Craft CMP - Consent Management Platform

Craft CMP is the headless-first cookie consent / consent management platform (CMP) for Craft CMS 5 purpose-built for decoupled, headless, JAMstack and composable architectures as well as traditional Twig sites. Your developer is searching for a Cookie Consent banner that plays well with their stack? Send them this link!

Capture, store and prove GDPR, ePrivacy, Québec Law 25, PIPEDA and CCPA/CPRA-aligned cookie consent with a single plugin. Drive your own cookie banner / cookie notice / consent banner from a clean REST API and GraphQL API, or drop in the bundled Twig banner — all powered by the same service, settings and consent records.

Built for Google Consent Mode v2 out of the box: map cookie categories to all seven consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage, security_storage) and ship compliant Google Analytics 4 (GA4), gtag.js and Google Tag Manager (GTM) tracking with default-denied consent and conversion modeling.

Not just Google — provider-agnostic script gating loads any tag only after consent: Meta/Facebook Pixel, Matomo, Hotjar, LinkedIn Insight Tag, TikTok Pixel, Microsoft Clarity, Pinterest, Snapchat and more.

Highlights

• Headless cookie consent — first-class GraphQL queries + mutation and a REST config / save / status API for Nuxt, Next.js, Vue, React, Svelte, Astro, Remix, SvelteKit and any decoupled / SPA / SSR frontend.
• Framework-agnostic JavaScript core — dependency-free, copy-paste, with Vue & React examples included (Svelte/Blade & an npm package on the roadmap).
• Twig integration — craft.cookieConsent variable + an overridable rendered cookie banner and preferences modal for monolithic Craft sites.
• Google Consent Mode v2 / Consent Mode — Advanced & Basic, EEA-ready, wait_for_update, url_passthrough, ads_data_redaction.
• Proof of consent / consent audit log — every decision stored as a Craft element with a Control Panel index, search, filtering, and CSV / JSON export for compliance audits; data-minimization retention / garbage collection.
• Cookie categories — necessary, functional/preferences, analytics/performance, marketing/advertising — fully configurable, multi-site and localization / i18n ready.
• Privacy-by-design — first-party cookie, anonymous visitor ID, hashed IP, granular opt-in / opt-out / withdraw consent, versioned re-consent on policy changes.
• Secure headless API — CORS allow-list, CSRF-aware, optional shared-secret, server-to-server friendly.
• Developer-friendly — Craft CMS 5, PHP 8.2, project-config driven, console/CLI commands, no third-party SaaS, no monthly fees, no external CMP scripts.

Perfect for

Headless Craft CMS builds, GDPR cookie banner requirements, Law 25 compliance in Québec/Canada, Google Consent Mode v2 rollouts, GA4 + GTM setups, agencies shipping privacy-compliant marketing sites, and anyone who wants cookie consent without a third-party subscription and for developers who want full control over their frontend without the hassle of managing proof of consent.