Forms, Focus items and statistics without tracking

Forms now work for visitors Mautic doesn't track. When a browser sends Do Not Track or Global Privacy Control, or the request comes from a bot or a prefetch, the submission is still saved and the mapped fields still update or create the contact. No cookie is set and no IP address or device ID is stored, not even in the points log. Kiosk mode forms work the same way for everyone.

The Gravatar pictures in the user list, the profile menu and the account page are replaced with avatars generated inside Mautic, so user email addresses no longer leave the installation. Contact pictures still use Gravatar for now, the setting that turns that off is in review.

The biggest change in review is in form statistics. The number of submissions a form shows was just the number of rows in its results table, so it dropped when results were deleted. Forms will now keep two numbers: the rows, which drive the results page and the submission limit, and a recorded total that only grows and follows the "Record aggregate analytics" setting. The chart uses the recorded total, and deleting results no longer changes the form's history.

Focus items are in review too. A Focus item used to load with its own tracking. With the change it shows right away without tracking, its cookies are only written after consent, and tracking starts on the same signal the main tracking script fires. One script, one consent. This builds on an earlier community pull request. What a Focus item should do before consent is still open.

Also in review from October: asset downloads and link clicks counted without being tied to a visitor, the per-email switch to turn tracking off, the preference centre choice for contacts, and the global setting that stops forms from tracking submitters. Thanks to everyone who picks these up.

The first documentation pages are in review in the user documentation, and the privacy centre page is in the 8.0 docs.

Next is forwarded emails, so that someone who gets a forwarded message isn't mistaken for the original contact, and then cookie revocation when a visitor withdraws consent.

Everything is on the Mautic Privacy Project board on GitHub. If any of this affects how you use Mautic, tell us there or in the comments here.