GDPR Pro

GDPR Pro gives a Magento store the privacy tooling regulators expect: a configurable cookie consent banner with a tamper-evident audit log, and a complete set of data-subject rights — export, deletion and rectification — that customers can exercise themselves. It works on a standard Luma store and on a headless (Astro) storefront, which reads the banner config and submits requests over GraphQL.

Compatibility

Magento

Open Source 2.4.9 GA (and later 2.4.x).

PHP

Tested on 8.4 and 8.5.

Storefront

Luma/PWA and headless (Astro) via GraphQL.

Articles

Covers GDPR Art. 16 (rectify), 17 (erase), 20 (export).

Cookie consent

Show a configurable consent banner and record every choice with a timestamp, IP address and user-agent — the proof-of-consent regulators ask for.

Configure it under Configuration → GDPR & Privacy → Cookie Consent Banner: enable, position, theme, title, message and an optional Reject button. Consent is captured across four standard categories — Strictly Necessary, Analytics, Marketing, Preferences.

Audit log

Every consent event is written to the Consent Audit Log (Reports/Admin → GDPR & Privacy → Consent Audit Log) with the consent payload, IP and user-agent — so you can demonstrate who consented to what, and when.

Data-subject requests

Customers can exercise their rights from their account; each request lands in GDPR & Privacy → Data Requests for you to review and process:

Export (Art. 20)

Gathers the customer’s personal data — profile, addresses, orders, reviews and newsletter subscription — into a portable export you can send them.

Delete (Art. 17)

The “right to be forgotten” — anonymises/removes the customer’s personal data. Processed on approval (it’s irreversible), so nothing is deleted without your sign-off.

Rectify (Art. 16)

The customer describes what’s inaccurate (e.g. “surname should be Smith”); you review and correct it within the statutory window. The current data is snapshotted for the record.

Each request carries the customer email, type and status (Pending → Processed), an admin comment field, and timestamps. Approve and process from the grid.

Deletion is gated

Deletion requests are never auto-executed — they require admin approval, because the action is irreversible. Export and rectification snapshots are generated server-side.

Headless / API

A headless (Astro) storefront renders the banner from gdprConsentConfig and submits everything over GraphQL:

Consent

# Banner config for the storefront
{ gdprConsentConfig { enabled cookie_policy_url privacy_policy_url
    consent_categories { code label } } }

# Save the visitor's choices (logged with IP + user-agent)
mutation { saveCookieConsent(necessary: true, analytics: true,
    marketing: false, preferences: true) { success message } }

Data rights

# All three require a customer token
mutation { requestGdprDataExport { success message request_id } }
mutation { requestGdprDataDeletion { success message request_id } }
mutation { requestGdprDataRectification(details: "surname should be Smith")
    { success message request_id } }

query { customerGdprData { /* export data + consent history */ } }

Auth enforced

The data-rights mutations require a logged-in customer (they return a clear authorization error otherwise), so one customer can never request another’s data.

Configuration

Stores → Configuration → AgenticEcom · Core & System → GDPR & Privacy (the admin screens — Data Requests and Consent Audit Log — live under Customers → GDPR & Privacy).

Group	Key settings
General	Enable GDPR compliance, privacy policy page, data-protection contact email, data-retention period (days)
Cookie Consent Banner	Enable, position, theme, title, message, show Reject button
Data Export / Deletion / Consent	Control the data-subject request flows and consent capture.
PII Scanner	Scan stored data for personal information, with optional AI Verification of Findings (Google Gemini) to cut false positives — needs your own Google AI API Key (encrypted) and an AI Model.

Retention

Set a Data Retention Period and the module will age-out stale personal data automatically, so you’re not holding information longer than you should.

FAQ

Does it prove consent, or just show a banner?

Both. Every consent choice is written to an audit log with the payload, IP address and user-agent and a timestamp — the evidence you need to demonstrate valid consent.

What’s actually in a data export?

The customer’s profile, addresses, order history, product reviews and newsletter subscription — gathered server-side into a single portable record (GDPR Article 20).

Can a customer delete their own account data instantly?

They can request deletion, but it’s only executed after admin approval because erasure is irreversible — protecting you from accidental or fraudulent deletions.

Does it work headless?

Yes — an Astro storefront reads gdprConsentConfig for the banner and submits consent and all three data-rights requests over GraphQL, with customer authentication enforced.