Cookie banner compliant with Federal Law No. 152, featuring proof of consent and script blocking

What this solution does

A standard cookie notification is insufficient if metrics, advertising pixels, and other third-party services continue to load after a user declines. This module enables consent collection by category, prevents the loading of confirmed third-party services until the user grants permission, and stores user decisions in a server-side consent log. Consequently, the site owner receives not merely a cookie banner but a tool for managing consent and complying with data processing requirements. If a user declines, scripts can be genuinely blocked. The module analyzes the rendered page before sending it to the browser and suspends the loading of third-party services for which consent has not yet been obtained. Blocked resources include external and embedded scripts, iframes, images, and other assets. The solution also handles inline loaders, such as when a component dynamically creates a third-party script during page execution. Once consent is granted, authorized services load. The user's choice affects not only the cookie record of the banner but also the actual loading of third-party code.

Full control over data processing consent

The module replaces the simplified 'agree to all' option with detailed settings. Consent is divided into four categories: necessary, analytical, marketing, and external services. Files in the first category remain active at all times. Users can allow or decline the remaining groups separately. Available scenarios include accepting all settings, declining optional categories, or creating a custom set of permissions.

Automatic detection of third-party services

Analytics systems and widgets are often scattered across templates, components, included areas, or the code of individual pages. The module scans the site and recognizes popular external services. The signature database contains 16 variants, including Yandex.Metrica, Google Analytics, GTM, Microsoft Clarity, Roistat, Calltouch, CoMagic, VK Pixel, YouTube, Rutube, Yandex.Maps, Google Maps, and JivoSite.

Managing detected connections

Detected services are displayed in a separate section. Administrators see the service name, page, resource type, and detection count. Actions available for each connection include confirming, ignoring, or changing the category. Group operations are supported to process multiple findings simultaneously.

The 152-FZ Cookie Banner module with consent verification and script blocking is designed with safety as a priority. Newly detected services are not blocked automatically; an administrator must first review and confirm them. This approach prevents the sudden disabling of working analytics or widgets after installation.

The system maintains a detailed server-side consent log. Entries record the date, site address, visitor data, decision made, allowed categories, privacy policy version, action source, and page. Optionally, IP addresses, User-Agent strings, and links to authorized Bitrix users can be stored.

The log preserves not only the policy version number but also a snapshot of the actual text displayed at the moment of consent, including the header, notification, category list, and buttons. This ensures that even if site text changes a month later, the exact version the user interacted with remains recorded.

Log entries are secured via an HMAC-SHA256 hash chain. Altering an old event would break the chain of subsequent records, making the log a robust proof of consent that surpasses a simple 'consent received' marker.

The banner can be customized to match the specific design and requirements of the site.

Core settings are managed in the Bitrix administrative panel. You can edit the banner and settings window text, button labels, the privacy policy link, color schemes, the refusal button style, banner position, and display delay. The module includes 55 configuration parameters for each site individually and supports Bitrix multisite architecture. Standard installation does not require modifying site templates, as the banner connects automatically.

Third-party code management is implemented in two ways. If analytics counters and widgets are already on the site, the module detects them in the rendered page and controls their loading. For new services, code can be entered directly into the module settings using dedicated fields for analytics, marketing, and external services. This code executes only after consent is granted for the corresponding category. This approach avoids restructuring an existing site while allowing all new integrations to be managed centrally through the module.

Data remains on your site. The module does not require any external cloud services to function.

Consent data is stored in the site's local database. The module code contains no outgoing requests to transmit activity logs to a third-party operator; all records are written to the site's own address.

The site owner receives an automated workflow: displaying the choice, obtaining consent, blocking prohibited services, saving the decision, and viewing the consent history if needed.

The module helps organize cookie and third-party service management in compliance with user consent and personal data processing requirements. The solution does not guarantee full compliance with Federal Law 152-FZ through a single installation, as requirements depend on site forms, privacy policies, the scope of collected data, and integrated services. The primary function of the module is to correctly organize cookie consents and manage the loading of third-party services within the 1C-Bitrix platform.

General iT can handle the implementation of “Cookie banner compliant with Federal Law No. 152, featuring proof of consent and script blocking”, from installation to configuration and compatibility checks.