Set up cookie consent

Drupal CMS includes a consent management tool (“the consent manager”) that handles cookies, tracking scripts, and embedded services, supporting compliance with data protection laws in the locations relevant to your organization. Rather than a one-size-fits-all approach, you configure privacy settings to match your audience’s needs and regulatory requirements, so users control their own data.

Goal

The consent manager configured for the features your site uses, so visitors control which services receive their personal data while being disturbed as little as possible.

Prerequisites

• A running Drupal CMS site with an administrator account.
• A published privacy policy, because consent manager texts link to it; see Publish a privacy policy.

Steps

The consent manager is the open source Klaro Privacy Manager, provided through the Klaro Cookie & Consent Management module. It gives users a consent management UI that integrates with other Drupal CMS features.

Understand what visitors see

When a visitor’s browser attempts to store personal data using a cookie, or to share it with a page containing a third-party resource (such as a map, video, or tracking script), the consent manager determines whether the action is permitted and in what form. Every time you enable a feature included with Drupal CMS, the consent manager updates its tracking list; enabling the Google Analytics feature (which uses Google Tag Manager) adds that service, for example. Most JavaScript snippets and cookies are detected automatically, and additional configuration options accommodate the rest.

Visitors can expect to see:

• A My privacy settings link in the footer of every page. It opens the consent manager dialog, which lists the sources requesting access to their personal data, grouped by purpose (functional, analytics, embedded external content, advertising and marketing), with toggles for complete control over whom that data is shared with. The link is only visible when a feature that requires consent management is enabled.
• A consent widget on embedded services such as maps, which requires the visitor to confirm loading the third-party resource, with options to allow it once or always and a link to the privacy settings.
• A consent notice when a page contains embedded JavaScript snippets that are not visible in the UI, like an analytics tracking snippet, with buttons to Accept all, Decline all, or Customize for fine-grained control.

Review the configuration

Go to Configuration → User interface → Klaro! settings/admin/config/user-interface/klaro. The settings divide into three sections:

• Settings controls the behavior and display of the consent manager dialog. Drupal CMS attempts to set the dialog’s visibility to the best option automatically, based on the features you have enabled. If no cookies or external services are used, the dialog stays hidden (the Drupal CMS default). When features like embedded media or JavaScript tracking tags are added, update the visibility settings so visitors can manage those services. The Klaro! documentation describes the different modes.
• Manage lists the services the consent manager controls access to, with configuration for each. A service is an individual application or tool on your website that collects user data, such as an analytics platform or a social media plugin. A purpose is the reason for the collection, such as improving user experience or targeted advertising. When a service is enabled, it appears in the consent manager for visitors to allow or refuse. See Manage services and purposes on Drupal.org.
• Texts configures the text visitors see in the consent manager UI. The description of each service is managed in that service’s own configuration, not here.

Add a service

The consent manager attempts to detect third-party sources automatically and add them to the available options. If it does not locate your service, or you need more control over how it is managed, add configuration for it yourself. If you have added custom features or additional modules, temporarily enable the Log unknown resources option to find services that were not added automatically.

1. Go to Configuration → User interface → Klaro! settings/admin/config/user-interface/klaro and select Manage, then Services.
2. Select Add service to create a new entry.
3. Enter a Label (for example, Internal Tracking Script) and a Description, which is shown to visitors in the consent manager dialog.
4. Under Purpose, select or create an appropriate category, such as Analytics or User Behavior Tracking.
5. On the Advanced tab, describe the page elements Klaro must block until a visitor consents. Give Klaro what it needs to find the elements on the page: the URL of a third-party JavaScript file (for example, example.com/tracking.js) or the HTML ID of an element (for example, #internal-analytics). Once configured, Klaro rewrites the HTML of the page to disable the service until it has been accepted.

Change a service’s default opt-in state

1. Go to Configuration → User interface → Klaro! settings/admin/config/user-interface/klaro, choose the Manage tab, then Services.
2. Find the service you want to configure and choose Edit.
3. On the General tab, choose the options for how the service’s default state appears in the consent manager dialog.
4. Optionally, update the service Description to explain the default state.
5. Select Save.

The same form also makes a service required, so that visitors cannot opt out of it.

Verify

After enabling new features or changing the consent manager’s configuration, visit your site in a private browsing window and confirm the consent manager behaves the way you configured it. If you see no dialog at all, that is usually correct: Klaro operates in silent mode by default, and the dialog stays hidden unless cookies, embedded media, or third-party scripts requiring user consent are detected.

Related

• Publish a privacy policy: the consent manager links to it, so publish it early.
• Set up Google Analytics enables a feature the consent manager tracks.
• Klaro official website, and the Klaro Cookie & Consent Management documentation guide on Drupal.org.