GDPR Pro for Magento 2

Privacy workflow tools inside Magento

GDPR Pro 1.0.3 brings cookie-choice recording, customer data requests and an admin review queue to Magento Open Source. It supports Luma and provides GraphQL endpoints for headless storefronts. It helps you operate a privacy workflow; your business remains responsible for its own policy, retention rules, tag setup and legal decisions.

Cookie choices on Luma

Display a configurable banner with Accept All, Reject All and granular analytics, marketing and preference choices. Necessary stays on. The selection is saved in a browser cookie and, when enabled and storage succeeds, logged with a timestamp, IP and user-agent. The module does not automatically prevent third-party scripts or other non-essential cookies from loading. Wire each tag to the saved choices and verify it on your storefront. Changing the consent-version setting affects new records; it does not automatically re-prompt earlier visitors.

Data access, deletion and correction

Authenticated Luma customers can directly download available personal data as JSON, XML or CSV and submit deletion requests. Customer-token-protected GraphQL mutations let a headless frontend submit export, deletion and rectification requests. Admins can approve, process and download export snapshots in the data-request grid; manual correction is required before marking a rectification complete. When the approval setting is enabled, pending deletion cannot be processed until approved. Export snapshots are delivered by the merchant through a chosen secure channel; the module does not send them by email.

Open orders can block account deletion. Order anonymisation is configurable, but merchants must review tax-retention needs and any custom or third-party data tables before erasure. A scheduled cleanup uses the configured retention period for consent logs and completed/rejected requests.

PII scanner: local first, AI optional

The command-line scanner keeps local pattern findings visible. AI advisory review is off by default. If enabled with an encrypted provider key, Auto selects OpenAI GPT-6 Luna when an OpenAI key exists or Gemini 3.8 Flash for an existing Gemini-only configuration. Detected email, phone, card and tax-ID patterns are masked in short excerpts before external review; surrounding words may still contain personal data. AI labels never remove local findings. Optional OpenAI or Google API use may incur separate charges. Review provider processing terms and your privacy notice before enabling external AI.

Compatibility and installation

The exact 1.0.2 ZIP was installed through Composer, upgraded and compiled on Magento Open Source 2.4.9 / PHP 8.5.10. Luma selective consent, guest GraphQL consent and the admin request actions were tested. Other editions, Magento versions and custom themes require separate staging qualification. A headless frontend must implement its own banner and tag controls.

Read the GDPR Pro user guide for setup, the GraphQL operations and the cookie-tag integration boundary.

Purchase and support

A one-time purchase includes 12 months of updates and support. Renewal is optional and never billed automatically. Eligible standalone extensions may renew at 60% of the then-current regular list price before term end or within 30 days afterward, plus applicable tax. Purchased versions remain usable afterward. See the AgenticEcom licence and your order terms. Support: support@agenticecom.net.

Frequently asked questions

Does the banner block analytics and advertising scripts?

No. It records consent choices. Connect your tags and scripts to those choices and test the result.

Are request exports emailed automatically?

No. Admins download an export snapshot and deliver it securely through their own process.

Does the PII scan send data externally?

No, unless the optional AI review is enabled. Masked excerpts can still contain personal data in surrounding words and provider charges may apply.