Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

'requireConsent' has not effect on cookie setting #13246

Closed
lbroermann opened this issue Aug 2, 2018 · 19 comments
Closed

'requireConsent' has not effect on cookie setting #13246

lbroermann opened this issue Aug 2, 2018 · 19 comments
Assignees
@tsteur
Labels
c: Privacy For issues that impact or improve the privacy.
Milestone
3.14.0

Comments

@lbroermann
Copy link

lbroermann commented Aug 2, 2018 •
edited by Findus23

Good day,

due to our goal to achieve GDPR compliance, we're trying to implement an opt-in procedure using a commercial cookie-plugin called "Borlabs Cookie" with our WordPress-Network.
We embedded Matomo with the following code/attributes:

<!-- Matomo -->
<script type="text/javascript">
  var _paq = _paq || [];
  /* tracker methods like "setCustomDimension" should be called before "trackPageView" */
  _paq.push(['requireConsent']);
_paq.push(['trackPageView']);
_paq.push(['trackAllContentImpressions']);
  _paq.push(['enableLinkTracking']);
  (function() {
    var u="//***/";
    _paq.push(['setTrackerUrl', u+'piwik.php']);
    _paq.push(['setSiteId', '1']);
    var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
    g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'piwik.js'; s.parentNode.insertBefore(g,s);
  })();
</script>
<!-- End Matomo Code -->

Tracking works fine, but Matomo creates _pk_id and _pk_ses at every session's start, also if we don't set
<script type="text/javascript"> _paq.push(['setConsentGiven']); </script> at the bottom of the page, using our plugin.
'rememberConsentGiven' is no option, since we want to use our WordPress plugin to handle opt-in/opt-out.

The support-pages weren't helpful as this doesn't seem to be the expected behaviour of "requireConsent". Could you please give me some advice on how to solve this problem?
Thank you!
@Findus23 Findus23 added the c: Privacy For issues that impact or improve the privacy. label May 4, 2020
@tobbecmd
Copy link

tobbecmd commented May 5, 2020

I can confirm this is still happening in version 3.13.5.
_paq.push([‘requireConsent’]); has no effect and _pk_id and _pk_ses cookies are being set without calling setConsentGiven.

@lastant
Copy link

lastant commented May 11, 2020

Maybe there is another way to make sure Matomo tracking code is loaded only after consent is given? For instance, I tried to add the tracking code dynamically using JS, instead of hard-coding it into the HTML; but tracking wouldn't work this way for some reason..

@Findus23
Copy link
Member

See also #13056 and #15948

@Findus23 Findus23 mentioned this issue May 24, 2020
Closed
@Sven74Muc
Copy link

Any chance to get this fixed... after 2 years? With this matomo isn't really GDPR ready

@Sven74Muc
Copy link

Maybe there is another way to make sure Matomo tracking code is loaded only after consent is given? For instance, I tried to add the tracking code dynamically using JS, instead of hard-coding it into the HTML; but tracking wouldn't work this way for some reason..

I tried an external consent Wordpress plugin called "GDPR Cookie Consence". This is placing the matomo code first if the user set the opt-in. No cookies will be set. After rejecting the opt-in the cookies will be deleted... Great, but... if the user set's the opt-in the matomo code will be placed and the cookis set. This is I think through a page reload. At the End I have 1 visit and 2 page views in matomo instead of 1 visit and 1 page view. :-(

@tsteur
Copy link
Member

tsteur commented Jun 12, 2020

@Sven74Muc we might have a look into this in a few months.

@Findus23 Findus23 added this to the 4.1.0 milestone Jun 14, 2020
@Findus23
Copy link
Member

I have moved this into 4.1.0 just so it doesn't get lost (as I think this would be really useful for being compliant with future privacy changes).

If someone else wants to contribute this feature, it would be possible to get it earlier.

@Sven74Muc
Copy link

Think it is not only useful for being compliant with future private chances... it's needed today to be compliant.
Think it should be solved in 4.0, 4.1 is too late!

@Sven74Muc
Copy link

Sven74Muc commented Jun 14, 2020 •
edited

If this is solved only in a few month (after two yearf of no change) I need to delete all matomo installations and have a look for another system.
My feeling is that this will not be changed in 2020 and also not in 2021... very sad. Matomo is a great system but with some issues like this (which are fundamental) it ios not usable.

@tsteur
Copy link
Member

tsteur commented Jun 14, 2020 •
edited

btw this refs #13056

I guess requireCookies would be calling disableCookies and then setConsentGiven would enableCookies (unless the user called disableCookies manually). since tracking consent != cookie consent so we cannot simply enable cookies if the user disabled cookies

@Sven74Muc
Copy link

Sven74Muc commented Jun 15, 2020 •
edited

btw this refs #13056

I guess requireCookies would be calling disableCookies and then setConsentGiven would enableCookies (unless the user called disableCookies manually). since tracking consent != cookie consent so we cannot simply enable cookies if the user disabled cookies

No, cookies are not allowed to set before consent is given (opt-in). Calling disabledCookies is not GDPR conform. There will be much court rulings in the future. The other thing is trust.. Do you think a visitor trust that a disabled cookie is realy disabled? If a cookie is there it is there and you cant't controll what it is doing. The fact that it is there generates question, doesn't matter what law is saying.

@tsteur
Copy link
Member

tsteur commented Jun 15, 2020

It's only how it would work internally. The user etc won't notice any of this.

@Sven74Muc
Copy link

So I maybe missunderstood you. As long as before the opt-in no cookies are set in the browser of the user it is fine.
So I hope this solution comes now quickly after 2 years of waiting.

@Sven74Muc
Copy link

How can we get this to 4.0.0 ??

@Findus23
Copy link
Member

How can we get this to 4.0.0 ??

The guaranteed way is by someone creating a Pull Request which contributes this change.

@Sven74Muc
Copy link

Hmmm... this means I need to develope it? I'm not a programmer :-(

@tsteur tsteur modified the milestones: 4.1.0, 3.13.7 Jul 2, 2020
@tsteur
Copy link
Member

tsteur commented Jul 2, 2020

FYI I'll look into this in the next days and we're planning to have this in the next 3.X release

@tsteur tsteur self-assigned this Jul 3, 2020
@tsteur tsteur mentioned this issue Jul 3, 2020
Merged
@tsteur
Copy link
Member

tsteur commented Jul 3, 2020

Apologies this took so long! I can totally understand any frustration. We'll do our best so this won't happen again.

I've worked on this and if anyone is familiar with patching files on a server then you could try to update your piwik.js, matomo.js, and js/piwik.min.js with this content and then give it a test: https://github.com/matomo-org/matomo/blob/74c86cc5ab97723774c0a93b1603b6cdb97cb7d2/js/piwik.min.js

@diosmosis
Copy link
Member

Fixed by #16173

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tsteur tsteur

Labels
c: Privacy For issues that impact or improve the privacy.
Projects
None yet
Milestone
3.14.0
Development

No branches or pull requests
7 participants
@diosmosis @tsteur @lastant @Findus23 @Sven74Muc @lbroermann @tobbecmd