Most teams discover their cookie-consent gap the hard way: the Odoo website already fires analytics, chat widgets, remarketing pixels, and embedded media the moment a visitor lands, long before anyone clicks "Accept." Odoo core ships a lightweight cookie bar, but out of the box it is essentially a notice, not a control plane — it does not block scripts before opt-in, does not capture granular per-category choices, does not keep a durable, timestamped record of who consented to what, and does not give your DPO or auditor anything to export when a regulator or a customer asks for proof. For any business subject to GDPR/ePrivacy, the UK regime, CCPA/CPRA, or similar frameworks, that "notice-only" behavior is exactly the pattern enforcement actions target.

This is where a purpose-built module earns its place. We build a dedicated Odoo application — a proper __manifest__.py addon depending on website — that turns consent into a first-class, auditable data object. New models such as consent.category (necessary, analytics, marketing, functional) and consent.record (models.Model with fields for visitor fingerprint, IP truncation, chosen categories, banner version, policy version, and create_date) persist every decision. A configurable, translatable QWeb/OWL banner and preference center render on the public website, and — critically — third-party scripts are registered against categories and injected only after the matching consent flag is set, so analytics and remarketing tags genuinely stay dark until the visitor opts in. Consent state is written server-side against the record and mirrored to a signed cookie so the choice survives across pages and sessions.

Under the hood we wire the pieces Odoo gives us for exactly this kind of governance work: ir.model.access.csv plus record rules so only Website/Settings managers can read the consent register and ordinary portal users cannot; compute fields (@api.depends) to derive an aggregate consent-status per record; automated actions or ir.cron jobs to expire and re-prompt consent after your defined retention window (e.g. 6 or 12 months); and QWeb reports plus list/pivot views so compliance staff can filter, count, and export the register as evidence. Because everything lives in standard models, the consent log is reachable over the XML-RPC/JSON-RPC API for your data-subject-access-request tooling or an external DPO dashboard. We build cleanly against Odoo 17.0, 18.0, or 19.0 and note Community vs Enterprise differences up front — the core mechanism runs on Community; Enterprise-only surfaces (such as certain website builder blocks) are handled only where your edition supports them.

Delivery is build-to-order, not an instant download. After a short scoping call we confirm the exact category taxonomy, the scripts to gate, the languages and geographies in scope, and your retention policy, then we build on a staging copy of your database, run UAT with you, and cut over with a rollback plan. Typical delivery is one working week from confirmed scope. You receive the installable source, technical and user documentation, a training session, and a post-go-live support window. Pricing starts from $999 (indicative, single-company base scope); multi-company or multi-website consent segregation, additional locales and geo-specific banner variants, deeper integrations with your analytics/CMP stack, and larger historical-consent data migration increase the quoted scope. We provide a fixed quote after the scoping call.