PrestaShop cookie consent needs more than the platform gives you. PrestaShop's own cookie for the cart and sign-in is strictly necessary, but its official GDPR module handles data requests, not a cookie popup that blocks trackers. To hold Google Analytics, the Meta Pixel and module scripts until visitors agree, add a consent script first inside <head> in your theme's templates/_partials/head.tpl, then check the result with a scan.
The cookies a PrestaShop store sets
Every PrestaShop installation sets cookies as soon as a visitor lands on the homepage. The core platform uses its own cookie, named PrestaShop- followed by a hash in PrestaShop's cookie class, to keep the cart, the customer's sign-in and the language or currency choice. Some installations also set PHPSESSID. These are strictly necessary for the store to operate.
The trouble starts with everything else. A typical PrestaShop store running Google Analytics sets _ga and _ga_<container-id>. Add the Meta Pixel and you get _fbp and fr. Payment providers such as PayPal and Stripe may add their own cookies during checkout, and modules for live chat, retargeting and A/B testing pile on more.
None of these non-essential cookies may be placed before the visitor gives informed, specific consent. That is the core rule under Article 5(3) of the ePrivacy Directive, with the GDPR's conditions for valid consent on top.
GDPR and ePrivacy rules for online stores
Two laws matter most for PrestaShop merchants selling to visitors in the European Economic Area. The ePrivacy Directive, often called the cookie law, requires prior consent before storing or reading information on a visitor's device, with narrow exceptions for cookies strictly necessary for the service the visitor asked for. The GDPR governs how the personal data collected through those cookies is then processed.
Under Article 7 of the GDPR, consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count, and neither does bundling analytics and marketing into a single switch. The CNIL fined Criteo 40 million euros in 2023, in part for processing data without proof of valid consent from the websites that carried its trackers, a reminder that the obligation runs along the whole advertising chain.
If your store has visitors from the United States, the CCPA, as amended by the CPRA, adds opt-out rights for the sale or sharing of personal information through cookies such as advertising pixels.
Where PrestaShop's GDPR module stops
PrestaShop offers an official GDPR module that handles data export and deletion requests and consent checkboxes on forms. It is not a cookie consent manager: it does not scan your store for cookies, does not block scripts before consent and does not offer visitors a choice by category.
Many merchants assume that installing it covers cookies. It does not. Without script blocking, _ga and _fbp are set on page load whatever the visitor chooses, which goes against Article 5(3) of the ePrivacy Directive.
Cookie modules from the PrestaShop Addons marketplace vary widely. Some show a cookie popup but never block anything: they inform the visitor without waiting for a decision. Others lack Google Consent Mode v2 support, so Google receives no consent signals even when visitors agree.
Common gaps in PrestaShop cookie modules
| Feature | Official GDPR module | Typical Addons module | Dedicated consent tool |
|---|---|---|---|
| Cookie scanning | No | Sometimes | Yes |
| Script blocking before consent | No | Varies | Yes |
| Choice by category | No | Sometimes | Yes |
| Google Consent Mode v2 | No | Some modules | Yes |
| Rules by region | No | Rarely | Yes |
| Consent records | No | Rarely | Yes |
Cookies in the PrestaShop checkout
The checkout is where cookie consent gets tricky for online stores. PrestaShop's checkout relies on its own cookie to keep the cart and identify the customer. That cookie is strictly necessary and needs no consent.
Payment provider cookies sit in a grey area. When a visitor chooses PayPal or a card processor, the provider may set cookies for fraud detection and session management. Fraud-prevention cookies are generally treated as strictly necessary, but advertising or analytics cookies from the same provider are not.
Conversion tracking is a different matter. If the order confirmation page sets _fbp or Google Ads' _gcl_au without consent, that breaks the rule even though it happens after the purchase. Consent must come before the cookie is set, not after the transaction.
How to add a cookie banner to PrestaShop
The most reliable method is a consent script in your theme's head template, so the banner loads before any other third-party script and can hold non-essential cookies until the visitor chooses.
PrestaShop 1.7 and 8 front-office themes are built from Smarty templates, according to the PrestaShop theme documentation. In the Classic theme, the contents of <head> live in templates/_partials/head.tpl. Edit that file in your theme (ideally a child theme, so updates do not overwrite it) and paste the script as the first element inside <head>, before Google Tag Manager, analytics and marketing pixels:
<script src="https://cdn.kukie.io/s/YOUR-SITE-KEY/c.js" async></script>A module that adds code to the displayHeader hook is an alternative if you prefer not to touch templates. The back office's Theme and Logo pages position modules and do not accept code. The PrestaShop installation guide in the Kukie.io Help Centre covers the steps.
Script blocking and tag management
A consent tool should hold third-party scripts until the visitor grants consent for their category. Kukie.io's banner holds more than 30 known trackers, such as the Meta Pixel and TikTok, and lets you add the domains of others. If your store uses Google Tag Manager, the consent tool must also send consent signals that Tag Manager reads before it fires tags.
Without that, Tag Manager loads every tag at once and the banner is decoration. With Kukie.io's Consent Mode integration switched on, GA4 and Google Ads receive the visitor's consent state.
Server-side tagging does not change this. Moving tags to a server container still starts with a request from the visitor's browser, and the cookies and identifiers involved still need consent, as the guide to server-side tagging explains.
Running a cookie audit on your PrestaShop store
Before configuring a banner, scan your store to see exactly which cookies it sets. Many merchants find cookies from modules installed months ago, abandoned integrations or CDN providers.
A cookie scanner loads your store's pages, including the homepage, categories, products, cart and checkout, and lists every cookie with its name, domain, duration and likely category. That list is the basis for your cookie policy and your banner's categories.
Scan again after module updates and new integrations. A cookie that appears after an update can open a gap you never notice.
Geo-detection and regional consent rules
Not every visitor to your PrestaShop store faces the same rules. EU and UK visitors need prior opt-in consent under the GDPR and PECR. California visitors need a visible opt-out under the CCPA, and a growing list of US states now gives residents similar opt-out rights. Visitors from Brazil fall under the LGPD.
A consent tool with geo-detection applies the region rules you set: an opt-in banner with categories for EU visitors, an opt-out notice where state laws give opt-out rights, and the version you choose elsewhere. That avoids consent fatigue in places with lighter rules while keeping the strict rules where they apply.
PrestaShop cookie consent questions
Does PrestaShop's built-in GDPR module handle cookie consent?
No. The official GDPR module handles data subject requests such as access and deletion and adds consent checkboxes to forms. It does not scan for cookies, block scripts or show a banner with choices by category.
Which PrestaShop cookies are strictly necessary and exempt from consent?
PrestaShop's own cookie, PrestaShop- followed by a hash, which keeps the cart, sign-in and language or currency, is strictly necessary, as is a PHPSESSID session cookie where one is set. Analytics, marketing and advertising cookies need consent.
Do I need cookie consent for payment gateway cookies at checkout?
Fraud-prevention cookies set by payment providers are generally strictly necessary. Analytics or advertising cookies set by the same provider during checkout still need prior consent.
How do I add a cookie banner to PrestaShop 8?
Add the consent script as the first element inside the head, in your theme's templates/_partials/head.tpl, or use a module that adds it through the displayHeader hook. It must load before any analytics or marketing tags.
Can I use Google Consent Mode v2 with PrestaShop?
Yes, if your consent tool supports it. The tool sends default and updated consent signals to gtag or the Tag Manager dataLayer, so GA4 and Google Ads follow the visitor's choices.
Scan your PrestaShop store for module cookies
Modules and payment providers decide most of the cookies on a PrestaShop store. The Cookie scanner loads your storefront like a visitor and lists every cookie it finds by name and category, so you can see what runs before a choice.
