strapi-plugin-cookie-consent

GDPR consent proof logging for Strapi v5 — the backend of a free, open-source cookie consent stack (Google Consent Mode V2, CNIL-compliant).

This plugin stores every consent choice made on your frontend in a Strapi collection, giving you the proof-of-consent record GDPR audits ask for. It pairs with the @isomorph-agency/cookie-consent React package (banner, preferences modal, GCM V2 signals), but works with any frontend able to send a POST request.

Built and maintained by ISOMORPH — a web development agency based in Paris and Toulon, France.

Using Strapi v4? Install strapi-plugin-cookie-consent-v4 instead.

What it does

• Auto-creates a cookie-consents collection on first start — no manual content-type setup
• Auto-configures permissions: POST is public (consent logging), GET is admin-only
• Rate limiting on the public endpoint (10 req/IP/min) to prevent abuse
• Stores anonymized data only: session hash, anonymized IP (first 3 octets), no personal data

Installation

npm install strapi-plugin-cookie-consent

// config/plugins.ts
export default {
  'cookie-consent': { enabled: true },
};

Restart Strapi. The collection and permissions are created automatically.

API

POST /api/cookie-consents (public)

Log a consent choice. Called automatically by the React package, or manually from any frontend:

{
  "data": {
    "sessionId": "a1b2c3…",
    "necessary": true,
    "analytics": false,
    "advertising": false,
    "functional": true,
    "gcmVersion": "v2",
    "consentDate": "2026-07-11T10:00:00.000Z",
    "expiryDate": "2027-08-11T10:00:00.000Z",
    "userAgent": "Mozilla/5.0 …",
    "ipAnonymized": "192.168.1.xxx",
    "source": "mysite.com",
    "action": "custom"
  }
}

All inputs are validated server-side. Invalid payloads are rejected.

GET /api/cookie-consents (admin only)

Browse the consent log from the Strapi admin or via an authenticated API token — your GDPR proof-of-consent record.

Collection schema

| Field | Type | Notes | |-------|------|-------| | sessionId | string | anonymous session hash | | necessary | boolean | always true | | analytics | boolean | maps to analytics_storage | | advertising | boolean | maps to ad_storage + ad_user_data + ad_personalization | | functional | boolean | maps to functionality_storage | | gcmVersion | string | "v2" | | consentDate / expiryDate | datetime | expiry = consent + 13 months (CNIL) | | userAgent | string | | | ipAnonymized | string | first 3 octets only — never the full IP | | source | string | site domain (multi-site friendly) | | action | enum | accept_all / refuse_all / custom |

Complete stack

| Package | Description | |---------|-------------| | @isomorph-agency/cookie-consent | React banner + preferences modal + GCM V2 + blocked-content facades | | strapi-plugin-cookie-consent | This plugin (Strapi v5) | | strapi-plugin-cookie-consent-v4 | Strapi v4 version |

Full documentation, contributing guide and issue tracker: github.com/agenceisomorph/cookie-consent

Compliance

• GDPR: proof-of-consent logging, anonymized data only, 13-month auto-expiry
• CNIL (French DPA): 13-month expiry, anonymized IP, consent granularity per category
• Logging is fire & forget on the frontend side — never blocks the user experience

License

MIT — free for personal and commercial use.

Built with care by ISOMORPH.