Cookies Bundle Laravel Package

Product Decisions This Supports

• EU/EEA market-entry sequencing — whether compliant consent capture is a launch gate or a fast-follow. Deciding this sets the launch date, not the other way around.
• Build vs. buy on consent management (CMP) — this package represents the "build lightly on the framework" option. It should be evaluated against commercial CMPs (OneTrust, Usercentrics, Cookiebot, Osano) on total cost of ownership, not license price.
• Tag and third-party script governance — whether any engineer can drop a pixel on a page, or whether every script must be registered against a consent category. Adopting this enforces the latter as policy, which is a durable organizational decision.
• Consent data model and audit posture — what you persist (categories granted, timestamp, policy version, anonymized identifiers) drives your privacy policy text, DPA annexes, DSAR response process, and the evidence you can produce in a regulator inquiry.
• Consent UX roadmap — banner copy, granular opt-in vs. implied consent, prominence of "reject all," preference center, and re-consent cadence. These are product surfaces with measurable conversion impact, not just legal checkboxes.
• Dependency and vendor-risk policy — a 3-star, zero-dependent package with no external users is a decision to become the maintainer. That's a staffing commitment disguised as a procurement decision.

Note on framing: despite the Laravel/PHP label, this is a Symfony bundle from a Symfony-focused agency. That materially changes the build-vs-buy math for a Laravel shop — see below.

When to Consider This Package

Consider it when:

• Your application is Symfony (5/6/7-era). On Laravel or any other PHP framework, the integration cost approaches a rewrite and the calculus collapses.
• Your cookie/script inventory is small, first-party, and stable — a handful of analytics and marketing tags, no tag manager, no dynamic tag injection.
• You have PHP engineering capacity to own it: read the source, write your own tests, patch it, document it. With three stars and no dependents, upstream support is effectively nil.
• Your legal team has approved a simple opt-in consent model for EU/EEA/UK, without requiring IAB TCF certification or certified-CMP status.
• You want a time-boxed spike: MIT license and a small codebase make a one-to-two-day proof of concept cheap and reversible.

Look elsewhere when:

• Your stack is Laravel or anything non-Symfony. Treat this as a reference implementation to read, not a dependency to install.
• You need Google Consent Mode v2 (effectively mandatory for Google Ads in the EEA) or IAB TCF v2.2 signal support. A small bundle will not deliver these, and retrofitting them is the bulk of the work.
• Legal, security, or procurement requires vendor attestation — SLA, security patch commitment, DPA with a subprocessor list, or indemnification. None of that exists here.
• Marketing needs no-code tag governance or a tag manager integration; that's a CMP feature, not a bundle feature.
• You operate multiple brands, domains, or locales with a preference center at scale.
• Your exposure is US-only (CCPA/CPRA), which is an opt-out model this package isn't built around.

How to Pitch It (Stakeholders)

One-line summary: A small, MIT-licensed Symfony bundle that handles cookie declaration and consent gating — genuinely useful as a starting point, but the real cost is internal ownership, not adoption.

For executives: Consent is a legal gate on EU revenue, so treat this as a make-vs-buy line item rather than a free-library find. The license is free; the commitment is an engineer who owns consent infrastructure indefinitely, including every future regulatory change. If EU revenue is material, or if legal and security require vendor attestation, budget for a commercial CMP and use this only as a reference. Recommendation: run a one-to-two-sprint spike with a hard decision checkpoint, and default to buy unless the cookie inventory is genuinely simple.

For engineering: It's Symfony-native, small enough to read end to end in an afternoon, and forkable. You get a cookie declaration registry and consent-gated script loading out of the box. You will need to add: automated tests, documentation, an audit/consent log, Google Consent Mode v2 signals, a preference center, and a re-consent policy — plus a plan for tracking upstream, since there is effectively no upstream. Assume you are the maintainer from day one.

For legal and privacy: It provides a consent mechanism, not a compliance guarantee. Confirm the package's storage and logging behavior against your retention policy, and make sure the banner UX you build on top of it meets the "as easy to reject as to accept" standard.