Craft CMP - Cookie Consent Management Platform

Craft CMP is the headless-first cookie consent / consent management platform (CMP) for Craft CMS 5 purpose-built for decoupled, headless, JAMstack and composable architectures as well as traditional Twig sites. Your developer is searching for cookies consent banner that plays well with their stack? Send them this link!

Capture, store and prove GDPR, ePrivacy, Québec Law 25, PIPEDA and CCPA/CPRA-aligned cookie consent with a single plugin. Drive your own cookie banner / cookie notice / consent banner from a clean REST API and GraphQL API, or drop in the bundled Twig banner — all powered by the same service, settings and consent records.

Built for Google Consent Mode v2 out of the box: map cookie categories to all seven consent signals (ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage, security_storage) and ship compliant Google Analytics 4 (GA4), gtag.js and Google Tag Manager (GTM) tracking with default-denied consent and conversion modeling.

Not just Google — provider-agnostic script gating loads any tag only after consent: Meta/Facebook Pixel, Matomo, Hotjar, LinkedIn Insight Tag, TikTok Pixel, Microsoft Clarity, Pinterest, Snapchat and more.

Highlights

• Headless cookie consent — first-class GraphQL queries + mutation and a REST config / save / status API for Nuxt, Next.js, Vue, React, Svelte, Astro, Remix, SvelteKit and any decoupled / SPA / SSR frontend.
• Framework-agnostic JavaScript core — dependency-free, copy-paste, with Vue & React examples included (Svelte/Blade & an npm package on the roadmap).
• Twig integration — craft.cookieConsent variable + an overridable rendered cookie banner and preferences modal for monolithic Craft sites.
• Google Consent Mode v2 / Consent Mode — Advanced & Basic, EEA-ready, wait_for_update, url_passthrough, ads_data_redaction.
• Proof of consent / consent audit log — every decision stored as a Craft element with a Control Panel index, search, filtering, and CSV / JSON export for compliance audits; data-minimization retention / garbage collection.
• Cookie categories — necessary, functional/preferences, analytics/performance, marketing/advertising — fully configurable, multi-site and localization / i18n ready.
• Privacy-by-design — first-party cookie, anonymous visitor ID, hashed IP, granular opt-in / opt-out / withdraw consent, versioned re-consent on policy changes.
• Secure headless API — CORS allow-list, CSRF-aware, optional shared-secret, server-to-server friendly.
• Developer-friendly — Craft CMS 5, PHP 8.2, project-config driven, console/CLI commands, no third-party SaaS, no monthly fees, no external CMP scripts.

Perfect for

Headless Craft CMS builds, GDPR cookie banner requirements, Law 25 compliance in Québec/Canada, Google Consent Mode v2 rollouts, GA4 + GTM setups, agencies shipping privacy-compliant marketing sites, and anyone who wants cookie consent without a third-party subscription and for developers who want full control over their frontend without the hassle of managing proof of consent.