Honor opt-out and Do Not Track

Generated with the help of an LLM.

Problem/Motivation

Three switches claim to stop tracking and do not.

• The account form stores an opt-out (UserHooks, permission opt-out of visitors tracking). VisibilityService::isVisible() never reads that user data. An opted-out user is still tracked.
• The settings form renders visibility.exclude_user1. submitForm() does not save it, and nothing reads it. User 1 is tracked.
• There is no Do Not Track handling. Matomo can drop the hit when the browser sends DNT: 1.

#3380096: Klaro covers a consent banner. This issue covers the switches Visitors already has, plus the browser DNT signal.

Proposed resolution

VisibilityService::isVisible() returns false when any of these is true:

• The current user has the opt-out flag in user data.
• The current user is uid 1 and exclude_user1 is saved and enabled.
• The setting "honor Do Not Track" is on and the request has DNT or X-Do-Not-Track of 1 or yes.

Save exclude_user1 from the settings form.

The noscript image is attached by the same visibility check, so it stays off for the same people.

Anonymous users have no account checkbox. Their opt-out is DNT, or Klaro. Do not build Matomo's opt-out iframe. A Drupal route that sets a flag is unnecessary while the account form and DNT exist.

Remaining tasks

• Persist exclude_user1.
• Read the account flag, uid 1, and DNT inside isVisible().
• Setting for DNT, off by default so existing sites do not change.
• Kernel tests for each of the three cases.
• Functional test: an opted-out user does not get the visitors library.

User interface changes

The existing account checkbox and uid 1 checkbox start working. One new checkbox: honor Do Not Track.

API changes

isVisible() gains the checks above. No new service.

Data model changes

Config: honor_do_not_track (boolean). The account flag already exists.

Matomo counterpart

setDoNotTrack(), PrivacyManager's Do Not Track admin toggle, and the opt-out page. The iframe generator stays in Matomo.