GDPR and KVKK cookie banner with equal Accept, Reject and Customize buttons, automatic script blocking, Google Consent Mode v2 and a consent log, for a one-time price.
Available Updated Oct 13, 2026Version 1.1.1CS-Cart, Multi-Vendor 4.17.2 – 4.21.x No core file edits
Built for
Cookie Consent Manager with Consent Mode v2 (GDPR, KVKK): overview1 of 14
What it does
A cookie consent manager for CS-Cart and Multi-Vendor stores with visitors in the EU, UK or Turkey.
Shoppers choose between necessary, preferences, analytics and marketing cookies in a bar, box or popup banner that follows your theme. Known scripts and YouTube or Vimeo videos stay blocked until consent.
It replaces monthly consent services with a one-time license and runs fully inside your store.
Google is a trademark of Google LLC; Meta is a trademark of Meta Platforms, Inc. Not endorsed by them.
What it changes for your store
Consent Mode v2 signals that Google Ads needs for EEA and UK audiences.
Nothing loads before consent, verified in the browser network panel.
Reject all as visible as Accept all, as EU regulators expect.
Proof of consent with CSV export for audits.
One banner instead of two. The core GDPR notice is turned off in one click.
No monthly fee, no external script, no data sent to a consent vendor.
How it works
Admin
Pick the layout and colors, the privacy page, the services to block and the Consent Mode defaults per region. Add custom rules for other scripts. Raise the policy version to ask everyone again, and review or export the consent log.
Shopper
The banner offers Accept all, Reject all and Customize. After a choice, allowed scripts and videos start at once without a reload. A floating button or footer link reopens the preferences; withdrawing consent deletes the related cookies.
Features
Bar, box and popup layouts that inherit the theme colors and font
Accept all, Reject all and Customize with equal prominence
Preference center with four categories and a list of services
Floating cookie settings button and a footer links block
Server-side blocking of Google Analytics, Tag Manager, Google Ads, Meta Pixel, TikTok Pixel, Hotjar and Clarity
YouTube and Vimeo placeholders with Load once and Always allow
Custom blocking rules and manual tagging with data-kv-consent
Google Consent Mode v2 with all seven consent types, regional defaults, basic and advanced modes
Meta Pixel and TikTok Pixel consent signals
Consent log with anonymous ID, truncated IP, policy version, CSV export and retention period
Policy versioning that asks every visitor again
Detection of the core GDPR cookie notice to avoid double banners
Works with Ecommerce Tracking Pro and Meta Conversions API by Kavio Labs
JavaScript and PHP consent API for other add-ons
Per-storefront settings; every text is editable in the admin panel
What you get
Package
kv_cookie_consent_mode-1.1.0.zip, installed through Add-ons → Manage add-ons
Updates & support
12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License
1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
For developers
Uses 4 CS-Cart PHP hooks. No core files are changed.
Compatibility
We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.
CS-Cart version and edition compatibility
CS-Cart version
CS-Cart
CS-Cart Ultimate
Multi-Vendor
Multi-Vendor Ultimate
4.22 and later
Testing next
Testing next
Testing next
Testing next
4.21.2
Supported
Supported
Tested
Supported
4.20.x
Supported
Supported
Supported
Supported
4.19.x
Supported
Supported
Supported
Supported
4.18.x
Supported
Supported
Supported
Supported
4.17.2
Tested
Supported
Tested
Supported
Before 4.17.2
Not supported
Not supported
Not supported
Not supported
Last tested build: Multi-Vendor 4.21.2, Oct 13, 2026Tested on: Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2
Requirements
PHP
CS-Cart and Multi-Vendor 4.17.2 – 4.21.x (tested on CS-Cart 4.17.2, Multi-Vendor 4.17.2 and Multi-Vendor 4.21.2 with PHP 8.3)
PHP
PHP 7.4 – 8.3, as supported by your CS-Cart version
Requirement
Administrator access to the admin panel
Theme
A storefront theme based on Responsive (Bright theme, Responsive or a child theme such as Nova, the 4.21 default)
Core changes
None. Hooks and template overrides only
1.1.0
Oct 13, 2026
Latest
Added 3
License check. Enter your license key (or CS-Cart Marketplace license number) on the new License tab of the settings. The add-on verifies it with cs-cart.kaviolabs.com when the key is saved and then once a day, only from the admin panel or cron, never on storefront requests. The license covers the domain entered at purchase and all its subdomains; local development hosts are always allowed.
License status on the License tab (status, licensed domain, result per storefront, last check, end of the updates period) with a Check now button, and a cron entry point (php admin.php --dispatch=kv_cookie_consent_mode_license.check).
Without a valid license for the store's domain the add-on runs in a "deny-all safe mode": every non-essential script and embed stays blocked (placeholders without Load/Allow buttons), Google Consent Mode stays "denied" and no grant is sent, the banner, the preference center and the cookie settings links are not shown, earlier choices are ignored, and the consent log, the GDPR notice bridge and the Meta/TikTok consent signals are off. The store never tracks without consent. The admin panel shows a safe mode notice and a License row in the Status block. New installations and upgrades from 1.0.x work for 14 days before a key is required, and if the license server cannot be reached the add-on keeps working for 14 days.
Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.
1.0.5
Oct 12, 2026
Fixed 1
Full page cache of CS-Cart 4.21 (Performance Booster): the 1.0.4 package still wrote to CS-Cart storage data in two places, the daily consent log cleanup and the bridge to the GDPR add-on's cookie consent mode. Each write cleared the whole page cache. While the page cache is on, both now keep their values in files under var/kv_storage/.
Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.
1.0.4
Oct 12, 2026
Fixed 4
CS-Cart 4.21: the consent banner script and the blocking of third-party scripts were not added to storefront pages, because CS-Cart 4.21 (Smarty 5) ignores the old way of registering page filters. Tracking tags could load before the visitor's choice. The filter is now registered the Smarty 5 way; older versions are unchanged.
Works with the Performance Booster (full page cache) of CS-Cart 4.21: pages that the cache shares between guests are always rendered with every non-essential service blocked, and the visitor's stored choice is applied in the browser. One visitor's consent can no longer unblock scripts for others.
The daily consent log cleanup no longer writes to CS-Cart storage data while the full page cache is on, which would have cleared the whole page cache.
Compatible with CS-Cart and Multi-Vendor 4.21 and PHP 8.3: tested on Multi-Vendor 4.21.2 with PHP 8.3 and the new Nova theme. The add-on now declares the supported range 4.17.2 – 4.21.x.
Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.
1.0.3
Oct 12, 2026
Added 1
In-place upgrades now complete themselves. After the add-on files are replaced (uploading the new zip over the installed add-on in Add-ons → Manage add-ons, copying the files by FTP, or installing an Upgrade Center package), the next admin page view adds any missing tables, columns, settings, language variables and e-mail templates, and updates the stored add-on version and icon flag. Existing data and setting values are kept. A hidden schema_version setting records the last applied version.
Fixed 2
While the add-on was disabled, saving or refreshing its settings logged "Class not found" errors and left the Status and Consent log boxes on the settings page empty. CS-Cart loads the add-on functions for a disabled add-on without its classes; the add-on now registers them itself.
After an upgrade by uploading the new zip over the installed add-on, CS-Cart saved empty multiple-choice settings with an empty selected entry. The next admin page view now repairs them.
Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.
1.0.2
Oct 12, 2026
Fixed 2
Consent log: the Granted categories column showed denied categories as blue labels that looked granted; it now lists only the granted categories ("Necessary" when everything optional was refused).
The admin add-on icon is now 150×150, the size the add-ons list uses.
Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.
1.0.1
Oct 12, 2026
Removed 1
Unused language files from the package.
Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.
1.0.0
Oct 12, 2026
Added 10
Cookie banner in bar, box and popup layouts with Accept all, Reject all and Customize buttons of equal size and color; light, dark, theme-following and custom accent colors.
Preference center with necessary, preferences, analytics and marketing categories, service lists, keyboard support, a floating "Cookie settings" button, a "Cookie settings links" block and #cookie-settings links.
Server-side blocking of Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, TikTok Pixel, Hotjar and Microsoft Clarity scripts, plus YouTube and Vimeo iframes with placeholders ("Load once", "Always allow"); custom rules and manual data-kv-consent tagging.
Google Consent Mode v2: default command as the first script of the page with all seven consent types, denied defaults for the EEA, UK and Switzerland, configurable default elsewhere, wait_for_update, ads_data_redaction, url_passthrough, basic and advanced modes, updates and kv_consent_update dataLayer events.
Meta Pixel (fbq('consent')) and TikTok Pixel (grantConsent/revokeConsent) consent signals.
Consent log with anonymous consent ID, policy version, truncated IP, filters, totals, CSV export and retention period.
Policy versioning that asks every visitor again; withdrawal removes known cookies and reloads the page.
Public consent API: window.kvConsent, kv:consent-ready and kv:consent-changed DOM events, fn_kv_cookie_consent_mode_has_consent() and the kv_cookie_consent_mode_get_services PHP hook.
Detection of the GDPR add-on cookie notice with one-click turn-off, restored on uninstall.
Automatic alignment with Ecommerce Tracking Pro (kv_ga4_ecommerce).
Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. First release.
Why are Accept all, Reject all and Customize the same size and color?
European data protection authorities, coordinated by the EDPB cookie banner taskforce, treat a missing or less visible reject option on the first layer as invalid consent. Rejecting must be as easy as accepting. The add-on keeps the three buttons identical on purpose.
Basic or advanced Consent Mode?
Basic (default) blocks Google tags until the visitor agrees, so nothing is sent to Google before consent. Advanced loads Google tags with denied signals; Google then receives cookieless pings and can model conversions. Advanced gives more data in Google Ads and Analytics, but several authorities consider any request to a tracker before consent as access to the device under Article 5(3) of the ePrivacy Directive (see the EDPB Guidelines 2/2023 on the technical scope of Art. 5(3)). If you sell in the EU and are unsure, keep Basic.
Is this enough for Google Ads in the EEA?
Google requires advertisers who use Google Ads or Analytics data for EEA users to collect consent and pass it with Consent Mode v2 (ad_user_data and ad_personalization). This add-on sends all required signals. Publishers who show Google ads (AdSense, Ad Manager, AdMob) to EEA and UK users must use a Google-certified CMP that supports the IAB TCF; this add-on is not a TCF CMP.
Does it work with Google Tag Manager?
Yes. The consent default is pushed to the dataLayer before the container loads. In basic mode the container is held back until analytics consent; in advanced mode it loads at once and your tags should use GTM's built-in consent checks. The kv_consent_update event is available as a trigger.
A script is not blocked. What can I do?
Add a custom rule (category|text) under Script blocking, using a unique part of the script URL or code. Or tag the script manually with type="text/plain" data-kv-consent="<category>". Scripts injected later by another script (not printed in the page HTML) cannot be rewritten: block the script that injects them.
A script should never be blocked.
Add data-kv-consent-skip to its <script> tag, or uncheck the service in Script blocking → Services.
Will the shoppers see two banners?
Only if the core GDPR add-on's cookie notice is also on. The Status block on the settings page detects it and turns it off in one click.
Do I need to change my theme?
No. The banner uses the theme's colors and font and is added through a template hook. For the footer link, add the Cookie settings links block in the layout editor.
Where is the choice stored and for how long?
In the first-party cookie kv_consent for the configured number of days (180 by default). Necessary cookies are not affected.
What personal data does the consent log contain?
A random consent ID, the time, the choices, the policy version, the language, the page path and the IP address with the last part removed (IPv4 /24, IPv6 /48). No name, e-mail, customer ID or user agent. Old rows are deleted after the retention period.
Does it slow the store down?
The consent core is about 6 KB, inline, with no external request. The banner script is about 5 KB and loads at the end of the page. Blocking happens once per page on the server with simple string matching.
Does it work in Multi-Vendor?
Yes. The banner and settings are per storefront. Vendor panels are not affected, and vendors cannot see the consent log.
How does it compare to Cookiebot or CookieYes?
Those are hosted services with monthly fees that load their script from their servers. This add-on is a one-time license, runs inside your store, sends no data to a third party and includes the consent log. It does not scan your site for cookies automatically: you choose the services and add rules for anything else.
The banner disappeared and the admin panel shows a "safe mode" notice.
Open Add-ons → Manage add-ons → Cookie Consent Manager with Consent Mode v2 (GDPR, KVKK) → Settings → License. The status line says what is wrong: no key, a key for another add-on, a revoked license, or a domain that the license does not cover. Fix it and click Check now. See License. While the license is not valid, the add-on keeps every tracking script blocked and does not show the banner, so the store never tracks without consent (see Safe mode).
Does the add-on work on my staging copy?
Yes. Subdomains of your licensed domain (for example staging.example.com) and local development hosts (localhost, private IP addresses, .local, .test) are covered by the same license.
What happens if your license server is down?
Nothing visible: the add-on keeps the last verified result and keeps working for 14 days while it retries. The admin panel shows a notice from the first failed check.
Does the license check slow down my storefront?
No. The check runs in the admin panel or from cron, once a day. The storefront only reads the stored result.
Legal note: not legal advice
This add-on and its documentation are technical tools and information, not legal advice. Kavio Labs does not guarantee that using it makes your store compliant with the GDPR, the ePrivacy Directive and national cookie laws, the UK GDPR and PECR, Turkey's KVKK, or any other law. Compliance depends on your banner texts, your privacy and cookie policies, the services you use, how you configure the add-on and how you process data elsewhere. Requirements also change and differ between countries and regulators. Review your setup with a qualified lawyer or your data protection officer.
