Laravel Consent Laravel Package

Product Decisions This Supports

• Build vs. buy for consent management. This package makes "build on Laravel" a credible option against commercial CMPs (Cookiebot, OneTrust, Usercentrics) for teams whose consent needs are first-party-cookie-scale rather than ad-tech-scale: versioned consent cookie, category grants, gated scripts, withdrawal, and a log are all in the box.
• Compliance-driven roadmap work gets a reference implementation. GDPR/ePrivacy "prior consent" requirements — no non-essential scripts before a grant, valid decision scoped to the current config version, re-prompt on policy change — are encoded in the contract rather than reinvented per feature squad.
• Google Consent Mode v2 becomes a configuration task, not an integration project. Basic mode with google.tags, signals, ads_data_redaction, url_passthrough, deferred tag load, and consent update on later grants covers the common marketing-analytics ask without a separate vendor contract.
• Withdrawal is a real product behavior, not a checkbox. Per-category cookie deletion (exact names plus _ga_*-style prefixes) on host and parent domains, on every revoking transition and on stale versions, plus reload_on_revoke, lets you promise "revoking actually removes what we set" in a privacy policy.
• Localization stops being a per-surface bug class. Server-resolved texts (de, en, es, fr, hu) mean Blade, Alpine, and Vue render identical strings — useful when deciding whether to expand into new markets or ship a localized landing page.
• A consent audit trail can be scoped cheaply. Optional logging with hashed truncated IP, event_id idempotency, retention pruning, and Consent::history() supports DSR/audit answers — and lets you defer buying a record-keeping product.
• Cookie transparency is a shippable surface. The cookie table (provider, translatable purpose, ISO 8601 lifetime) with Blade and Vue renderers means the "cookie policy page" is content work, not engineering work.
• Frontend stack is not a forcing function. Framework-free core, Alpine, and Vue 3 adapters with the same config and events de-risk the decision of which stack a given product surface uses, and Livewire navigation awareness avoids the classic SPA re-render regressions.
• Cross-product reuse. Cookie format compatibility with netipar/laravel-office-leads and the documented upgrade path from netipar/cookie-consent 1.x signal that consent is being treated as shared infrastructure — a portfolio-level decision, not a per-app one.
• Adoption sequencing. Because the banner is unstyled and the API is server-side first, you can ship compliance behavior before design sign-off — decoupling the legal deadline from the design system milestone.

When to Consider This Package

Consider it when:

• You run one or more first-party Laravel apps and want consent handled inside the app rather than via a third-party JS snippet and a vendor contract.
• Your consent scope is category-based (necessary / analytics / marketing / preferences) and your obligations are GDPR/ePrivacy-style rather than IAB TCF-based.
• You need script gating for third-party tags and can express them as <script type="text/plain" data-consent="…">, including CSP nonce and module scripts.
• Google Consent Mode v2 Basic is the marketing requirement — you do not need advanced mode, server-side GTM, or per-vendor signal mapping.
• You want a consent log you control (own table, own retention, hashed IP) rather than exporting to a vendor.
• You need multilingual consent UI resolved server-side so all rendering paths agree.
• You are on Blade, Alpine, Vue 3, or Livewire — or a mix — and want one contract across them.
• You are migrating from netipar/cookie-consent 1.x and want the documented path.

Look elsewhere when:

• You require IAB TCF v2.2, Google Additional Consent Mode, or vendor-list management — this is explicitly Basic mode only, and there is no TCF string handling.
• You need advanced Consent Mode with server-side GTM, conversion modeling, or per-region signal policy.
• You need a hosted CMP with legal indemnity, pre-built vendor databases, geolocation-based banner behavior, or a compliance team behind an SLA. This is a self-hosted library; your legal review is your own.
• You want a styled, design-system-ready banner — the shipped component is deliberately unstyled, so budget design and accessibility QA (the accessibility contract is shared, but the visuals are yours).
• You need geo-targeted or jurisdiction-aware prompting (EU vs. US opt-out models). Nothing here selects behavior by region.
• You depend on legacy browser support — the client core and adapters assume modern JS.
• You need SSR-rendered Vue consent state hydrated without a client round-trip; the Vue plugin is client-side.
• Your team cannot absorb pre-1.0 API churn: v0.1.0 means the contract, config shape, and JS package surfaces may move. Pin versions, and treat the upgrade guide as evidence of intent rather than a stability guarantee.
• You are not on Laravel, or you want consent handled entirely at the edge/CDN — the server-side API reads the raw Cookie header, which assumes the request reaches your app.

How to Pitch It (Stakeholders)

For executives: This is a small, self-hosted Laravel package that satisfies the consent requirements we actually have — no non-essential script loads before a grant, a decision is invalidated when our cookie policy changes, users can withdraw and have cookies actively deleted, and Google Consent Mode v2 Basic is covered for marketing tags. It replaces an "evaluate and contract a CMP" line item with a bounded engineering task, and it removes the per-site vendor fee and the third-party JS dependency from the critical path. The trade-off is explicit: we own the compliance surface and the legal review, and we get no vendor indemnity, no IAB TCF support, and no geo-targeted prompting. At v0.1.0 we should treat the API as stabilising — pin the version and expect upgrades.

For engineering: The package is a config-driven consent core, not a framework. Server-side Consent facade (allows(), granted(), hasDecision(), decision(), clientConfig(), cookieTable()), Blade conditionals and @consentConfig, plus an unstyled <x-consent::banner> and <x-consent::cookie-table>. Client side is one framework-free core with thin Alpine (registerConsent(), consentBanner, Livewire-navigation aware) and Vue 3 (createConsentPlugin(), useConsent(), renderless ConsentBanner) adapters, all reading the same clientConfig() texts so we cannot drift between stacks. Consent state is a versioned cookie (__cookie_consent / __cookie_consent_v) validated against the config version, read from the raw Cookie header — so it works without session coupling and is compatible with netipar/laravel-office-leads.

Two integration points deserve early attention, because they are where the work actually lands: script gating converts existing tags to <script type="text/plain" data-consent="…"> (CSP nonce and module types supported), and withdrawal requires us to enumerate per-category cookie names and prefixes in config — that inventory is the real deliverable, and it is also what makes the deletion promise true on host and parent domains. Google tags are declarative (google.tags, google.signals, ads_data_redaction, url_passthrough) and load only after consent, with consent update and a late config on subsequent grants.

The optional log is opt-in: CONSENT_LOG_ENABLED, publishable migration, POST /consent/log behind web with throttling and event_id idempotency, HMAC-hashed truncated IP, retention-driven pruning, and Consent::history(). Enable it if we need an audit answer; skip it and we carry no PII surface. Documentation is bilingual (EN/HU) with a cookbook and an upgrade guide from netipar/cookie-consent 1.x, which materially lowers the cost of the first migration.

What we are accepting: pre-1.0 churn, Basic Consent Mode only (no TCF, no advanced/server-side GTM), unstyled UI that needs design and accessibility QA against the stated contract, and no regional prompting logic. If marketing later asks for TCF vendor lists or geo-targeted banners, that is a re-evaluation, not a config change.