Guide · June 17, 2026
PrestaShop and OpenCart: what to do for PDPL cookie consent?
PDPL cookie consent guide for PrestaShop, OpenCart: consent module, grouping commercial cookies, blocking pixels, logging consent.
Quick answer
What is PDPL cookie consent for PrestaShop and OpenCart?
Cookie consent under the PDPL is the mechanism to ask for and record consent before a website uses cookies or trackers that are not necessary for core operations. With PrestaShop and OpenCart, it usually involves a cookie banner, a consent module, blocking pixels, and keeping logs to prove who consented, when, and to what content.
Key point: PDPL is the Personal Data Protection Law (Law 91/2025/QH15), expected to take effect on 01/01/2026, replacing Decree 13/2023/ND-CP. If your e-commerce website uses cookies for measurement, advertising, remarketing, or personalization, you should design consent right at the technical layer.
How should PrestaShop and OpenCart categorize commercial cookies?
You should group cookies by purpose of use, not by technical name. This makes it easier to explain to users and to map into code logic.
| Cookie group | Real examples | Can be enabled before consent? | Handling suggestion on PrestaShop/OpenCart | |
|---|---|---|---|---|
| Essential | session, cart, CSRF, login | Yes | Load by default to operate the cart and checkout | |
| Preferences | remember language, interface | Depends on policy/design | Include in the banner for users to select | |
| Analytics | Google Analytics, Matomo, heatmap | Should not be default | Block scripts until consent is given | |
| Marketing | Meta Pixel, Google Ads, TikTok Pixel | Should not be default | Activate only after explicit consent | |
| Personalization | product recommendations, remarketing | Should not be default | Separate as its own item, allow withdrawal |
In practice, many Vietnamese shops lump everything into a multi-page “cookie policy.” That approach makes it hard to prove consent as required and hard to operate during audits. At a minimum, the banner should include: “Accept all,” “Reject non-essentials,” and “Preferences.”
What should a consent module for PrestaShop and OpenCart include?
A good consent module doesn’t just display a banner. It must be able to control script execution flow and store proof of consent.
Separate the presentation layer and the script-blocking layer:
The banner is just UI; the important part is blocking pixels/analytics/ads until consent is recorded.
Map cookies by group:
Attach each script to “essential,” “analytics,” “marketing,” or “personalization” groups to make toggling easier.
Store proof of consent:
Record the timestamp, the banner content version, the user’s selections, and the consent status.
Allow easy withdrawal:
Place a “Cookie settings” button in the footer or account area so users can change their decision.
Sync with DSAR and internal logs:
When users request to view/delete data, the operations team must be able to find consent logs quickly.
For PrestaShop, the consent module often needs to hook at the top of the page to block scripts early. For OpenCart, check where the theme and extensions inject pixels: header, footer, product page, checkout, or a third-party script manager. If a pixel is embedded directly in the theme, the banner module alone is not enough; you must modify the template or load the script conditionally.
How do you properly block pixels on PrestaShop and OpenCart?
The safest approach is to avoid rendering pixels until the user consents, rather than “load then hide.” Many systems still send requests before the banner appears; in that case, consent has no practical value.
Simple technical examples:
- Google Analytics / GA4: load only after the “analytics” group is enabled.
- Meta Pixel: inject only when the “marketing” group is accepted.
- TikTok Pixel / CAPI: check both the browser pixel and server-side events.
- Chat widgets with tracking: assess whether they send data to third parties; if they do, treat them as trackers.
If you use a tag manager, configure triggers based on consent status, not the default pageview. If you use a third-party module, check whether it truly blocks network requests or just changes the banner UI.
A practical implementation example for a Vietnamese shop
A cosmetics shop running OpenCart uses Meta Pixel, GA4, and a heatmap tool. Previously, all scripts were embedded in the footer, so every visitor to the homepage was tracked immediately. After adjusting for PDPL:
- The cookie banner appears on the first visit.
- Cookies are grouped into “Essential,” “Analytics,” and “Marketing.”
- GA4 and Meta Pixel are loaded only when the user opts in.
- The log table stores the session ID, time, and banner version.
- Users can reopen “Cookie settings” from the footer to change their choices.
This approach does not make the website “automatically compliant” overnight, but it helps the business demonstrate control over processing purposes and respect for user choices as required by the regulations.
What should store owners watch out for to avoid getting it wrong?
A commonly missed point is that consent must be sufficiently clear and provable. If the banner only has an “OK” button and no way to refuse non-essentials, your compliance risk increases. If you place pixels through an app/extension without checking the loading flow, data collection may occur before consent.
Under the regulations, serious violations can be subject to criminal handling; specific penalties will be set by a Government decree. If your system involves many third parties, especially ad networks, review your DPA, privacy notice, and consent mechanism together, instead of only changing the banner.
FAQ
- Not all cookies require consent, but non-essential cookies like analytics, marketing, and personalization typically need to be assessed and have a consent mechanism designed in line with the regulations.
- Usually not sufficient for solid compliance. You should allow refusal of non-essentials, let users customize cookie groups, and log proof of consent.
- You need to block loading scripts or requests until there is consent. If you just hide the banner while the pixel still fires requests, you haven’t achieved control.
- The enforcement authority is the Ministry of Public Security, specifically the Department of Cybersecurity and High-Tech Crime Prevention (A05).
If you need to implement a cookie banner, store proof of consent, or build DSAR flows for PrestaShop/OpenCart, consent.vn can help you design an approach that’s easier for both your dev and legal teams to operate.
Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP — thuvienphapluat.vn; enforcement authority A05 — bocongan.gov.vn
Get started — set up in 5 minutes.
Need help with PDPL compliance?