Joomla extension (package = plugin + component) providing a GDPR-compliant cookie consent banner with admin dashboard and Google Consent Mode v2 support.

Joomla	PHP	Current version
4.x, 5.x, 6.x	8.1+	1.0.4

---

1. Requirements

• Joomla 4.x, 5.x, or 6.x
• PHP 8.1 or newer
• MySQL 5.7+ / MariaDB 10.3+

2. Installation

Obtaining the Installation Package

Download the ZIP file pkg_semacookieconsent-X.Y.Z.zip from SemaHub (semakin.cz).

Installation Steps

1. Log in to the Joomla administration panel.
2. Navigate to System > Install > Extensions.
3. Upload the pkg_semacookieconsent-X.Y.Z.zip file.
4. Joomla installs both parts at once:
   • Plugin: plg_system_semacookieconsent (System – Sema Cookie Consent)
   • Component: com_semacookieconsent (Sema Cookie Consent – admin dashboard and log)
5. The plugin is automatically enabled after installation (via pkg_script.php).

Upgrade: Same procedure as installation. Joomla uses method="upgrade" and preserves data in the #__semacookieconsent_consents table.

Migration: If the site has an old #__cookie_consents table (from a previous implementation), the install script automatically migrates data to the new table.

3. Enabling the Plugin

The plugin is automatically enabled during installation. If it has been disabled for any reason:

1. System > Manage > Plugins
2. Search for semacookieconsent or Cookie Consent.
3. Click the plugin name and set Status = Enabled.

Once enabled, the cookie consent banner immediately appears on the site frontend (if the visitor has not yet given consent).

4. Basic Configuration

Open the plugin settings: System > Plugins > click the plugin name.

Settings are organized into 6 tabs:

Tab	Content
General	Banner position, cookie policy URL, consent expiry, reopen bar
Texts	All banner texts (heading, description, buttons, category names)
Colors	Background, text, heading, accent (buttons), and active toggle colors
Categories	Enable/disable analytics and marketing categories, cookies to delete
Google Consent Mode	Enable GCM v2, wait for update, region
Advanced	Consent logging, rate limit, IP anonymization, excluded pages

General Tab

Parameter	Default	Description
Banner Position	Bottom	Banner appears at the bottom (bottom) or top (top) of the page.
Cookie Policy URL	/pouziti-cookies	Relative or absolute URL to the cookie policy page.
Consent Expiry (days)	365	After how many days the consent expires and the banner reappears. Range: 1–730.
Show Reopen Bar	Yes	After consent is given/rejected, a small bar (with a cookie icon) is shown allowing the visitor to modify their consent.

5. Banner Texts

The Texts tab allows customization of all texts displayed in the banner. Each field has a default value from the language file (CZ or EN depending on the site language).

Parameter	Default (EN)	Description
Heading	Cookie Settings	Banner heading.
Description	(dynamic based on categories)	Main banner text. If left empty, the text adapts automatically to enabled categories (see below).
Accept All Button	Accept All	Text on the button to accept all cookies.
Reject All Button	Reject All	Text on the button to reject all optional cookies.
Settings Button	Settings	Text on the button to open category details.
Save Button	Save Settings	Text on the button to save custom category selection.
Necessary Title	Necessary Cookies	Name of the necessary cookies category.
Necessary Description	Required for the site to function properly. Cannot be disabled.	Description of the necessary cookies category.
Analytics Title	Statistical Cookies	Name of the analytics cookies category.
Analytics Description	Help us understand how visitors use the site (Google Analytics).	Description of the analytics cookies category.
Marketing Title	Marketing Cookies	Name of the marketing cookies category.
Marketing Description	Used for targeted advertising and retargeting (Google Ads).	Description of the marketing cookies category.
Policy Link Text	Cookie Policy	Text of the link to the cookie policy page.
Reopen Bar Text	Cookie Settings	Text on the reopen bar.

Dynamic Banner Description

If the Description field is left empty (or keeps the default value), the plugin automatically selects the text based on enabled categories:

Enabled Categories	Text
Analytics + Marketing	“...We use statistical and marketing cookies only with your consent...”
Analytics only	“...We use statistical cookies only with your consent...”
Marketing only	“...We use marketing cookies only with your consent...”
None (necessary only)	“This website uses only necessary cookies required for the site to function.”

If you enter custom text, it always takes priority over the dynamic logic.

6. Colors

The Colors tab allows you to customize the banner appearance to match your site design. Colors are applied via CSS custom properties.

Parameter	Default	CSS property	Description
Background Color	#1e2533	--scc-bg	Banner background.
Text Color	#ccd0d8	--scc-text	Main text color.
Heading Color	#ffffff	--scc-heading	Heading color.
Accent Color (buttons)	#e67e22	--scc-accent	Button and highlight color. Hover state darkens automatically.
Toggle Active Color	#27ae60	--scc-toggle	Toggle switch color when a category is enabled.

If you use a custom CSS template, you can override colors directly in CSS using the variables --scc-bg, --scc-text, etc.

7. Cookie Categories

The Categories tab determines which optional categories are shown in the banner.

Parameter	Default	Description
Enable Analytics Category	Yes	Shows the “Statistical Cookies” category in the banner.
Enable Marketing Category	Yes	Shows the “Marketing Cookies” category in the banner.
Analytics Cookies to Delete	_ga,_gid,_gat	Comma-separated cookie names to delete when analytics is rejected.
Marketing Cookies to Delete	_gcl_au,_fbp,_fbc	Comma-separated cookie names to delete when marketing is rejected.

How Cookie Deletion Works

When a visitor rejects a category (or disables it in settings), JavaScript automatically deletes all cookies listed in the corresponding field. Deletion is performed for the current domain and with a leading dot (.example.com).

Necessary Category

The “Necessary Cookies” category is always enabled and cannot be turned off (the toggle is disabled). This complies with GDPR – necessary cookies do not require consent.

Tip: If the site does not use any tracking services, you can disable both optional categories. The banner will then only display information about necessary cookies.

8. Google Consent Mode v2

The Google Consent Mode tab enables integration with Google Consent Mode v2 (GCM).

Parameter	Default	Description
Enable Google Consent Mode v2	No	Enables injection of the consent-mode.js script into <head>.
Wait for Update (ms)	500	The wait_for_update value for GCM – how long Google waits for a consent update. Range: 0–10000.
Region (optional)	(empty)	Comma-separated ISO 3166 region codes (e.g. CZ,SK,DE). Leave empty for all regions.

How GCM Works

1. The consent-mode.js script is injected synchronously into <head> (no defer/async).
2. It must load BEFORE any gtag.js or Google Tag Manager script.
3. On page load, it reads existing consent from localStorage and sets gtag('consent', 'default', ...).
4. When the visitor changes consent in the banner, JavaScript calls gtag('consent', 'update', ...).

GCM Consent Types

GCM type	Banner category	Purpose
analytics_storage	Analytics	Allows analytics cookies (GA4).
ad_storage	Marketing	Allows advertising cookies (Google Ads).
ad_user_data	Marketing	Allows sending user data for advertising.
ad_personalization	Marketing	Allows personalized advertising.
functionality_storage	–	Always granted (functional cookies).
security_storage	–	Always granted (security cookies).
personalization_storage	–	Always denied (personalization not used).

Important: If the site does not use Google Analytics, Google Ads, or Google Tag Manager, there is no need to enable GCM. GCM is only relevant for sites with Google tracking services.

9. Advanced Settings

The Advanced tab contains consent logging settings and other technical parameters.

Parameter	Default	Description
Enable Consent Logging	Yes	Records every consent/rejection to the database (GDPR audit log).
Rate Limit (seconds)	5	Minimum interval between two consent logs from the same session. Protection against abuse. Range: 0–60.
Anonymize IP Address	No	IPv4: zeros out the last octet (e.g. 192.168.1.0). IPv6: zeros out the last 80 bits.
Excluded Menu Items	(empty)	Comma-separated Joomla menu item IDs where the banner should not appear.

Consent Logging

When logging is enabled, every visitor action (“Accept All” / “Reject All” / “Save Settings”) sends an AJAX request to the server, which records:

• Consent UUID (generated on the client, stored in localStorage)
• IP address (optionally anonymized)
• User-Agent
• Joomla user ID (if logged in)
• State of each category (necessary/analytics/marketing)
• Action type (accept_all, reject_all, custom)
• Date and time

Records are stored in the #__semacookieconsent_consents table.

GDPR requirement: Articles 7 and 13 of the GDPR require demonstrable proof of consent. The consent log serves as legal evidence that the visitor gave or refused consent. We recommend keeping logging enabled.

10. Administration – Dashboard

After installation, a new menu item appears in the sidebar: Components > Sema Cookie Consent.

Dashboard

The Dashboard view shows a consent overview for the last 30 days:

Card	Description
Total (30 days)	Total number of banner interactions in the last 30 days.
Accepted	Number of “Accept All” actions (green). Including percentage.
Rejected	Number of “Reject All” actions (red). Including percentage.
Custom	Number of “Save Settings” actions with custom selection (blue). Including percentage.
Consent Rate	Percentage of visitors who accepted analytics cookies (accept_all + custom with analytics). Green ≥ 50%, red < 50%.
All-time Total	Total number of interactions since plugin installation.
Daily Trend	Table with daily interaction counts for the last 30 days. Visual bar chart.

11. Administration – Consent Log

The Consent Log view shows a detailed list of all recorded consents.

Table Columns

Column	Description
ID	Sequential record number.
Consent ID	UUID v4 generated on the client (unique consent identifier).
IP Address	Visitor IP address (optionally anonymized).
Necessary	Green checkmark / gray X. Necessary is always enabled.
Analytics	Green checkmark (consented) / gray X (rejected).
Marketing	Green checkmark (consented) / gray X (rejected).
Action	Action type: accept_all (green badge), reject_all (red), custom (blue).
Date	Date and time the consent was recorded.

Filtering

Filter	Description
Filter by Action	Show only Accept All / Reject All / Custom.
Date from	Filter from the specified date.
Date to	Filter until the specified date.
Search	Full-text search on consent ID or IP address.

Sorting

Click the ID or Date column headers to change the sort direction.

12. CSV Export

1. In the Consent Log view, click the “Export CSV” button in the toolbar.
2. A CSV file is downloaded with all records (respects current action and date filters).
3. Encoding: UTF-8 with BOM (for correct display in Excel).
4. Delimiter: semicolon (;).
5. File name: cookie-consents-YYYY-MM-DD.csv.

The CSV contains columns: ID, Consent ID, IP Address, User Agent, User ID, Necessary, Analytics, Marketing, Action, Created At.

13. Integration with Semakin SST Plugin

If the site uses the Semakin Server-side Tracking plugin, Sema Cookie Consent integrates with it automatically:

Consent Bridge

1. The banner JavaScript saves consent to localStorage (key scc_cookie_consent).
2. The SST plugin reads this key and maps it to three levels:
   • L0 (anonymous) – no consent, necessary only
   • L1 (analytics) – analytics cookies consented
   • L2 (marketing) – marketing cookies consented
3. The SST plugin sets a cookie semakin_sst_cl (values 0/1/2) as a consent bridge between JS and PHP.
4. PHP reads the cookie and enables/disables server-side tracking based on the consent level.

Cookies Generated by Semakin Plugins

Necessary (always):

Cookie	Expiry	Description
cookieconsent_status	365 days	Consent status (allow/deny) for server-side checks.
semakin_sst_cl	24 h	Consent bridge (localStorage → PHP). Only if SST plugin is installed.

Analytics (after L1 consent):

Cookie	Expiry	Description
semakin_sst_cid	2 years	GA4 client_id fallback (server-side). Only if SST plugin is installed.

Marketing (after L2 consent):

Cookie	Expiry	Description
semakin_sst_gclid	90 days	Google Ads click ID. Only if SST plugin + Google Ads.
semakin_sst_heureka_optout	2 h	Heureka opt-out. Only if SST plugin + Heureka.
hg_ocm_id	30 days	Heureka OCM attribution (set by Heureka SDK).

14. Uninstallation

Procedure

1. System > Manage > Extensions
2. Search for Sema Cookie Consent.
3. Uninstall the package pkg_semacookieconsent.

What Gets Deleted

• Plugin plg_system_semacookieconsent (PHP, JS, CSS, language files)
• Component com_semacookieconsent (admin files, templates)
• Media files (media/plg_system_semacookieconsent/, media/com_semacookieconsent/)

What Gets Deleted from the Database

• Table #__semacookieconsent_consents (all consent records)

Warning: Unlike some other Sema extensions, this table IS deleted on uninstall (defined in uninstall.mysql.sql). If you need to preserve consent records, perform a CSV export before uninstalling.

15. Troubleshooting

Banner Does Not Appear

1. Verify the plugin is enabled (Status = Enabled).
2. Check if the current page is in the Excluded Menu Items list.
3. Verify the visitor has not already given consent (delete scc_cookie_consent from the browser’s localStorage and cookieconsent_status from cookies).
4. Check the browser console (F12) for JavaScript errors.
5. Verify no other plugin on the page is blocking onAfterRender.

Banner Appears but CSS Is Missing (Looks Broken)

1. Verify the file exists: {root}/media/plg_system_semacookieconsent/css/semacookieconsent.css.
2. If the file is missing, the plugin is not correctly installed – reinstall.
3. Check if another plugin is removing CSS from <head>.

Google Consent Mode Not Working

1. Verify Enable Google Consent Mode v2 is turned on in plugin settings.
2. Check the page source (Ctrl+U) – consent-mode.js must be in <head> BEFORE any gtag.js or GTM script.
3. Check the browser console – dataLayer must contain a consent event with default values.

Consent Log Is Empty

1. Verify Enable Consent Logging is turned on.
2. Check that the visitor actually clicked a button in the banner (refreshing the page without interaction does not log anything).
3. Check the browser console for AJAX request errors to com_ajax.
4. Verify the #__semacookieconsent_consents table exists in the database.

Banner Behaves Strangely After Upgrade

• The visitor must perform a hard refresh (Ctrl+Shift+R) to load the new JS/CSS files.
• An older consent in localStorage may have a different structure – deleting scc_cookie_consent from localStorage and refreshing the page will resolve the issue.

Dashboard Shows Zero Values

• The dashboard displays data for the last 30 days. If there were no interactions in that period, this is expected.
• Verify consent logging is enabled.

Banner Appears on a Page Where It Should Not

• Add the Joomla menu item ID to the Excluded Menu Items field in plugin settings.
• Find the menu item ID in Menus > [menu name] – the ID column.

---

How the Banner Works (Visitor Perspective)

1. The visitor arrives at the site and the cookie consent banner is displayed.
2. Three options are available:
   • Accept All – enables all optional categories, banner is hidden.
   • Reject All – rejects all optional categories, banner is hidden.
   • Settings – expands the detail panel with categories and toggles.
3. In the detail panel, the visitor can enable/disable individual categories (Analytics, Marketing) and click Save Settings.
4. After consent is given/rejected, a small bar (with a cookie icon) appears for reopening the banner.
5. Clicking the bar reopens the banner with pre-filled values.
6. Consent is stored in the browser’s localStorage and expires after the configured number of days (default 365).

Consent Storage

• localStorage: Key scc_cookie_consent contains JSON with the detailed state of all categories and a timestamp.
• localStorage: Key scc_consent_id contains a UUID v4 for identifying the consent in the log.
• Cookie: cookieconsent_status with value allow or deny for server-side checks.

---

Launch Checklist

• Plugin installed and enabled
• Cookie policy URL configured and page exists
• Colors customized to match site design
• Categories set according to services used (GA4, Google Ads, Facebook, etc.)
• Cookies to delete match the cookies actually used on the site
• Google Consent Mode enabled (if using Google services)
• Consent logging enabled
• IP anonymization enabled (recommended for GDPR)
• Cookie policy page (/pouziti-cookies or equivalent) is complete and up to date
• Privacy policy page references the cookie policy page
• Test consent given and record appears in the Consent Log
• Dashboard shows correct data