Cookies & Consent (CMP)

A CMP (Consent Management Platform) is a cookie consent banner plus the machinery that actually blocks third-party scripts until the visitor clicks “Accept”. A bar at the bottom of the screen is not enough for the GDPR: before consent, analytics and advertising pixels must not run at all.

Our CMP works both on our storefront and on your own website — with the same code.

Where to configure it:

Marketing → “My Website” → the “Cookies & Consent” card (for an external site);
or Website → “Configure site” → the “Cookies & Consent (CMP)” section (for our storefront).

Turning it on

Paste the install code from My Website — the cookie banner loads first among the widgets so that the other scripts see the decision already applied.
Switch the widget on.
Run the scanner so it collects the cookies your site actually sets.
Publish a “Cookie Policy” page or point to your existing one.

The banner detects the page language and shows itself in it — translations for 45 languages are built in.

Categories and what is blocked before consent

Four standard categories:

Category	What goes in it	Default
Necessary	Cart, session, security	Always on, cannot be disabled
Preferences	Language, currency, previously chosen location	Visitor's choice
Statistics	Google Analytics, Yandex Metrica, Matomo, Clarity	Visitor's choice
Marketing	Facebook Pixel, VK, TikTok, ad pixels and remarketing	Visitor's choice

Until consent is given, scripts and iframes in these categories do not load: their addresses are matched against a built-in tracker registry, and you can add your own patterns. A blocked iframe (a YouTube video, for example) shows a placeholder with an “allow” link.

Consent signals are also passed to ad platforms: Google Consent Mode v2 (cookieless mode before consent), Microsoft UET, Meta (fbq) and the Clarity Consent API. Browser signals GPC and Do Not Track are respected.

Consent lifetime is configurable (365 days by default), after which the banner asks again. A refusal is remembered — we will not re-ask on every visit. You can also share consent across subdomains and link to a list of the sites it covers.

Per-country modes

One site, different legal requirements. Modes are assigned per country (by IP), plus a default:

opt-in — everything is denied until explicit consent (EU, UK, Türkiye, Russia);
opt-out — allowed until explicit refusal, with a “Do Not Sell or Share” option (US);
informational — the banner informs but does not block;
hidden — no banner at all; the preferences screen opens from a trigger link on your site (the model familiar from Shopify's native banner).

Appearance and texts

Layout: bar, card or modal; six position options along an edge or corner.
Preference centre: expanded inside the card, or a sliding side panel.
Per-element palette for light and dark themes, your logo, custom CSS (up to 10 KB).
Button toggles: close “×”, “Reject all”, “Customise”. “Accept” cannot be hidden, and in opt-in mode the dashboard warns you about the risk of removing “Reject”.
Categories can be shown as checkboxes on the banner's first layer.
Any banner text can be overridden per language on top of our translations.
The preview switches between desktop, tablet and mobile widths.
A floating “Cookie settings” button (left/right/off) and a list of pages where the banner is not shown are configured separately.

Cookie scanner and Cookie Manager

The scanner opens your site in a browser and collects the real cookies and third-party services:

crawling via sitemap.xml and links from the starting pages, with a page limit;
schedule: monthly or weekly, with the next scan date shown in the dashboard;
scan history with a “new / disappeared cookies” diff;
scanning behind a login — for account pages;
an AI classifier: unknown cookies get a suggested category with an explanation, and you confirm or change it.

Cookie Manager is the table of all cookies by category: name, provider, retention, purpose. You can add your own entries and edit descriptions and translations. The same table feeds the banner's declaration and the policy page.

The “Cookie Policy” page

The banner link points either to your existing page or to a document we generate and host: it is assembled from scan results, published in 45 languages and updated together with the declaration — so the cookie table on it is always current.

If you need the other legal pages too (privacy policy, terms, returns, delivery), see Legal documents.

Consent log and reports

The log is your proof of consent in case of an inspection:

date, anonymous identifier, chosen categories, policy version, country and language;
CSV export and export of a single record;
trends: accepted / rejected / partial per day and per country;
banner impression counter.

The “Re-collect consent” button bumps the policy version — after material changes the banner asks everyone again.

Install check and debugging

Check installation — we read the source HTML of your page and tell you whether the code is there.
Send the code to a developer — an email with a ready snippet and instructions.
Google Tag Manager guide — how to deploy the banner as a GTM tag.
Debug mode: open your site with ?cenaly_consent_debug=1 and Consent Mode events (default/update) are logged to the console, so you can see exactly what Google and others receive.
Consent Mode diagnostics — a check that the signals really reach your site's dataLayer.

FAQ

Is the banner mandatory? If you have visitors from the EU/UK and use analytics or ad pixels — yes. In the US the logic differs (opt-out and “Do Not Sell”), and elsewhere the banner is usually informational. The mode is set per country.

Will the CMP block my own analytics? Before consent — yes, that is its job. Platform analytics keeps counting visits in the cookieless mode of Consent Mode v2.

What happens to old consents after I edit the policy? Nothing, until you press “Re-collect consent” or republish the policy — then the version is bumped and the banner asks again.

Does this work if my site is not on your platform? Yes, that is the main scenario. One tag on any site.

🍪 Cookies & Consent (CMP)