The proof-of-consent log

Every decision — and every change of mind — becomes a row.

use Devix\CookieConsent\Models\ConsentLog;

ConsentLog::query()->where('consent_id', $id)->orderBy('revision')->get();

Nothing here identifies a person on its own. That is deliberate: a consent log that becomes a tracking database is its own problem.

The endpoint#

POST /consent accepts the record the widget sends. It writes the row and answers 201; a payload that is not a decision gets 422. It never sets the consent cookie — the browser owns that, and a server that could grant consent is a server that can be made to.

Rename it, move it, or wrap it in middleware:

'route' => [
    'enabled' => true,
    'uri' => 'privacy/consent',
    'name' => 'consent.store',
    'middleware' => ['web', 'throttle:30,1'],
],

Set 'log' => false to keep the widget and drop the database entirely.

Your own handling#

use Devix\CookieConsent\Events\ConsentRecorded;

class SyncConsentToCrm
{
    public function handle(ConsentRecorded $event): void
    {
        if ($event->decision->allows('marketing')) {
            $this->crm->allowEmail($event->decision->id);
        }
    }
}

Housekeeping#

Consent records are personal data too. Trim them on your own schedule:

Schedule::call(fn () => ConsentLog::query()->where('decided_at', '<', now()->subYears(3))->delete())->monthly();