Mautic Privacy Project RFC

We used the findings from our audit to develop proposed solutions for the scope defined for this project.

We would now like your assessment of the technical proposals briefly presented in the document, keeping in mind that a more in-depth investigation into the implementation of each milestone will take place according to the project timeline (which you can request access to, if you are interested in more details about the next steps).

Quick context / what this project is about:

The project primarily focuses on ensuring that all functionality across the platform respects privacy preferences related to tracking. For example, downloading an asset without linking the tracked count directly to a contact; this is the kind of control the project aimed for, being able to choose if these features will (and how) track contacts + integrating what’s technically needed to operate without tracking cookies.

This also means the project does not cover topics related to consent management or general GDPR compliance.

Document is available here: https://docs.google.com/document/d/1JkZMbNa7PWqZeOcROdWutWK7fHyOSftFfySD2jUBZro/edit?usp=sharing

It's providing ideas for execution of the following milestones (project scope):

• Cookieless forms

• Asset downloads and URL redirects without cookies

• Consent-aware mtracking.gif pixel

• Focus items consent split

• Forwarded email handling

• Cookie revocation on consent withdrawal

• Disabling the Gravatar integration

• Form submission retention and cleanup

• Surfacing and extending DNT and GPC handling

• Field-level contact field permissions

• Engagement and timeline data permissions

• Grouped data spaces

• Audit logging of read access and authentication

• Privacy-first default roles

• Privacy centre configuration screen

• Contact-facing tracking controls in the preference centre

• Tracking off by default and the onboarding journey

Project members: Anderson José Eccel (Design Engineer) and Predrag Vukovic (Developer).