How to restrict Magento 2 Cookie Notice - EU Cookie Law - DSGVO

Cookie Restriction is a Professional-edition feature of Mageplaza GDPR extension. It gives you two ways to ask for cookie consent: a classic banner with a single accept button, or — since v4.3.0 — a preferences popup where shoppers accept or reject each cookie category on its own. Every decision the popup collects is written to a log you can review in the admin. This guide shows how to do both.

GDPR for Magento 2

Increase trust, cybersecurity & data protection with GDPR compliance

(35 reviews)

Check it out!

Advantages of Magento 2 Cookie Restriction (EU Cookie Compliance)

Under the EU Cookie Law and the GDPR, a store may not set non-essential cookies before a visitor agrees to them. Cookie Restriction gives you three things that matter for that:

• A record of consent, not just a notice: Showing a banner is not the same as being able to show, later, who agreed to what.
• A choice that is genuinely free: Rejecting a cookie category has to be as easy as accepting it — one click, same screen.
• Transparency about what you actually set: Visitors can see the cookies in each category before deciding.

Enable Cookie Restriction Mode in Magento 2

Go to Stores > Settings > Configuration > Mageplaza Extensions > GDPR and expand the Cookie Restriction section

• Set Enable Cookie Restriction Mode to Yes. Nothing appears on the storefront until you do.
• Visitors must accept cookie policy decides how strict the restriction is. Set it to Yes and a visitor has to accept the policy before they can sign in or add a product to their wishlist. Leave it at No and the notice is informational only.
• Save the configuration, then flush the Magento cache. The notice will not appear until you do, and this is the most common reason a correctly configured banner seems to do nothing.

• About Magento’s own cookie settings: Magento ships its own Cookie Restriction Mode at Stores > Settings > Configuration > General > Web > Default Cookie Settings, alongside Cookie Lifetime, Cookie Path, Cookie Domain and Use HTTP Only.

Magento 2 classic Cookie Notice display on frontend

Look at the picture above to see the notification if customers haven’t accepted cookies. Customers will be acquired to confirm their permission to use cookie before signing in if admins have already set Visitors must accept cookie policy at the backend.

The classic mode shows a single notice with one accept button — the behaviour most stores started with, and still the right choice in markets that only require notice and a single agreement.

• Cookie Text Message holds the wording visitors see; it accepts HTML, so you can keep it to one sentence and link out for the rest.
• Button Label sets the text on the accept button, Allow Cookies by default.
• CMS Cookie Policy Page picks the page behind the Learn more link, so visitors who want the full policy can reach it without leaving the notice. You can place the notice at the top or the bottom of the page, choose which pages it appears on, and restrict it to the countries where you actually need it.
• Custom CSS is there when the default styling does not match your theme.

One thing to watch. The Learn more link points at the CMS page you selected. If you later change that page’s URL key without adding a URL rewrite, the link returns a 404 — and it keeps doing so silently, because nothing in the admin flags it. Re-check the link after any change to your policy page.

Let shoppers choose per category (Consent Mode)

A single accept button is no longer enough in much of the EU: a visitor should be able to turn analytics on and leave advertising off, then change their mind later. Since Mageplaza GDPR v4.3.0 the extension can do that.

• Set Consent Mode to Granular (choose by cookie category) in the same Cookie Restriction group. The single banner is replaced by a preferences popup, and the rest of the classic settings — wording, policy page, position, countries — carry over unchanged.

• Define your categories. Each category gets its own toggle in the popup, so a shopper accepts or rejects them one at a time. Essential cookies stay on; everything else is a real choice. Rejecting takes exactly one click, the same as accepting.

• List the cookies in each category. Every category carries a cookie inventory — the cookies it covers, what each one is for, and how long each one lasts. A shopper expands a category and sees the actual contents before deciding, instead of taking a policy page on trust. It also means you maintain that list in one place, rather than in a table on a CMS page nobody remembers to update.

Shoppers can reopen the popup at any time. The newer decision replaces the older one, and both stay in the log.

This is what granular cookie consent means in practice, and it is the part regulators look at when they ask whether consent was freely given.

Review the Cookie Consent Log

Collecting consent is half the obligation. The other half is being able to show, months later, what was collected and under which version of your policy.

Open Mageplaza > GDPR > Cookie Consent Log to reach the Cookie Consent Log. Every accept, every reject and every change of mind lands there as its own row.

Three columns carry most of the weight:

• Policy Version — the version of your cookie policy in force when that decision was made. Update your policy and older rows keep the version they were collected under, so you can show what a visitor was actually shown rather than what the policy says today.
• Categories (granted) — which categories that visitor allowed. A rejected category is simply absent from the list.
• IP Hash (SHA-256) — the visitor’s IP address stored as a hash, never in the clear. Enough to match a row against a specific claim, without turning your consent log into another store of personal data you now have to protect.

The remaining columns — ID, Store View, Source, User Agent and Created At — tell you where and how the decision was made. The grid behaves like any other admin grid: filter it, sort it, export what you need.

A cron job runs daily and removes rows once they pass the retention period you set, so the log stays queryable instead of growing without limit.

However, there is no customer or email column. The log is deliberately pseudonymous: it answers “show that consent was collected properly”, not “what did this named customer agree to”. Holding less personal data is the safer position under GDPR, not an oversight.

FAQ

Do I need Magento’s native Cookie Restriction Mode turned on as well?

You don’t need to, as our extension provides the advanced consent interface and the log on top.

Can shoppers change their cookie choices after they have accepted?

Yes. The preferences popup can be reopened at any time and the newer decision replaces the older one. Both remain in the Cookie Consent Log, so the change itself is preserved.

Can I look up what a specific customer consented to?

No, and that is deliberate. The log holds no customer name or email — only the categories granted, the policy version, a hashed IP and the user agent. It is built to demonstrate that consent was collected correctly, not to profile individual shoppers.

Does this send consent signals to Google Analytics or Google Ads?

No. Mageplaza GDPR collects and stores the consent decision. Passing that signal on to GA4 and Google Ads through Google Consent Mode v2 is handled by Google Tag Manager for Magento 2, which acts on the decision this extension records.

Conclusion

Cookie Restriction gives you two ways to meet the EU Cookie Law, and which one you need depends on where you sell. A single banner is enough in markets where notice and one agreement satisfy the regulator. Set up the classic banner first and confirm it appears and holds back what it should. Switch Consent Mode on once you have mapped your categories and written the inventory for each — the banner settings carry over, so nothing is wasted.

However, cookies are only one slice of the regulation. Account deletion, data access requests and anonymization sit alongside them, and the full GDPR checklist walks through all ten steps.