Introduction
Since the 'cookie ruling' of the European Court of Justice on October 1, 2019, website operators have been startled: Which consents must now be obtained? What are the consequences of ignoring it? This article summarizes the most important information.
Please note: we cannot and must not provide legal advice. If you have any questions, you should therefore contact a lawyer.
What is it all about?
Simply put: if you want to track the behavior of a website visitor across several pages, you need the prior express and voluntary consent of the visitor. A notice stating "Our website uses cookies" is not sufficient.
Not only cookies are affected, but all technical measures with which a user can be tracked and third-party services are used for this purpose. This includes techniques such as browser fingerprinting and the local memory of the browser.
All elements in which data (e.g. the IP address) is transmitted to a third-party provider are affected. These include Google Analytics, Google Fonts, Google Maps, YouTube, Vimeo, Facebook Pixel, etc.
Cookies that are technically necessary for the operation of the website may be used without the visitor's consent. For example, for the shopping cart in online stores or a login function.
Important change since 1.12.2021: With the entry into force of the new "Act on Data Protection and the Protection of Privacy in Telecommunications and Telemedia" (TTDSG) only technically necessary cookies may be set without the prior active consent of the visitor in accordance with §25. This now also includes cookies that are set by the statistics software Matomo. These were previously classified as technically necessary by the data protection authorities. We therefore recommend using the option to use Matomo without cookies.
General information
A standard TYPO3 installation (version 6.2 and higher) does not use cookies at all in the frontend. Cookies are only used for the login to the TYPO3 backend. However, as these are necessary and normal visitors to the website do not come into contact with them, they are not relevant.
Cookies in the frontend are usually set by additionally integrated third-party tools such as Google Analytics, Matomo, Facebook Pixel, eTracker or similar.
So if your TYPO3 installation does not use such tools, it is highly likely that no cookies are set in the frontend and you therefore do not need a cookie banner.
How do I find out whether my website sets cookies?
There are several ways to do this.
You can use an external tool such as cookieserve.com.
You can also look in the developer console of your web browser. It is best to open your website in an incognito window to avoid "interference" from any installed browser plugins.
Example in the Chrome browser:
- Open incognito window (File -> New incognito window)
- Call up domain
- In an empty area of the website, right-click with the mouse and click on "Inspect" in the context menu that opens
- Click on "Application" in the lower area
- In the lower left area below "Storage", click on the small arrow next to "Cookies", then click on the domain
- In the larger area at the bottom right, you will now see all the cookies currently in use. If this area is empty, no cookies are being used.
Solutions
There are several paid and free extensions or external tools that can be used to implement a cookie opt-in/opt-out. We have tested some of them and try to compare the advantages and disadvantages of these solutions here. This page is intended to help you decide which option is right for your TYPO3 website. However, the overview of available solutions is not comprehensive.
Extension om_cookie_manager
https://extensions.typo3.org/extension/om_cookie_manager
https://olli-machts.de/en/extension/cookie-manager
License: Open Source (Free of charge)
Functions:
The extension creates a banner in which the user can accept or reject cookies. Different cookies can be combined into groups, for example "Analytics" or "Marketing". Consent (opt-in) or rejection (opt-out) can be given per group.
The groups and cookies must be created in the backend as data records in a system folder. If a cookie is generated by a JavaScript (e.g. Matomo, Facebook Pixel), the JavaScript must also be loaded via this data record.
In addition, the extension offers a plugin that can be integrated as a content element on a page and shows a list of the cookies used and offers the option of calling up the cookie banner again if you want to change your settings.
Advantages of the extension:
- Very good documentation
- Relatively easy to install
- Multilingualism is supported
- Standard CSS looks good, customization is of course possible
- With a subsequent opt-out (i.e. the subsequent rejection of cookies), JavaScripts from external tools (e.g. Matomo, Google Analytics or similar) are no longer loaded.
Disadvantages of the extension:
- Installation via Composer currently only possible via the Github repository (alternatively, in non-Composer installations, installation is also possible "classically" via the Extension Manager)
- Explanatory texts for the cookies must be written by the user. This may require more extensive research, depending on the type and quantity of cookies used
- In the case of a subsequent opt-out (i.e. the subsequent rejection of cookies), the cookies set are not deleted (but JavaScripts from external tools such as Matomo, Google Analytics or similar are no longer loaded).
Extension cookieman
https://extensions.typo3.org/extension/cookieman
https://github.com/dmind-gmbh/extension-cookieman/
License: Open Source (free of charge)
Functions:
The extension integrates either a modal window or a banner. Themes for Bootstrap 3 and 4 are included. You can also define your own themes.
Advantages:
- Example configurations are provided for some common cookies, but these must be adapted.
- Listing of configured cookies directly in the banner
- Multilingualism is supported
- For websites based on Bootstrap 3 or 4, no adjustments to the CSS are necessary
Disadvantages:
- The cookies are configured exclusively in the TypoScript setup and requires appropriate knowledge.
- The configuration of the cookies appears somewhat complex and requires a certain amount of time
- For websites that use Bootstrap 3 or 4, the supplied themes can be used directly without further adjustments. For all other websites, a relatively complex creation of a custom theme is necessary. Although this is described in the documentation, it takes some time.
- Explanatory texts for the cookies must be written by the user. More extensive research may be necessary here, depending on the type and quantity of cookies used
Update from 24.01.2020
The following message from the developers reached us on 22.01.2020 and refers to version 2.3.9 and higher:
- The extension now actively removes cookies if consent is not given or withdrawn
- There are now sample configurations for Bing/Matomo/Google/Analytics/Google TagManager/eTracker and the TYPO3 FE and cookieman cookies
- all texts for these are included and translatable via the Crowdin translation platform
Extension sg_cookie_optin
https://shop.sgalinski.de/products/9/typo3-cookie-opt-in-extension (affiliate link)
License: subject to a fee (from 59.99 Euro/year/domain, or lifetime license/domain (price incl. VAT))
Functions:
With this extension, the cookies, JavaScripts or HTML codes used can be configured via a separate backend module. Various groups (e.g. analytics, marketing etc.) can be created here and scripts and cookies can then be defined within these groups, which should only be loaded after opt-in.
The appearance of the cookie banner can also be customized in this backend module.
Visitors can view detailed information on the individual cookies directly in the cookie banner.
Advantages:
- Easy to install and configure
- Clear backend module
- Multilingualism is supported
- Colors of the cookie banner can be adjusted directly in the backend module
- Listing of configured cookies directly in the banner
- To enable visitors to change their cookie settings at a later date, a corresponding content element can be placed on a page as a plugin.
- With a subsequent opt-out (i.e. the subsequent rejection of cookies), JavaScripts from external tools (e.g. Matomo, Google Analytics or similar) are no longer loaded.
Disadvantages:
- Subject to a charge
- Explanatory texts on cookies must be written by the user. More extensive research may be necessary here, depending on the type and quantity of cookies used
- In the event of a subsequent opt-out (i.e. the subsequent rejection of cookies), the cookies set are not deleted (but JavaScripts from external tools such as Matomo, Google Analytics or similar are no longer loaded).
Extension dv_t3_consent_management
https://www.davitec.de/cookie-zustimmung/
License: fee-based (200.- Euro plus VAT per domain (single domain installation, prices for multi-domain setups and agencies on request)
Functions:
The extension offers an integrated cookie scanner that checks the frontend for cookies. Identified cookies can then be assigned to a category (e.g. necessary cookies, marketing cookies, etc.). The cookie window is configured accordingly based on the identified cookies.
The configuration of the extension is carried out via a separate backend module. The design of the cookie window can also be easily customized here.
If JavaScript codes for tools such as Matomo, Google Analytics, Facebook Pixel or similar are used, these must be created as an extension data record in a system folder and assigned to one of the categories. In the frontend, the JavaScript code is only loaded (and cookies set accordingly) if the user gives their consent. As a special feature, you can also set whether the codes should only be displayed on certain pages of the website.
The user can edit or revoke their consent at any time. To do this, a line of HTML code, for example as the content element "HTML", must be inserted into the website. This generates a button in the front end that can be used to call up the cookie window again. If the visitor withdraws their consent, cookies that have already been set are also deleted again.
The extension is multi-domain capable, which means that different cookies can be configured for each domain and the design of the cookie window can be customized.
Advantages:
- Easy to install and configure
- Automatic scan of the frontend for cookies
- Cookies found can be configured in the backend module
- Clear backend module
- Multilingualism is supported
- Multidomain capable
- Appearance of the cookie window can be customized in the backend module
- Listing of configured cookies directly in the banner
- The usual categories (incl. explanatory texts) are already preconfigured, but can be customized or extended
- With a subsequent opt-out (i.e. the subsequent rejection of cookies), JavaScripts from external tools (e.g. Matomo, Google Analytics or similar) are no longer loaded and cookies that have already been set are removed again.
Disadvantages:
- Subject to a charge
- Explanatory texts on cookies must be written by the user. This may require more extensive research, depending on the type and quantity of cookies used
Extension wacon_cookie_management
https://github.com/wacon-internet-gmbh/wacon_cookie_management/
License: Open Source (free of charge)
The extension is currently only available on Github.
Functions:
The cookies/scripts used must also be configured manually here. A corresponding data record is created in a system folder for this purpose. The cookies can be assigned to predefined categories. External scripts can also be integrated in this way.
The display of the cookie banner and the cookie settings are controlled via two plugins that are created as content elements on a page. However, these content elements must be displayed on every page, which usually requires a corresponding setup via TypoScript/Fluidtemplates.
Advantages:
- Multilingualism is supported
- Standard CSS is appealing and can probably be used directly in most cases.
- External scripts (e.g. Twitter timeline, Facebook page widget) can be integrated via the extension and only loaded after the visitor's explicit consent. Prior to this, a freely defined text or any image can be displayed at this point. This can also be maintained editorially.
Disadvantages:
- In the test, the extension could not be fully used in TYPO3 9 LTS, the integration of the plugins led to an error message in the frontend. In TYPO3 8 LTS this worked without any problems.
- The CSS is partly too unspecific and could possibly lead to conflicts with existing CSS.
- Explanatory texts for the cookies must be written by the user. More extensive research may be necessary here, depending on the type and quantity of cookies used
Extension we_cookie_consent
https://extensions.typo3.org/extension/we_cookie_consent
License: Open Source (free of charge)
Installation
The extension can be installed as usual via the Extension Manager.
For composer-based installations, composer.typo3.org must be added as a repository in the composer.json of the project, as described here, as the extension is currently (10.03.2020) not registered with Packagist.
Functions:
The cookies/scripts used must be configured manually. A corresponding data record is created in a system folder for this purpose. Predefined scripts are supplied for a number of services such as Matomo, Google Analytics, Facebook Pixel etc.. Only the corresponding ID / API key needs to be added here.
You can also define cookies and scripts that are not supplied or your own cookies and scripts in this way. In addition, you can set when the scripts should be loaded (for example, only after approval, or even before for "necessary" cookies/scripts).
Some basic settings can also be made using the constant editor.
A list of configured cookies can be displayed on the data protection page via a plugin. The cookie banner can also be called up again at any time via a link so that visitors can change their settings.
Advantages:
- Standard CSS is appealing and can probably be used directly in most cases.
- The CSS uses its own namespace and therefore avoids conflicts with existing CSS as far as possible. This also makes it easier to overwrite in your own CSS.
- Predefined scripts for common cookies/applications (Matomo, Google Analytics, Google Tag Manager, Facebook Pixel)
- If you opt out later, cookies that have been set are removed again
Disadvantages:
- Multilingualism is currently not yet supported
- To change the texts in the cookie banner, it is currently sometimes necessary to intervene directly in the JavaScript.
- Cookies/scripts cannot be grouped into categories such as "Necessary", "Marketing", "Statistics" etc.
- Explanatory texts for the cookies must be written by the user. More extensive research may be necessary here, depending on the type and quantity of cookies used
- The extension uses jQuery in the frontend. If the jQuery library is already in use, no adaptation is necessary. Otherwise, jQuery must be integrated. Future versions of the extension should work without jQuery.
Cookiebot
Paid external service
Functions:
Cookiebot is an external service that can be used not only for TYPO3 websites.
Cookiebot automatically scans a website for used cookies at certain intervals. The cookie banner is automatically adjusted after these scans. The recognized cookies are automatically sorted into appropriate categories and provided with explanatory texts, if known in the Cookiebot database. For cookies unknown to the service, this can be done manually.
The recognized scripts are automatically blocked; manual adjustment is only necessary if tools such as the Google Tag Manager are used. The configuration is described in the documentation, but is relatively time-consuming.
A list of all cookies used can be output. This can be displayed on any page, for example the data protection page.
To integrate Cookiebot, two JavaScript snippets must be integrated. The first generates the cookie banner and must be integrated directly at the beginning of the <head> area. The second generates the list of cookies used and can be placed on any page via an HTML content element, for example.
There are now also TYPO3 extensions for the integration of Cookiebot, but in our opinion these are unnecessary, as the necessary JavaScript code can be integrated with 2 lines in the TypoScript setup.
Cookiebot can be used free of charge for small websites (1 domain, less than 100 individual pages). The prices are staggered and start at 9 euros/month/domain (plus VAT)(https://www.cookiebot.com/de/pricing/).
Advantages:
- Very easy to integrate
- Automatic scan of the website for cookies used
- Explanatory texts of known cookies are automatically generated and integrated into the banner
- Regular scan of the website for changed cookies (1 time/month in the free version)
- In our tests, cookies that had already been set were actually deleted in the event of a subsequent opt-out.
Disadvantages:
- The use of Cookiebot may violate the GDPR(preliminary judgment in summary proceedings)
- Use quickly becomes relatively expensive for larger websites or multi-domain setups
- Visual customization of the cookie banner only possible in the paid version
Usercentrics
External fee-based service (price cannot be found on the website)
Functions:
This is also an external service that can be used not only for TYPO3 websites.
When configuring the cookies used, Usercentrics offers a range of predefined settings for common cookies such as Google Analytics, Matomo, YouTube, Vimeo and many more.
However, the scripts of external providers must also be adapted so that the opt-in works.
The cookie banner provides detailed information on the cookies used and also allows consent to be given only to certain cookie groups.
Visitors can change their settings or opt out at any time. For this purpose, a "floating" button is displayed at the bottom left of the website, which can be used to access these settings at any time.
Advantages:
- Explanatory texts from known cookies are automatically integrated
- Visually appealing presentation that can also be customized
Disadvantages:
- Manual adjustments to the JavaScript codes of e.g. Google Analytics, Matomo or similar tools required for opt-in/opt-out to work
- When using the Google Tag Manager, the configuration is relatively complex, but well documented
- Unfortunately, no pricing information can be found on the website
This page contains automatically translated content.