Privacy audit and technical discovery report

A significant part of this project involved understanding the platform’s current state in relation to the changes we would propose next.

The project primarily focuses on ensuring that all functionality across the platform respects privacy preferences related to tracking. For example, downloading an asset without linking the tracked count directly to a contact; this is the kind of control the project aimed for, being able to choose if these features will (and how) track contacts + integrating what’s technically needed to operate without tracking cookies.

This also means the project investigation does not cover topics related to consent management or general GDPR compliance, despite we included a quick overview on what Mautic would need to offer in order to improve its GDPR compliance capabilities.

The full document is available on the link: https://docs.google.com/document/d/1YMVN-9ZnrlbtYR7T51yOqX_Ow3NzXAr3T0BsvhU7CuM/edit?usp=sharing

We'll use this audit when working on those milestones (project scope):

• Cookieless forms

• Asset downloads and URL redirects without cookies

• Consent-aware mtracking.gif pixel

• Focus items consent split

• Forwarded email handling

• Cookie revocation on consent withdrawal

• Disabling the Gravatar integration

• Form submission retention and cleanup

• Surfacing and extending DNT and GPC handling

• Field-level contact field permissions

• Engagement and timeline data permissions

• Grouped data spaces

• Audit logging of read access and authentication

• Privacy-first default roles

• Privacy centre configuration screen

• Contact-facing tracking controls in the preference centre

• Tracking off by default and the onboarding journey

• Documentation, WCAG conformance and privacy regression suite

Project members: Anderson José Eccel (Design Engineer) and Predrag Vukovic (Developer).