Cookie Consent for Laravel — quebecstudio-mods/laravel-consent-kit

Cookie consent banner for Laravel 11 to 13, built for Quebec's Law 25 and usable under the GDPR. Built on quebecstudio-mods/consent-kit-core, shared with the Craft CMS plugin.

• No third-party cookie is set before consent.
• The HTML is the same for every visitor; pages stay cacheable.
• English and French included; an application adds any language with one file.
• YouTube videos load on click, with the thumbnail served by the application.

Installation

Requires PHP 8.2. Declare the private repositories in the application's composer.json:

"repositories": [
    { "type": "vcs", "url": "git@github.com:quebecstudio-mods/laravel-consent-kit.git" },
    { "type": "vcs", "url": "git@github.com:quebecstudio-mods/consent-kit-core.git" }
]

composer require quebecstudio-mods/laravel-consent-kit
php artisan vendor:publish --tag=cookie-consent-assets
php artisan vendor:publish --tag=cookie-consent-config

The service provider is discovered automatically. The banner is added to every HTML page served through the web middleware group.

How it works

InjectConsent, appended to the web group, edits HTML responses:

JSON, redirects, file and streamed responses are left untouched.

Configuration

config/cookie-consent.php. The keys follow the core's settings; the Craft-only ones (policySource, policyEntry, pluginName, templateRoot) do not apply.

Categories

null ships three categories: necessary, declaring the session cookie (config('session.cookie')), XSRF-TOKEN and the consent cookie; statistics and marketing, empty. A category with no declared cookie is not shown.

Wording in categories is a string, or keyed by locale:

'categories' => [
    'necessary' => [
        'required' => true,
        'label' => ['en' => 'Necessary', 'fr' => 'Nécessaires'],
        'cookies' => [
            'session' => ['name' => 'laravel_session', 'purpose' => ['en' => 'Keeps your session.'], 'duration' => ['en' => 'Session']],
        ],
    ],
    'statistics' => [
        'label' => ['en' => 'Statistics', 'fr' => 'Statistiques'],
        'cookies' => [
            'ga' => ['name' => '_ga', 'provider' => 'Google', 'purpose' => ['en' => 'Distinguishes visitors.'], 'duration' => ['en' => '2 years']],
        ],
    ],
],

Wording

The banner speaks the application locale (app()->getLocale()): the exact locale, then its base language, then defaultLanguage.

lang/vendor/cookie-consent/<language>.php replaces strings or adds a language. A file holds only the keys it changes:

<?php

return [
    'texts' => ['accept' => 'J’accepte'],
];

php artisan vendor:publish --tag=cookie-consent-lang

copies the shipped files there as a starting point. A published file keeps every key, so shipped wording updates no longer reach it; keep only the keys you change.

In templates

@cookieConsentBanner                               {{-- with autoInject off --}}
{{ CookieConsent::cookieTable() }}
{{ CookieConsent::cookieTable(['category' => 'statistics', 'headingLevel' => 2]) }}
@withCookieTable($page->body)
@withCookieTable($page->body, ['heading' => false])
{{ CookieConsent::videoFacade($youtubeId, $title) }}

@withCookieTable outputs its content as HTML with the [cookie-table] markers replaced; like {!! !!}, use it only for HTML you trust. CookieConsent::withCookieTable() escapes content that is not Htmlable.

YouTube posters are served by the route cookie-consent.thumbnail (/cookie-consent/thumbnail?v=<id>), outside the web group, and cached in storage/app/cookie-consent-thumbnails/.

Overriding templates

resources/views/vendor/cookie-consent/<name>.blade.php replaces a shipped template: banner, cookie-table, video-facade, video-embed.

php artisan vendor:publish --tag=cookie-consent-views

The variables each template receives are listed in the core package's README. Keep the data-qsm-ck-* attributes: the script finds every control through them.

Assets

vendor:publish --tag=cookie-consent-assets copies consent.js and consent.css to public/vendor/cookie-consent/. They are also published with the laravel-assets tag, which the Laravel application skeleton republishes on composer update.

Front end

Styling, the JavaScript API, conditional tags and integration recipes are the same as for the Craft plugin; see its documentation.

Tests

composer install
vendor/bin/pest

Licence

Proprietary. See LICENSE.md.