Web Privacy: Cookie Notices, Policies, and GDPR Compliance with Laravel Consent

In modern web development, ensuring compliance with privacy regulations (such as the General Data Protection Regulation or GDPR in Europe) involves much more than simply displaying a notice on screen. It is necessary to understand the difference between the informative cookie notice, legal policy pages, and the technical management of user consent.

1. Cookie Notice vs. Privacy Policies

They are often confused, but they serve distinct purposes within the platform:

• Cookie Notice / Banner: It is the popup interface that informs the user upon first entering the website about the use of tracking technologies. Its main function is to allow acceptance, rejection, or granular configuration of cookies before they are executed.
• Privacy and Cookie Policies: These are structured informational pages detailing what data is collected (via forms or browsing), the purpose of its processing, retention periods, and mechanisms for users to exercise their rights of access or deletion.

2. Consent Modes and Analytics Loading (Google Consent Mode v2)

The core of GDPR compliance lies in conditioning the execution of analytics scripts (such as Google Analytics 4, Meta Pixel, or TikTok Pixel) on the user's choice. By default, all tracking and marketing cookies must be disabled until an explicit acceptance action occurs.

To avoid completely losing traffic traceability when a user rejects tracking cookies, platforms like Google implement the so-called Consent Mode:

• Basic Mode: Tracking scripts are completely blocked if there is no consent. No information of any kind is sent to the analytics servers.
• Advanced Mode: If the user rejects tracking, scripts do not read or write identifying cookies, but send anonymous requests (pings without IP or personal data) so the site owner can measure overall visitor volume without violating privacy.

3. Consent Logging and Proof (Consent Audit)

The GDPR requires website owners to be able to demonstrate that the user gave consent before activating tracking cookies. This proof of consent must be logged in a structured manner:

{
  "consent_id": "8f3b2c1a-90de-4f56-b789-0123456789ab",
  "timestamp": "2026-10-26T11:30:00Z",
  "policy_version": "v1.2",
  "preferences": {
    "necessary": true,
    "analytics": false,
    "marketing": false
  }
}

While on the client side this preference is usually stored in localStorage or a technical cookie to maintain the browsing experience, on sites with registered users or critical applications it is advisable to synchronize this log on the server to preserve an audit trail in the event of data protection inspections.

Conclusion

Implementing a GDPR-compliant consent system is not just about hiding a floating banner, but about dynamically managing the loading of third-party scripts through client-side integrations (JavaScript) or backend libraries (such as dedicated packages in Laravel or consent plugins). Ensuring that only necessary cookies remain active by default is the foundation for avoiding legal penalties and respecting user privacy.

Cookie management and GDPR compliance with Laravel Consent

As we have already discussed, GDPR compliance involves not only having informative pages about cookie policies, but also having a tool that manages user preferences. This is essential to decide whether or not to allow the use of analytics and marketing tools, such as Google Analytics, the Meta pixel, or the TikTok pixel, especially for users in regions like Europe.

To manage this in Laravel, we use the Laravel Consent package. Once installed and the configurations are published, the package offers us two main components:

• The component that displays the visual banner.
• The HEAD component, which loads JavaScript and executes the logic to allow or block services based on user preferences.

We can customize three main aspects in the configuration:

• General settings: such as cookie names and design preferences (colors, etc.).
• External services: the package already comes with examples for Google Analytics (version 4), the Meta pixel, Microsoft Clarity, and the TikTok pixel.
• Custom services: you can add other services from other companies to work in an equivalent way.

config/consent.php

Script management and legal compliance

To comply with regulations, the GAT must be in the corresponding part, either in the blog page layout or the banner layout. Although you could use solutions like Spatie's cookie banner, this alone is not enough because it lacks the necessary protection for GDPR compliance.

It is installed via:

$ composer require jakub-lipinski/consent-for-laravel
$ php artisan vendor:publish --tag=consent-config

Just as we expose the configuration file.

Once you have Laravel Consent configured, you will have a panel where you can manage privacy policies and user options. The system allows the user to accept all cookies or reject optional analytics ones, always maintaining those that are mandatory for the correct functioning of the site.

<x-consent::banner />

In the HEAD section, a JavaScript block is included which saves us from having to manually implement the Google Analytics configuration. This code allows that, if the user does not give their consent, the advanced mode runs to keep analytics with anonymous data.

<x-consent::head />

It is a fundamental aspect, especially if you are in Europe, to avoid any penalty from the corresponding departments.