Changes at "Granular consent and subscription management"

• +Granular consent and subscription management

• +

  Has your proposal been discussed on the Mautic Forums already?

  Double opt-in, the preference center and objections that don't stick have each come up on the forum, but always as separate threads.

  Related:
• +

• https://forum.mautic.org/t/does-mautic-offer-double-opt-in-forms/14677

• +

• https://forum.mautic.org/t/gdpr-compliant-double-opt-in/9008

• +

• https://forum.mautic.org/t/do-not-contact-on-preference-page/23391

• +

• https://forum.mautic.org/t/unsubscribe-do-not-contact-contain-a-lot-of-problems/23701

• +

• https://forum.mautic.org/t/rfc-improving-mautics-gdpr-compliance-cookie-management/27801

• +

Is your feature request related to a problem? Please describe.

Mautic can only record one thing per channel. If a contact may be emailed/sent SMS/actions from other channels at all. It can't record what the person subscribed to, on which legal basis, if they confirmed their address, or if they objected to direct marketing. Valid consent has to be freely given, specific, informed and unambiguous (a beautiful GDPR Art. 4(11) for you here), and withdrawing has to be as easy as giving it (Art. 7(3)).

This means:

- Consent is per channel (currently), not per purpose. There's no way to say "yes to the newsletter, no to random offers", so organizations makes you leave society to live in mountains without a mailbox or build workarounds with segments and custom fields that nothing enforces: https://forum.mautic.org/t/do-not-contact-on-preference-page/23391

- There is no lawful basis for communication. Customer getting updates under soft opt-in and a lead who explicitly opted in are treated the same + nothing recorded.

- The standard form checkbox has no connection to consent. Nothing changes in the contact's permissions unless someone builds that logic by hand. Didn't you never drop a tear building 50 forms like this?

- There is no real AND decent double opt-in. You have to build workarounds that will never be the same as natively offering statuses for this kind of flow: https://forum.mautic.org/t/does-mautic-offer-double-opt-in-forms/14677

- Objections don't stick. A form action, the API or an import can put the contact back: https://forum.mautic.org/t/remove-dnc-from-contact-if-they-submit-a-new-form/33461 https://forum.mautic.org/t/unsubscribe-do-not-contact-contain-a-lot-of-problems/23701

- Consent never expires. Someone who confirmed five years ago and hasn't opened an email since counts as freshly consenting.

Regulators do enforce this. The CJEU ruled in Planet49 (C-673/17) that a pre-ticked checkbox isn't valid consent, and in 2020 the Italian authority fined Wind Tre EUR 16.7 million for marketing without valid consent and ignored objections (https://hunton.com/privacy-and-information-security-law/italian-garante-fines-telecoms-provider-17-million-euros-for-direct-marketing-infringements). Organizations that care end up paying for a separate consent tool and connecting it to Mautic, which brings back the vendor lock-in Mautic exists to avoid. It can hurt any bank account, you know.

Solution

I'd like to replace the single per-channel switch with real subscriptions. Contacts subscribe to named subscription choices (a newsletter, event updates), grouped in categories and sent through channels. Each one has its own lawful basis, description and status: subscribed, unsubscribed, not specified/unknown or pending. Only subscribed allows marketing. Contract and transactional messages stay outside marketing subscriptions.

Phase 1, subscriptions with their own lawful basis. Consent lives at the subscription choice, not at the channel. The channel is only how it gets delivered. Topics (frequency, interests) sit under a choice and don't carry consent. Every change adds a new row, so the history of each subscription is kept. By default the setup creates one subscription choice per channel with consent as its basis, so regular users hardly notice the extra layers. Existing installs get a default topic under each channel on migration. No more using segments as subscriptions, this was never a decent solution since segmentation and subscriptions are completely different things.

Phase 2, collect consent that holds up. A new "Opt-in" form field, in checkbox mode (one box per consent area) or notice mode (implicit consent or legitimate interest). It updates the subscription statuses, records the lawful basis (consent by default) and keeps the submission as evidence. Special categories of data (Art. 9) always get their own option.

Phase 3, double opt-in and expiry. New signups stay pending until they confirm through a private link that works with tracking off. An optional inactivity period moves confirmed contacts back one step, so the organization knows when to ask for reconfirmation. Admins can delete contacts that stayed pending for too long.

Phase 4, objections, withdrawal and tracking choices. An objection to direct marketing blocks the contact from any future send, not only the current one. Campaigns check the status when they send, not when the contact enrolls. Segments, imports, the API and integrations can't turn unsubscribed back into subscribed. Only the contact can, or a user recording a signed statement. The preference center becomes one page for subscriptions, topics and tracking choices. I'd also add a cookie banner with two separate settings: one that only notifies, and one that requires opt-in (accept and refuse with the same weight, no non-essential cookies until accepted). The choice is saved with date, banner version and categories.

Alternatives

Separate consent or preference tools connected to Mautic, or proprietary platforms, since no open source option covers everything above. Workarounds inside Mautic (segments, custom fields, hand-built double opt-in campaigns) aren't enforced by the platform and makes marketers' life a nightmare.

Impact

Yes. It stores, per contact, what they subscribed to, the lawful basis, the status history and the submission that proves it. For cookies, it stores a visitor ID (or anonymous session ID) with the choice, categories, date and banner version. All of it is append-only, so it works as proof.

Who benefits: organizations that need valid consent without paying for a separate tool, and the contacts, who can see what they signed up for and leave as easily as they joined.

Funding

Looking for funding. The full scope is EUR 49,920. We estimate about 6 months (13 sprints of 2 weeks), including community feedback, code review and merging. The cost is EUR 49,920: a senior developer at 0.5 WTE and a design engineer at 0.7 WTE, EUR 40/hour.

+

+gid://app/Decidim::Hashtag/2/_Mautic