Overview

Odoo's built-in cookies bar asks one question: everything, or only the essentials. Regulators expect a choice per purpose, a refusal that is as easy as consent, and records that show what a visitor agreed to. This module replaces the bar with a consent manager that does all three, and keeps the rest of Odoo's own cookie plumbing intact while doing it.

No vendor account, no subscription, no external script and no second product to buy. Everything runs inside your Odoo, on Community and Enterprise alike.

A Real Choice, On The First Layer

Refuse all and Accept all sit side by side on the first layer, in the same variant and the same size. That parity is built into the template rather than offered as a setting, because a banner that quietly favours one answer is the pattern supervisory authorities actually sanction. Nothing optional is pre-ticked, and pre-ticking is refused on save. Escape never counts as a decision, in either direction — and a visitor who reopens the banner just to look can leave it again without touching the choice they already made.

Blocked Per Service, Not All Or Nothing

Register the services you use and the hosts they load from. Scripts and embeds belonging to a service whose purpose has not been granted are removed from the page server-side, before the browser ever sees them, so nothing races a script blocker. Granting statistics stops blocking your analytics without also releasing your advertising pixels.

A blocked video or map leaves a notice in its place. Clicking it allows that one embed, and nothing else — a service you mark ask in place only is never released by a purpose, not even by Accept all. Google Consent Mode v2 is signalled with all seven signals, in basic or advanced mode, for whichever Google tag your site already loads, and Plausible is consent-gated too, which the built-in bar does not do.

Set It Where You Can See It

How the banner looks belongs in the website editor, not in a settings page you cannot see it from. Select the Cookies Bar block and choose its layout — a bar top or bottom, a box in either corner, a centred dialog — its density, whether the footer carries the way back to the choice, and which corner holds the floating button. The notice text itself is edited in place like any other content, while the parts generated from your registry stay protected from accidental edits.

What is left under Settings is the handful of decisions that carry legal weight rather than taste: blocking, Consent Mode, Global Privacy Control, consent proof, the policy link and the policy version.

Proof You Can Actually Produce

Every decision is recorded with what the visitor was shown, not only what they chose: the policy version, a fingerprint of the cookie registry in force, the banner version, the language, the resolved country and region rule, the purposes granted and the purposes refused, and a salted hash of the truncated IP — no readable address is kept. Records are append-only: a later decision is filed as its own record instead of overwriting the earlier one, which is what makes the log worth producing.

Adding a purpose, a service or a cookie asks your visitors again by itself, because consent given against an older disclosure does not cover a new one. You can see it in the log: the fingerprint changes, and the decisions taken after it are the ones that still count.

A Registry That Already Knows Odoo

The declarations ship filled in for what Odoo itself stores on a visitor's device: the session, language and company cookies, the timezone, the live-update and presence keys, the basket count, a live chat, a survey in progress, the UTM attribution cookies, and the storage the Enterprise appointment and push notification features use. Each one carries its provider, purpose, retention and type, and every strictly-necessary classification carries the reason it is necessary — which is the part you have to be able to defend.

A weekly scan walks your own pages and lists the cookies they set, the storage keys their scripts write and the third-party hosts they load. What no declaration covers is put up for review, so a pixel someone pasted into the page turns up as a task rather than as a surprise in an audit.

A Cookie Policy Built From The Registry

The policy page is generated from the same declarations the banner gates on, so the two always agree with each other. Point the banner at your own legal page instead if you keep one, and the rest still follows the registry.

Region rules decide how long a decision is relied on, with presets for the EU/EEA, the UK and Switzerland. Each preset names the authority behind its figure, and where no figure has been published it says so instead of inventing one.

Built To Be Used By Everyone

The dialog is a real role="dialog" labelled by its own heading, with switches operable by keyboard, 24 px minimum targets and no control hidden from assistive technology. Modality is claimed only where it is true: the notice leaves your page usable and does not steal focus, while the preference centre covers the page, announces itself as modal, keeps Tab inside it and hands focus back on close. It is built to WCAG 2.2 AA, which matters twice over: an inoperable banner cannot produce informed consent, so the cookies it sets have no valid basis.

Everything renders server-side, in the initial HTML. The banner costs no request to appear, reserves its own space rather than shifting your layout, and adds no third-party request, no external domain and no vendor script to your pages. It ships in English, German, French, Spanish and Italian.