Key Takeaways
- GDPR-minded Laravel SMS handling is minimization: hash OTP, redact bodies, keep message ids, drop raw MSISDNs from debug logs.
- This is engineering practice, not legal advice. Your counsel owns the DPIA. Official EU overview: the Commission data-protection pages.
- failed_jobs and Horizon often store the full payload. Treat that table like production PII.
- STOP and consent live in your app. The gateway does not invent a lawful basis.
- You bring the phone and operator credit. Platform pricing is devices plus send volume.
Laravel / Frameworks: How to GDPR-minded data handling is an engineering checklist for teams sending SMS through a paired Android. It is not a law firm memo. Privacy policy · privacy basics · data retention. EU overview: European Commission — data protection.
Live API fields: Developer Center. You bring the SIM. Devices and send volume.
body → hash → id only
If support can read the OTP from logs, you are not done.
What Laravel actually stores
The radio already saw the plaintext. Your job is to not copy it into five more systems. Redis, MySQL,failed_jobs, Slack alerts, and Sentry breadcrumbs are five controllers if you are sloppy.
Minimization is a delete policy you can run, not a paragraph on the marketing site.
How to handle SMS data with GDPR in mind
- Inventory every store that can hold MSISDN or message text.
- Hash OTP. Pepper in env — see API keys in env.
- Monolog processor: drop
text, keep gateway id. - Prune webhooks and failed jobs on a clock you can defend.
- Map inbound STOP into suppression. Two-way SMS
Keep vs hash vs drop
| Field | Production | Logs / Sentry |
|---|---|---|
| OTP digits | Hash + TTL | Never |
| MSISDN | Needed to send | Hash or last-4 |
| Gateway message id | Keep | Keep |
| Bearer token | Env only | Never |
| Marketing body | If you must send it | Template id, not copy |
OTP is not a log line
Same pattern as Express: hash, enqueue, compare. Laravel API in-depth · OTP.
failed_jobs is a mailbox
Laravel serializes the job payload. If the job carried text, so does the table. Redact before dispatch or use a payload that only has ids. Horizon tags are not a privacy control.
Retention and access
Align app retention with what you tell users. Panel history is a separate store — do not assume we delete on your schedule. Log retention. REST samples, not an SDK: PHP HTTPS samples.
Next steps
Dump one failed job and one log line. If you can read a code, fix the processor first. Install the app. 300 lifetime SMS is a lab cap, not a justification to keep bodies forever.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- PHP REST send samplesPHP code examples
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
