installation in a private browser window: decline all cookies, then check the browser's developer tools to confirm that analytics and marketing cookies are absent while OCSESSID remains.
Handling Google Analytics and marketing tags on OpenCart
Most OpenCart stores use Google Analytics 4 and at least one advertising pixel. These scripts must not run before consent.
If you use Google Tag Manager, set it to respect consent signals. Google Consent Mode v2 lets GA4 and Google Ads tags work in a limited, cookieless way while consent is missing, then switch to full measurement once the visitor opts in. That keeps some conversion modelling data without setting cookies before consent.
For the Meta Pixel and other tags loaded outside Tag Manager, use your consent tool's script blocking to stop them running until the visitor grants marketing consent. With Kukie.io you can also tag a script in the header template with type="text/plain" and data-cc-category="marketing", and the banner runs it once marketing is accepted.
Common consent mistakes on OpenCart stores
Several patterns appear again and again on OpenCart sites.
Setting analytics cookies on page load, before any banner appears, is the most frequent problem. It usually happens when the GA4 code is hardcoded into the header template with no consent gate. Relying on OpenCart 4's built-in notice without any script blocking is another: the notice records an answer but does not stop cookies from being set.
Ignoring e-commerce-specific cookie obligations is also common. Abandoned cart recovery tools, live chat plugins and personalisation features all need consent if they track behaviour beyond the current session. Each extension you install can add new cookies that need to be scanned, categorised and controlled.
OpenCart cookie consent questions
What is the OCSESSID cookie in OpenCart?
OCSESSID is OpenCart's session cookie, named by the session_name setting in its default configuration. It keeps the visitor's session, including the cart, and is strictly necessary, so it does not need consent.
Is the OpenCart 4 built-in cookie notice enough for EU visitors?
Not on its own. It shows Agree and Disagree buttons and stores the answer in a policy cookie, but it does not block scripts, offer category choices or log consent. A store with analytics or marketing tags needs a consent tool that holds them until the visitor opts in.
How do I block Google Analytics on OpenCart until consent is given?
Use a consent tool that blocks scripts, or send Google Consent Mode v2 signals through Google Tag Manager. Both keep analytics cookies from being set until the visitor gives consent.
Do payment gateway cookies on OpenCart need consent?
Payment cookies used during an active checkout, such as fraud-detection tokens from Stripe or PayPal, are generally strictly necessary. Document them in your cookie policy, but they do not usually need prior consent.
Can I use a free OpenCart extension for cookie consent?
Free extensions exist, but many do not block scripts, log consent or apply rules by region. If your store serves EU visitors, check that the extension stops cookies from loading before consent and offers a real reject option.
See every cookie your OpenCart store sets
A default OpenCart install sets only a handful of cookies. Extensions, pixels and payment providers add the rest. The Cookie scanner loads your store like a visitor and lists every cookie it finds by name and category, from OCSESSID to the tags that should wait for consent.
