Trader Information
Back to topOverview
Back to topImprontus Privacy and Consent Compliance is an enterprise-grade privacy and consent management platform built natively for Adobe Commerce and Magento Open Source. It delivers production-ready compliance with CCPA/CPRA, GDPR, and LGPD — plus any region-specific privacy regulation — without external SaaS dependencies, GeoIP databases, or recurring per-visitor fees.
Deploy once and equip your storefront with a fully customizable cookie consent banner, Google Consent Mode v2 integration, automated script gating, customer Data Subject Access Request (DSAR) workflows, and complete audit logging — all engineered to the highest Magento 2 coding standards (PHP 8.1+, strict types, service contracts, modern controller interfaces, declarative schema).
Why Choose Improntus Privacy Compliance?
- Full California Privacy Coverage (CCPA / CPRA) — One-click opt-out of sale, opt-out of share, account deletion, and personal data download from the customer’s My Account area. EAV-backed customer attributes ensure preferences persist and integrate cleanly with third-party data warehouses and marketing platforms.
- GDPR & LGPD Ready — Article 15 (access), Article 18 (restriction of processing), and Article 21 (object to marketing) supported out of the box, plus configurable response deadlines for LGPD (Brazil) and any jurisdiction with a statutory response window.
- Global Privacy Control (GPC) — Automatic detection and honoring of the GPC browser signal at the cookie banner level, fully logged for audit and regulator inquiries.
- Zero External Dependencies — No GeoIP database to license, no SaaS calls, no recurring per-visitor fees. Everything runs inside your Magento installation.
- Hyva-Friendly Architecture — Built with standard Magento layout XML and lightweight Knockout, compatible with both Luma and Hyva theme stacks.
Features
Cookie Consent Banner & Categories:
- Five granular consent categories: Necessary, Functional, Analytics, Marketing, and Personalization — each with configurable titles and descriptions per store view.
- Two display modes: a simple accept/reject banner for low-friction compliance, or a full Customize panel for granular per-category control.
- Configurable positioning (top, bottom, side) and full per-store content overrides via database.
- HMAC-signed cookie protects consent decisions from client-side tampering.
- Automatic re-consent enforcement when your privacy policy version changes.
- Guest-to-customer linkage — anonymous consent decisions automatically link to the customer account upon registration or login.
Google Consent Mode v2 Integration:
Automatically emits the gtag('consent', 'default', …) signal in the page <head> before Google Analytics or Google Tag Manager loads, ensuring Google’s tags initialize in the correct consent state from the very first request.
- Sends 'update' signals dynamically as visitors change their preferences.
- Configurable mapping between your consent categories and Consent Mode flags: ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage, personalization_storage, security_storage.
- Optional regional restriction (ISO country list) to enable Consent Mode only for EEA visitors, reducing overhead for non-regulated traffic.
Consent-Triggered Script Gating:
Block third-party scripts (Google Analytics, Meta Pixel, GTM, HotJar, chat widgets, retargeting tags, etc.) from loading until the visitor grants consent. Three flexible integration paths cover every use case:
- Layout XML — drop a ScriptGate block into any layout file with category, src, async, and body arguments.
- HTML markup — add type="text/plain" and data-improntus-consent="category" attributes to any existing script tag.
- JavaScript API — use window.improntusPrivacy.hasConsent() and onConsentChange() in your own code.
Inert scripts are activated only after the matching category receives consent. The Necessary category is always active and never gated.
Customer Data Subject Rights (DSAR):
- Download personal data — CSV export of all customer data (GDPR Art. 15) available from the customer’s My Account area and as a CLI command (improntus:privacy:export).
- Account anonymization — comprehensive anonymization of customer entity, orders, quotes, reviews, wishlists, gift registries, and newsletter subscriptions. CLI command (improntus:privacy:anonymize) plus admin approval queue.
- Order-level anonymization — customers can anonymize individual orders without deleting their account.
- Configurable protected order statuses — skip anonymization for orders in active fulfillment.
- Step-up authentication — sensitive privacy actions require an elevated 5-minute authenticated session (password re-entry), protecting against session hijacking.
- Extensibility events — before/after anonymization hooks let you integrate with CRM, ERP, or data warehouse systems.
Admin Privacy Center:
A dedicated admin area under Customers → Data Privacy Center gives compliance officers and store administrators full control:
- Privacy Policy management — version-controlled policies; only one enabled at a time; automatic re-consent triggered when versions change.
- Consent Checkboxes editor — create per-location consent prompts (registration, checkout, contact form, newsletter) with country scoping (All / EEA only / custom list) and legal basis per checkbox.
- Consent Log grid — searchable record of every accept/reject decision with IP, source, policy version, legal basis, and timestamp.
- Action Log (audit trail) — complete human-readable trail of every customer privacy action.
- Delete Requests queue — mass Approve/Deny with admin comments; pending count visible in the dashboard footer.
- Dashboard KPI widget — delete-request trend, 30-day opt-out rate, and 7-day consent acceptance rate at a glance.
- Configurable admin notifications — email alerts on new deletion requests with fully customizable templates.
Location-Based Compliance (No GeoIP Required):
Apply the right regulation to the right visitor without licensing or maintaining a GeoIP database:
- Provider cascade — customer/quote address (shipping → billing → default billing) first, then a manual selection cookie when no address is available.
- Manual location selector banner — visitors declare their country/region when no address can resolve their location.
- Configurable fallback — default country pre-selected when detection fails.
- California-only mode — restrict CCPA features to California residents only.
- Extensible architecture — implement your own LocationProviderInterface and register via DI to plug in MaxMind, Cloudflare headers, or any custom provider.
Compliance Logging & Audit Trail:
- Consent Log — every accept/reject decision recorded with customer ID, IP, policy version, source, legal basis, and timestamp.
- Action Log — all customer privacy actions logged: data downloads, opt-out toggles, deletion requests, anonymization, GPC honors.
- Audit CLI — consolidated per-customer audit trail (improntus:privacy:audit:trail) for compliance officers and DPOs.
- Automated retention — daily cron-based cleanup with configurable retention window (default 365 days), batched in 1,000-row chunks to prevent lock contention.
REST API & Headless Compatibility:
Full REST API exposure for headless storefronts, PWA Studio, and external integrations.
Automation & Cron Jobs:
- Log retention cleanup — prunes old consent and action log entries on a configurable schedule.
- Automatic delete request creation — enqueues deletion requests for customers inactive beyond a configurable threshold.
- Automatic order anonymization — anonymizes orders older than the configured retention window.
Technical Specifications
- Magento Compatibility: Adobe Commerce and Magento Open Source 2.4.6, 2.4.7, and 2.4.8.
- PHP Compatibility: PHP 8.1, 8.2, 8.3.
- Performance-first: batched bulk operations, eager-loading collections, no N+1 query patterns.
- Security-hardened: ACL on every admin controller, escaped output, HMAC-signed cookies, step-up authentication for sensitive actions, no ObjectManager in business logic.
- Event-driven extensibility: public events for anonymization hooks, custom consent locations, and customer linkage.
Support & Documentation
The module ships with a comprehensive installation guide, script gating documentation, and location resolver architecture documentation. For commercial support, custom feature development, and consulting, contact Improntus — a certified Adobe Gold Partner with over a decade of experience delivering enterprise-grade Magento solutions.
Technical Specifications
Back to topSeller profile
Seller contact
Current Version
1.0.0
Adobe Commerce platform compatibility
Adobe Commerce (cloud): 2.4 (current)
Adobe Commerce (on-prem): 2.4 (current)
Magento Open Source: 2.4 (current)
Type
Stable Build
Updated
22 June, 2026
Categories
Extensions, Marketing
Documentation
License Type
GNU General Public License 3.0 (GPL-3.0)
Policy
Quality Report
Back to topAll tests were conducted on the latest versions of Adobe Commerce that existed for the compatible release lines at the moment of the extension submission. Latest versions of all other software were used, as applicable.
Release Notes
Back to top1.0.0:
- Compatible with Adobe Commerce (cloud) : 2.4
- Compatible with Adobe Commerce (on-prem) : 2.4
- Compatible with Magento Open Source : 2.4
- Stability: Stable Build
-
Description:
Initial version
Support
Back to topThe best place to start if you need help with a specific extension is to contact the developer. All Adobe Commerce developers have both a contact email and a support email listed.
Contact Vendor