Download the PHP package atriametal/sylius-cookie-consent-plugin without Composer

Sylius Cookie Consent Plugin

Asks the visitors of a Sylius shop for their consent to cookies, purpose by purpose, blocks the scripts and the embedded contents until they consent, and keeps a proof of each choice. It follows the recommendations of the French data protection authority (CNIL):

• nothing optional is loaded before the visitor chooses;
• rejecting is as easy as accepting: both buttons have the same style, on the banner and in the preferences;
• the visitor can accept or reject each purpose, and sees the third parties behind it;
• the visitor can change or withdraw the consent at any time, from a link in the footer; the cookies of a withdrawn purpose are deleted;
• the choice is kept for 6 months by default (13 months at most), then the visitor is asked again;
• each choice is recorded, without any personal data, so that it can be proven.

No external service, no build step: one module script and one style sheet, themable with CSS custom properties.

Requirements

• Sylius 1.14 or 2.x, PHP 8.2 or later, and Symfony 5.4, 6.4, 7.4 or 8 within the versions supported by your Sylius version.
• Sylius 1.14 requires api-platform/core 2.7, whose releases are all affected by security advisories: Composer 2.9 and later refuses to install them unless your project ignores these advisories, as this plugin does for its CI in composer.json. This concerns Sylius, not the plugin.

Installation

1. Require the plugin:

2. If you do not use Symfony Flex, enable the plugin:

3. Import the routes. The shop route is outside the locale prefix; the admin route goes under the admin prefix:

4. Install the assets and create the table of the consent records:

5. Describe your cookies (see Configuration), block your scripts and embedded contents (see Blocking), and add the preferences link to your footer:

6. Remove the consent records older than the retention period every day, for instance with cron:

The banner, the style sheet and the script are rendered by the layout template events (Sylius 1) or Twig hooks (Sylius 2) of the shop: a theme that keeps them needs nothing else.

Configuration

The label and the description of each category are translated from atriametal_cookie_consent.categories.<name>.label and .description, in the messages domain. The plugin translates the default categories in English, French and German. Override any text in your translations/messages.<locale>.yaml: the texts of the banner must describe the purposes you actually use.

Blocking scripts and embedded contents

A script runs once a visitor consents to any of the categories listed in its data-cookie-consent attribute. Give it the text/plain type, so that the browser does not run it before:

A module script keeps its type in data-type="module".

An embedded content gets its address from data-src. Until the visitor consents, a placeholder explains why it is hidden and lets the visitor allow its category; data-cookie-consent-service names the third party in it:

On the server side, cookie_consent_granted('media') tells whether the visitor consented. Do not use it in pages cached for every visitor.

Google consent mode

With google_consent_mode.enabled, the style sheet template denies the configured signals before any Google tag loads, and the script sends the choice of the visitor with gtag('consent', 'update', …). Render the style sheet template before your Google tags in the <head>. The consent mode does not replace the blocking: without consent, Google tags still send cookieless pings.

JavaScript

Any element with data-cookie-consent-action="open" opens the preferences. A script cannot be unloaded: when the visitor withdraws a consent, the page is loaded again, after the cookies of the category are deleted.

Theming

Override the custom properties of .cookie-consent and .cookie-consent-placeholder:

See public/cookie-consent.css for the full list. Keep accepting and rejecting with the same style.

Proof of consent

Each choice is recorded with a random identifier, the version of the policy, the granted categories, the date and the channel: no IP address, no customer. The identifier stays the same when the visitor changes the choice, and is shown in the preferences, so that the visitor can refer to it. The admin lists the records under Configuration › Cookie consents.

Limitations

• Without JavaScript, nothing is unblocked and the banner is not shown.
• The texts of the banner are yours: they must match the categories and services you configure.
• Another site cannot make a visitor consent: the choice is only accepted as JSON, which browsers cannot send from another site without a CORS preflight.

Development

License

MIT