Summary
This proposal outlines the creation of a new Flarum extension to provide robust, legally compliant consent management. Built to first-party quality standards to ensure deep integration and future compatibility, it would replace the outdated fof/cookie-consent with a modern solution featuring prior-consent script blocking, granular controls, auditable server-side logging, and native Google Consent Mode v2 (GCMv2) integration. This is essential for any Flarum admin serving EU users.
The Problem: A Critical Compliance Gap
The current fof/cookie-consent extension is architecturally obsolete and exposes Flarum administrators to significant legal and financial risk. Its core failures are:
- No Prior Consent (ePrivacy Directive, Art. 5(3)): It cannot block non-essential scripts (e.g., from an analytics extension) from loading before a user gives consent.
- Invalid Consent UI (GDPR, Art. 7): It lacks an equally prominent "Reject" option and granular controls, rendering any consent collected invalid.
- No Audit Trail (GDPR, Art. 5(2)): It provides no server-side logging, making it impossible for an admin to demonstrate compliance to a supervisory authority.
- No GCMv2 Support: It cannot communicate consent signals to Google's APIs, a technical requirement since March 2024. This cripples Google Analytics and Ads functionality for all EEA traffic, leading to lost insights and ad revenue.
This isn't just an inconvenience; it's a critical gap that makes it difficult to operate a Flarum forum legally and effectively in the EU.
Core Goals (The MVP)
The primary goal is to create a Minimum Viable Product (MVP) that solves the core legal requirements elegantly and reliably.
- Block By Default: Actively block all non-essential scripts from executing until explicit, affirmative consent is granted.
- Provide Valid UI: Present "Accept All" and "Reject All" buttons with equal prominence on the first layer, with a clear link to "Manage Preferences."
- Granular Control: Offer opt-in toggles for distinct categories (e.g., Analytics, Marketing). These must be unchecked by default.
- Integrate GCMv2: Natively implement the Google Consent Mode v2 API.
- Log Consent: Securely store each consent event on the server, including an anonymized ID, a timestamp, the user's choices, and the active policy version.
- Enable Withdrawal: Provide a persistent, easily accessible UI for users to review and change their consent preferences at any time.
Non-Goals (To Maintain Focus)
To ensure a focused and achievable MVP, this extension will not initially include:
- Automated cookie scanning.
- Advanced GCMv2 features like "Advanced Implementation" (cookieless pings).
- Geolocation-based banner display.
- IAB TCF Certification: This extension will not pursue IAB TCF certification itself due to the significant annual fees (e.g., €1,575 for IAB Europe). For publishers requiring IAB TCF compliance (e.g., for AdSense, Ad Manager, AdMob), this extension is designed to work alongside a separate, Google-certified, IAB TCF-compliant third-party CMP, providing Flarum-native functionality while leveraging the external CMP for ad-tech specific compliance.
Proposed Technical Solution
This describes a potential implementation path using standard Flarum patterns.
1. Extension Scaffolding
- Proposed Name:
fof/consent (to align with the FriendsOfFlarum ecosystem)
- Dependencies:
flarum/core (latest stable), PHP (latest stable)
2. Relationship to flarum/gdpr
This extension is designed to be complementary to, not a replacement for, the official flarum/gdpr extension. They address two different, but equally critical, areas of compliance:
fof/consent (this proposal): Manages cookie consent, script blocking, and GCMv2, fulfilling requirements from the ePrivacy Directive and GDPR Art. 7 (Conditions for consent).flarum/gdpr: Manages user data rights, such as the Right to Access (Art. 15) and the Right to Erasure (Art. 17).
A fully compliant forum will need both extensions working together.
3. Front-End Implementation (Mithril.js)
- A new
ConsentBanner component will be injected into the main App layout.
- The banner's state (
isVisible, preferences) will be managed by a global app.consent state object.
- Script Management: The proposed solution is to use Flarum's
Formatter extender to parse the final HTML output. Scripts identified as non-essential will have their type attribute changed to text/plain, effectively disabling them.
- Example: A script tagged with
<script data-consent-category="analytics" ...> would be transformed into <script type="text/plain" data-consent-category="analytics" ...>.
- When consent is granted, the front-end logic will find these scripts and switch their
type back to text/javascript, allowing them to execute.
4. Back-End Implementation (PHP Extender)
- Database Migration: A new
consent_events table will be created to log consent actions, deliberately avoiding storing any personal data like IP addresses.
// In extend.php
(new Extend\Migration())
->add(__DIR__.'/migrations/2025_07_13_000000_create_consent_events_table.php');
// In the migration file
use Illuminate\Database\Schema\Blueprint;
use Flarum\Database\Migration;
return Migration::createTable('consent_events', function (Blueprint $table) {
$table->increments('id');
$table->string('user_token', 255)->index(); // Anonymized identifier
$table->timestamp('created_at')->useCurrent();
$table->json('choices'); // Stores { "analytics": true, "marketing": false }
$table->string('policy_version', 50);
});
- API Endpoints: A controller will expose endpoints for managing consent.
POST /api/consent: Receives the consent payload.GET /api/consent: Retrieves the current user's consent state.
5. Admin Panel Configuration
A settings page in the admin dashboard will allow administrators to:
- Customize all banner text via Flarum's localization system.
- Define the URL for the Privacy/Cookie Policy.
- Set the current
policy_version string (e.g., "1.1").
- Provide a simple interface to define which scripts belong to which category by specifying CSS selectors (e.g.,
script[src*="google-analytics"] for the Analytics category).
6. User Experience
- The banner will be styled to match the forum's theme out of the box.
- The "Accept All" button will use the primary theme color; "Reject All" will use a secondary/neutral color.
- A "Manage Preferences" link will open a Mithril-based modal with toggles for each category.
- A persistent floating icon or a link in the footer will allow users to re-open the preferences modal.
→ Try the Interactive Demo
(mockup only)
Benefits
- Legal Compliance: Provides a robust, defensible solution for GDPR and the ePrivacy Directive.
- Restored Functionality: Enables the legal use of Google Analytics and Ads for EEA traffic.
- Trust & Transparency: Builds user trust by offering clear, honest choices.
- Future-Proof: Aligns with the direction of EU privacy law.
- Platform Value: Makes Flarum a more attractive platform for professional and commercial use cases.
Should this be a priority for the Flarum ecosystem?
If you believe GDPR-compliant consent management is critical for Flarum's future, please share your thoughts below. Your feedback will help determine if this extension should move forward and what features matter most to the community.
Particularly valuable input:
- Forum administrators serving EU users
- Extension developers familiar with consent management
- Anyone who has struggled with the current
fof/cookie-consent limitations
Let's make Flarum the most privacy-compliant forum platform available! 🚀
