Skip to main content

Cookie Consent

The consent module is a cookie consent banner with the three things a banner alone does not give you: category-level control, actual script blocking before consent is given, and an audit log that evidences the decision. It targets GDPR and CCPA-style requirements, and it is tooling rather than legal advice.

Who this page is for​

  • Merchants selling into the EU, UK, Canada, Brazil or US states with consent obligations.
  • Agencies who need a consent surface they can configure per client without adding a third-party script.
  • Anyone preparing for review — by an app store, a data protection authority, or their own counsel.

What you get​

  • A consent banner with accept-all, reject-all and a preferences path.
  • A preferences modal with category toggles, so a shopper can accept analytics and decline marketing.
  • Script blocking until consent — the mechanism that makes the choice mean something.
  • Region targeting for the EU, UK, Canada, Brazil and the US.
  • Language auto-detection with consent copy in eight languages.
  • Consent logging and consent proof for audits.
  • A cookie scanner to find what your store actually sets.
  • Styling options so the banner matches the theme.

Why blocking matters more than the banner​

The common failure mode of consent tooling is a banner that records a decision while the trackers it asks about have already loaded. The shopper clicks "reject", and the analytics script that ran on page load has long since fired. The banner is then decoration: it produces a record of a choice that was never honoured.

This module blocks scripts until consent is given, per category. That places the burden where it belongs — on configuring your categories correctly, so that each script is assigned to the category that governs it. A script left uncategorised is a script that is not being governed.

The audit log​

Consent has two halves: obtaining a decision, and being able to show you obtained it.

The module records consent decisions to an audit log, surfaced in the app's compliance view. That is what turns "we have a banner" into something demonstrable to a reviewer or a data protection authority — a banner without a log proves nothing after the fact.

Region targeting, used deliberately​

Region targeting lets you show the banner where it is required rather than to every visitor worldwide. That is a legitimate configuration choice with a real usability benefit.

It is also a choice you are making about your obligations. Growthify renders a banner according to the rules you set; it does not determine which regions oblige you, and getting that determination wrong is not something the tool can detect. Take the scope question to counsel and configure accordingly.

Surfaces​

  • Theme blocks: cookie-banner (a body embed, so it renders site-wide) and cart-terms for terms acceptance.
  • Storefront API: consent storage and consent-language endpoints, behind the app proxy.
  • Admin: the Consent module configuration — banner design, categories, language, region rules.
  • Compliance view: the consent audit log.

The consent banner is one of the few surfaces that renders without you placing a section block, because a consent banner that depends on a merchant remembering to position it is a consent banner that will sometimes be missing.

Plan availability​

The cookie module is available from Free and is on by default — consent is not a capability it makes sense to gate behind a paid tier. IAB TCF 2.0 is out of scope entirely, at every tier.

  • It is not legal advice, and it does not determine your obligations, your lawful bases, or which regions apply to you.
  • It does not implement IAB TCF 2.0. If your ad stack requires a registered TCF consent management platform, this does not replace one.
  • It cannot block a script you did not categorise. Configuration is load-bearing.
  • It does not write your cookie policy or your privacy notice.
  • It does not govern server-side tracking initiated outside the storefront.
  • It does not audit your third-party apps' own data practices. The scanner reports cookies; it does not vouch for vendors.

FAQ​

No. It is a configurable banner with category toggles, script blocking, region rules, language packs and an audit log — tooling, not legal advice, and it does not determine what you are obliged to do.

Yes, script blocking until consent is part of the module. That is the difference between a consent record and a consent mechanism — but it depends on you categorising scripts correctly.

Which regions can I target?​

The EU, the United Kingdom, Canada, Brazil and the United States, so the banner shows where you have decided it is required.

What does the audit log record?​

Consent decisions, kept so a choice can be demonstrated rather than assumed. It is the evidence half of consent, which a banner alone does not provide.

Is IAB TCF 2.0 supported?​

No — explicitly out of scope for this module at every tier.

Eight, delivered as language packs with automatic detection from the storefront locale.

No. It is available from Free and enabled by default.

  • Privacy — how Growthify itself handles store and shopper data.
  • Webhooks — the GDPR topics that handle data requests and erasure.
  • Theme blocks — where cookie-banner and cart-terms render.
  • Entitlements — the scopes the app requests and why.