Add JS-function / method to set ga-disable-...

Sadly data privacy laws in Germany require to disable Google Analytics without a third party tool by a click.

What law are you referring to?

I do not see a law named or linked :-). That seems to be personal thinking of one lawer that tries to makes money with data protection consulting via his website and by writing impress / data protection pages. That does not mean he is wrong, but I'd like to read the law myself again. It would also be important to have a final court decission that comfirms this is needed. If it would be needed I guess Google would have published documentation and maybe an out of the box software solution.

There is much more to do to comply. I'm aware of the project https://www.drupal.org/project/eu_cookie_compliance. I also think this or another project was around that added the disable variable already.

On the end we may need to integrate with these modules if needed. A website does not only set GA cookies... Just add the JS code from above is not enough as the disable link is still not in the page and https://www.drupal.org/project/eu_cookie_compliance adds a bar with buttons to the page until you made a decission. And this bar is for all cookies and not just the GA one.

I'm not against complying to European / German laws - There are reasons why I made anonymize ip a default for German sites. We just need to make sure the implementation is complete and not immature.

Please share the law with me that you reference, too.

The existence of such a law has not proven yet, so I suspect this is a lie or just a public text of one lawer who tries to make money and you may be hoodwinked by sb.

Until we know about this law this is not getting changed for now. However, this module will always try to comply with all laws - especially with German ones.

Hello,

I wouldn't say it's a lie or something.. It's just a HUGE topic with some uncertainties and while I understand your point of view, that a implementation should be solid and complete, I fear that it's barely possible simply to the matter itself.

The article linked above is not the only one of this type. There are tons of them: several SEO agencies, lawers, bloggers, organizations of webshop operators etc.

Even if we couldn't call it a law (yet), there is a huge problem of the danger of getting charged. Not by lawers who actually post these articles, but those who are "waiting in the dark" for the best time to "strike". Sounds a bit dramatic, I know, but that's how it is, sadly... So people are looking for ways to prevent it as well as possible by doing such feature requests like the one above.

I too stambpled accros a blog post of similar content today, which has some tipps to come as close as possible to the conformance of the "ePrivacy law", which also addresses cookies to some extent and that's probably what people are calling the "cookie law". There the same code examples are being linked as the ones "Anybody" posted in the first post.

This article of another lawer https://www.it-recht-kanzlei.de/cookies-eu-datenschutz-grundverordnung.html
links to this site reporting of some court cases https://www.telemedicus.info/article/2722-Die-Stellungnahme-der-Bundesre...
and linking to that "ePrivacy law" in it's first version: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:d...
and a current one: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0011...

Both address cookies in paragraph 25 and 66 respectively. Not explicitely the Google Analytics ones, but still one can get an idea, I think... Both mention the need of an option to disagree with cookie usage and we can assume it also covers tha tracking part, surely.

While one could think it's a task of the https://www.drupal.org/project/eu_cookie_compliance module, one could also say, that a user might want to disagree with the usage of Google Analytics, while he is fine with other cookies. Aside from this the description of the EU cookie compliance module states this:
[...]
This module does not provide:

prevention of cookies being set on the site.
[...]

This doesn't sound as if it's compliant with that law, but that's nothing you can comment, I guess. Maybe some changes will happen there too, but if at least Google Analytics module would offer this opt-out option by using the code above. In the "Developers" section of the EU cookie compliance module there are some examples on how to treat GA cookies separately etc. so it seems to be a hot topic...

The new EU-DSGVO law (http://eur-lex.europa.eu/legal-content/DE/ALL/?uri=CELEX:32016R0679) will apply on 25. May 2018 and make many privacy related things much more strict by the sound of it, with potential charges being draconic, hence the desire to make things as safe as possible :)

We should not waste time with bullsh**. If there is a problem we will hear about it AND Google will provide information and official solutions... 100%! not the stuff written by these money makers...

Well, the ePrivacy law is real and changes will apply from 25 May 2018.

See http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm for example.

In my country (the Netherlands), this will mean that if Google Analytics ISN'T configured to use 'privacy-friendly' settings, you have to let users agree to placing the tracking cookie.

See https://www.traffic-builders.com/gdpr-impact-digital-analytics/ (Dutch)

GDPR is kind of a big deal. It's a real law, and covers any EU citizen *wherever they are*. There's plenty thats still unknown about enforcement and how it applies to US companies - but just about every client I've talked to lately has asked about this.

Here's a drupal-specific blog post on the topic: https://www.thirdandgrove.com/seven-must-do-checks-ensure-your-drupal-si...

Every third-party app needs to be audited for GDPR compliance. Many popular apps are likely to be compliant, like Google Analytics, but many others may not be. You may have to defer their use until after you fix the second-page load (see check #1), refine the integration configuration, or find another altogether.

Big companies are changing policies: https://techcrunch.com/2018/04/17/facebook-gdpr-changes/

Modules are beginning to address this as well: https://www.drupal.org/project/gdpr

While this issue was raised to address German law, it is directly pertinent to the GDPR, under which Drupal site owners using Google Analytics are Data Controllers because they control the data that is sent to Google, which is the Data Processor.

https://www.eugdpr.org/

Google's obligations as a Data Processor are irrelevant to the obligations of Data Controllers. Those obligations include:

• transparency in the form of explicit consent
• proof of consent: an audit trail of opt-ins

The penalty for non-compliance is the greater of €20 million or 4% of worldwide revenue.

Unfortunately, I am unable to contribute to this issue until well after the the GDPR goes into effect on 25 May 2018. I recommend that all organisations within EU jurisdiction disable Google Analytics tracking from that date until they can properly implement a legally compliant opt-in and audit trail.

The most common method I've seen to address this issue is to present the user with a modal before loading the GA script which, upon affirmative consent, either re-loads the page or proceeds to execute the script.

++ for #14 We need a fix for this at least if we like to use GA with Drupal trough this plugin in the future.

I'd like to summarize what I already know and think.

• Google has send useless emails to all users that do not help or explain anything.
• Google has not provided a single example how GA need to be implemented to comply with GDPR (as of today).
• The only information I have seen from Google is how to configure retention periods and that I can manually delete data from GA servers. But they do not explain what retention period is correct or what maximum is allowed. This overall is completly useless information as I have no clue what anonymous user has what id in ga. So I cannot delete any ones data from ga if I need (what is also a big question). I'm not sure if this may affects logged in users only - I think not.
• I think I have read something that Anonymize IP should be enabled. Something the module allows for ages and done by default latest releases.
• eu_cookie_compliance module is able to save consent status.
• eu_cookie_compliance module is not well integrated with ga module and this difficult configuration could be improved, but it is not impossible to configure. Examples are given in various pages on d.o.

Questions are therfore more likely - can we point people to install eu_cookie_compliance to comply. We do not need to reinvent this wheel here.

The bunch of gdpr modules have no useful function yet. gdpr module itself is only confusing and tells you nothing new and also do not tell you how to comply to anything. It only blacklists things and send you to a lawer. Nobody knows why.

Let me know if I missed something.

Patches are welcome to improve integration with eu_cookie_compliance.

Indeed this issue is quite annoying because we need to remove this module and do this with custom code if we can't prevent loading google analytics when we still not have the user consent. This issue is active also in Drupal 7.

There is an example of implementation done by the CNIL (the french organization that monitor the government about data citizens)
https://github.com/LINCnil/Cookie-consent_Google-Analytics/blob/master/T...

I also think like @hass said that we should work with the eu_cookie_compliance module.

Adding related issue: https://www.drupal.org/project/eu_cookie_compliance/issues/2933614

This issue is for Drupal 8, so I've created another issue for Drupal 7 with a patch: https://www.drupal.org/project/google_analytics/issues/2971644

So, I have tried to port phjou's patch to D8 but so far I haven't managed to make it work. Anyway, I post the patch here in case somebody wants to take up the challenge.

I wanted to use the current workaround from the issue description:

var gaProperty = window.google_analytics_uacct;
var disableStr = 'ga-disable-' + gaProperty;
if (document.cookie.indexOf(disableStr + '=true') > -1) {
  window[disableStr] = true;
  // Debug output:
  console.log('ga-disable is enabled, GA disabled.');
}
function gaOptout() {
  document.cookie = disableStr + '=true; expires=Thu, 31 Dec 2999 23:59:59 UTC; path=/';
  window[disableStr] = true;
}

But the line var gaProperty = window.google_analytics_uacct; seems not to be working for me (in Firefox), resulting in disableStr = ga-disable-undefined, so I replaced it with
var gaProperty = 'UA-XXXX-Y';, where UA-XXXX-Y is the actual tracking ID.

I fixed the workaround code in the issue description.

There's still something I don't get: Even when setting window['ga-disable-UA-XXXXXXX-YY'] to true, GoogleAnalytics is still setting 2 cookies: _ga & _gid.

So I'm not sure this is compliant with the GDPR as we're supposed not to set any tracking cookie on users' devices until they give consent, right? Or am I doing something wrong when configuring this module?

Module eu_cookie_compliance kind of mitigates this by trashing all cookies that are not white listed every 5 seconds until users give consent. But it still means that tracking cookies are set for 5 seconds, before getting deleted.

In all honesty I'm quite lost right now, after reading many threads on the topic. I'm still not sure how GoogleAnalytics can be GDPR compatible, until users give consent :/

I'm wondering if a way forward wouldn't be to amend this module (google_analytics) so it allows setting Javscript code snippets before and after the whole bunch of JS code related to GA? So that we would be able to add JS snippets that prevents GA from doing anything at all until users consents are given?

I believe that's basically what @DigitalFix is suggesting in #14.

@pacproduct You probably have missing something because ga-disable allow you to avoid executing the google code, so no cookie are set when it is correctly implemented. So for me this solution is GDPR compliant.

Thank you for your comment, I didn't know about the 5s cookie clear feature from eu_cookie_compliance, and I thought Firefox has a tracking protection feature I couldn't disable, but it is Chrome which is not doing a live refresh of the cookies in the console.

@mikael-berger Your patch is working for me, but you do not have all the adjustments which have been done for Drupal 7. I will work on that. Why were you saying that your patch was not working?

I've just done the patch with the improvement in the config form.

I haven't added the part for tracking the first loaded page when accepting. As I said in the Drupal 7 issue, Eu cookie compliance allow us to do that by using their feature Reload page after user clicks the "Agree" button . I think it's better to keep less code. The patch is concerning eu cookie compliance, so using their features make sense for me.

@phjou I think I mixed my wires at some point.

In the end, did a few more tests and it seems like it works as expected if I set the following in the custom javascript fields:

Before:

document.addEventListener('DOMContentLoaded', function(){
  if (!Drupal.eu_cookie_compliance.hasAgreed()) {
    window['ga-disable-UA-0000000-00'] = true;
  }

After:

});

This ensures that "Drupal.eu_cookie_compliance.hasAgreed()" is available, and that "ga('send', ...)" runs after we've set "window['ga-disable-UA-0000000-00']" to true if necessary.

Anyway, we went down this path for now. Seems satisfactory.

The code to track the first load is not kept in D7, so the patch should be ok.

The patch in #24 is working well for me so far.

A workaround that works with cookieconsent.js:

var gaCode = 'UA-XXX-X';
window['ga-disable-' + gaCode] = true;
if(getCookie('cookieconsent_status') === "allow") {
  window['ga-disable-' + gaCode] = false;
}

function getCookie(name)
  {
    var re = new RegExp(name + "=([^;]+)");
    var value = re.exec(document.cookie);
    return (value != null) ? unescape(value[1]) : null;
  }

Use this in the BEFORE code.

Applied #24 to 3.0-beta1 and after much testing to find the right configuration, it seems to be working for me.

Based on #29, #30, #32.

I think $cookie_name allows code injection. Cookie_domain, may be too.

Aside of this this code is eu cookie compliance specific and not generic. We should only implement solutions that all modules in the drupal universum can use.

For reference, the D7 patch is being developed and discussed in #2971644: Eu cookie compliance support.

#25 worked for me in combination with eu_cookie_compliance module.

Hi, thank you for this great work,
#24 is ok for me ( no need to apply # 25 )
with:
Drupal Core 8.6.12
GA 8.x-2.4
Eu_cookie_compliance 8.x-1.5

Thank you again !

Hi again,
something i dont understand,

I upgraded GA to 8.x.3.0, applied the patch, and config so the www.googleanalytics.com tracker is not set, and it is really not set.

But now, in my firefox i can see a newe tracker named "www.googletagmanager.com"...
i can see it was not set with 8.x.2.4 (as i rolled back for testing), but why it is now ?

Thank you !

Reroll #24 and add whitelist cookies support (GA will be enabled if user allows cookie category consists _ga cookie)

Why re-roll a patch on a closed issue?

This patch works for me. Related issue is not fixed yet too.

I don't think this should be closed, as #3060312: Better GDPR compliance: Fix Do not track & EU Cookie Privacy integration is currently blocked. We could probably wrap the code being added with annotations to remove it once core unblocks the other issue.

Is there any progress on the Analytics issue?

Tried to get cookies blocked in the first place, but not lucky, yet :-)

As long as cookies cannot be blocked until consent given, it is not practical to use it at all, as ga is set anyway.

Reroll #24 and add option to track as anonymize information were we have not their consent and match with "opt-in with categories" consent.

Edit : patch failed... (A file is missing in patch) Try new patch google_analytics-eu_cookie_compliance_support-2917905-49.patch

Issues with patches to test should be in "needs review".

google_analytics-eu_cookie_compliance_support-2917905-47.patch is not ok... Sorry I forgot a file...

Reroll #24 and Add interdiff.

Update patch #47 to google_analytics-eu_cookie_compliance_support-2917905-49.patch because file is missing in patch 47

Hi, thanks for working on this. I have feedback for you.

Unfortunately, patch in #49 didn't work for me.

After applying the patch, when user accepts tracking via the button on the EU cookie compliance banner, the Google Analytics cookies are not tracked at all. I did try both options, Eu cookie compliance support first by itself, and then with Eu cookie compliance support anonymizeip.

The workaround in #90 works without this patch, but see note in #92.

google_analytics 3.x-dev
eu_cookie_compliance 1.x-dev

Hi, thanks for working on this.

Unfortunately the patch in #49 did not work on our site since it is installed on a sub-directory. The patch fails to find the google_analytics_ecc.js file. I have updated the patch that fixes the reference for all site installations.

With this updated patch #53 google_analytics-eu_cookie_compliance_support-2917905-53.patch it now works on our site.

Comment withdrawn. Misunderstanding.

its work using #49 thank you

ps
Berita Unik

Any reason why this should not be RTBC?

I tried to implement this using the method outlined in #25, both with and without the patch (#53). In both cases I have the issue that the hasAgreed() function returns false, regardless of the selection status.

Hi, thanks for working on this !

I tried the combination : Core 8.9.13 + Google Analytics 8.x-3.1 with patch #53 + EU Cookie Compliance 8.x-1.14 without success.

What is not clear to me : is this patch working with the ECC setting :
Opt-in. Don't track visitors unless they specifically give consent. (GDPR compliant)

Or only with categories :
Opt-in with categories. Let visitors choose which cookie categories they want to opt-in for (GDPR compliant).

By the way, I tried the 2 ways without success so far...

Thanks for all the work above.

I had success in the end with comments #90 combine with #108 from [2.x?] How to block cookies until the user accepts, for example Google Analytics cookies? with "Reload page after user clicks the "Agree" button." turned on in the EU Cookie Compliance settings.

Drupal 9.1.4
EU Cookie Compliance 8.x-1.14
Google Analytics 8.x-3.1

In general, EU drupal sites IMHO should be depending on EU Cookie Compliance to block/enforce GDPR rules. Pushing this upto the 4.x branch for visibility by them, but there is likely no action needed in this module specifically.. Unless there is an API or something that'd help the EU Cookie Compliance module work better with GA.

Postponed on #3245331: Account ID inaccessible in JavaScript

Created an issue fork with the relevant code from @Anybody adding gaOptout() functionality. Note that Google doesn't use a cookie for Opting out, see:
https://developers.google.com/analytics/devguides/collection/analyticsjs...

Since the account id isn't accessible, the patch won't work currently.

Just realised, I pushed to the wrong branch and can't delete the branch unfortunately, this is the correct branch with the patch: "google_analytics-2917905", sry for the confusion.

@jcnventura: Is it good to have such a high expire date for this cookie?

Also the console.log(gaTrackingId); line should be removed from google_analytics_optout.js file.

For the new version of google analytics.

We need need to implement the consent settings.
https://developers.google.com/tag-platform/devguides/consent

        gtag('consent', 'default', {
            'ad_storage': 'denied',
            'analytics_storage': 'denied'
          });

          gtag('consent', 'default', {
            'ad_storage': 'granted',
            'analytics_storage': 'granted'
          });

Also needs a local rebase.

#3245331: Account ID inaccessible in JavaScript is fixed! Setting this to needs work.

Functionality tested locally and through additional test.

Hi, When is this committed please to latest 4.x-dev?
Thanks for your reply in advance, greetings,

This has been rolled into google tag. Customers should not be using the google analytics module anymore.