Utm Cookie Bundle Laravel Package

Product Decisions This Supports

• Attribution modeling (first-touch vs. last-touch). The package persists UTM parameters from the landing URL into a cookie so the originating channel survives the gap between ad click and signup/purchase. That persisted value is the raw input to any "which channel gets credit" decision.
• Marketing budget allocation. Without persisted UTMs, returning visitors are attributed to direct/organic and paid channels get under-credited. Fixing capture changes channel ROI numbers — and therefore reallocation decisions — often materially for paid social and affiliate.
• Lead routing and CRM hygiene. Source data captured at form submit and written into HubSpot/Salesforce lets sales see acquisition channel and lets marketing segment by campaign.
• Growth and experimentation. Reliable cohorting of signups by campaign, enabling holdout/lift analysis instead of self-reported attribution.
• Build vs. buy — the decision this most directly informs. The honest answer here is build. This is a Symfony bundle, not a Laravel package, and the entire feature is a middleware of roughly 50 lines. The PM decision is "adopt the pattern, not the dependency."
• Roadmap scope. Whether to invest in a real attribution capability (consent-aware, server-side, multi-touch) or ship this as a stopgap now and defer the platform work.

When to Consider This Package

Consider it only if:

• The application is Symfony — the description explicitly says "Symfony Bundle," so in a Laravel context there is no service provider and no auto-registration; you would be reimplementing it regardless.
• You are on a Symfony version from the 2021 release window (5.x-era). No releases since 2021-11-26 means modern Symfony 6/7 support is unlikely and unverified.
• You need simple last-touch or first-touch UTM capture only, with no multi-touch requirement.
• You are reading it as a reference implementation / spec for your own middleware.

Look elsewhere — or don't adopt — when:

• Laravel. Not compatible out of the box; the integration cost exceeds the build cost.
• Consent is required (EU/UK). UTM cookies are non-essential under ePrivacy/GDPR and require consent before being set. A bundle that writes on request without a consent gate is a compliance gap you must build around.
• Browser reality matters. Safari ITP and Firefox ETP cap script-set cookies at 7 days or less; cross-domain and subdomain scoping aren't handled; the 4KB cookie ceiling constrains how much you can store.
• Supply chain and maintenance. 0 stars, 0 dependents, no release in ~3 years, small single-vendor project: no security-patch path, no advisory history, no community. An unmaintained dependency sitting in the conversion path is an availability and audit risk for very little code saved.
• You actually need multi-touch, server-side tagging, GA4/Ads integration, or cross-device identity. Those are CDP/attribution-platform decisions, not a cookie bundle.

How to Pitch It (Stakeholders)

For executives: The problem is real and cheap to fix; this package is not the fix. Our channel reporting likely over-credits direct/organic because campaign parameters disappear when users come back later — that distorts where we spend. Persisting UTMs is a small, low-risk middleware change we can own outright. Adopting instead an unmaintained, Symfony-only dependency (0 stars, no releases since 2021) adds supply-chain and privacy-compliance surface in exchange for roughly 50 lines of logic we'd have to rewrite anyway for Laravel. Recommendation: no-go on adoption, go on the capability, build in-house.

For engineering: Treat medelse/utm-cookie-bundle as a spec, not a dependency. Implement a Laravel middleware that (1) gates strictly on consent state, (2) captures utm_* params on request, (3) writes a signed, scoped, expiry-bounded first-party cookie storing first-touch and last-touch separately plus a schema version, and (4) exposes the values to form submissions and CRM sync. Include tests and an opt-out/clear path. Budget ~2–3 days including QA and a privacy review.

Revisit "buy" only if we later need multi-touch attribution or cross-device identity — that's a CDP evaluation, not a cookie bundle.