Weave Code
Laravel Consent Laravel Package
netipar/laravel-consent
A Laravel package for managing user consent and privacy preferences. Track opt-ins and opt-outs, store consent records, and integrate GDPR-friendly consent flows into your application with simple, configurable APIs.
Headless cookie-consent for Laravel: versioned consent cookie, server-side API and Blade directive, framework-free JS core with Google Consent Mode v2, unstyled Alpine/Livewire and Vue 3 adapters.
Frequently asked questions about Laravel Consent
- How do I install and set up laravel-consent in a Laravel app?
- Install with composer require netipar/laravel-consent, then publish the config, language files and migration and run the migration. Drop the <x-consent::banner> Blade component into your layout and wrap third-party scripts in type="text/plain" blocks so they stay inert until the matching category is granted. PHP owns the source of truth for categories, texts, policy URL and cookie inventory and projects it into the browser through clientConfig(), so you configure consent in one place. Note the package is at 0.1.0, so treat the public API as unstable until 1.0.
- Which Laravel and PHP versions does laravel-consent support?
- The published overview and evaluation notes do not state a supported Laravel or PHP version matrix, so check the require constraints in the package composer.json before committing. Also look for a CI workflow and test suite in the repository, since neither test coverage nor browser targets for the JS core are documented. If your application runs an older Laravel LTS or an unusual PHP version, verify compatibility on a branch before rollout.
- Do I need Alpine.js or Vue 3 to use laravel-consent?
- No. The JS layer is a framework-free core (@netipar/consent-core) with optional, unstyled Alpine/Livewire and Vue 3 adapters, so plain Blade plus the core script is enough. Because nothing is styled, you own the design of the banner and the accessibility verification of your markup and focus behaviour. The unstyled approach is deliberate: it avoids CSS collisions and inline-style problems under a strict Content Security Policy.
- What happens to existing user consents when I bump the consent version?
- Changing the consent version in config invalidates every stored decision, triggers deletion of the related cookies and re-prompts all users. That is correct behaviour for compliance when categories, texts or your cookie inventory actually change. It is dangerous as an incidental deploy artifact, so gate version bumps behind a deliberate review rather than letting them ride along with routine releases.
- How does laravel-consent handle Google Consent Mode v2?
- It supports Google Consent Mode v2 in Basic mode only: tags do not fire before consent, and a later grant sends a consent update plus a late configuration call. This is the compliance-safe pattern, but it will undercount conversions compared with advanced mode. Your marketing or growth owner should accept that trade-off before adoption, and you should confirm whether advanced mode is on the roadmap.
- Does laravel-consent make my site GDPR compliant?
- The package gives you the mechanics, not the legal sign-off: categories, versioned consent storage, a consent log and cookie deletion are tooling, while texts, cookie inventory and legal review become your first-party responsibilities. The consent log is the highest-risk surface, adding a database table, a public POST /consent/log route under web middleware with CSRF, throttling, event_id idempotency, HMAC-truncated IPs and retention pruning. Expect that piece to be scrutinised in a DPIA and plan monitoring around it.
- Can I disable the consent log route, and what happens if logging fails?
- The endpoint is part of the package's public surface, so confirm in the published config whether it can be turned off completely without side effects before you rely on it. Test the degraded path explicitly: a 429 from throttling, a CSRF mismatch or a network failure must not leave the user without a valid consent decision in the browser. Whether consent remains valid when the log write fails is a question to raise with the maintainer and document for your own DPIA.
- Can laravel-consent really delete all cookies when a user withdraws consent?
- Withdrawal deletes cookies per category by exact name and by _ga_*-style prefixes across the host and parent domains. It cannot remove cookies your host cannot see or those set under unrelated domains, so complete withdrawal is a claim to validate against your actual cookie inventory rather than a guarantee. Maintain the inventory carefully and test withdrawal against real third-party scripts.
- Which languages are included, and how do I add a new locale?
- Five locales ship with the package: de, en, es, fr and hu. For any other market you either contribute translations upstream or publish and maintain the language files yourself. Since consent texts are legally sensitive, have translations reviewed rather than machine-translating them.
- Is it safe to adopt a 0.x package, and how do I keep the PHP and JS packages in sync?
- Treat 0.1.0 as a first release with an unstable public API and plan for churn before 1.0. Four artifacts must stay in lockstep: the PHP package plus the core, Alpine and Vue JS packages, because a mismatched pair can silently read an incompatible contract. Pin exact versions in composer.json and package.json, upgrade them together, and ask the maintainer whether releases are lockstep and whether the PHP-to-JS contract is negotiated at runtime or fails silently on mismatch.
Weaver
How can I help you explore Laravel packages today?