Reply to thread

What about cookie xf_from_search?

This does get set for guests visiting through search engines to track that they visited through a search engine without getting consent from the user to set this cookie.

We got legal advice from our data protection officer that this is not the case (depending on which features are being used):

• It is not compliant for visitors visting the forum through a search engine (see abovce)
• It is not compliant if Google Analytics is being used, as GA does set cookies to track the user without the user being able to explicitly accept or deny this
• Is is not complianet if various social media content (YouTubeVideos, Facebook posts, etc.) is embedded in posts as the providers do set cookies without the user being able to explicitly accept or deny this
• It is not compliant if various Anti-Spam services (like Google ReCaptcha, StopForumSpam, Akismet, etc.) are being used as those services do process personal data (IP addresses, email addresses, etc.) without visitors being able to explicitly accept or deny this
• It is not compliant if external content (Images, Giphy, etc.) is being loaded as the external services do process personal user data (IP address) without the visitor being able to explicitly accept or deny this
• It is not compliant if gravatar is enabled as Gravatar would process personal data (IP address.) of visitors without being able to explicitly accept or deny this
• It is not compliant if a user executes certain functions (like staying logged in, switching style as a guest, switching language as a guest or using a smilie via the smilie menu) as those functions do set "performance cookies" (eg. cookies that are not technically required for the website/service to operate but are necessary tp provide comfort functions)  without the visitor being able to explicitly accept or deny this.
• It is not compliant if a valid IP information URL is configured as personal user data (IP address) would be submitted to an external service without the user being able to expelcility accept or deny this

Due to this, we had to implement code to block all those features / cookies untikl the visitor has given explicit consent to use them.