Gdpr Bundle Laravel Package

Product Decisions This Supports

• Compliance backlog prioritization. Informs whether cookie consent is a "buy," "build," or "adapt an OSS starting point" decision — the package gives us a reference for the minimum viable feature set: cookie categories (necessary/preferences/analytics/marketing), consent persistence, and blocking non-essential cookies until opt-in.
• Build vs. buy evaluation. With 2 stars, 0 dependents, and a last release in April 2021, this is a data point in favor of buy (a maintained CMP such as Cookiebot, Osano, CookieYes, or a self-hosted Klaro/Tarteaucitron) or build on top of a maintained library — not a data point in favor of adopting this package.
• Vendor/dependency risk assessment. Use it as a worked example for our OSS intake criteria: release cadence, dependent count, security advisory history, maintainer responsiveness. It fails most of them, which is useful for calibrating the scorecard rather than for the product decision itself.
• Roadmap framing for consent scope. Its feature set is a useful scoping strawman for what "Phase 1 consent" looks like (banner + category toggle + blocking + audit log), which helps size the internal effort against a commercial CMP quote.
• Framework-fit decision. Important nuance for the decision record: this is a Symfony bundle, not a Laravel package. If our stack is Laravel, it is not directly installable — at best it is a design reference for a Laravel-native implementation (e.g., spatie/laravel-cookie-consent or whitecube/laravel-cookie-consent as maintained starting points).

When to Consider This Package

Consider it only when all of the following hold:

• The application is Symfony (not Laravel) and on a PHP/Symfony version contemporary with the 2021 release, or we are prepared to pin and patch.
• We need a self-hosted, no-third-party-data-transfer consent mechanism and commercial CMPs are ruled out by procurement, budget, or data-residency policy.
• We are willing to fork and own the code — assign a maintainer, add a test harness, and track upstream ePrivacy/GDPR guidance.
• We are using it as a reference implementation to copy patterns from, not as a production dependency.

Look elsewhere when:

• Stack mismatch — Laravel, or any non-Symfony app. Rewriting a Symfony bundle's service wiring costs more than starting from a maintained alternative.
• Compliance is the actual requirement. Consent law has moved substantially since April 2021 — CNIL/EDPB guidance on reject-all parity, granular purposes, consent refresh intervals, and Google Consent Mode v2. An unmaintained 2021 banner likely does not satisfy current expectations, and an unmaintained dependency has no one to ship the fix when it doesn't.
• You need an audit trail of consent (who consented, when, to which purposes, at which policy version) for regulator or DPA requests — verify this exists before anything else.
• Supply-chain hygiene matters — 0 dependents and 2 stars means effectively no community scrutiny; we would be the only ones reading the diff.
• Security review capacity is limited. Unmaintained PHP touching cookies and headers is not where we want to spend review cycles.

How to Pitch It (Stakeholders)

One-liner for execs: A small, free, self-hosted Symfony bundle for cookie consent banners — interesting as a template, but effectively unmaintained since 2021, so we should not put it on the compliance-critical path.

For engineering: It's a Symfony bundle (not Laravel), so it isn't a drop-in for our stack. It shows a reasonable minimal consent model — categories, persisted preferences, cookie gating — and is worth a half-day read as a design reference. It is not worth adopting: no releases in ~4 years, no dependents, no maintainer signal, and no path to a security patch. Recommend a time-boxed spike (≤1 day) to mine the approach, then either adopt a maintained CMP or build a thin Laravel-native layer over a maintained consent library.

Recommendation: Do not adopt. Classify as reference only. The real decision this surfaces is that consent is a compliance obligation with a moving legal target — that argues for a maintained dependency with a vendor on the hook, not a two-star OSS bundle.