Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Ziggy is an open source PHP and JavaScript package, maintained by Tighten, that exposes a Laravel application named routes and a route() helper to client side JavaScript. It is compiled into the application own bundle and served from the first party origin. Ziggy sets no cookies, makes no third party requests and collects no behavioural or personal data, so it is a strictly necessary technical component that does not require consent.
Ziggy is an open source package maintained by Tighten that bridges Laravel and the browser. During the build it takes the named routes defined in your Laravel application and serialises them into a JavaScript object, then exposes a route() helper so front end code, including Vue, React or Inertia components, can generate correct URLs without hard coding them. Ziggy ships as part of your own application bundle and is served from your own domain.
Ziggy handles route definitions, not user data. It exposes route names, URI patterns and, optionally, the current route parameters to the client. It does not set cookies, does not write to localStorage for tracking, does not read device identifiers and does not send any information to Tighten or to a third party. Because nothing about the visitor is collected or transmitted, Ziggy does not process personal data in its own right.
Article 5(3) of the ePrivacy Directive only requires consent when a service stores or accesses information on the user terminal, and an exemption applies to storage that is strictly necessary to deliver a service the user requested. Ziggy neither stores nor reads terminal information for tracking, so the consent obligation simply does not arise. It can load before any consent decision, just like your application own JavaScript.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
While Ziggy itself is neutral, the application around it will usually process personal data and must have its own legal basis, privacy notice and security measures. The one Ziggy specific point is exposure: because your route table is serialised into the page, avoid placing secrets, tokens or personal identifiers in route names or default parameters, and use Ziggy route filtering to publish only the routes the client genuinely needs.
Ziggy performs no data transfers. It makes no outbound network requests of its own and sends nothing outside the European Economic Area. Any transfer risk in your stack comes from other components, such as analytics or hosting, and should be assessed there rather than against Ziggy.
Keep Ziggy up to date, serve it only from your first party origin and enable its route filtering so that internal or administrative routes are not leaked to the browser. Document Ziggy in your technical records as a strictly necessary component, and note in your component inventory, if you keep one, that it sets no cookies. No consent gating is required.
Websites using Ziggy must obtain user consent under GDPR regulations.
DPIA considerations
A dedicated Data Protection Impact Assessment is not required for Ziggy itself, because it processes no personal data and stores nothing on the user terminal for tracking. The only residual consideration is that Ziggy serialises your route definitions into the page, so review your route names and parameters to ensure they do not expose sensitive identifiers or internal endpoints to unauthenticated users. Any assessment effort should focus on the surrounding Laravel application rather than on Ziggy.
Sample consent text
This site uses Ziggy, a technical component that makes our application page addresses available to the browser so that links and navigation work correctly. Ziggy sets no cookies, tracks nothing and sends no data to third parties, so no consent is required for it to function.
This service may collect user data. Ensure GDPR compliance with FlowConsent.
No. Ziggy sets no cookies and writes nothing to localStorage for tracking. It only serialises your Laravel route definitions into a JavaScript object that your own front end uses to build URLs.
No. Because Ziggy does not store or read information on the user device for tracking and processes no personal data, the ePrivacy consent requirement does not apply and it can load without a consent decision.
Ziggy is strictly necessary technical functionality, so no separate consent based legal basis is needed for it. The host application relies on its own legal basis under Article 6 GDPR for whatever personal data it processes.
No. Ziggy makes no outbound requests of its own and sends no data to Tighten or any third party, so it triggers no international transfer. Assess transfers against your analytics, hosting and other vendors instead.
Not for Ziggy itself, since it processes no personal data. If your application requires a Data Protection Impact Assessment, focus it on the components that actually collect or use personal data.
Serve it from your own origin, keep it updated and enable route filtering so internal routes are not exposed. Avoid putting secrets or personal identifiers in route names, and record Ziggy as a strictly necessary component in your technical documentation.
Alternatives include Laravel Wayfinder, passing routes manually through Inertia shared props, or generating a typed route map at build time. All of these are first party approaches with the same low privacy profile as Ziggy.
You are not required to, because Ziggy sets no cookies. If you maintain a full inventory of components you may list it as a strictly necessary technical library that stores nothing on the device.
