Cookie consent for Drupal 9, 10 and 11
Cookie consent for Drupal, installed as a module. Local-first runtime, no third-party requests on your visitor’s page, Consent Mode v2 included.
or see all twelve platforms
Why Drupal sites need consent that actually blocks
Drupal runs sites where governance, privacy and data handling are usually taken seriously — public sector, education, healthcare, large organisations. Its audience is technical and will read your architecture claims carefully.
Installing on Drupal
01
Add the module
Manage → Extend → Add new module, upload the archive. If there is no such button, the guide shows the FTP path to modules/custom/.
02
Install it
Find Cookie Craft in the Extend list, tick it and press Install. Credentials are read from settings.php.
03
Clear all caches
Manage → Configuration → Development → Performance. Realistic time: 5 to 10 minutes.
What’s specific to Drupal
If you cannot see an “Add new module” button, the core Update Manager module is switched off. This is common on hardened Drupal installations, and it is a deliberate security choice rather than a fault. You have two ways forward: enable Update Manager, or upload the unzipped folder to modules/custom/ over FTP — after which the module appears in the Extend list as if you had uploaded it through the interface. On Drupal the second path is often the only one permitted.
Drupal’s credentials live in sites/default/settings.php (or web/sites/default/settings.php). A stock file contains a commented-out example $databases block near the top as well as the real one at the bottom — Cookie Craft reads the real one, a detail that trips up naive parsers.
Included on Drupal, not upsold
No feature is held back for a higher tier. One plan, everything in it.
Google Consent Mode v2
The four signals GA4 and Google Ads need to run properly in the EEA — analytics_storage, ad_storage, ad_user_data, ad_personalization — set from your visitor’s real choice.
GTM, Meta & TikTok
Google Tag Manager, Meta Pixel and TikTok Pixel get base placement and consent-aware loading — no snippets pasted into your Drupal templates, no second plugin to gate them. Your tracking plan still defines the events and conversions.
One licence, one root domain
For an organisation with data-residency requirements, consent records in your own database — not a vendor’s cloud — is a materially different proposition, and one licence still covers every subdomain.
A guide for your exact site
Your install guide is generated with your real Drupal paths already filled in, in twelve languages — no example.com placeholders to translate into your own setup.
Why it matters here
For a Drupal audience, the strongest argument is architectural rather than commercial. Cookie Craft loads nothing from an external domain on a visitor’s page, contacts no third party before consent exists, and stores consent records in your own database. For a Data Protection Officer who asks pointed questions, that is a different proposition from embedding a vendor’s script.
The runtime is plain PHP and JavaScript, in your codebase, readable. Nothing is obfuscated or minified beyond normal asset compression.
What it does — and what it doesn’t
Cookie Craft does not scan your Drupal site to discover cookies automatically, and it does not write your privacy policy for you. It gives you the mechanism: a banner your visitors actually interact with, real blocking of the scripts you configure, and correct Consent Mode v2 signals to Google. What you declare in it is up to you.
Consent for Drupal, done properly.
Self-hosted, first-party, and everything included — €25/month or €240/year per root domain.