PHPackages minkovdev/laragdpr - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. minkovdev/laragdpr ActiveLibrary minkovdev/laragdpr ================== GDPR Cookie consent and cookie manager for Laravel 1.0.0-RC.6(1mo ago)26↓100%proprietaryPHPPHP ^8.2|^8.3|^8.4 Since Jul 13Pushed 1mo agoCompare [ Source](https://github.com/minkovdev/laragdpr)[ Packagist](https://packagist.org/packages/minkovdev/laragdpr)[ Docs](https://laragdpr.com)[ Fund](https://www.buymeacoffee.com/minkovdev)[ RSS](/packages/minkovdev-laragdpr/feed)WikiDiscussions develop Synced 1mo ago READMEChangelog (10)Dependencies (19)Versions (7)Used By (0) Lara GDPR ========= [](#lara-gdpr) [![Latest Version on Packagist](https://camo.githubusercontent.com/da79d5d0c1580e9cfadb6e3077bcb159af77a54b51e0b7c2d16169d8b6448d66/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6d696e6b6f766465762f6c617261676470722e7376673f7374796c653d666c6174)](https://packagist.org/packages/minkovdev/laragdpr)[![Total Downloads](https://camo.githubusercontent.com/72ac8359b903c937d33d9265508f44f93ce6f3c5e79bdfe6b99bafd4ad15c244/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6d696e6b6f766465762f6c617261676470722e7376673f7374796c653d666c6174)](https://packagist.org/packages/minkovdev/laragdpr)[![GitHub Stars](https://camo.githubusercontent.com/212b93ecf3f3c5d5f36f3704d2e8efb6568f3004c9ed28ff91bf7fbf1251d50e/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f6d696e6b6f766465762f6c61726167647072)](https://github.com/minkovdev/laragdpr)[![Laravel Support](https://camo.githubusercontent.com/eef1c038216332ba8f3a3e5d7ae6b520c97974bcc11550386ce5811442535ef6/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d31312e7825323025374325323031322e7825323025374325323031332e782d6f72616e67653f7374796c653d666c6174266c6f676f3d6c61726176656c)](https://laravel.com)[![PHP Version](https://camo.githubusercontent.com/d7468887182ab9c8a15872f7bbbc12da3a083f48fc0ce1979c7fac47e5642d7d/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f6d696e6b6f766465762f6c617261676470723f7374796c653d666c6174)](https://www.php.net)[![License](https://camo.githubusercontent.com/88cb1f81dfd3ade28f7b96b327011591fe79a4057df815c0a529415091bc9006/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6d696e6b6f766465762f6c617261676470722e7376673f7374796c653d666c6174)](LICENSE.md) A comprehensive Laravel package for **GDPR-compliant cookie consent and cookie management**. This package provides a configurable consent banner, granular per-category cookie preferences, database-backed cookie definitions, and dynamic, risk-analyzed script injection — all rendered through your choice of **Blade (Alpine.js)**, **Livewire**, or **React**. > The package is auto-discovered by Laravel, so no manual service provider registration is required. Key Features ------------ [](#key-features) ### Consent Management [](#consent-management) - **GDPR-compliant consent** — records consent with a pseudonymized identity, IP address, user agent, timestamp, and the active cookie-policy version. - **Tamper-proof consent cookie** — the consent payload is HMAC-signed with your app key, so it cannot be forged or altered client-side (independent of Laravel's cookie encryption; supports `APP_PREVIOUS_KEYS`rotation). - **Immutable audit trail** — deletion of consent/choice records is blocked by default, preserving a complete history for regulators (configurable). - **Flexible banner placement** — fixed banner at the `top` or `bottom` of the page, with an optional close button for incidental browsing, and configurable privacy/cookie policy links. - **Consent versioning** — bump the policy version to automatically re-prompt every visitor. - **Works for everyone** — identifies both authenticated users and anonymous visitors without linking personal data. ### Granular Cookie Preferences & Dynamic Injection [](#granular-cookie-preferences--dynamic-injection) - **Cookie categories** — Essential, Analytics, Advertisement, Marketing, Social, and Other (extensible via the database). - **Dynamic script injection** — cookie scripts are injected into ``, ``, or the footer based on the user's saved choices, without a full page reload. - **Script risk analysis** — every injected script is scanned for dangerous patterns (`eval`, `Function`constructor, `document.write`, …) and filtered according to a configurable risk threshold. - **User control** — a floating preferences icon and a full settings modal let visitors change or withdraw consent at any time. ### Technical Features [](#technical-features) - **Three rendering modes** — `blade` (default, Alpine.js), `livewire`, or `react`. - **Auto-injected assets** — styles/scripts and approved cookie scripts inject into every page automatically; layout directives are optional (same technique Livewire uses for its own assets). - **Security by default** — security headers and rate limiting are applied to the package's own routes. - **Data retention & cleanup** — configurable retention periods with a cleanup command for GDPR compliance. - **Observability** — a health check endpoint and optional package logging / admin notifications. - **Multi-language ready** — all UI strings ship as translatable language files. Requirements ------------ [](#requirements) RequirementVersionPHP`^8.2`, `^8.3`, or `^8.4`Laravel`^11.0`, `^12.0`, `^13.0`Livewire`^3.0` or `^4.0` *(only if you use the `livewire` rendering mode)*Quick Start ----------- [](#quick-start) ### 1. Install [](#1-install) ``` composer require minkovdev/laragdpr ``` Migrations are loaded automatically — there is **no need** to publish or run vendor migrations manually. The database tables are created on `php artisan migrate`. ### 2. Publish the configuration (recommended) [](#2-publish-the-configuration-recommended) ``` php artisan vendor:publish --tag=laragdpr-config ``` ### 3. Run migrations [](#3-run-migrations) ``` php artisan migrate ``` ### 4. Add the consent banner to your layout [](#4-add-the-consent-banner-to-your-layout) Only **one** directive is required — `@laraGdprContent`, which renders the consent banner, settings modal, and preferences icon. Styles, scripts, and approved cookie scripts are injected automatically into every page by default (`auto_inject.*` in the config), so a minimal layout is enough: ``` {{ $slot ?? '' }} @laraGdprContent ``` If you want explicit control over where assets/cookie scripts land (or you're integrating with an existing layout that manages its own ``/`` precisely), the full set of **Blade directives** still works alongside auto-injection with no double output — whichever renders first for a given request wins (see [RENDERING\_MODES.md](doc/RENDERING_MODES.md#auto-injected-assets--cookie-scripts)): ``` {{-- Package styles --}} @laraGdprStyles {{-- Cookie scripts for the (e.g. Google Analytics) --}} @laraGDPRHeaderCookies {{-- Cookie scripts for the (e.g. Facebook Pixel) --}} @laraGDPRBodyCookies {{ $slot ?? '' }} {{-- Cookie scripts for the footer (e.g. X pixel) --}} @laraGDPRFooterCookies {{-- Consent banner + settings modal + preferences icon --}} @laraGdprContent {{-- Package scripts --}} @laraGdprScripts ``` That's it — visitors will now see a consent banner and cookie scripts will be injected according to their choices. > **Rendering modes:** The example above uses the default `blade` mode. For **Livewire** or **React** modes the same directives are used, but the `@laraGdprContent` directive renders the appropriate component and the script set differs. See [doc/RENDERING\_MODES.md](doc/RENDERING_MODES.md). ### 5. (Optional) Publish assets and views [](#5-optional-publish-assets-and-views) ``` # Front-end assets (CSS/JS) for styling customization php artisan vendor:publish --tag=laragdpr-assets # Blade views for deeper customization php artisan vendor:publish --tag=laragdpr-views ``` Before You Go Live ------------------ [](#before-you-go-live) Decisions and caveats every production integration must consciously handle — each links to the full explanation. 1. **Plan for `APP_KEY` rotation.** Consent cookies are HMAC-signed and visitor identities are hashed with your app key. Rotating it **without** `APP_PREVIOUS_KEYS` invalidates every consent cookie and identity hash — all visitors are re-prompted and lose their saved choices. Rotate the Laravel-recommended way. → [Application key rotation](doc/SECURITY_AND_COMPLIANCE.md#application-key-rotation) 2. **Open the health endpoint deliberately.** `GET /laragdpr/health` answers **403** outside the `local` environment until you either redefine the `viewLaraGdprHealth` gate (e.g. for admins) or set `LARAGDPR_HEALTH_SECRET` for external uptime monitors — choosing the header or query transport via `LARAGDPR_HEALTH_SECRET_VIA`. → [Health check access](doc/CONFIGURATION.md#health-check-access) 3. **Decide how erasure requests meet the immutable audit trail.** With the default `immutable_consents` / `immutable_choices`, calling `delete()` on consent/choice records throws. If your compliance workflow hard-deletes individual records, plan to disable the flag or delete via a mass query deliberately. → [Immutable records](doc/SECURITY_AND_COMPLIANCE.md#immutable-records) 4. **Keep `expose_exception_messages` off in production.** It appends raw exception messages (queries, class names, configuration) to visitor-facing JSON responses and to the health endpoint's per-check detail. Debugging aid only. → [expose\_exception\_messages](doc/CONFIGURATION.md#expose_exception_messages) 5. **Protect the pages that embed the banner from framing.** The package's security headers cover only its own routes — clickjacking protection for the pages rendering `@laraGdprContent`(an invisible-iframe overlay tricking visitors into clicking *Accept All*) is your application's `X-Frame-Options` / `frame-ancestors` responsibility. → [Security headers](doc/SECURITY_AND_COMPLIANCE.md#security-headers) 6. **Treat cookie-management access as privileged.** Script risk analysis is a pattern-based heuristic, not a sandbox — obfuscated JavaScript can bypass it. Whoever can author cookie script content can effectively run JavaScript on your pages. → [Script risk analysis](doc/SECURITY_AND_COMPLIANCE.md#script-risk-analysis--a-heuristic-not-a-sandbox) 7. **Bump `COOKIE_POLICY_VERSION` when your policy or scripts change.** A version bump re-prompts every visitor, keeping recorded consent aligned with what they actually agreed to. Forgetting it means consent records reference an outdated policy. → [Consent versioning](doc/SECURITY_AND_COMPLIANCE.md#consent-versioning) Configuration ------------- [](#configuration) All configuration lives in `config/laragdpr.php` (after publishing) under the `laragdpr` key, and is overridable with `LARAGDPR_*` environment variables. Highlights: Config keyEnv variableDefault`require_consent``LARAGDPR_REQUIRE_CONSENT``true``cookie_policy_version``COOKIE_POLICY_VERSION``'1.0.0'``rendering_mode``LARAGDPR_RENDERING_MODE``'blade'``auto_inject.assets``LARAGDPR_AUTO_INJECT_ASSETS``true``auto_inject.cookie_scripts``LARAGDPR_AUTO_INJECT_COOKIE_SCRIPTS``true``banner.position``LARAGDPR_CONSENT_BANNER_POSITION``'bottom'``banner.show_close_button``LARAGDPR_BANNER_SHOW_CLOSE``true``banner.text.privacy_policy_link``LARAGDPR_CONSENT_BANNER_TEXT_PRIVACY_POLICY_LINK``'privacy-policy'``banner.text.cookie_policy_link``LARAGDPR_CONSENT_BANNER_TEXT_COOKIE_POLICY_LINK``'cookie-policy'``use_sweetalert``LARAGDPR_USE_SWEETALERT``true``disable_notifications``LARAGDPR_DISABLE_NOTIFICATIONS``false``retention.consent_records``LARAGDPR_CONSENT_RETENTION_DAYS``365``retention.choice_records``LARAGDPR_CHOICE_RETENTION_DAYS``365``preferences.show_icon``LARAGDPR_PREFERENCES_SHOW_ICON``true``preferences.icon_position``LARAGDPR_PREFERENCES_ICON_POSITION``'right'``consent_cookie.name``LARAGDPR_COOKIE_CONSENT_NAME``'laragdpr_cookie_consent'``consent_cookie.lifetime_days``LARAGDPR_COOKIE_CONSENT_LIFETIME_DAYS``30``consent_cookie.secure_cookie``LARAGDPR_COOKIE_CONSENT_SECURE_COOKIE``true``security.security_headers_enabled``LARAGDPR_SECURITY_HEADERS_ENABLED``true``script_risk_threshold``LARAGDPR_SCRIPT_RISK_THRESHOLD``'low'``rate_limiting_enabled``LARAGDPR_RATE_LIMITING_ENABLED``true``health_check_enabled``LARAGDPR_HEALTH_CHECK_ENABLED``true``health_check_secret``LARAGDPR_HEALTH_SECRET``null``health_check_secret_via``LARAGDPR_HEALTH_SECRET_VIA``'header'``expose_exception_messages``LARAGDPR_EXPOSE_EXCEPTION_MESSAGES``false``immutable_consents` / `immutable_choices`—`true`See [doc/CONFIGURATION.md](doc/CONFIGURATION.md) for the complete reference. Cookie & Consent Management ------------------------------- [](#cookie--consent-management) Cookie definitions and categories are stored in the database (seeded automatically). The package injects the matching scripts only after the visitor has granted consent for the relevant category, and only when the script passes the configured risk analysis. - Database schema, models, and the cookie/category system → [doc/COOKIE\_MANAGEMENT.md](doc/COOKIE_MANAGEMENT.md) - Blade directives, Livewire components, React mount, and the preferences icon → [doc/RENDERING\_MODES.md](doc/RENDERING_MODES.md) - Programmatic services, routes, events, commands, and helpers → [doc/API\_REFERENCE.md](doc/API_REFERENCE.md) Data Retention & Cleanup ---------------------------- [](#data-retention--cleanup) To stay GDPR-compliant, old consent and choice records can be purged automatically: ``` # Preview what would be deleted php artisan laragdpr:cleanup-data --dry-run # Delete records older than the configured retention period php artisan laragdpr:cleanup-data # Delete records older than a specific number of days php artisan laragdpr:cleanup-data --days=180 ``` Schedule it in `routes/console.php` (Laravel 11+) or `app/Console/Kernel.php`: ``` use Illuminate\Support\Facades\Schedule; Schedule::command('laragdpr:cleanup-data --scheduled')->weekly()->sundays()->at('02:00'); ``` Security & Compliance ------------------------- [](#security--compliance) - **HMAC-signed consent cookie** — the consent payload is signed with your app key and verified on every read; tampered or hand-crafted payloads are rejected. Key rotation is supported via `APP_PREVIOUS_KEYS`. - **Immutable consent records** — deletion of consent/choice records is blocked by default to preserve the audit trail (`immutable_consents` / `immutable_choices`). - **Security headers** are added to the package's own routes (X-Content-Type-Options, Referrer-Policy, Permissions-Policy, frame/cross-origin policies) and can be disabled or customized. - **Rate limiting** protects the consent/choice endpoints. - **Script risk analysis** blocks risky admin-authored scripts above a configurable threshold. - **Data integrity validation** can throw or log when inconsistent data is detected, with optional administrator email notifications. - **No internal error disclosure** — visitors see only a generic, translated error message; raw exception messages are logged, not sent (opt-in for debugging via `expose_exception_messages`). - **Consent versioning** lets you re-prompt users when your policy changes. - **Health check** endpoint for monitoring — access-controlled via the `viewLaraGdprHealth` gate (local-only by default) or a shared secret for external uptime monitors. See [doc/SECURITY\_AND\_COMPLIANCE.md](doc/SECURITY_AND_COMPLIANCE.md). Documentation ------------- [](#documentation) Detailed documentation lives in the [`doc/`](doc/README.md) folder: DocumentContents[doc/README.md](doc/README.md)Documentation index[doc/INSTALLATION.md](doc/INSTALLATION.md)Detailed installation & quick start for all three rendering modes[doc/CONFIGURATION.md](doc/CONFIGURATION.md)Full configuration & environment-variable reference[doc/RENDERING\_MODES.md](doc/RENDERING_MODES.md)Blade directives, Livewire components, React, preferences icon[doc/COOKIE\_MANAGEMENT.md](doc/COOKIE_MANAGEMENT.md)Database schema, models, categories, script injection, risk levels[doc/API\_REFERENCE.md](doc/API_REFERENCE.md)Services, routes, events, commands, models, enums, helpers[doc/SECURITY\_AND\_COMPLIANCE.md](doc/SECURITY_AND_COMPLIANCE.md)Signed consent cookie, security headers, rate limiting, integrity, immutable records, versioning, retention, healthContributing ------------ [](#contributing) Contributions are welcome! Please open a Pull Request. See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. Support ------- [](#support) - **Issues:** [GitHub Issues](https://github.com/minkovdev/laragdpr/issues) - **Discussions:** [GitHub Discussions](https://github.com/minkovdev/laragdpr/discussions) - **Author:** Milen Karaganski — 📄 License & Fair Use Disclaimer ----------------------------------- [](#-license--fair-use-disclaimer) Please read the [LICENSE.md](LICENSE.md) file. --- ### 🚀 Looking for more features? (Dual Licensing) [](#-looking-for-more-features-dual-licensing) We are actively developing a **PRO version** with advanced enterprise features, extended support, and premium components. If you love this package and want to unlock its full potential, stay tuned or visit our official website: ****. ### Health Score 39 — LowBetter than 84% of packages Maintenance91 Actively maintained with recent releases Popularity9 Limited adoption so far Community6 Small or concentrated contributor base Maturity41 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 6 Last Release 47d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/e693a3b3a9da833685cdc1f0d2c10317c3fd7addbba3a0627581a673660037a9?d=identicon)[minkovdev](/maintainers/minkovdev) --- Top Contributors [![minkovdev](https://avatars.githubusercontent.com/u/287708014?v=4)](https://github.com/minkovdev "minkovdev (45 commits)") --- Tags gdprgdpr-compliancegdpr-consentgdpr-cookielaravellaravel-package ### Code Quality TestsPHPUnit Static AnalysisPHPStan, Rector Code StyleLaravel Pint Type Coverage Yes ### Embed Badge ![Health badge](/badges/minkovdev-laragdpr/health.svg) ``` [![Health](https://phpackages.com/badges/minkovdev-laragdpr/health.svg)](https://phpackages.com/packages/minkovdev-laragdpr) ``` ### Alternatives [psalm/plugin-laravel Psalm plugin for Laravel 3365.5M359](/packages/psalm-plugin-laravel)[laravel/cashier Laravel Cashier provides an expressive, fluent interface to Stripe's subscription billing services. 2.5k31.8M166](/packages/laravel-cashier)[laravel/pulse Laravel Pulse is a real-time application performance monitoring tool and dashboard for your Laravel application. 1.7k17.6M165](/packages/laravel-pulse)[pressbooks/pressbooks Pressbooks is an open source book publishing tool built on a WordPress multisite platform. Pressbooks outputs books in multiple formats, including PDF, EPUB, web, and a variety of XML flavours, using a theming/templating system, driven by CSS. 45945.2k1](/packages/pressbooks-pressbooks)[api-platform/laravel API Platform support for Laravel 58190.1k22](/packages/api-platform-laravel)[laravel/ai The official AI SDK for Laravel. 1.1k6.4M360](/packages/laravel-ai) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)