Hi,

I am searching but I am not getting this thing anywhere and I am thinking this is one of the critical thing.

Recently, I am preparing Privacy policy for my website and I am currently stuck at only one point, What is the privacy policy statement of Drupal CMS itself?. Because, I am not sure,

  • Whether Drupal core using any cookies?
  • Whether any part of code collecting IP Address?
  • Whether any part of code collecting any kind of visitor data?

Hence, I am not sure what to write in Privacy Policy of my website about Drupal.

Now, I read a README.txt file in core, It does has following points on legal aspects, but not on privacy statement.

Legal information about Drupal:
* Know your rights when using Drupal:
See LICENSE.txt in the "core" directory.
* Learn about the Drupal trademark and logo policy:
https://www.drupal.com/trademark

I have asked this question on Drupal answers too: Does Drupal 8 core by default collect visitors date?, but still waiting for answer.

And later, I searched and I found following question, hence looks like some people also have question on this issue.

  • What cookies does Drupal use?

    A client wants to write a privacy policy for their site and they are asking what cookies Drupal uses so that they can include a description of them in the policy.

  • Does Drupal Core use any cookies?

    I've just discovered the eu-cookie-compliance module and quite like it. What I want to know is, does the core Drupal installation use cookies for visitors to my site?

I think, It would be great if there is one text file on the Privacy policy statement or somewhere it has to be mentioned on Drupal.org. So website creators can include that in their websites's privacy policy. And this will add ONE OF THE STRONG POINT IN FEATURES OF DRUPAL.

Please, let me know if this Information is already available or I would have missed in searching or reading?

Many Thanks

Comments

Codenext created an issue. See original summary.

Codenext’s picture

Codenext CreditAttribution: Codenext as a volunteer commented
Title: Legal privacy policy statement of Drupal core itself » Legal privacy policy statement of Drupal core
Codenext’s picture

Codenext CreditAttribution: Codenext as a volunteer commented
Issue summary: View changes
cilefen’s picture

cilefen CreditAttribution: cilefen commented
Priority: Critical » Major
Related issues: +#2848974: Privacy Concerns as GDPR Compliance

This may be duplicating #2848974: Privacy Concerns as GDPR Compliance and does not meet the project requirements for critical priority.

Codenext’s picture

Codenext CreditAttribution: Codenext as a volunteer commented
Version: 8.2.6 » 8.4.x-dev

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Balu Ertl’s picture

Balu Ertl
he/him
Primary language Hungarian
Location Budapest 🇪🇺
CreditAttribution: Balu Ertl as a volunteer and at Brainsum commented
Status: Active » Closed (outdated)

Quoted from the Drupal Answers question mentioned above, it seems the requester has gained satisfying response there:

"From your both comments, now I am understanding how things are going. Now, I can be sure, Drupal does not use cookies on non-logged in user and regarding IP addresses, it needs to be done something in between. Very very thanks for these infos. Much Appreciated."

I'd suggest to close this issue then.

David_Rothstein’s picture

David_Rothstein CreditAttribution: David_Rothstein as a volunteer commented
Title: Legal privacy policy statement of Drupal core » Add a privacy policy to the Drupal core download (or link to one hosted on drupal.org)
Status: Closed (outdated) » Active

This is a documentation issue, not a support request, so I think it's still valid.

Any such privacy statement, though, would need to be really clear that it's talking about Drupal core only, since custom or contrib modules and themes could of course decide to do things that don't comply with it.

mgifford’s picture

mgifford
he/him
Primary language English
CreditAttribution: mgifford at OpenConcept Consulting Inc. commented
Issue tags: +GDPR

More working being done here:
https://www.drupal.org/project/drupal_gdpr_team/

The main chats about this are taking place on DrupalChat.eu which is Rocketchat:
https://www.drupal.org/node/2958812

mgifford’s picture

mgifford
he/him
Primary language English
CreditAttribution: mgifford at OpenConcept Consulting Inc. commented
Parent issue: » #2971870: Privacy policy document, etc. (Article 12)

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.