The GDPR requires explicit user consent before users can be tracked. Therefore, XWiki.org should present the users with a cookie banner.
Note that functional cookies do not require consent before they can be stored on user devices.
I propose adding GDPR Cookie Consent - XWiki Store to XWiki.org. The GDPR Cookie Consent app is made by XWiki SAS, and it is free, no license required. This would probably be the easiest way of going about this.
Technically the tools track IPs. However we don’t care about them and we don’t care to store them. Is there a way with Matomo to not store IPs so that we could do away with the cookie banner? (we could imagine matomo could encode a unique id based on an ip but that the decode to find back the ip address would not be possible - assymetrical encryption -, no?).
It wouldn’t help without changes. What would need to be changed is configuring GA and/or Matomo to not track an IP when the cookie is refused, see GDPR Cookie Consent - XWiki Store
Personally I don’t like these cookie screens that don’t let you easily refuse all cookies (like what is displayed at GDPR Cookie Consent - XWiki Store).
We would also need to configure the message as it doesn’t apply to XWiki.org.
Because of the added complexity, I’d also prefer that we don’t track anything rather than display this cookie banner. However, I feel it’s important that we know which pages are the most accessed, to improve our doc navigation.
So +1 for a properly configured cookie banner as mentioned above.
By default, Matomo hides 2 bytes of the user IP address. IP addresses are stored, for example as 192.168.xxx.xxx.
Unfortunately, this setting applies to the whole instance, and it cannot be changed per website. For XWiki SAS websites we’d need to keep the value at the default to have access to data about the countries that most frequently access our websites.
That being said, as far as I can understand (?), since the IP is not fully stored, we don’t need consent, as it is not Personally Identifiable Information. However, we still need to inform the user, through a cookie banner, that this data is being stored!
Outdated documentation. In newer versions the notice looks like this:
Still, Matomo offers their own opt-out script as an option. See here.
However, I’m not really a fan of the default phrasing (luckily, it can be changed):
You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.
You are not opted out. Uncheck this box to opt-out.
Alternatively, a custom opt-out form can be created from scratch. See their documentation.
ok cool but if it keeps only parts of the IP, I wonder how Matomo recognizes unique users (all users from the same company will be seen as the same person for ex, no?).
Why, if it cannot be linked to the user at all?
Ok, but this text is not completely true if we don’t store the user’s IP address. First we wouldn’t be analyzing the user actions but the actions taken by some random person. Second, it shouldn’t protect more their privacy to refuse the cookie if we can’t link the data to them.
Ok, more realistically some part of the IP is still stored and thus it should be possible to identify the company for example, right?
I’m not really sure about the technical implementation. I just know that it works . But it uses multiple data points, such as the screen resolution, browser, OS etc.
You’d have to ask the lawmakers .
Here is an excerpt from a website I used to inform myself:
The information or the notice as well as the consent are given via such a cookie banner. It is important in this context that, according to the ECJ, no distinction should be made between personal and non-personal data. When it comes to protecting the privacy of your users, this is fundamentally affected by the storage and recall of cookies. This also applies to non-personal data. The only exception are technically essential cookies, without which it is not possible to operate the website. These are so-called consent-free cookies.
It’s the default text. I presume it’s written this way based on the default settings of Matomo.
Correct. You cannot identify the user directly, but you still can infer some stuff about them (e.g.: general location, if it’s a company IP - the company, info about the OS & Browser, pages visited etc.).
I’d be curious to understand what “not possible to operate the website” means? For example, not being able to provide the most accessed pages as highlights in the doc would cause harm to the website and if we think it’s necessary then you cannot operate the website without them (ie not to the same quality level)…
The same would apply to “remember me” cookies on xwiki.org. They are technically not essential to operate the web site. Same for the current user locale, etc.
Honestly, great question. I know that in the case of user locale and “remember me” functionality, those are generally accepted to be “necessary cookies”. But you bring up a good point.
I’m unsure if there’s a right or wrong answer at the moment. As long as a lawyer could successfully argue that those cookies are necessary, I guess it would be allowed .
. But it uses multiple data points, such as the screen resolution, browser, OS etc.