GDPR cookie banner for OpenCart 4.x and 3.0.x that really holds Google, Meta, TikTok, Hotjar, Microsoft, Pinterest, Snap, LinkedIn, YouTube, Vimeo and Google Maps until the visitor agrees, plus your own rules. Accept all, Reject all and Customise with equal weight, a preferences centre with four categories, a cookie button and a footer link; bar, box or popup, light, dark or automatic, texts per language. Google Consent Mode v2 (regional defaults, advanced or basic, Tag Manager event), Meta, TikTok and Microsoft consent signals, cookies of withdrawn categories deleted, policy version with re-consent, EU-only banner (Cloudflare country, our GeoIP or time zone), consent log with CSV export, store scan. Same HTML for every visitor, so page caches keep working; Server-Side Tracking reads the same choice. No OCMOD.
Tested on 4.1.0.4 & 3.0.5.1Updated Nov 5, 2026Version 1.0.0Compatible with OpenCart 4.1.0.4, 3.0.5.1 No core file edits
Built forOpenCart
A banner that treats both answers the same1 of 6
What it does
GDPR cookie banner for OpenCart 4.x and 3.0.x that really holds Google, Meta, TikTok, Hotjar, Microsoft, Pinterest, Snap, LinkedIn, YouTube, Vimeo and Google Maps until the visitor agrees, plus your own rules. Accept all, Reject all and Customise with equal weight, a preferences centre with four categories, a cookie button and a footer link; bar, box or popup, light, dark or automatic, texts per language. Google Consent Mode v2 (regional defaults, advanced or basic, Tag Manager event), Meta, TikTok and Microsoft consent signals, cookies of withdrawn categories deleted, policy version with re-consent, EU-only banner (Cloudflare country, our GeoIP or time zone), consent log with CSV export, store scan. Same HTML for every visitor, so page caches keep working; Server-Side Tracking reads the same choice. No OCMOD.
Consent first, then tracking. Cookie Consent & Consent Mode v2 holds the scripts and embeds of Google, Meta, TikTok, Hotjar, Microsoft, Pinterest, Snap, LinkedIn, YouTube, Vimeo and Google Maps until the visitor agrees, and sends Google Consent Mode v2 signals so GA4 and Google Ads keep modelling conversions.
Features
A banner visitors trust
Accept all, Reject all and Customise with the same size and colour
Preferences centre with Necessary, Preferences, Statistics and Marketing, and the services in each
Bar, box or popup; light, dark or automatic; your colour with a contrast check
Texts per store language, link to your privacy page
Cookie button and footer link to change the choice later
Real blocking
Scripts held in the page until consent, then run in order
Videos and maps behind a placeholder with Load once and Always allow
Cookies of a withdrawn category are deleted
Your own rules for any other script or embed
Store scan lists what is held and what is not
Google and ad platforms
Consent Mode v2 defaults before any Google tag, denied in the EU, EEA, UK and Switzerland
Advanced or basic mode, ads_data_redaction, url_passthrough, Tag Manager event
Meta, TikTok, Microsoft Clarity and UET consent signals
Proof and control
Consent log with consent ID, policy version, page, country, shortened or hashed IP address
CSV export and a retention period
Policy version: ask everyone again with the previous choice preselected
EU-only option by Cloudflare country, our GeoIP or the visitor's time zone
Fits your shop
Same HTML for every visitor, so page caches keep working
Server-Side Tracking reads the same choice for server events
No OCMOD, no core file edits
One license for OpenCart 4 and 3
What you get
Download & installTwo installer packages (.ocmod.zip): one for OpenCart 4.0.2 – 4.1.x and one for 3.0.3 – 3.0.5. One license key covers both. Download it from My licenses right after payment.
12 months of updates & supportNew versions and help for 12 months (24 or 36 months at checkout). After that the extension keeps working; renew anytime at 50%.
License for your storeOne production domain with all its subdomains; staging and local development hosts are free. How licensing works
30-day refundFull refund within 30 days of your first purchase, no reason needed. Refund policy
Tested buildsOpenCart 4.1.0.4, 3.0.5.1. Tested on OpenCart 4.1.0.4 and OpenCart 3.0.5.1.
Documentation & supportFull guide (Installation, Configuration, Usage, FAQ) on this page. Tickets from your account, first reply within 1 business day.
Compatibility
Cookie Consent & Consent Mode v2 works with OpenCart 4.1.0.4, 3.0.5.1.
We list the builds we install and test on. “Tested” means the test plan ran on that build; “Supported” means the build is inside the supported range.
Compatibility
Version
Range
Runs on
Status
OpenCart 4.1.0.x
4.1.0.0 – 4.1.0.4
PHP 8.1 – 8.3
Tested on 4.1.0.4
OpenCart 4.0.2.x
4.0.2.0 – 4.0.2.3
PHP 8.0 – 8.2
Supported
OpenCart 3.0.x
3.0.3.8 – 3.0.5.x
PHP 7.4 – 8.1
Tested on 3.0.5.1
1.0.0
Nov 5, 2026
Latest
First release: cookie banner (bar, box or popup; light, dark or automatic; your button colour with a contrast check; texts per language) with equal Accept all, Reject all and Customise buttons, a preferences centre with four categories and the services in each, a cookie button and a footer link; real blocking of scripts and embeds of 14 catalogued services plus your own rules, with placeholders for videos and maps; Google Consent Mode v2 (regional defaults, advanced or basic mode, wait_for_update, ads_data_redaction, url_passthrough, Tag Manager event); Meta, TikTok, Microsoft Clarity and UET consent signals; deletion of withdrawn categories' cookies; policy version; EU-only option (Cloudflare country, Bot & Country Blocker GeoIP, time zone); consent log with CSV export and retention; store scan; registry helper for other extensions; page-cache-safe output. Shared consent core 1.0.0.
How do I install the extension?
Upload. Extensions > Installer: upload the .ocmod.zip for your OpenCart version (4.x or 3.0.x). Both packages come with every license.
Install and enable. Extensions > Extensions > Modules: install, open the settings and switch it on. Events register themselves; nothing is patched.
Enter the license key. Paste the key from My licenses. Subdomains, staging and local hosts are included; you have 14 days to do it.
OpenCart 4.1.0.4, 3.0.5.1. Tested on OpenCart 4.1.0.4 and OpenCart 3.0.5.1. The Compatibility tab lists every version range.
Do the extensions change core files?
No. They work through OpenCart events and standard extension types (modules, order totals, themes). No core file edits, no OCMOD patches, no theme template edits, so OpenCart updates and other extensions keep working.
Do I get packages for OpenCart 4 and OpenCart 3?
Yes. Every download has a package for OpenCart 4.0.2 to 4.1.x and one for OpenCart 3.0.3 to 3.0.5, and the license key works with both. Moving from OpenCart 3 to 4 later costs nothing.
What does the license cover?
One production store domain with every subdomain (www, shop., staging.), plus local development hosts such as localhost, *.local and *.test. A store on another domain needs its own license; a second-store license is 40% off. You have 14 days after installing to enter the key. 12 months of updates and support are included; after that the extension keeps working and renewals are 50% off. How licensing works
Can I get a refund?
Yes. Ask for a full refund within 30 days of your first purchase, no reason needed: open a ticket or write to [email protected] with your order number. The money goes back to the card or bank account you paid with within 5 business days of approval. Refund policy
How do I get help?
Open a ticket from your account, so your license details are attached. We answer Monday to Friday: bug reports within 1 business day, how-to questions within 2. Support policy. Not a customer yet? Ask a pre-sales question.
Cookie Consent & Consent Mode v2 shows a clear cookie banner and really holds Google, Meta, TikTok, Hotjar, Microsoft and other trackers, videos and maps back until the visitor agrees. Google tags get Consent Mode v2 signals, every choice is logged as proof, and the banner works with page caches.
Real blocking. Scripts and embeds of the services you choose are held in the page (type="text/plain") and run only after consent in their category. Videos and maps show a placeholder with "Load once" and "Always allow".
Google Consent Mode v2. Defaults are set before any Google tag (always "denied" in the EU, EEA, UK and Switzerland; your choice elsewhere), and every choice sends an update. Advanced mode (Google tags load with denied defaults and send cookieless pings) or basic mode (Google tags wait like every other service). ads_data_redaction, url_passthrough and a kv_consent_update event for Tag Manager.
Fair banner. Accept all, Reject all and Customise with the same size and colour on the first layer; a preferences centre with Necessary, Preferences, Statistics and Marketing and the services in each; a cookie button and a footer link to change the choice later.
Bar, box or popup, light, dark or following the visitor's device, your button colour (with a contrast check), texts per store language, a link to your privacy page.
EU-only option. Show the banner only to visitors in the EU, EEA, UK and Switzerland: country from Cloudflare (CF-IPCountry), else the GeoIP database of our Bot & Country Blocker when installed, else the browser time zone. Decided in the browser, so cached pages stay the same for everyone.
Consent log. Consent ID, choice, categories, policy version, banner text version, page, country, shortened or hashed IP address and date, with filters, CSV export and a retention period.
Policy version. Raise it after changing your cookie use: every visitor is asked again, with the previous choice preselected.
Store scan. Lists every script and embed from another site on your home page, a category, a product and the login page: held, sent with Consent Mode, or not held.
Withdrawal. Withdrawing a category deletes its cookies (Google Analytics, Meta, TikTok, Microsoft, Hotjar and others) and can reload the page.
Vendor signals. Meta fbq('consent'), TikTok grantConsent / revokeConsent, Microsoft Clarity consentv2 and Microsoft Advertising UET consent.
Works with our other extensions. Server-Side Tracking 1.0.1 or newer reads the same choice for server events; Page Speed & Cache Pro serves the same cached page to every visitor.
The banner and its logic run in the visitor's browser; the server never prints visitor-specific content. No OCMOD, no core file edits: four events. One licence covers OpenCart 4 and 3. Tested on OpenCart 4.1.0.4 and 3.0.5.1 with the default themes; other 4.0.2.x to 4.1.x and 3.0.3.x to 3.0.5.x versions are expected to work but are not tested.
This extension helps you meet the cookie rules of the GDPR and the ePrivacy Directive; it is not legal advice, and the texts of your privacy and cookie policy remain your responsibility.
Installation
Requirements: OpenCart 4.0.2.0 - 4.1.x or 3.0.3.x - 3.0.5.x, PHP 7.4 or newer. cURL for the store scan.
OpenCart 4
Extensions > Installer > Upload kv_cookie_consent.ocmod.zip, then click the green Install button in the list.
On the Dashboard tab: if OpenCart's own cookie bar is on (System > Settings > Option > Cookie Policy), click Turn the OpenCart cookie bar off so visitors see one banner.
Open the Store scan tab and click Scan the store. Add your own rules for anything listed as "Not held" that sets cookies.
The banner is on right after the install with these defaults: box in the bottom left corner, every visitor, Consent Mode v2 advanced, all services in the catalogue held, consent log on (IP address shortened), choice kept 180 days.
Server-Side Tracking
If you use our Server-Side Tracking, update it to 1.0.1 or newer and set its consent mode to "Kavio Labs Cookie Consent & Consent Mode v2". Its built-in banner stays hidden while this extension is enabled.
Uninstall
Extensions > Extensions > Modules > Cookie Consent & Consent Mode v2 > Uninstall removes the events, the settings and the consent log table. Export the log as CSV first if you need it as proof. Visitors' kv_consent cookies stay in their browsers until they expire.
Licence
Enter the licence key from your Kavio Labs account on the Banner tab. The extension works for 14 days without a key; after that, without a valid key, the banner is not shown and scripts are no longer held back; the admin keeps working.
Configuration
Banner tab
Setting
What it does
Status
Off: no banner and nothing is held back.
Layout
Bar (full width, top or bottom), box (card in a bottom corner) or popup (centred over a dimmed page). Accept all, Reject all and Customise always have the same size and colour.
Position, colours, corners
Bottom / top for the bar, left / right for the box; light, dark or following the device; button colour with a WCAG contrast check (the button text turns white or black automatically).
Change later
A cookie button in a bottom corner and / or a "Cookie settings" link in the footer. Any link to #cookie-settings opens the settings too.
Privacy page
Information page linked from the banner and the settings.
Texts
Per store language; empty fields use the English default. [service] and [category] are replaced in the text of held videos and maps.
Keep the choice for
Default 180 days.
Policy version
"Ask everyone again" raises it: every visitor sees the banner again with the previous choice preselected.
Who sees the banner
Every visitor (default), or only visitors in the EU, EEA, UK and Switzerland. Elsewhere: everything allowed without a banner (logged as "Outside the EU"), or the banner as well. Country from Cloudflare CF-IPCountry, else the Bot & Country Blocker GeoIP database when installed, else the browser time zone; unknown visitors see the banner.
Consent log
On by default. IP address shortened (IPv4 /24, IPv6 /48) or stored as a salted hash; retention 30-3650 days (default 365).
After withdrawing
Cookies of withdrawn categories are always deleted; optionally the page reloads so running scripts stop.
Locked mode
Refuses every optional cookie and saves no choice (testing).
Services & Google tab
Services held until consent: Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, TikTok Pixel, Microsoft Advertising (UET), Microsoft Clarity, Hotjar, Pinterest Tag, Snap Pixel, LinkedIn Insight Tag, YouTube, Vimeo, Google Maps. Each is recognised by its script address, inline code or embed address.
Your own rules: text => preferences | analytics | marketing, one per line, matched in script addresses, inline script code and iframe addresses. Example: widget.example.com => marketing.
Google Consent Mode v2: on / off; advanced or basic; the default for visitors outside the EU, EEA, UK and Switzerland; wait_for_update (default 500 ms); ads_data_redaction; url_passthrough.
Other consent signals: Meta, TikTok, Microsoft Clarity, Microsoft UET.
Scripts that handle consent themselves are left alone: code that uses window.kvConsent, a kv...Config object, or carries data-kv-consent-skip.
For developers
Browser: window.kvConsent.get('marketing'), .on('change', fn), .open(); events kv:consent, kv:consent-ready, kv:consent-changed on document; dataLayer events kv_consent_default and kv_consent_update.
Server (other extensions): $this->registry->get('kv_consent')->granted('marketing') (reads the flags of the kv_consent cookie).
Cookie: kv_consent=1.<id>.<policy version>.<unix time>.<preferences><statistics><marketing> (each flag 0 or 1), SameSite=Lax, Secure on HTTPS.
Usage
Dashboard
Choices saved in the last 30 days, the share of visitors who accepted all, rejected all, allowed statistics and allowed marketing, a chart of choices per day, the top countries (when known) and checks: Server-Side Tracking consent mode, page cache, OpenCart's own cookie bar (with a button to turn it off), privacy page, Consent Mode.
Consent log
Every saved choice: date (UTC), consent ID, choice (accepted all, rejected all, own choice, withdrew, outside the EU), the categories allowed, the policy version, the page, the country and the IP address (shortened or hashed). Filter by consent ID, choice and dates, export as CSV, remove rows older than the retention period.
A visitor who asks what they agreed to can read their consent ID in the cookie settings of your shop (at the bottom of the preferences centre); search it in the log.
Store scan
Click Scan the store. For each page the table shows every script and embed from another site:
Held: <category>: waits for consent in that category.
Consent Mode: a Google tag that loads with the denied defaults (advanced mode).
Not held: add a rule on the Services & Google tab if it sets cookies or tracks visitors.
What visitors see
A new visitor sees the banner. Before a choice no held script or embed runs; in Consent Mode advanced mode Google tags send cookieless pings.
Accept all, Reject all, or Customise to choose categories.
The cookie button or the "Cookie settings" footer link opens the settings again; withdrawing a category deletes its cookies.
Checking a page yourself
In the browser's developer tools (Elements), held scripts have type="text/plain" data-kv-consent="marketing". In the Network tab, requests to facebook.net, tiktok.com, hotjar.com and similar appear only after consent.
FAQ
Does it make my shop GDPR compliant?
It helps you meet the cookie rules: no optional cookies before consent, equal Accept and Reject buttons, easy withdrawal and a log of every choice. It is not legal advice; your privacy and cookie policy texts and the services you use remain your responsibility.
Do I need a TCF (IAB) consent platform?
Only if your shop shows ads from Google AdSense, Ad Manager or AdMob to visitors in the EEA, UK or Switzerland; then Google asks for a certified CMP with TCF. A shop that advertises with Google Ads and measures with GA4 needs Consent Mode v2, which this extension sends. This extension is not a Google-certified CMP.
Does it really block scripts, or only send signals?
Both. Scripts and embeds of the services you hold are not run before consent; Google tags receive Consent Mode v2 signals (and are held as well in basic mode).
What about scripts my theme or another extension prints?
Everything in the finished page is checked: header, footer, modules and the content. The store scan shows what is held and what is not; add a rule for anything not held.
Does it work with page caches?
Yes. The server sends the same HTML to every visitor; the banner and the choice live in the browser. Our Page Speed & Cache Pro treats kv_consent and kv_geo as harmless cookies, so cached pages stay shared.
Does it work without Cloudflare?
Yes. Cloudflare's country header is only used for the EU-only option; without it the GeoIP database of our Bot & Country Blocker (when installed) or the visitor's time zone decides, and unknown visitors see the banner.
Will it slow my shop down?
The consent code and styles are about 45 KB (about 12 KB with the gzip compression most servers use), printed inline so there is no extra request; held scripts load only after consent.
How do I ask everybody again after changing my cookies?
Banner tab > Policy version > Ask everyone again.
Does it use OCMOD or change core files?
No. Four events.
Does it work with Server-Side Tracking?
Yes, from Server-Side Tracking 1.0.1: set its consent mode to "Kavio Labs Cookie Consent & Consent Mode v2". Server events then follow the same choice, and its built-in banner stays hidden.
Server-side tracking for OpenCart 4.x and 3.0.x: purchases, refunds, add to cart, checkout, product views and leads go from your server to the free official GA4 Measurement Protocol, Meta Conversions API and TikTok Events API, deduplicated with the browser pixels through shared event ids. Consent-aware, SHA-256 hashed customer data, order status mapping, queue with retries, test mode and an event log. No paid relay, events only, no OCMOD.
The department store theme for OpenCart 4.x and 3.0.x: colour-coded departments, a department list beside the hero slider with two side promos, a big search with a department selector, tabbed product blocks, a 2 + 1 + 2 offer grid, deals of the day with real countdowns, a department showcase, a promotions band and a three-column product page with a sticky buy box. Four styles (Meridian, Harbor, Citrus, Night) and your own colours on top. Events only, no core changes.
Stop AI crawlers, scrapers, vulnerability scanners and unwanted countries before OpenCart 4.x or 3.0.x builds a page. Googlebot and Bingbot are verified by DNS and always allowed; 50+ bots get one switch each; country rules use free GeoIP databases and can close only the checkout; IP and network lists, rate limits, honeypots and the cart flood fix; a one-second challenge instead of a captcha; learning mode, dashboard, log, IP tester and Cloudflare export. No core changes, no OCMOD.
