Weave Code
Laravel Cookie Consent Laravel Package
whitecube/laravel-cookie-consent
A GDPR-compliant cookie consent package for Laravel with cookie registration, customizable Blade views, translations, directives, facade methods, and JS-enhanced UX. Works with or without JavaScript.
Laravel Cookie Consent is a flexible package for building a fully EU GDPR-compliant cookie policy in Laravel applications. It handles cookie registration and configuration, ships with Blade views and translation files for consent alerts and pop-ups, and provides Blade directives and Facade methods to keep your code clean. Consent works both with and without JavaScript, and every aspect—content, behavior, and styling—can be customized to fit your site.
- Register and categorize cookies with a simple definition API
- Ready-made, translatable consent banners and pop-ups
- Blade directives and Facade methods for checking consent
- Progressive enhancement JS for a smoother experience
- Fully customizable views, behavior, and styling
Frequently asked questions about Laravel Cookie Consent
- How do I install whitecube/laravel-cookie-consent in a Laravel app?
- Run composer require whitecube/laravel-cookie-consent, then publish the package assets for the service provider, config, views and translations with vendor:publish. Register the published application-level provider after RouteServiceProvider on Laravel 10 and below, or in bootstrap/providers.php on Laravel 11 and above. Finally add the @cookieconsentscripts directive in your head section and @cookieconsentview in the body of your base layout. Getting the provider order wrong is the most common install mistake with this package.
- Which Laravel versions does this package support?
- Check the version constraints on Packagist before committing, since the repository documentation only describes the current registration pattern. The package relies on standard framework features such as auto-discovery, a published app-level provider extending CookiesServiceProvider, and Blade directives, so it fits the normal Laravel request lifecycle. Provider registration differs by version: after RouteServiceProvider on Laravel 10 and below, or in bootstrap/providers.php on Laravel 11 and up.
- How do I register cookies and categories with this package?
- Implement registerCookies() in the published provider, which extends CookiesServiceProvider and acts as the single extension point. Inside it you define categories, then the cookies belonging to each category, along with attributes and optional accepted callbacks that are resolved through the service container. Configuration is fluent and centralized, so your whole cookie policy lives in one class. Keep that inventory aligned with what the site actually sets, because the package is a declaration layer and does not intercept cookies.
- How do I check whether a visitor has accepted a cookie category?
- The package exposes facade methods and Blade directives, so you can branch on consent for a category in templates or plain PHP. Route any third-party script that sets cookies through an accepted() callback so it only renders after consent, since nothing in the package blocks code that fires unconditionally. Because enforcement happens during the response phase, all gating logic has to live in your own views or callbacks.
- Can I customize the cookie consent banner views and translations?
- Yes. Views and language files are publishable, so you can restyle the alert and pop-up and rewrite every category and cookie description. Plan to localize categories and cookie labels for each locale you ship, since the legal copy is your responsibility rather than the vendor's. An optional JavaScript layer improves the front-end experience, but the banner and consent flow still work without JS.
- Is this package really 100% GDPR compliant?
- Treat the 100% GDPR compliant claim as vendor marketing rather than assurance. The package gives you category-level granularity and a way to re-open the banner, but it does not produce a consent receipt with timestamp, policy version or an audit log, so provable consent and records of processing remain yours to build. ePrivacy also expects easy withdrawal and per-purpose granularity, which you must verify in your own implementation. Budget for a legal review of the cookie inventory before launch.
- Does it work with Inertia.js, Livewire or an SPA front end?
- It is built for server-rendered Blade: the banner is a Blade view and consent is resolved during the response, so an API-first or JavaScript-driven client needs the consent state exposed to it separately. Inertia and SPA setups can still use the backend registry and facade methods, but the out-of-the-box banner assumes a classic Laravel monolith. For a pure JSON API the package adds little value on its own.
- How do I gate Google Analytics or GTM until consent, and is Consent Mode v2 supported?
- Third-party scripts only load after consent if you wrap them in an accepted() callback for the analytics category, so route your GTM or gtag snippet through the registry. The documented google(id:, anonymizeIp:) shorthand looks UA-era, so verify GA4 measurement IDs and confirm whether your setup emits Consent Mode v2 default-denied signals, which is a separate EEA requirement from showing a banner. The package does not emit those signals for you, so add them yourself inside the gated snippet.
- What production issues should I watch for with caching and Content-Security-Policy?
- Consent resolution and Set-Cookie headers happen per request, so full-page caches, CDNs and response caches can serve stale banner state or drop the consent cookie. Exclude banner pages and consent mutations from caching, or vary correctly on the consent cookie. Also note that @cookieconsentscripts injects inline JavaScript, which a strict Content-Security-Policy will silently block, so plan nonces or hashes before shipping.
- Is whitecube/laravel-cookie-consent actively maintained, and are there alternatives?
- It has roughly 500 GitHub stars but no Packagist dependents, so external production validation is thin, and a single agency maintains it, which is a bus-factor risk. Documentation is largely the README and release notes with limited edge-case coverage, and there is no geo-targeting or hosted consent management admin UI. If you can avoid non-essential cookies entirely, cookieless analytics such as Fathom, Plausible, Pirsch or Swetrix may remove the need for a banner; otherwise pair this package with a dedicated CMP for consent records.
Weaver
How can I help you explore Laravel packages today?