First privacy changes in forms, downloads and emails

The last two weeks were the first ones where we were mostly writing code instead of documents, and it's good to finally see the RFC turning into something you can try.

Most of that work went into one idea, that Mautic should be able to do its job without tracking people who never agreed to it. A form should still work and a download should still count, just without a cookie or an IP address attached when there's no reason for one.

Some of it is already in Mautic. Kiosk mode forms no longer keep the IP address or a device ID of whoever fills them in. Visitors whose browser sends Do Not Track or Global Privacy Control aren't picked up again by the tracking script, even if Mautic knew them from before. And there's a new setting that decides whether Mautic keeps totals that aren't linked to anyone, like how many times a form was submitted.

A lot more is waiting for review. Forms can be submitted without tracking the person behind them. Asset downloads and link clicks still get counted, but without being tied to the visitor. Contacts get a simple yes or no in the preference centre for whether their activity is recorded, and each email can have its tracking switched off, which makes sense for things like a password reset. All of it has been through a first round of review, and now it needds a maintainer to merge it.

Anderson has been working on the other side of this, the design system and the move to Bootstrap 5 that the new privacy screens will be built on. Some of that is merged already.

Next up are Focus items, where the cookies that only remember what a visitor already chose will be kept apart from the ones that need consent. After that we'll look at forwarded emails, so someone who gets an email forwarded to them isn't mistaken for the contact who sent it.

If you want to see where things are, everything is on the Mautic Privacy Project board.If any of this touches how you use Mautic, or you think we've missed something, let us know in the comments. :)