- How do I install spatie/laravel-cookie-consent in a Laravel app?
- Install the package with Composer using composer require spatie/laravel-cookie-consent. Laravel auto-registers the service provider, and you can optionally publish the config file. Then include the cookie-consent::index Blade partial in your layout or add the middleware to render the banner automatically. The setup is lightweight and usually takes under a day.
- Does spatie/laravel-cookie-consent support Laravel 11, 12, and 13?
- Yes. The package is current through Laravel 13 as of release 3.4.0, and PHP 8.2 support landed in version 3.2.3. It also works with Laravel 9 and 10, where you register the middleware in app/Http/Kernel.php; on Laravel 11 and later you append it in bootstrap/app.php. The MIT license keeps code usage straightforward.
- How do I customize the cookie consent banner text and translations?
- Publish the package views to resources/views/vendor/cookie-consent and the translations to resources/lang/vendor/cookie-consent/{locale}/texts.php. You can then edit the banner markup and wording per locale. The config file can also be published if you need to adjust package behavior.
- Does this package block cookies or trackers before consent?
- No. The package explicitly does not block trackers or cookies before consent; that is left to your application. Analytics, ad pixels, chat widgets, and other non-essential scripts can still fire on first paint unless you independently gate them. This is a key compliance gap to plan for.
- Can users decline cookies with spatie/laravel-cookie-consent?
- No. spatie/laravel-cookie-consent intentionally has no decline option, and its README notes that an accept-only banner might not meet requirements. Consent under GDPR and ePrivacy should be freely given and refusable, so an accept-only banner is a known enforcement exposure. If you need a decline path, use a more advanced consent package or a CMP.
- How does the middleware inject the cookie banner, and when should I use it?
- The optional global middleware performs a string injection of the Blade partial before the closing body tag. That means it mutates HTML responses and can be fragile for non-HTML responses, binary downloads, JSON APIs, streamed responses, or layouts without a body tag. Many teams prefer including the cookie-consent::index partial directly in the layout for more control.
- Why is the cookie consent banner not showing on localhost with a port?
- The consent cookie domain is derived from config/session.php, so on hosts with a port such as localhost:3000 the package can silently fail to set or read the cookie. Setting SESSION_DOMAIN correctly usually resolves it. This is documented but easy to miss during local development.
- Does spatie/laravel-cookie-consent work with full-page caching, CDNs, or Inertia and Livewire?
- Because the render decision is made server-side based on cookie presence, full-page caches and CDNs can serve a banner-bearing page to a user who already consented, or the reverse. You need to account for that variance in your caching strategy. SPA, Inertia, and Livewire layouts may also render the banner inconsistently or after hydration, so test those cases carefully.
- Is spatie/laravel-cookie-consent GDPR compliant, and does it store consent records?
- The package is a simple presentation-layer banner, not a compliance system. It stores consent only in a client-side cookie named laravel_cookie_consent, with no server-side audit record, no timestamp, no versioning, and no consent categories. It also cannot gate server-rendered content on consent status. For demonstrable consent records or granular categories, you need a CMP or a more advanced package.
- What are alternatives to spatie/laravel-cookie-consent for advanced consent management?
- The README points to whitecube/laravel-cookie-consent, statikbe/laravel-cookie-consent, and devrabiul/laravel-cookie-consent as more advanced Laravel alternatives. For Filament, marcogermani87/filament-cookie-consent is listed. Commercial CMPs such as Cookiebot, Osano, or Klaro can provide categories, decline options, tracker blocking, and audit records if you need those capabilities.