An update on the current status of the Privacy Project

We began this work with a full privacy audit, which is now complete. We went through a default Mautic install piece by piece: every cookie, every call out to a third party, every place that can track a visitor or a contact. We checked it all against the actual code, not just the docs, so what we have is an actual list of what's handled and what isn't, instead of working off assumptions.

The RFC is finished now too, and it's sitting in internal review before it goes out publicly. It lays out the plan across three main areas.

Making core features like forms, page tracking, email opens, downloads and Focus items actually respect consent, so nothing gets recorded or cookied before someone's agreed to it.

Real control over who can see what inside Mautic. Permissions down to the field level, limits on who can browse a contact's behavioral history, and audit logs that also cover who read something, not just who changed it.

A privacy centre that brings today's scattered settings into one place, ships with tracking off by default, and walks a new install through turning on only what it actually needs.

We were also upfront about what this project isn't trying to solve. Profiling and personalization aren't things we can realistically "control" without breaking how the product works, and a couple of items, like rectification and deletion, are getting pushed into a follow-up project instead of rushed into this one.

Once internal review wraps up, it goes up for community consultation before any of it gets built. We'll post the link here as soon as it's live.