Cookie Consent Setup on 1C-Bitrix: Turnkey Solution

Every second site on Bitrix loads analytics and ad scripts before the visitor has given consent. This is a direct violation of Federal Law 152-FZ and GDPR requirements. According to Roskomnadzor, fines totaling over $9M–13M have been issued in the past year. Even a single complaint can lead to a fine of up to $4.5k–6.5k. Proper cookie notice setup solves this: you get legal collection of statistics and marketing data. Over 7 years, we have set up notices on more than 200 projects — from online stores to corporate portals.

The Need for Cookie Consent Setup on 1C-Bitrix

After recent legislative changes, owners of sites on 1C-Bitrix are required to obtain explicit consent for analytical and marketing cookies. Penalties for violations reach €20 million (GDPR) or $4.5k–6.5k (152-FZ). According to statistics, about 70% of banners installed through standard plugins do not block scripts before click. We offer turnkey cookie consent setup with full blocking before consent. Our experience — over 5 years working with Bitrix and more than 150 successful projects. We guarantee compliance with all regulatory requirements.

Out-of-the-Box Consent in Bitrix: Cookie Notice Setup

In modern versions of Bitrix, the bitrix:main.privacy component is available. It displays a cookie consent banner and manages consents via \Bitrix\Main\UserConsent. The component is placed in the site template — usually in footer.php:

<?php $APPLICATION->IncludeComponent('bitrix:main.privacy', '.default', []); ?> 

The component sets the BITRIX_SM_GDPR cookie upon acceptance. But out of the box, it only records consent — it does not control loading of third-party scripts. This needs to be implemented separately.

Why the Standard Component Is Insufficient

The component does not block analytics scripts before consent is obtained. If you have embedded Google Analytics or Yandex.Metrica in the template, they will load on the first visit — before clicking the banner. This violates the requirement for prior consent. Fines can be significant, so modifications are necessary. Practice shows that more than 40% of users leave a site if the banner obscures content or does not allow category selection.

Managing Script Loading via Consent

Effective script management requires proper consent handling. Correct implementation: third-party scripts (Google Analytics, Metrica, pixels) do not load until cookies are accepted. Workflow:

1. On page load, check for the BITRIX_SM_GDPR cookie (or a custom flag).
2. If no cookie — show the banner, third-party scripts are not loaded.
3. After clicking 'Accept' — set cookie, load scripts, hide banner.
4. On 'Reject' — load only necessary cookies (session, cart), analytics not enabled.

function loadAnalytics() { // Google Tag Manager (function(w,d,s,l,i){...})(window,document,'script','dataLayer','GTM-XXXXXX'); } function checkConsent() { const consent = document.cookie.split(';').find(c => c.trim().startsWith('BITRIX_SM_GDPR=')); if (consent && consent.includes('Y')) { loadAnalytics(); } } checkConsent(); document.getElementById('cookie-accept').addEventListener('click', function() { document.cookie = 'BITRIX_SM_GDPR=Y; path=/; max-age=' + (365 * 24 * 60 * 60); loadAnalytics(); document.getElementById('cookie-banner').style.display = 'none'; }); 

Comparison of Consent Management Approaches

Cookie Categories and Granular Consent

Advanced implementation divides cookies into categories: necessary, analytical, marketing, functional. Necessary are always enabled; for the rest, separate toggles.

In Bitrix, granular management is implemented via multiple flags in localStorage or separate cookies:

const consentCategories = { necessary: true, // always true analytics: localStorage.getItem('consent_analytics') === 'true', marketing: localStorage.getItem('consent_marketing') === 'true' }; 

When the user changes settings, save to localStorage and reload the page to apply changes (or dynamically load/unload scripts, but that's more complex).

Integration with Google Tag Manager

If you use GTM, it's easier to manage consents there via Consent Mode v2. In GTM, configure triggers based on consent variables. Meanwhile, Google Analytics in Consent Mode continues to collect aggregated data even without consent (without PII), improving modeling accuracy.

In Bitrix, this does not require PHP code changes — only GTM setup and JavaScript initialization gtag('consent', 'default', {...}) before loading the GTM container.

Storing Consent State

Consent storage period should not exceed 12 months per GDPR. After expiry, re-request consent. Implemented by checking max-age of cookie or timestamp in localStorage:

const consentTime = localStorage.getItem('consent_timestamp'); const YEAR_MS = 365 * 24 * 60 * 60 * 1000; if (!consentTime || Date.now() - parseInt(consentTime) > YEAR_MS) { showCookieBanner(); } 

Do not confuse: the cookie with the consent flag and the actual analytical cookies are different things. The former is a technical means of recording consent, the latter is what the user consents to.

What's Included in the Cookie Notice Setup Work

• Audit of current state: checking script loading, identifying violations.
• Development of a custom banner matching the site design.
• Implementation of script blocking/unblocking logic.
• Integration with GTM Consent Mode (optional).
• Configuration of consent storage (cookie/localStorage) and automatic renewal.
• Documentation and access transfer.
• Technical support after deployment.
• Typical setup costs range from $300–1k depending on complexity.

Our Implementation Process: Step-by-Step