Contrib.social

[Discussion] Add details about each cookie per service

Open on Drupal.org →
Created on 4 December 2024, 17 days ago

Problem/Motivation

I'm unsure, if we / the website owner needs to provide more detailed information about each cookie used by each Consent Service.

Perhaps someone could find out, if there's any legal requirement.

If we need to, I'll leave the list of cookies (without any warranty!) here, that could be added to each service (below).
Before adding that to each service, we should discuss some more challenges:
How to keep the texts up to date
Should we better add this as structured information, maybe based on the cookies list (for cookie deletion)
Who should keep this up to date? Might become a bunch of work
Who's legally responsible?

Having this as structured data might have the benefit, that we could mark fields translatable in schema.yml

Steps to reproduce

Proposed resolution

Here are our cookie information tables (without any warranties) used for COOKiES:

eTracker:

<table style="width:100%;">
    <caption><strong>Cookie-Information</strong></caption>
    <thead>
        <tr>
            <th>
                Name
            </th>
            <th>
                Purpose
            </th>
            <th>
                Duration
            </th>
            <th>
                Example-content
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                _et_coid
            </td>
            <td>
                Cookie recognition (only with cookie activation)
            </td>
            <td>
                2 years / configurable
            </td>
            <td>
                108bf9a85547edb1108bf9a85547edb1
            </td>
        </tr>
        <tr>
            <td>
                et_oi_v2
            </td>
            <td>
                Functional / required:<br>
                Opt-In cookie stores the visitor's decision when tracking Opt-In is played on the customer's site. Also used for a possible opt-out.
            </td>
            <td>
                "no" - 50 Jahre<br>
                "yes" - 480 Days
            </td>
            <td>
                yes
            </td>
        </tr>
        <tr>
            <td>
                et_oip
            </td>
            <td>
                Functional / required:<br>
                OptIn cookie for "Signalize". If the customer chooses "no", the cookie is set with the value "no" and a duration of 30 days. If the customer chooses "x" or presses the ESC key (no decision), the cookie is set with the value "no" for a validity of 1 day. A value of "yes" is not required as this is implicitly given by the consent to the actual browser push.
            </td>
            <td>
                "no" - 30 Tage<br>
                "no" (Session) 1 Day
            </td>
            <td>
                no
            </td>
        </tr>
        <tr>
            <td>
                et_allow_cookies
            </td>
            <td>
                Functional / required:<br>
                When using data block cookies, the API call _etracker.enableCookies() sets this cookie to "1" to indicate that etracker may set cookies. The cookie is set to "0" when _etracker.disableCookies() is called.
            </td>
            <td>
                "0" - 50 Years<br>
                "1" - 480 Days
            </td>
            <td>
                1
            </td>
        </tr>
        <tr>
            <td>
                isSdEnabled
            </td>
            <td>
                Recognition of whether the visitor's scrolling depth is measured (only with cookie activation).
            </td>
            <td>
                24H
            </td>
            <td>
                true
            </td>
        </tr>
        <tr>
            <td>
                GS3_v
            </td>
            <td>
                Set by the Optimizer Web Service. Contains the same Visitor ID as BT_pdc (only with cookie activation).
            </td>
            <td>
                1 Year
            </td>
            <td>
                4682607
            </td>
        </tr>
        <tr>
            <td>
                BT_ctst
            </td>
            <td>
                Is only used to detect whether cookies are activated in the visitor's browser or not (only if cookies are activated).
            </td>
            <td>
                Browser-Session
            </td>
            <td>
                101
            </td>
        </tr>
        <tr>
            <td>
                BT_sdc
            </td>
            <td>
                Contains Base64-encoded data of the current visitor session (referrer, number of pages, number of seconds since the start of the session, displayed smart messages in the session), which are used for personalisation purposes (only if cookie is activated)
            </td>
            <td>
                Browser-Session
            </td>
            <td>
                eyJldF9jb2lkIjoiTkEiLCJy...DMzNTYzNzM3LCJwaSI6NH0=
            </td>
        </tr>
        <tr>
            <td>
                BT_pdc
            </td>
            <td>
                Contains Base64-encoded visitor history data (is customer, newsletter recipient, visitor ID, displayed smart messages) for personalisation (only if cookie is activated)
            </td>
            <td>
                1 Year
            </td>
            <td>
                <br>
                eyJldGNjX2N1c3QiOjAsImVj...GNjX25ld3NsZXR0ZXIiOjB9
            </td>
        </tr>
        <tr>
            <td>
                BT_ecl
            </td>
            <td>
                Contains a list of project IDs for which the visitor is excluded. This cookie is set by the web service if the client has configured that not all visitors are assigned to a test, but only a certain fraction (only if cookie is activated).
            </td>
            <td>
                30 Days
            </td>
            <td>
                BT-6037799f213de9e9961facc224b69
            </td>
        </tr>
    </tbody>
</table>

Facebook Pixel:

<p>
    If you are logged in to Facebook, you can set your settings for advertisements at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. If you are not a Facebook user, you can manage your usage-based online advertising at https://www.youronlinechoices.com/de/praferenzmanagement/.
</p>
<p>
    For more information about the provider's data policies, please visit https://www.facebook.com/policy.php.
</p>
<table style="width:100%;">
    <caption><strong>Cookie Information</strong></caption>
    <thead>
        <tr>
            <th scope="col">
                Name
            </th>
            <th scope="col">
                Provider
            </th>
            <th scope="col">
                Purpose
            </th>
            <th scope="col">
                Duration
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                _fbp
            </td>
            <td>
                Facebook
            </td>
            <td>
                This cookie uses Facebook to display advertising products.
            </td>
            <td>
                3 months
            </td>
        </tr>
        <tr>
            <td>
                fr
            </td>
            <td>
                Facebook
            </td>
            <td>
                This cookie is used to keep Facebook pixels working properly.
            </td>
            <td>
                3 months
            </td>
        </tr>
        <tr>
            <td>
                comment_author_50ae8267e2bdf1253ec1a5769f48e062311233632
            </td>
            <td>
                Facebook
            </td>
            <td>
                This cookie stores the text and name of a user who, for example, leaves a comment.
            </td>
            <td>
                1 year
            </td>
        </tr>
        <tr>
            <td>
                comment_author_url_50ae8267e2bdf1253ec1a5769f48e062
            </td>
            <td>
                Facebook
            </td>
            <td>
                This cookie stores the URL of the website, which the user enters in a text field on our website.
            </td>
            <td>
                1 year
            </td>
        </tr>
        <tr>
            <td>
                comment_author_email_50ae8267e2bdf1253ec1a5769f48e062
            </td>
            <td>
                Facebook
            </td>
            <td>
                This cookie stores the user's e-mail address, if the user has provided it on the website.
            </td>
            <td>
                1 year
            </td>
        </tr>
    </tbody>
</table>

Functional / CMS:

<table>
    <thead>
        <tr>
            <th width="15%">
                Cookie name
            </th>
            <th width="15%">
                Default expiration time
            </th>
            <th>
                Description
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                <code dir="ltr" translate="no">SSESS&lt;ID&gt;

Google reCaptcha

<table style="width:100%;">
    <caption><strong>Cookie-Information</strong></caption>
    <thead>
        <tr>
            <th>
                Name
            </th>
            <th>
                Purpose
            </th>
            <th>
                Duration
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                rc::a
            </td>
            <td>
                This cookie is used to distinguish between humans and machines. This is necessary for the website to prevent spam.
            </td>
            <td>
                Persistent
            </td>
        </tr>
        <tr>
            <td>
                rc::b
            </td>
            <td>
                This cookie is used to distinguish between humans and machines. This is necessary for the website to prevent spam.
            </td>
            <td>
                Session
            </td>
        </tr>
        <tr>
            <td>
                rc::c
            </td>
            <td>
                This cookie is used to distinguish between humans and machines. This is necessary for the website to prevent spam.
            </td>
            <td>
                Session
            </td>
        </tr>
        <tr>
            <td>
                _GRECAPTCHA
            </td>
            <td>
                This cookie is used to distinguish between humans and machines. This is necessary for the website to prevent spam.
            </td>
            <td>
                179 Days
            </td>
        </tr>
    </tbody>
</table>

YouTube

<ul>
    <li>
        <strong>Purpose:</strong> YouTube Video Platform Integration.
    </li>
    <li>
        <strong>Provider:</strong> https://www.youtube.com (Google LLC)
    </li>
    <li>
        <strong>Provider's privacy policy &amp; further information:</strong> https://policies.google.com/privacy
    </li>
</ul>
<table style="width:100%;">
    <caption><strong>Cookie-Information</strong></caption>
    <thead>
        <tr>
            <th>
                Name
            </th>
            <th>
                Purpose
            </th>
            <th>
                Duration
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                VISITOR_INFO1_LIVE
            </td>
            <td>
                Provides bandwith estimations.
            </td>
            <td>
                6 Months
            </td>
        </tr>
        <tr>
            <td>
                YSC
            </td>
            <td>
                Stores track and interaction.
            </td>
            <td>
                Session
            </td>
        </tr>
        <tr>
            <td>
                Yt-Player-Bandwidth
            </td>
            <td>
                Provides bandwith estimations.
            </td>
            <td>
                Session
            </td>
        </tr>
        <tr>
            <td>
                Yt-Player-Headers-Readable
            </td>
            <td>
                Stores configuration information.
            </td>
            <td>
                17 Days
            </td>
        </tr>
        <tr>
            <td>
                GPS
            </td>
            <td>
                Stores location data.
            </td>
            <td>
                Session
            </td>
        </tr>
        <tr>
            <td>
                PREF
            </td>
            <td>
                Stores user preferences.
            </td>
            <td>
                8 Months
            </td>
        </tr>
        <tr>
            <td>
                CONSENT
            </td>
            <td>
                Stores if the visitor has accepted the marketing category in the cookie banner.
            </td>
            <td>
                2 Years
            </td>
        </tr>
    </tbody>
</table>
<hr>
<h3>
    Vimeo
</h3>
<ul>
    <li>
        <strong>Type:</strong> Media (Video)
    </li>
    <li>
        <strong>Purpose:</strong> Vimeo Video Platform Integration
    </li>
    <li>
        <strong>Provider:</strong> https://vimeo.com/
    </li>
    <li>
        <strong>Provider's privacy policy &amp; further information:</strong> https://vimeo.com/cookie_policy
    </li>
</ul>
<table style="width:100%;">
    <caption><strong>Cookie-Information</strong></caption>
    <thead>
        <tr>
            <th>
                Name
            </th>
            <th>
                Purpose
            </th>
            <th>
                Duration
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                vuid
            </td>
            <td>
                Store user usage history.
            </td>
            <td>
                2 Year(s)
            </td>
        </tr>
        <tr>
            <td>
                player
            </td>
            <td>
                Stores the user settings for playing Vimeo videos.
            </td>
            <td>
                1 Year(s)
            </td>
        </tr>
        <tr>
            <td>
                sync_active
            </td>
            <td>
                Contains data about the visitor's general preferences regarding video content, such as volume.
            </td>
            <td>
                Persistent
            </td>
        </tr>
    </tbody>
</table>

Remaining tasks

User interface changes

API changes

Data model changes

📌 Task
Status

Active

Version

3.0

Component

Documentation

Created by

🇩🇪Germany Anybody Porta Westfalica

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @Anybody
  • Comment 17 days ago →
    🇩🇪Germany Anybody Porta Westfalica

    I personally like the idea to add this meta information per cookie to the "Cookies" table in each Consent Service as structured information.

  • Merge request !50Draft: Add metadata for cookies definition. → (Open) created by Anybody
  • Pipeline finished with Success
    17 days ago
    Total: 139s
    #359338
  • Comment 17 days ago →
    🇩🇪Germany jan kellermann

    At the beginning of the project we decided against this:

    • There are several laws in several countries - so we could not cover them all
    • Cookies are changing - we can not track these changes and we dont want be responsible for these - the data controller is the operator of the website.
    • The ePrivacy directive is not only for cookies - but for local storage and session storage.

    Thats why we link to the privacy policy.

    Here is a list of the storages of my dummy dev 10.3 Drupal:

    Session Storage:

    • Drupal.contextual.block:block=base_sub_main_menu:langcode=en|menu:menu=main:langcode=en
    • Drupal.contextual.block:block=base_sub_page_title:langcode=en
    • Drupal.contextual.block:block=base_sub_site_branding:langcode=en
    • Drupal.contextual.entity.view.edit_form:view=frontpage:location=page&name=frontpage&display_id=page_1&langcode=en
    • Drupal.contextual.media:media=1:changed=1733156253&langcode=en
    • Drupal.contextual.node:node=2:changed=1733178284&langcode=en
    • Drupal.contextual.permissionsHash
    • Drupal.toolbar.toolbarState
    • escapeAdminPath

    Local Storage:

    • Drupal.history.1.1
    • Drupal.history.1.2
    • Drupal.history.1.4
    • Drupal.olivero.stickyHeaderState
    • Drupal.toolbar.activeTabID
    • Drupal.toolbar.subtrees.base_sub
    • Drupal.toolbar.subtrees.claro
    • Drupal.toolbar.subtreesHash.claro
    • Drupal.webform.system_modules.edit_modules_entity_type_behaviors_enable_description
    • Drupal.webform.system_modules.edit_modules_entity_type_behaviors_example_enable_description

    I dont think that we can describe all this storage items.

  • Comment 17 days ago →
    🇩🇪Germany Anybody Porta Westfalica

    Thank you @jan kellermann I'm totally fine with that, just wanted to drop the infos before we deprecate COOKiES.

  • Comment 17 days ago →
    🇩🇪Germany jan kellermann

    I didn't want to close the ticket, I just wanted to explain why we decided against it at the time.

    Let's decide again in a roadmap when the group has found itself for future work.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024