Consent evidence, suppression and data subject rights
Has your proposal been discussed on the Mautic Forums already?
Consent evidence, erasure and suppression have come up on the forum, but only as workarounds, never as a built-in feature.
Related:
https://forum.mautic.org/t/no-contact-email-addresses-data-base-table/13697
https://forum.mautic.org/t/gdrp-let-user-delete-its-mautic-contact/30556
https://forum.mautic.org/t/are-these-things-possible-any-idea-of-how-gdpr-compliance-of-mautic/17922
https://forum.mautic.org/t/gdpr-best-way-to-implement-these-eu-privacy-rules-in-mautic/13696
Is your feature request related to a problem? Please describe.
The GDPR puts the burden of proof on the organization. If processing is based on consent, you have to show the person consented (Art. 7(1)), and show compliance with every principle (Art. 5(2)). Mautic keeps no proof of consent (DNC isn't proof, ok?), and it forgets people as soon as they're deleted. Without proof, organizations either keep privacy-sensitive features off or use them and hope nobody asks.
Regulators look at the detail. In December 2024 the Italian authority fined Wind Tre EUR 347,520 after finding that its timestamps didn't distinguish registration from consent, and that some consents had been "renewed" with no record of when they were first given (https://blog.galalaw.com/post/102m2bn/garantes-decision-in-wind-tres-case-insights-for-valid-consent-collection-for). Mautic has none of that.
So:
- In the basic DNC, changes overwrite each other. In the code, it updates the existing row in place, original timestamp included, so the history is lost on every change.
- Deleting a contact deletes the proof. The Do Not Contact table cascades on delete, so every opt-out record goes with the contact.
- There is no record of what the person saw. A stored checkbox label only shows the person was pointed to a privacy policy, not what it said. And when your --gdpr cronjob cleans up old form submissions, that's an extra thing you won't have to prove during a dispute. Or when a contact says "that clause wasn't there when I signed up", there's nothing to show. Nothing, literally nothing. There's a whole industry of paid tools just for policy versions.
- Erased people come back. An old spreadsheet import or a CRM sync can re-create them, and they get contacted again. This idea was already raised on the forum: https://forum.mautic.org/t/no-contact-email-addresses-data-base-table/13697
- Erasure is manual and incomplete. Admins write SQL to anonymize data (https://forum.mautic.org/t/are-these-things-possible-any-idea-of-how-gdpr-compliance-of-mautic/17922), and one user reports form data staying behind after deleting a contact (https://forum.mautic.org/t/contact-is-not-being-deleted-in-the-corresponding-form-table-nor-in-the-form-submissions-table/19152).
- Access and portability requests are manual. There's no single place to export everything Mautic holds about a person (Art. 15 and 20). Contact export currently doesn't mean activity gets exported too.
Describe the solution you'd like
I'd like Mautic to keep a permanent, append-only record of every consent decision and its context, a global suppression list for people who asked to be erased (and customize days to block marketing emails), and tools to answer access, portability and erasure requests from inside Mautic.
Phase 1, consent evidence. A separate store where every grant, denial and withdrawal is a new entry, with purpose, lawful basis, channel, source (form, import, API, user, campaign, preference center), the statement shown and the privacy policy version. Entries are never edited or deleted. They stay linked to the contact but survive its deletion. Purpose and channel are free values, so it works with whatever an installation uses. When a user subscribes a contact manually, they confirm "this person gave me permission", and that is recorded too.
Phase 2, privacy policy versions. Each consent entry points to the policy text shown at the time. Per policy, organizations choose between a snapshot (Mautic saves the HTML of the policy page, and a scheduled job checks a hash for changes, so 10k submissions don't make 10k requests) or managed content (a rich-text editor in Mautic, hosted by Mautic or embedded by iframe, with each revision stored).
Phase 3, pseudonymization and global suppression list. Each instance generates its own secret key and identifies people with an HMAC of their email, phone or any other identifier. The same identifier always gives the same value, so consents, withdrawals and suppressions link to the same person without keeping the identifier, and it can't be reversed. The global suppression list is separate from Do Not Contact. It holds the HMAC of everyone who asked to be erased or never contacted, with date and reason, and supports bulk import and export. Forms, imports, the API, integrations and CRM sync check it first. On a match, the contact is created suppressed (no sends, out of segments and campaigns, no processing), the profile shows a warning with the date of the original request, the match is recorded and the roles the admin chooses, like the DPO, get notified. Only a user who records an attestation of new consent can lift it.
Phase 4, data subject rights. A dedicated GDPR erasure action deletes contact preserving anonymized identifier, so consent history and suppression records stay intact. It adds the ID to the suppression list, records who did it and why, and can't be undone. One central action for bulk cleanup (hard bounces, unsubscribed from every channel, inactivity), which adds suppression entries so cleanup never erases the fact that someone opted out. And an export of everything Mautic holds about a person (JSON, CSV for tables): profile fields, subscription and DNC status, consent history with policy versions, form submissions and the timeline. It works from the profile and from the API, and each export is recorded.
Alternatives
Paid privacy policy and consent management tools connected to Mautic, or proprietary platforms, since no open source option covers this. Inside Mautic, the forum workarounds are SQL scripts and campaigns to anonymize contacts (see the threads above), which don't keep evidence.
Impact
Who benefits: organizations that need to prove consent and answer data subject requests without a paid add-on, public bodies and anyone moving away from proprietary software, and the contacts, whose erasure or objection actually holds.
Funding
Looking for funding. The full scope is EUR 49,920. We estimate about 6 months (13 sprints of 2 weeks), including community feedback, code review and merging. The cost is EUR 49,920: a senior developer at 0.5 WTE and a design engineer at 0.7 WTE, EUR 40/hour.
#Mautic
Teilen