- How do I install and set up laravel-cookie-consent in a Laravel app?
- Install with composer require jeffersongoncalves/laravel-cookie-consent, then run php artisan migrate to create the settings table and the 4.2.0 migration that adds consent_mode and type. Add @include('cookie-consent::cookie-consent-head') inside your layout's head and @include('cookie-consent::cookie-consent-body') in the body. Optionally publish the views or settings migrations with vendor:publish, and remember all configuration lives in spatie/laravel-settings.
- Which Laravel and PHP versions does laravel-cookie-consent support?
- The package requires PHP 8.1 or newer and Laravel 9 or newer, and it is tested up to Laravel 13.x. Lumen is not supported. Because settings are persisted through spatie/laravel-settings, that dependency needs to stay version-aligned with your framework.
- How do I enable Google Consent Mode v2 with this package?
- Set consent_mode to true in CookieConsentSettings, either through the settings class, the cookie_consent_settings() helper, or a Filament/Nova panel. The head view then pushes gtag('consent', 'default', ...) for ad_storage, ad_user_data, ad_personalization, and analytics_storage, restores a previous choice from the cookieconsent_status cookie, and pushes consent('update', ...) when the visitor selects. This default snippet must render before any Google tag loads.
- What is the difference between the info, opt-in, and opt-out consent types?
- With type set to info the banner is a notice only and scripts run immediately, with no allow or deny choice. Opt-in denies scripts until the visitor accepts, which fits GDPR in the EU and UK, while opt-out grants scripts by default until the visitor declines, which matches typical CCPA setups. The type setting is also what makes the Allow and Decline buttons render, so pick opt-in or opt-out for an actual consent gate.
- Why are my Allow and Decline buttons not showing in the cookie banner?
- In versions before 4.2.0 the package never passed a type value, so the allow and deny copy was never rendered. The type setting also defaults to info, which preserves the old notice-only behaviour even after upgrading. Set type to opt-in or opt-out in CookieConsentSettings, confirm you are on 4.2.0 or later, and run php artisan migrate for the migration that adds the new settings.
- How do I customize the cookie consent banner text, position, and styling?
- Publish the views with php artisan vendor:publish --tag=cookie-consent-views and edit the Blade templates and CSS, which are built on Osano templates. Text, position, theme, and behaviour come from CookieConsentSettings in the database and can be changed at runtime. Advanced theming usually means overriding the published views and stylesheets.
- Does laravel-cookie-consent store a server-side consent audit trail?
- No. Consent state lives only in the cookieconsent_status client cookie, so there is no server-side record of who consented to what and when. For audit obligations you need to post the value to your own endpoint when it changes and persist it in your database. That recording logic is custom work the package does not ship.
- Can I show opt-in in the EU and opt-out in the US with this package?
- There is no built-in geo-targeting: one type applies per deployment, so every visitor gets the same behaviour. To serve opt-in in the EU and UK and opt-out elsewhere you must override the setting per request, for example in middleware using a GeoIP lookup, before the views render. That logic lives outside the package.
- Do I need spatie/laravel-settings to use this package?
- Yes. Every setting is persisted with spatie/laravel-settings, so it is a required dependency and a second package surface to keep version-aligned. In return you get database-backed configuration you can read via app(CookieConsentSettings::class) or cookie_consent_settings() and change at runtime without redeploying.
- Can I block non-Google scripts such as Meta Pixel or Hotjar until consent is given?
- Only Google consent signals are emitted by Consent Mode, so Meta Pixel, LinkedIn Insight, Hotjar, and similar tags still need your own gating. Use data-cookieconsent attributes or middleware that checks the cookieconsent_status cookie before loading them. Server-side tagging and advanced Consent Mode options such as ads_data_redaction and url_passthrough are not exposed either, so teams running sGTM must extend the package.