Drupal CMS-compatible consent management

Created on 11 December 2024, 11 days ago

Problem/Motivation

When using non-self-hosted providers (and that means all providers that will be shipped in CMS 1.0 recipe), user interaction with AI bots, automatic generation of alt text and other tasks performed by AI modules, results in data sent to third-party servers.

This data may contain sensitive information, but even if it doesn't, users initiating an AI transaction, need to consent to data processing by a third party.

Remaining tasks

Discuss possible UX and DX of consent management. Should it be global? Per AI task type (bots/translation/image manipulation), or per task? How will it work with different providers?

User interface changes

TBD

API changes

TBD

📌 Task
Status

Active

Version

1.0

Component

Miscellaneous

Created by

🇧🇬Bulgaria valthebald Sofia

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @valthebald
  • 🇬🇧United Kingdom MrDaleSmith

    I don't believe this is an issue for the AI module to resolve: consent management is an issue that affects a website globally, and all organisations are required to come up with a solution for it. It is a complex area legally, needs to take into account the specific data and staff requirements of the organisation processing the data (ie the website owner). Any solution we put in place just for the AI module could conflict with the policy elsewhere, would be onerous to maintain and would give the impression we give legal indemnity for data-related issues, which we don't.

    Drupal has some modules designed to assist with GDPR management: we would be better letting them handle this issue.

  • 🇧🇬Bulgaria valthebald Sofia

    @mrdalesmith: this issue is not about consent management in general (this should be handled elsewhere, and Drupal CMS is going to use Klaro manager for that), but about getting user consent when data is sent for external data processing by the provider.

    For locally hosted providers like llama, this is not an issue, but when a user communicates with (as an example) a chatbot, they need to be aware their input may be sent outside of the website.

  • 🇬🇧United Kingdom MrDaleSmith

    I'd still say that is something for the site's GDPR and consent management to worry about, not this specific module, but if you want to do it have at it.

Production build 0.71.5 2024