Cookie Consent (GDPR / CNIL)

Name: Cookie Consent (GDPR / CNIL)
Author: ISOMORPH

Free, full-stack GDPR cookie consent for Strapi and React/Next.js: Google Consent Mode V2, CNIL compliance, WCAG 2.1 AA accessibility, and consent proof logging in a Strapi collection. Strapi v5 and v4 plugins, first-party cookies only, no third-party service.

Latest version

v1.0.4

released July 21, 2026

npm install strapi-plugin-cookie-consent

GDPR consent proof logging for Strapi v5 — the backend of a free, open-source cookie consent stack (Google Consent Mode V2, CNIL-compliant).

This plugin stores every consent choice made on your frontend in a Strapi collection, giving you the proof-of-consent record GDPR audits ask for. It pairs with the @isomorph-agency/cookie-consent React package (banner, preferences modal, GCM V2 signals), but works with any frontend able to send a POST request.

Built and maintained by ISOMORPH — a web development agency based in Paris and Toulon, France.

Using Strapi v4? Install strapi-plugin-cookie-consent-v4 instead.

What it does

Auto-creates a cookie-consents collection on first start — no manual content-type setup
Auto-configures permissions: POST is public (consent logging), GET is admin-only
Rate limiting on the public endpoint (10 req/IP/min) to prevent abuse
Stores anonymized data only: session hash, anonymized IP (first 3 octets), no personal data

Installation

npm install strapi-plugin-cookie-consent

// config/plugins.ts
export default {
  'cookie-consent': { enabled: true },
};

Restart Strapi. The collection and permissions are created automatically.

API

`POST /api/cookie-consents` (public)

Log a consent choice. Called automatically by the React package, or manually from any frontend:

{
  "data": {
    "sessionId": "a1b2c3…",
    "necessary": true,
    "analytics": false,
    "advertising": false,
    "functional": true,
    "gcmVersion": "v2",
    "consentDate": "2026-07-11T10:00:00.000Z",
    "expiryDate": "2027-08-11T10:00:00.000Z",
    "userAgent": "Mozilla/5.0 …",
    "ipAnonymized": "192.168.1.xxx",
    "source": "mysite.com",
    "action": "custom"
  }
}

All inputs are validated server-side. Invalid payloads are rejected.

`GET /api/cookie-consents` (admin only)

Browse the consent log from the Strapi admin or via an authenticated API token — your GDPR proof-of-consent record.

Collection schema

Field	Type	Notes
`sessionId`	string	anonymous session hash
`necessary`	boolean	always `true`
`analytics`	boolean	maps to `analytics_storage`
`advertising`	boolean	maps to `ad_storage` + `ad_user_data` + `ad_personalization`
`functional`	boolean	maps to `functionality_storage`
`gcmVersion`	string	`"v2"`
`consentDate` / `expiryDate`	datetime	expiry = consent + 13 months (CNIL)
`userAgent`	string
`ipAnonymized`	string	first 3 octets only — never the full IP
`source`	string	site domain (multi-site friendly)
`action`	enum	`accept_all` / `refuse_all` / `custom`

Complete stack

Package	Description
`@isomorph-agency/cookie-consent`	React banner + preferences modal + GCM V2 + blocked-content facades
`strapi-plugin-cookie-consent`	This plugin (Strapi v5)
`strapi-plugin-cookie-consent-v4`	Strapi v4 version

Full documentation, contributing guide and issue tracker: github.com/agenceisomorph/cookie-consent

Compliance

GDPR: proof-of-consent logging, anonymized data only, 13-month auto-expiry
CNIL (French DPA): 13-month expiry, anonymized IP, consent granularity per category
Logging is fire & forget on the frontend side — never blocks the user experience

License

MIT — free for personal and commercial use.

Built with care by ISOMORPH.