README

Laravel Cookie Consent

This Laravel package provides a simple and elegant way to implement cookie consent on your website, ensuring compliance with privacy regulations like GDPR and CCPA. It offers a clean and customizable interface, allowing you to easily manage and display cookie consent banners and preferences.

Installation

You can install the package via composer:

composer require jeffersongoncalves/laravel-cookie-consent

Run the migrations to create the settings in the database:

php artisan migrate

Usage

Add head template.

@include('cookie-consent::cookie-consent-head')

Add body template.

@include('cookie-consent::cookie-consent-body')

Publish views (optional).

php artisan vendor:publish --tag=cookie-consent-views

Publish settings migrations (optional).

php artisan vendor:publish --tag=cookie-consent-settings-migrations

Configuration

All settings are stored in the database using spatie/laravel-settings. You can access and modify them at runtime using the CookieConsentSettings class or the cookie_consent_settings() helper.

Accessing settings

use JeffersonGoncalves\CookieConsent\Settings\CookieConsentSettings;

// Via helper
$settings = cookie_consent_settings();

// Via container
$settings = app(CookieConsentSettings::class);

// Read a value
$position = $settings->position;

Updating settings

$settings = cookie_consent_settings();
$settings->position = 'top-right';
$settings->popup_background = '#000000';
$settings->save();

Available settings

Property	Type	Default
`css_url`	`string`	`https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css`
`js_url`	`string`	`https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js`
`content_header`	`string`	`Cookies used on the website!`
`content_message`	`string`	`This website uses cookies to ensure you get the best experience on our website.`
`content_dismiss`	`string`	`Got it!`
`content_allow`	`string`	`Allow cookies`
`content_deny`	`string`	`Decline`
`content_link`	`string`	`Learn more`
`content_href`	`?string`	`null`
`content_close`	`string`	`❌`
`content_target`	`string`	`_blank`
`content_policy`	`string`	`Cookie Policy`
`popup_background`	`string`	`#696969`
`popup_text`	`string`	`#FFFFFF`
`popup_link`	`string`	`#FFFFFF`
`button_background`	`string`	`transparent`
`button_border`	`string`	`#f8e71c`
`button_text`	`string`	`#f8e71c`
`highlight_background`	`string`	`#f8e71c`
`highlight_border`	`string`	`#f8e71c`
`highlight_text`	`string`	`#000000`
`position`	`string`	`bottom-left`
`theme`	`string`	`block`
`type`	`string`	`info` (`info`, `opt-in` or `opt-out`)
`consent_mode`	`bool`	`false`

Position

Top Left	Top Right

Bottom Left	Bottom Right

Google Consent Mode v2

Google requires Consent Mode v2 for ads and analytics measurement of EEA/UK visitors. Turn it on and pick a compliance type:

$settings = cookie_consent_settings();
$settings->type = 'opt-in';      // banner shows Allow / Decline
$settings->consent_mode = true;
$settings->save();

The head view then pushes gtag('consent', 'default', ...) for ad_storage, ad_user_data, ad_personalization and analytics_storage, restoring a previous choice from the cookieconsent_status cookie, and the banner pushes gtag('consent', 'update', ...) when the visitor chooses.

`type`	Before a choice	Allow	Decline
`opt-in`	denied	granted	denied
`opt-out`	granted	granted	denied
`info`	granted	—	—

Include the head view before the Google Tag Manager or gtag snippet, so their tags start with the consent state already set:

<head>
    @include('cookie-consent::cookie-consent-head')
    @include('gtm::head') {{-- or @include('gtag::script') --}}
</head>

Works with laravel-gtm and laravel-gtag, or any Google tag on the page. type defaults to info and consent_mode to false, so upgrading changes nothing until you opt in; run php artisan migrate after updating to add the two settings.

Content Security Policy

When your app sets a CSP nonce through Laravel's Vite (Vite::useCspNonce(), as laravel-security-headers does), every <script> this package renders carries it, so a script-src 'self' 'nonce-{nonce}' policy works without 'unsafe-inline'. Scripts loaded afterwards from the vendor's own CDN still need that host in script-src (and its API in connect-src).

Testing

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

This package uses the Osano CookieConsent plugin.

License

The MIT License (MIT). Please see License File for more information.

jeffersongoncalves / laravel-cookie-consent

Package info

Security

Fund package maintenance!

Statistics