iubenda for TYPO3

Cookie consent and privacy policy from one provider sounds convenient, but it creates dependencies

Under the GDPR and the EU’s ePrivacy rules on cookies (implemented in Germany by the TTDSG, since renamed TDDDG), practically every website needs a cookie consent banner and an up-to-date privacy policy. (US: There is no general cookie consent requirement; state privacy laws such as California’s CCPA/CPRA work with opt-out rights instead.) iubenda offers both as a SaaS solution: a JavaScript widget for the consent banner and a generator for privacy and cookie policies that update automatically when laws change. The TYPO3 extension embeds both into the page source. For companies that don’t want to hire a data protection officer or a law firm to keep these documents current, iubenda is a pragmatic solution.

The trade-off is clear: convenience in exchange for dependency. The consent banner and the privacy policy are loaded from iubenda’s servers. If the service goes down or the API changes, your website is affected. Alternatives such as dp_cookieconsent or Usercentrics work on the same principle, but with different strengths in configurability and pricing.

Typical use cases: SME websites, portals and international web presences

The standard scenario is a mid-sized company website with 20 to 100 pages that uses Google Analytics, a contact form and embedded YouTube videos. iubenda scans the website, detects the services in use automatically and generates a matching cookie policy. The consent banner blocks the detected cookies until the visitor consents. Setting up this scenario takes one to two hours.

The second scenario is multilingual portals that operate in different jurisdictions. Besides the GDPR, iubenda also supports California’s CCPA and Brazil’s LGPD. The privacy policy is displayed automatically in the visitor’s language and contains the legal bases relevant to their location. For companies with audiences in Europe, the US and South America, this saves writing three or four separate policies.

The third scenario is websites whose third-party integrations change frequently. When marketing teams regularly add new tracking pixels, chat widgets or social media embeds, iubenda updates the cookie policy automatically at the next website scan. That reduces the risk of new services running without consent. In practice, this matters most for companies that use marketing automation tools and add new A/B tests, heatmap trackers or conversion pixels every month without telling the IT department.

Technical architecture: an external JavaScript widget embedded in TYPO3

The TYPO3 extension integrates iubenda through two code snippets: a JavaScript tag for the consent banner and an embed code for the privacy policy. Both snippets are configured in the TYPO3 Extension Manager and output automatically in the HTML header and on the privacy page, respectively. The extension itself is minimal and contains hardly any logic of its own.

The consent banner can optionally follow the current version 2.3 of the IAB’s TCF standard (Transparency and Consent Framework) and blocks cookies with a proxy technique: external scripts only load once the visitor has consented. The blocking works by rewriting script tags (type=“text/plain” instead of type=“text/javascript”) and loading the scripts via JavaScript after consent.

The automatic policy generation relies on a website scanner that crawls the domain and detects the services in use. The generated texts are legally reviewed and updated by iubenda’s legal team whenever laws change. The policy is embedded on the privacy page either as an iFrame or as direct HTML.

Common problems: script blocking failures, performance losses and layout shift

The most common problem: not all third-party scripts are blocked correctly. If a script isn’t loaded through a standard HTML tag but injected dynamically via JavaScript, the proxy technique may not catch it. The solution: review every embedded service manually and configure it explicitly in the iubenda dashboard. A browser plugin such as “CookieMetrix” helps with verification.

The second problem is performance losses caused by the additional JavaScript. The iubenda widget weighs 40 to 80 KB (compressed) and is loaded from external servers. That can worsen Largest Contentful Paint by 200 to 400 ms. The solution: load the widget asynchronously and make sure it doesn’t block rendering.

The third problem is layout shift caused by a banner that appears after the page has loaded. If the banner pushes into the page content, it shifts the visible area. Google measures this as Cumulative Layout Shift (CLS) and counts it against the page. The solution: configure the banner as an overlay (not as an inserted element) or reserve a fixed placeholder in the CSS. The target is a CLS value below 0.1, and a poorly configured consent banner alone can push it to 0.3 or higher.

Some administrators also report that the iubenda dashboard is complex to configure. Telling apart the “Cookie Solution” (consent banner), “Privacy Controls and Cookie Solution” (extended) and the “Consent Database” (for compliance documentation) requires an understanding of your own legal requirements that many webmasters don’t have. In TYPO3 projects, Gosign configures iubenda together with the client’s data protection officer, so the technical setup matches the legal assessment.

iubenda works regardless of the TYPO3 version, because the integration is minimal

Since the extension essentially just embeds two JavaScript snippets, there is no deep dependency on the TYPO3 API. The integration works with TYPO3 v10, v11, v12 and most likely v13 without any adjustments. During an upgrade, you only need to check that the snippets are still injected correctly in the HTML header, which is usually the case. Gosign nevertheless recommends running a cookie consent test after every TYPO3 upgrade to make sure all blocking rules still work.