GDPR: Disable reports / personalized reports

[christophpaster]

Question

Is there a possibility to disable reports or do reports anonymous?

Additional context

GDPR requires special consent from users to be tracked in newsletter-sendouts, except when the tracking is anonymous.

[bencroker]

Not currently. In order to send marketing emails to users in the first place, you need to get their explicit consent under GDPR. Is there a valid use-case for getting this consent but then anonymysing their data in the campaign reports?

[kringkaste]

Yes, this is a use-case. You are allowed to send emails but the recipients do not accept tracking for opening / clicking. It would by nice to disable the tracking in mailing list types.

[bencroker]

If that's the case Tom @kringkaste, then you'd probably want to be able to have this as a lightswitch field on a per contact basis. Would allowing tracking to be enabled/disabled per mailing list type really be sufficient for your use-case?

[bencroker]

After doing some further research, it seems that according to GDPR, organisations should be getting explicit consent for "tracking" of users. What I might consider is adding a new "Tracking Consent" field to contacts, with the following options:

• Personal Tracking (what the Campaign plugin does at present)
  Records events traceable to the contact such as when they opened an email and what they clicked on.

• Anonymous Tracking
  Records only events that are not traceable to the contact such as demographic information and most popular links.

• No Tracking
  Does not record any events for the contact.

The plugin still needs to record when a contact subscribed and unsubscribed, but I guess that doesn't necessarily fall under "Personal Tracking" so much as a necessary part of maintaining their preferences.

Any thoughts on the above?

Reference: https://www.gdpreu.org/compliance/email-tracking/

[christophpaster]

I like the options and agree on the subscribe/unsubscribe as "neccesity". UX-wise, getting the acceptance might be solved with a checkbox on the submission-form.

[bencroker]

This would essentially mean that in addition to a general consent checkbox, subscribe forms would require a second option for tracking, for example:

Consent

• I would like to receive marketing emails from Acme Corp. (required)

Tracking

• I agree to Acme Corp. tracking my personal activity
• I agree to Acme Corp. tracking my activity anonymously
• I do not agree to Acme Corp. tracking any of my activity

I would love to see some existing examples of such a subscribe form being used in production.

I suppose the alternative would be to ask for consent for tracking, but this is less explicit in regards anonymous tracking.

Consent with Tracking

• I would like to receive marketing emails from Acme Corp. (required)
• I agree to Acme Corp. tracking my personal activity (optional)

[tombauer]

Is there some news in this regard already? Would it be possible to make the tracking non-personalized or to deactivate it completely?

[bencroker]

This issue is still open for discussion. It will most likely make it into the next major version of the plugin, due to be released along with Craft 4.

[bencroker]

Added the enableAnonymousTracking setting to campaign types in 2585708, which prevents tracking of personal data of contacts.This seems like the simplest solution without having to require major changes to mailing list subscribe forms.

Also added a campaign/reports/anonymize console command that anonymizes all previously collected personal data.

These changes will be released in version 2.0.0.

[bencroker]

This has been released in version 2.0.0.