Data Collect Consent

[thomas-kl1]

• Built-in pop-in
• https://github.com/osano/cookieconsent
• https://github.com/phpro/phpro-mage2-module-cookie-consent
• https://github.com/AmauriC/tarteaucitron.js

Each 13 months, customer must give his consentent of personal data processing (cookies).
This value should be configurable in the settings.

[SomeGeek]

Important to note: As of 2.3, a reCaptcha module is included by default. In most situations, this will be turned on, at least for the contact form.

However, as this collects lots of personal data, this can't be considered a functional cookie.

So, to comply with the law, people need to opt-in for this. But if they don't it is not an option to present them with a unprotected contact form either, that would be a bad idea.

I see only really 2 ways around this:

• Use a honeypot. Not a favorite option as it's quite easy to work around it for bots. And if it's not today, it will be tomorrow: spammers innovate, just like us, unfortunately.
• Prevent submitting the form without reCatpcha consent. Do this by only processing the form if reCaptcha cookies are sent with the form.

The latter one requires fine-grained cookie control, thus having multiple (configurable) groups. Like Marketing, Analytics and reCaptcha.

[SomeGeek]

Another note: We also need to deal with other third-party cookie-enabled extensions which are included by default. Google Analytics and Google Adwords are two of them, which I suspect are used a lot.

Magento 2 has a internal "cookie restriction mode", which gets checked before those are loaded. We could extend that to also look at our cookie settings.

[thomas-kl1]

It might be necessary to achieve this in a specific module, as it can quickly became large. We definitly need to check what is involved in Magento core.

[ioweb-gr]

I would like to point out for tarteaucitron that it's actually a very good solution regarding the fact that it allows you out of the box to run a script only after the user gives his consent explicitly. However due to it's legacy javascript code, it's very hard to ensure that it's properly loaded before you load your custom scripts.

It's impossible to handle the dependency with requirejs and keep it modular so often it will give issues with uninitialized window objects that google tags need. For example remarketing code in product page/cart etc is not certain that will execute correctly unless you tie it in the custom script code.

It's also loading it's own file for services via the main tarteaucitron.js file so merging usually breaks it. You'd have to load it from a CDN

Basically it's very hard to integrate in asynchronous ways.

[thomas-kl1]

Interesting.. thank you for your feedback, have you proof of concept with Magento 2 or integration tool to achieve this in mind?

[ioweb-gr]

I've been experimenting with this for a while because I haven't seen a single module offering proper cookie consent integration for Magento 2 but every single one has limitations. You'd be amazed to see that even paid solutions don't adhere to the regulation regarding cookies. For example some just unset the cookies instead of preventing their storage on the user's device in the first place before consent is given. Only tarte was 100% compliant but unreliable for Magento 2.

I've tried with quantcast GDPR too but it relies on external service so I avoided that too. Seems similar to osano mentioned earlier.

I am currently focusing on this library

https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework

I haven't tried it yet since it needs studying but the main idea is that the framework provides a list of purposes and the ability to check if consent is given for them.

So you can wrap scripts and inline scripts with a check for which purpose you need consent for. If consent is given then the code executes