Yablonsky Cookie Consent for Frappe is a self-hosted cookie consent banner and Google Consent Mode v2 integration app for Frappe and Frappe Builder websites.
Current release: v1.0.0
Developed and maintained by Yablonsky.io.
Yablonsky Cookie Consent for Frappe helps Frappe site owners manage cookie consent, Google Consent Mode v2, Google Tag Manager loading, and public website tracking behaviour from a Frappe-native admin interface.
It is designed for self-hosted Frappe websites that need practical cookie consent controls without hardcoding client-specific text, local domains, tracking IDs, or custom scripts directly into the public app source.
Frappe has flexible website, Web Form, and scripting capabilities, but cookie consent and Google tracking control often become difficult to maintain across real production websites.
A typical Frappe website may use:
- standard Frappe Website pages;
- Frappe Builder pages;
- Web Forms;
- CRM lead capture;
- Google Tag Manager;
- Google Analytics;
- Google Ads conversion tracking;
- custom Website Settings snippets;
- custom Builder head or body code;
- page-specific scripts or templates.
Without a dedicated consent layer, tracking scripts can easily be duplicated, loaded before consent, or scattered across several places in the site configuration.
This app solves that problem by providing a Frappe-native cookie consent layer that can be configured from Desk, reused across public pages, and kept separate from site-specific copy, styling, and tracking IDs.
Use this app when you need:
- a self-hosted cookie consent banner for Frappe websites;
- Basic Google Consent Mode behaviour;
- controlled Google Tag Manager loading after consent;
- configurable banner text, policy links, layout, and custom CSS;
- a reusable open-source app that does not hardcode client-specific values;
- a practical alternative to manually managing consent snippets across multiple Frappe pages.
The app deliberately avoids acting as legal advice, a certified CMP, or a replacement for a full privacy compliance programme.
The app displays a public cookie consent banner with clear user actions:
- Accept all;
- Reject non-essential;
- Cookie settings;
- Save preferences.
The banner supports configurable text, labels, links, and styling through Frappe Desk settings.
The public v1.0.0 release supports common consent categories:
- Necessary;
- Analytics;
- Marketing.
Necessary cookies should remain enabled for security and core website functionality.
The app supports Google Consent Mode v2 parameters used by Google Analytics, Google Tag Manager, and Google Ads setups.
Supported consent parameters include:
analytics_storage
ad_storage
ad_user_data
ad_personalization
functionality_storage
security_storage
personalization_storage
The public v1.0.0 core release focuses on Basic Consent Mode:
- Google Tag Manager is not loaded before consent.
- Analytics and marketing scripts managed by the app are blocked before consent.
- Consent defaults are denied before managed Google tags are loaded.
- Consent updates are applied after the user makes a choice.
Any Google tags hardcoded outside this app should be removed by the site owner.
The app can be used with Frappe Builder websites when the consent loader or relevant asset includes are added through the site or Builder head configuration.
This helps keep Builder pages and standard Frappe Website pages aligned under the same consent logic.
Site owners can adjust the banner visually through settings.
This allows local visual customisation without adding project-specific CSS to the public app source.
The frontend reads public consent configuration from the app API. This keeps public pages dynamic while allowing site owners to manage settings in Desk.
The app can support server-side consent logging depending on configuration.
Logs should be used for operational review and should not contain secrets.
Yablonsky Cookie Consent for Frappe does not:
- provide legal advice;
- guarantee GDPR, ePrivacy, Google Ads, or GA4 compliance by itself;
- guarantee Google Ads account, campaign, or landing page approval;
- act as a Google-certified CMP;
- implement IAB TCF;
- replace a Google-certified CMP for publisher monetization products such as AdSense, Ad Manager, or AdMob;
- generate Privacy Policy or Cookie Policy pages automatically;
- manage personal-data consent for lead forms;
- store lead form data such as name, phone, email, uploaded images, or customer request details;
- automatically remove tracking scripts that were manually hardcoded elsewhere;
- manage every possible third-party script on a site;
- replace a full privacy compliance review.
- Frappe Framework v16.
- A working Frappe bench and site.
- Access to Desk / Admin.
- Public website pages where the cookie banner should appear.
- Google Tag Manager, Google Analytics, or Google Ads only if you want to use Google consent features.
No external database, SaaS backend, or third-party consent platform is required.
- Frappe Framework v16.x.
- Frappe Website pages.
- Frappe Builder pages.
- Ubuntu-based production bench environment.
- Google Tag Manager container loading through consent-controlled logic.
ERPNext is not required.
The app is expected to work on ERPNext v16 sites that run on Frappe Framework v16, because it works at the Frappe website, Desk settings, and public asset layer rather than depending on ERPNext-specific DocTypes.
Frappe Builder pages may require adding the consent loader or app assets through Builder global head configuration, depending on the site setup.
Standard Frappe Website pages and Frappe Builder pages should be tested separately, because they may use different rendering and asset-loading paths.
A simplified flow:
Public page loads
|
Consent app fetches public configuration
|
Default non-essential consent is denied
|
Cookie banner is shown if no stored preference exists
|
User accepts, rejects, or saves preferences
|
Preference is stored in cookie and localStorage
|
Google consent state is updated
|
Managed Google Tag Manager loading follows the selected consent state
The app separates:
- reusable public app code;
- site-specific text and policy links;
- site-specific Google Tag Manager ID;
- site-specific custom CSS;
- public frontend behaviour;
- optional server-side logging.
From your Frappe bench:
cd ~/frappe/your-bench-name
bench get-app frappe_cookie_consent https://github.com/Alex-Yablonsky/yablonsky-cookie-consent
bench --site your-site.example.com install-app frappe_cookie_consent
bench --site your-site.example.com migrate
bench build --app frappe_cookie_consent
bench --site your-site.example.com clear-cache
bench restartIf your bench version does not accept the app-name argument in bench get-app, use the repository URL directly:
bench get-app https://github.com/Alex-Yablonsky/yablonsky-cookie-consentThen install the app using the internal Frappe app name:
bench --site your-site.example.com install-app frappe_cookie_consentIf the app is already installed on a site and you are updating local code:
cd ~/frappe/your-bench-name/apps/frappe_cookie_consent
git pull
cd ~/frappe/your-bench-name
bench --site your-site.example.com migrate
bench build --app frappe_cookie_consent
bench --site your-site.example.com clear-cache
bench restartIf you use Cloudflare or another caching layer, purge the cache after asset or JavaScript changes.
Open Desk and search for:
Frappe Cookie Consent Settings
Direct admin URLs usually look like:
/app/frappe-cookie-consent-settings
or:
/desk/frappe-cookie-consent-settings
The exact route may depend on the Frappe version and Desk routing configuration.
Configure the app from Frappe Cookie Consent Settings.
Recommended first setup:
| Field | Recommended value | Description |
|---|---|---|
| Enabled | 1 |
Turns the public cookie banner on. |
| Site Mode | production |
Use production mode for live sites. |
| Default Language | en |
Public defaults are English. Local text can be configured per site. |
| Policy Version | v1.0.0 or date-based value |
Helps identify the policy version used for consent. |
| Privacy Policy URL | /privacy-policy |
Link to your privacy policy page. |
| Cookie Policy URL | /cookie-policy |
Link to your cookie policy page. |
| Terms URL | optional | Link to your terms page if used. |
| Google Consent Mode Enabled | 1 |
Enables Google consent state handling. |
| Google Consent Mode Mode | basic |
Recommended for the public v1.0.0 release. |
| Google Tag Manager Enabled | 1 if GTM is used |
Allows consent-controlled GTM loading. |
| Google Tag Manager ID | your GTM container ID | Example format: GTM-XXXXXXX. Do not hardcode it in source files. |
| Block Non-essential By Default | 1 |
Blocks analytics and marketing before consent. |
| Debug Mode | 0 |
Keep off in production unless troubleshooting. |
| Server-side Consent Log Enabled | optional | Enable only if you need operational consent logs. |
| Anonymize IP in Logs | 1 |
Recommended when logs are enabled. |
| Custom CSS Class | optional | Adds a custom class for site-specific styling. |
| Custom CSS | optional | Adds site-specific CSS from settings, not from public source code. |
Before using the app for Google Ads, GA4, or GTM readiness, remove Google tracking scripts from:
- Frappe Website Settings;
- Website Theme custom code;
- Frappe Builder global head or body code;
- custom HTML blocks;
- hardcoded templates;
- third-party injected snippets;
- page-specific script fields.
Then add the GTM Container ID only through Frappe Cookie Consent Settings.
This helps avoid duplicate Google tags and prevents unmanaged scripts from loading before consent.
Use this when you only need a visible consent banner and local cookie preferences.
Recommended setup:
- Enable the app.
- Configure banner title and message.
- Add Privacy Policy and Cookie Policy URLs.
- Keep Google Tag Manager disabled if you do not use Google tags.
Use this when your site uses GTM for analytics and advertising tags.
Recommended setup:
- Enable Google Consent Mode.
- Set Google Consent Mode Mode to
basic. - Enable Google Tag Manager.
- Add your GTM Container ID.
- Remove hardcoded GTM snippets from other places.
- Test before and after accepting or rejecting cookies.
Use this when your public pages are rendered by Frappe Builder.
Recommended setup:
- Confirm the banner appears on Builder pages.
- Confirm the banner appears on standard Frappe Website or Web Form pages if both are used.
- If Builder pages use a separate global head configuration, add the consent loader there.
- Purge external cache after changing frontend assets.
This app manages cookie and tracking consent. It does not replace form-level consent for personal data processing.
If your Frappe site collects personal data such as name, phone, email, requested product details, descriptions, or uploaded images, that should be handled by your Web Form, CRM, Contact Form app, or business-specific DocType.
Those forms should include their own data processing notice or consent checkbox where required.
Rejecting analytics or marketing cookies must not block necessary form submission, CSRF protection, or security functionality.
The public app ships with generic English defaults.
Site owners can configure local labels and copy through settings, for example:
- banner title;
- banner message;
- Accept all label;
- Reject non-essential label;
- Cookie settings label;
- Save preferences label;
- category labels;
- category descriptions;
- policy links.
Do not hardcode local language strings into the public app source.
The app includes a clean default frontend style.
For site-specific styling, use settings such as:
- Custom CSS Class;
- Custom CSS;
- theme-level CSS in the target site if needed.
Do not add client-specific visual rules, local brand colours, or production-site CSS directly to the reusable public app source.
The public frontend uses whitelisted API methods from the frappe_cookie_consent.api module.
Important public configuration method:
frappe_cookie_consent.api.get_public_config
This method provides public settings needed by the frontend banner and consent logic.
Other consent-related API methods are defined in the app source and should be reviewed before custom integration.
Do not expose secrets, private tokens, or local configuration values through public API responses.
Yablonsky Cookie Consent for Frappe follows a conservative frontend-consent security model.
Public configuration must not contain:
- API keys;
- secret tokens;
- private credentials;
- production-only internal identifiers;
- client-specific confidential data.
Site-specific values such as policy URLs, banner text, GTM ID, and custom CSS should be configured in Desk settings.
They should not be hardcoded in the public repository.
Rejecting analytics or marketing cookies should not block:
- CSRF protection;
- login security;
- form submission;
- basic website routing;
- security-related cookies.
In Basic Consent Mode, managed Google Tag Manager loading should happen only after the user gives the required consent.
Hardcoded Google scripts outside the app can bypass this behaviour and should be removed by the site owner.
If configuration cannot be loaded, the app should avoid loading managed non-essential tracking scripts.
Debug mode should be used only for troubleshooting.
Before enabling the app on a live production site:
- confirm the app is installed and listed in
bench --site your-site.example.com list-apps; - confirm
Frappe Cookie Consent Settingsopens in Desk; - enable the app only after configuring banner text and policy links;
- remove duplicate Google snippets from Website Settings, Builder, themes, templates, and custom HTML blocks;
- add the GTM Container ID only through Cookie Consent Settings;
- test the site before accepting cookies;
- test the site after accepting all cookies;
- test the site after rejecting non-essential cookies;
- confirm GTM is not loaded before consent in Basic Mode;
- confirm GTM is loaded after accepting relevant consent;
- confirm forms still submit when analytics and marketing cookies are rejected;
- clear Frappe cache;
- rebuild assets if frontend files changed;
- purge Cloudflare or external cache if used;
- keep Debug Mode disabled in production;
- review Privacy Policy and Cookie Policy text with appropriate legal support.
Internal Frappe app name:
frappe_cookie_consent
Public product name:
Yablonsky Cookie Consent for Frappe
GitHub repository:
yablonsky-cookie-consent
Run basic Python compile checks:
python3 -m compileall frappe_cookie_consentTypical release flow:
git status
git add .
git commit -m "Describe the change"
git tag -a vX.Y.Z -m "Yablonsky Cookie Consent for Frappe vX.Y.Z"
git push origin main
git push origin vX.Y.ZBefore publishing, run public hygiene checks for site-specific strings, secrets, local domains, and non-public setup notes.
- Added Frappe-native Cookie Consent Settings.
- Added public cookie consent banner.
- Added Necessary, Analytics, and Marketing consent categories.
- Added Basic Google Consent Mode v2 support.
- Added consent-controlled Google Tag Manager loading.
- Added configurable banner copy, button labels, category text, and policy links.
- Added Custom CSS support through settings.
- Added public configuration API.
- Added documentation for installation, configuration, Google Consent Mode, Google Ads / GA4 validation, privacy limitations, and development context.
- Kept public app source generic and free from client-specific configuration.
Possible future improvements:
- advanced Google Consent Mode support;
- multi-language text profiles;
- per-site or per-language consent text presets;
- improved consent log review UI;
- export tools for consent logs;
- more granular script categories;
- optional helpers for common analytics providers;
- improved Frappe Builder integration helpers;
- automated validation diagnostics;
- additional frontend layout options.
These items are possible future improvements, not guaranteed commitments.
See:
- Installation
- Configuration
- Google Consent Mode
- Google Ads / GA4 Validation
- Privacy and Limitations
- Development Context
Developed and maintained by Yablonsky.io.
For business automation, AI, SEO and Frappe-related projects, visit Yablonsky.io.
AI tools and automation platform: ai.yablonsky.io
Yablonsky Cookie Consent for Frappe is an independent open-source project and is not affiliated with, endorsed by, or sponsored by Frappe Technologies Pvt. Ltd.
Frappe, ERPNext, and related product names are trademarks of their respective owners. They are used here only to describe compatibility with the Frappe Framework ecosystem.
MIT