Hi,

I am searching but I am not getting this thing anywhere and I am thinking this is one of the critical thing.

Recently, I am preparing Privacy policy for my website and I am currently stuck at only one point, What is the privacy policy statement of Drupal CMS itself?. Because, I am not sure,

  • Whether Drupal core using any cookies?
  • Whether any part of code collecting IP Address?
  • Whether any part of code collecting any kind of visitor data?

Hence, I am not sure what to write in Privacy Policy of my website about Drupal.

Now, I read a README.txt file in core, It does has following points on legal aspects, but not on privacy statement.

Legal information about Drupal:
* Know your rights when using Drupal:
See LICENSE.txt in the "core" directory.
* Learn about the Drupal trademark and logo policy:
https://www.drupal.com/trademark

I have asked this question on Drupal answers too: Does Drupal 8 core by default collect visitors date?, but still waiting for answer.

And later, I searched and I found following question, hence looks like some people also have question on this issue.

  • What cookies does Drupal use?

    A client wants to write a privacy policy for their site and they are asking what cookies Drupal uses so that they can include a description of them in the policy.

  • Does Drupal Core use any cookies?

    I've just discovered the eu-cookie-compliance module and quite like it. What I want to know is, does the core Drupal installation use cookies for visitors to my site?

I think, It would be great if there is one text file on the Privacy policy statement or somewhere it has to be mentioned on Drupal.org. So website creators can include that in their websites's privacy policy. And this will add ONE OF THE STRONG POINT IN FEATURES OF DRUPAL.

Please, let me know if this Information is already available or I would have missed in searching or reading?

Many Thanks

Comments

Codenext created an issue. See original summary.

Codenext’s picture

Codenext commented
Title: Legal privacy policy statement of Drupal core itself » Legal privacy policy statement of Drupal core
Codenext’s picture

Codenext commented
Issue summary: View changes
cilefen’s picture

cilefen commented
Priority: Critical » Major
Related issues: +#2848974: Privacy Concerns as GDPR Compliance

This may be duplicating #2848974: Privacy Concerns as GDPR Compliance and does not meet the project requirements for critical priority.

Codenext’s picture

Codenext commented
Version: 8.2.6 » 8.4.x-dev

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

baluertl’s picture

baluertl
he/him
Primary language Hungarian
Location Budapest 🇪🇺
commented
Status: Active » Closed (outdated)

Quoted from the Drupal Answers question mentioned above, it seems the requester has gained satisfying response there:

"From your both comments, now I am understanding how things are going. Now, I can be sure, Drupal does not use cookies on non-logged in user and regarding IP addresses, it needs to be done something in between. Very very thanks for these infos. Much Appreciated."

I'd suggest to close this issue then.

David_Rothstein’s picture

David_Rothstein commented
Title: Legal privacy policy statement of Drupal core » Add a privacy policy to the Drupal core download (or link to one hosted on drupal.org)
Status: Closed (outdated) » Active

This is a documentation issue, not a support request, so I think it's still valid.

Any such privacy statement, though, would need to be really clear that it's talking about Drupal core only, since custom or contrib modules and themes could of course decide to do things that don't comply with it.

mgifford’s picture

mgifford
he/him
Primary language English
commented
Issue tags: +GDPR

More working being done here:
https://www.drupal.org/project/drupal_gdpr_team/

The main chats about this are taking place on DrupalChat.eu which is Rocketchat:
https://www.drupal.org/node/2958812

mgifford’s picture

mgifford
he/him
Primary language English
commented
Parent issue: » #2971870: Privacy policy document, etc. (Article 12)

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone’s picture

quietone commented
Title: Add a privacy policy to the Drupal core download (or link to one hosted on drupal.org) » [policy] Add a privacy policy to Drupal core
Status: Active » Postponed (maintainer needs more info)

There has been no discussion here for 7 years. Does anything think that this still needs to be added? If so, add a comment and even outline the content of the policy. Thanks.

smustgrave’s picture

smustgrave commented

Do we close these after 3 months too?

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

quietone’s picture

quietone commented
Assigned: Unassigned » quietone
Issue tags: -Legal, -Privacy improvements, -policy

Assigning to myself to look into this over the next month.

quietone’s picture

quietone commented
Assigned: quietone » Unassigned
Status: Postponed (maintainer needs more info) » Closed (works as designed)

I asked about this issue in committer Slack channel and found out that Drupal CMS does not offer a privacy statement as well. For both Core and Drupal CMS the privacy is dependent on the setup of each site. And where a statement could be clear that it is just for core, as suggested in #9, that really doesn't help a site owner understand what their site does or does not do for privacy. No one suggested making a privacy statement would help.

There are core issues to improve various aspects of privacy, such as

#2828793: Stop logging comment IP addresses by default
#2972065: Ensure that watchdog doesn't log personal data with core

And there is the Drupal GDPR Compliance Team project.

Adding credit for those in the slack discussion.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

quietone’s picture

quietone commented
Status: Closed (works as designed) » Closed (won't fix)

Actually, I meant won't fix.