DoNotTrack privacy feature

If a user requests the page and do not have the HTTP_DNT header set, a GA code will be put into the page (correct). But if the next user requests the same page (this has been cached) the GA code will still excist regardless if the HTTP_DNT header is sendt or not.

Please prove with a test. The current test do not show this issue.

I didn't create a test to prove #1: "The DoNotTrack feature is not working properly for cached pages", as requested in #2. Anyway it seems that for multiple reasons DoNotTrack (DNT) is not respected for cached pages.

1. It's already said in the settings form: "Universal web tracking opt-out ... This feature is currently limited to logged in users and disabled page caching". This is because Tracking is always enabled for anonymous visitors visiting cached pages, if it is allowed for anonymous visitors:

See _googleanalytics_visibility_header():

  if (($account->uid || variable_get('cache', 0) == 0) && variable_get('googleanalytics_privacy_donottrack', 1) && !empty($_SERVER['HTTP_DNT'])) {
    // Disable tracking if caching is disabled or a visitors is logged in and
    // have opted out from tracking via DNT (Do-Not-Track) header.
    return FALSE;
  }

For anonymous user uid is 0 (= FALSE in above condition), the cache variable is 1 for enabled page-cache, so 1 == 0 is FALSE to, which means the code in the if statement won't get executed, therefore the function seems to always return TRUE for anonymous users when caching is enabled.

2. AFAIK hook_page_alter() is not called for cached pages, for caches like varnish and boost that is sure, as drupal won't get involved for that kind of page delivery, see also #2205193: Google Analytics works only after clearing cache and #2173433: No GA code with alternative page caching engines and DNT header. hook_page_alter() is also not called if pages are served from drupal cache, see https://api.drupal.org/api/drupal/modules%21system%21system.api.php/func....

It seems to be better to not do the DNT check on server side at all, but in JavaScript with Navigator.doNotTrack, but that is experimental technology (Working Draft).

Any interests to change the implementation of DNT to JavaScript which should also work with cached pages?

Yes, it should be client side.

The current implementation made me laugh and cry. People who have DNT set do so because they don't want to be tracked. If they need to log in and set an option and even then only visit uncached pages for their wishes to be recognised, that's a very small subset of honoured DNT pages.

Could we simply wrap the code snippet like

if (! ((window.navigator && (window.navigator.doNotTrack || window.navigator.msDoNotTrack)) || window.doNotTrack)) {
...rest of code...
}

https://developer.mozilla.org/en-US/docs/Web/API/navigator/doNotTrack

Can you write a plugin like http://www.outfox.com/do-not-track-for-google-analytics/ for the module? That would solve a lot of our troubles and is clean to integrate without changing the tracking code.

Attached is the patch based on @artfulrobot approach.

Use this patch instead as it does DNT check on Analytics and AdSense.

See #7

I agree with @abrlam that the DNT check should be done using JS.

@hass, I'm not sure if #7 is GDPR compliant. My interpretation of GDPR is that if users have DNT enabled on their browser, nothing should be sent to the Google Analytics. Correct me if I'm not on the right track.

@phjou, you can credit @osopolar and @artfulrobot for it. Their comments led to this patch (#9).

Minor correction

Third try is the charm

See #7

#14 works as JS based solution and is much better than the current solution in PHP. This feature is also contained in #3060312: Better GDPR compliance: Fix Do not track & EU Cookie Privacy integration and it would be great to have your help there to have a working 8.x-3.x GDPR patch. Thank you!

I'd suggest to close this as duplicate in favor of #3060312: Better GDPR compliance: Fix Do not track & EU Cookie Privacy integration?

Actually I can find more than 3 issues related to the same problem.
#2933614: [2.x?] How to block cookies until the user accepts, for example Google Analytics cookies?
#2917905: Add JS-function / method to set ga-disable-...
So let's close all issues and keep this one #3060312: Better GDPR compliance: Fix Do not track & EU Cookie Privacy integration