Filament Consent Control Laravel Package

Product Decisions This Supports

• Build vs. buy for consent gating. This package covers one slice of the consent problem — gating third-party embeds inside the CMS — that a full CMP (OneTrust, Usercentrics, Cookiebot) charges enterprise money for. It lets you defer or scope down a CMP purchase if your only real exposure is marketing pages with embedded video/maps.
• Content-team self-serve. The RichEditor plugin is the highest-leverage feature: editors can paste a YouTube/Vimeo link and get a consent-gated, youtube-nocookie-normalised embed without filing a ticket or hand-editing HTML. That removes the single most common source of accidental GDPR violations on content sites.
• Roadmap: consent as a platform capability. Because settings are editable at runtime via the eloquent driver, non-developers can adjust consent copy/behaviour without a deploy — a genuine operational win, and a stepping stone toward a broader privacy-config surface.
• Vendor/architecture optionality. The package is explicitly additive: the underlying laravel-consent-control config still drives behaviour, and the Filament layer "does nothing until you opt in." That makes it a reversible decision — you can adopt the admin UI and drop it later without re-architecting consent.
• Consolidation of ad-hoc workarounds. Teams usually have three or four homegrown iframe wrappers and a wiki page. This replaces them with one plugin, one markup contract (.consent-message--wrapper / data-src), and consistent rendering.
• Not supported yet: consent receipts/audit trails, IAB TCF strings, geo-targeting, multi-brand/multi-domain consent scoping. If those are on the roadmap, this is a complement, not a substitute.

When to Consider This Package

Adopt (pilot) when:

• You are already on Laravel 11.28+/12 and Filament 5 — the Filament 5 pin is hard, so this is a non-starter for Filament 3/4 panels until backported.
• Your consent exposure is concentrated in editor-authored embeds rather than in ad-tech or analytics tag sprawl.
• You want settings editable at runtime by non-developers, either via settingsPage() or by embedding ConsentSettingsForm in an existing resource.
• You are a small-to-mid team that needs a defensible, low-cost baseline rather than a contract-backed compliance vendor.

Look elsewhere / wait when:

• You need legal-grade evidence: consent logs, versioned policy records, withdrawal audit trails, DSAR export. This package stores settings, not consent events — confirm before assuming otherwise.
• You need IAB TCF, Google Consent Mode v2 integration, or geo/IP-based consent variation.
• You require vendor due diligence: v0.1.0, a single-maintainer namespace, no visible security policy or release cadence. Treat as a dependency-risk item, not infrastructure.
• Your threat model requires server-side gating — the gate is client-side JS, so non-JS clients and scrapers see the data-src, not a blocked page. Fine for UX/compliance posture, not for "no request is ever possible."
• You can't absorb upgrade churn: a pre-1.0 package tracking a young Filament major will move.

Practical criteria: run a one-week spike on two real content pages, verify in devtools that zero third-party requests fire before consent, verify the stored markup survives round-trips through the editor, and pin the version.

How to Pitch It (Stakeholders)

To executives (one paragraph): This is a small, optional add-on that closes a real compliance gap — the videos and maps our editors paste into pages currently contact third parties before anyone clicks "accept." It auto-converts embeds to privacy-friendly URLs and holds them behind consent, which is exactly the pattern regulators look for. Integration is roughly a day of engineering, it's additive and fully reversible, and it lets us postpone a five-figure CMP contract while our exposure is limited to content embeds. Recommendation: fund a scoped pilot, not a rollout.

To engineering: Thin Filament layer over the existing laravel-consent-control runtime — publish config and assets, register ConsentControlPlugin::make() in the panel, opt into settingsPage() only if you want the ready-made settings UI. No mandated migrations. Two caveats: it hard-requires Filament 5, and v0.1.0 is young — pin it, wrap adoption in a feature flag, and keep consent behaviour in the underlying config so the admin layer stays swappable. Worth a review of how the eloquent driver stores settings and whether anything is written per-visitor.

To legal/DPO: It reduces accidental tracking by normalising YouTube to youtube-nocookie and Vimeo to player embeds, and it blocks embeds until consent via data-src markup. It does not produce consent receipts, audit logs, or TCF signals — those remain a separate requirement. Ask for a short written position on whether client-side gating is acceptable for our risk tier before we rely on it.

The ask: one engineer, one week, two pages, a devtools check that no third-party requests fire pre-consent. Success criteria are measurable; the downside is bounded.