Cookie consent according to the new requirements of Federal Law No. 152 (cookies, consent log, blocking of Yandex.Metrica)

What this solution does

A simple cookie notice no longer guarantees protection against fines

Many websites still rely on outdated formats: a pop-up window with a single 'Accept' button or a footer statement implying that continued site usage constitutes consent to cookies. While this was previously sufficient, Roskomnadzor and courts now consider such wording inadequate. These notices inform users about cookies but fail to record explicit visitor consent.

If the site uses Yandex.Metrica, a social network pixel, or an online chat widget, personal data processing begins from the very first second of a visit. The module collects cookie consent in strict compliance with Federal Law 152-FZ and automatically logs each confirmation in the 1C-Bitrix audit journal. Installation and basic configuration take approximately 15 minutes and do not require a programmer.

The MACHAON module ensures compliance with 152-FZ requirements by managing consent for personal data processing through a pop-up window. The interface includes buttons for refusal, settings configuration, and consent confirmation.

Under the law, the combination of a cookie and an IP address is classified as personal data. Analytics counters transmit the IP address, browser and device version, cookie identifiers, and user actions such as clicks, scrolling, and goal completions. Collectively, these data points allow for the identification of a specific visitor, necessitating explicit consent for their processing.

Consent must be specific, informed, conscious, and unambiguous. This requires the user to clearly understand what data is collected and why. Confirmation is granted only by pressing a button; scrolling, closing the window, or inaction do not constitute consent. The procedure for refusal must be as simple as granting consent. Checkboxes must not be pre-selected; the user must choose them independently. Access to site functionality must not depend on consent for analytics or advertising.

Consent is not required for technically necessary cookies that ensure session management, cart functionality, authorization, and form protection. Without these files, the site cannot open the cart or provide access to the personal account.

Analytical and advertising cookies collect data for the website owner: Yandex.Metrica, webvisor, social media pixels, retargeting, call tracking, and online chats. User consent is required for their operation. Until such consent is obtained, these services must not collect data.

The module ensures compliance with Federal Law No. 152-FZ by managing consent for personal data processing. It records the visitor's choice in a consent log, enabling the site owner to demonstrate the legal basis for data collection upon request from Roskomnadzor. The module also controls third-party services, including blocking Yandex.Metrica until the user provides consent.

The User Consent Journal is available in the Agreements section.

The data controller, meaning the website owner, bears responsibility for compliance with Federal Law 152-FZ. This liability does not transfer to the contractor who developed the site; the developer is liable to the client solely under the terms of the contract.

Penalties for violating Article 13.11 of the Code of Administrative Offenses of the Russian Federation have increased significantly. Processing personal data without legal grounds entails the following fines:

For a first violation:

Legal entity: 150,000 to 300,000 rubles.

Individual entrepreneur: 50,000 to 100,000 rubles.

Official: 50,000 to 100,000 rubles.

For a repeated violation:

Legal entity: 300,000 to 500,000 rubles.

Individual entrepreneur: 300,000 to 500,000 rubles.

Official: 100,000 to 200,000 rubles.

In addition to the fine, the regulator issues an order to eliminate the violation within a specified timeframe.

Module Operation

The module ensures compliance with the law through four steps.

1. Banner display. Upon the first visit, a window with three buttons appears in the corner of the screen. Refusal of data processing is possible with a single click.

2. Category selection. The Configure button opens a window with toggles. Mandatory cookies are always enabled. Analytical and marketing cookies are disabled by default and are activated only after explicit selection by the visitor.

The module ensures compliance with 152-FZ requirements by managing cookie consent, maintaining a consent log, and blocking Yandex.Metrica until permission is granted.

The settings window disables analytics and marketing by default. Counters wait for explicit user consent: until confirmation is received, Yandex.Metrica does not send statistics or set its own cookies. All consents are recorded in the log within the Agreements section, where each entry displays the date, time, IP address, page, and selected categories.

Interface configuration is performed in the admin panel without developer involvement. The visual editor allows modification of the title, main text, and button labels, as well as insertion of a link to the privacy policy. The window appearance is adapted to the corporate style: screen position, font size, margins, corner rounding, transparency, and eight color parameters are adjustable. The display delay is set in seconds.

The module ensures compliance with Federal Law No. 152-FZ regarding cookie usage. It manages the display of consent notifications, maintains a log of recorded user decisions, and enables blocking of data transmission to Yandex.Metrica until explicit permission is granted. The functionality includes configuration of dialog window appearance and color scheme parameters for integration with the site design.

The module ensures compliance with 152-FZ requirements for cookie processing. It manages the consent popup, controls the loading sequence of analytics counters, and maintains a consent log within the standard Agreements section of the 1C-Bitrix platform. This approach helps avoid fines from the Federal Service for Supervision of Communications, Information Technology and Mass Media, as regulatory checks begin with these specific elements.

The solution addresses the issue where website owners completely disable Yandex.Metrica due to fear of violations. With this solution, analytics continues to function for users who have given consent, preserving access to data on traffic sources, goals, and conversions. Meanwhile, visitors who decline tracking can still complete purchases and submit inquiries.

The consent popup appearance is customizable to match the website's corporate style, ensuring it integrates seamlessly with the design. The module eliminates common errors: counters do not load before consent is obtained, users can decline via the site interface rather than only through browser settings, and there is a clear mechanism for explicitly confirming consent.

The solution resolves six typical scenarios of non-compliance with the law that frequently occur even when a consent popup is present on a website.

The module ensures compliance with current requirements of Federal Law No. 152-FZ regarding cookie usage. Its functionality includes maintaining a consent log and the ability to block Yandex.Metrica when user permission is not granted.

Technical specifications

The solution is designed for multi-site projects and operates correctly in the composite mode of the 1C-Bitrix platform. It supports PHP 8 environments and current versions of the CMS. The module is compatible with popular ready-made templates such as Aspro, Sotbit, Intec, as well as websites with custom designs.

To ensure performance, the scripts are written in native JavaScript without third-party libraries, preventing additional page weight.

About the developer

MACHAON Digital is a Gold Partner of 1C-Bitrix and holds accreditation from the Ministry of Digital Development. The company portfolio includes over 420 implemented projects, including solutions for government organizations where strict requirements apply to personal data processing.

If “Cookie consent according to the new requirements of Federal Law No. 152 (cookies, consent log, blocking of Yandex.Metrica)” fits the task, General iT can install the module, configure it and verify the result in the project.