Everything you'd want to know before you install.
A detailed look at how DataFirefly Cookie Manager — powered by the open-source tarteaucitron.js engine works, why we built it the way we did, and the thinking behind the features above.
§ 01
Why a dedicated GDPR module
The French data protection authority has been actively auditing cookie banners since 2022, and other European regulators have followed. The findings are consistently the same three: refusing is harder than accepting, third-party cookies are dropped before consent, and the merchant cannot prove consent was ever collected. Cookie Manager Tarteaucitron addresses all three.
§ 02
The tarteaucitron engine, with a current interface
tarteaucitron.js is the most established open-source consent manager in France, used by government sites. It is technically solid, but its interface has aged. The module keeps the engine, which is what makes it reliable, and wraps it in an animated floating card with per-category toggles, fully configurable from the back office.
§ 03
The detail that matters: where the files are served from
A cookie banner that loads its own files from a CDN hands the visitor's IP address to a third party before they have chosen anything. That single detail undermines the whole banner. The module bundles tarteaucitron and its 36 languages, served from your domain. The CDN remains available as an option, but it is not the default.
§ 04
Consent Mode v2 without losing measurement
Many merchants assume compliance means losing half their analytics. With Consent Mode v2, your tags keep sending anonymised signals that feed modelled conversions. The module goes further: the default state is derived from the existing consent cookie, which removes the transient denied window that eats conversions on every page reload for visitors who already accepted.
§ 05
A log you can actually hand over
Article 7 of the GDPR requires you to demonstrate that consent was given. Every action is recorded with its timestamp, an anonymous visitor ID, the accepted categories and the per-service detail. The IP address is never stored in clear text: only an HMAC-SHA256 fingerprint salted with a shop-specific key. The log exports to CSV, purges itself beyond the retention period you set, and survives uninstalling the module.
§ 06
Stripe and strictly necessary cookies
Stripe drops cookies required for payment fraud prevention, which fall under the exemption for strictly necessary trackers. Blocking them would break checkout. The module loads them without asking, while showing them in the Always on category of the preferences panel so the visitor is informed.
Matches the description and works really wellAutomatically translated