Not planned XenForo might not be compliant with EU law

[Kirby]

https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-10/cp190125en.pdf

XenForo does set non-essential cookies (like xf_from_search, xf_style_id, xf_language_id, xf_tfa_trust, xf_user, xf_notice_dismissed) without getting active consent from the user.

It would therefore be nice if XF would be compatible with IAB TCF 2.0 so we could easily implement proper consent solutions.

 

[Chris D]

I promise you that if we ever implement cookies to "collect information for the purposes of advertising" then we will implement a system by which consent is explicit.

For now, we are comfortable with our use of cookies and the level of implied consent that we seek.

 

[Kirby]

I promise you that if we ever implement cookies to "collect information for the purposes of advertising"

You already do.

Cookie xf_from_search is recorded for the sole purpose of tracking that a visitor came from a search engine and to personalize the presented content based on that.

Implied consent, especially for such purposes, is not valid.

Furthermore, it must be communicated that such cookies are being used, what they are being used for, and how long they are valid - this currently does not seem to be the case.

Also users must be able to withdraw consent and still use the website, this is also not possible.

 

[Kirby]

Press statements by german authorities (ICO equivalents) that tracking does require active consent:

Google Analytics und ähnliche Dienste nur mit Einwilligung nutzbar

Das offizielle Informations- und Serviceangebot des Hamburger Beauftragten für Datenschutz und Informationsfreiheit

datenschutz-hamburg.de

Google Analytics und ähnliche Dienste nur mit Einwilligung nutzbar

Internetangebot des Landesbeauftragten für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz

www.datenschutz.rlp.de

Einbindung von Drittanbieter-Diensten in Webseiten und Apps

Aufgrund einer Vielzahl an Anfragen, Beschwerden und Kontrollanregungen weist der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Prof. Dr. Ronellenfitsch, auf Folgendes hin:

datenschutz.hessen.de

https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191114-PM-Analyse_Trackingtools.pdf

Google Analytics und ähnliche Dienste nur mit Einwilligung zulässig | Der Landesbeauftragte für den Datenschutz Niedersachsen

Pressemitteilung: Vorsicht bei Einbindung von Analyse-Diensten auf Websites – Website-Betreiber sollten ihr Angebot überprüfen

Datenschutzbeauftragte fordert Webseiten-Betreiber auf, den Einsatz von Analyse-Diensten zu überprüfen | LDA

Achtung, Webseiten-Betreiber: Bitte Einbindung von Analyse-Diensten überprüfen - ULD

Website der Sächsischen Datenschutzbeauftragten

Startseite – Neuigkeiten und Wissenswertes rund um den Datenschutz und das Recht auf Informationszugang

www.saechsdsb.de

https://www.tlfdi.de/mam/tlfdi/presse/191114_pressemitteilung_zu_google_analytics.pdf

The XenForo implementation of Google Analytics as well as the use of Google Analytics by this website does not fulfill those requrements; implied consent is not valid.

I therefore re-iterate that it would be nice (well, in fact: required) that XF does implement a real consent solution for cookies, not only those set by XF but also for 3rd parties like YouTube, Twitter, Facebook (if used for embedding), Google Analytics, Unfurling, [IMG], etc.

Ideally, such a solution should be compatible with IAB TCF which will soon (planned Q1/20) also be supported by Google.

 

[twollert]

I therefore re-iterate that it would be nice (well, in fact: required) that XF does implement a real consent solution for cookies, not only those set by XF but also for 3rd parties

I agree. More and more websites in Germany devide cookies in three categories now:

Essential: Cookies that enable the basic functions of the website
Statistics: e.g. Google Analytics, Matomo, Google Tag Manager
Marketing: e.g. Facebook Pixel, Google AdSense

Visitors have to acceppt the first, the other two are optional.

Is there already a plugin for XenForo which can do that?

 

[Kirby]

Is there already a plugin for XenForo which can do that?

None that I am aware of.

Also the mentioned purposes are not sufficient for IAB TCF 2.0 which most likely will be required for AdSense in a few month.

1. Store and/or access information on a device
2. Select basic ads
3. Create a personalised ads profile
4. Select personalised ads
5. Create a personalised content profile
6. Select personalised content
7. Measure ad performance
8. Measure content performance
9. Apply market research to generate audience insights
10. Develop and improve products
11. Ensure security, prevent fraud, and debug
12. Technically deliver ads or content

 

[otto]

It would be great if Xenforo make a step to there customers in this point.
Otherwise we have to leave the xenforo ship, after 10 (!) years with Xenforo as forum solution now. Other companies also have nice solutions, in a time the glitter of a Xenforo 1.x is away.

 

[Hoffi]

Even if XF implemt such things, you still can't be sure what 3rd partys are doing this.
I suppose to user third party tools like UserDataTrust or CookieBot.

 

[otto]

... but both are non free for most cases. And another abo is a bad option.

It would be nice if the Xenforo own cookie will be a opt-in cookie as first step.