Drupal CMS-compatible consent management

I don't believe this is an issue for the AI module to resolve: consent management is an issue that affects a website globally, and all organisations are required to come up with a solution for it. It is a complex area legally, needs to take into account the specific data and staff requirements of the organisation processing the data (ie the website owner). Any solution we put in place just for the AI module could conflict with the policy elsewhere, would be onerous to maintain and would give the impression we give legal indemnity for data-related issues, which we don't.

Drupal has some modules designed to assist with GDPR management: we would be better letting them handle this issue.

@mrdalesmith: this issue is not about consent management in general (this should be handled elsewhere, and Drupal CMS is going to use Klaro → manager for that), but about getting user consent when data is sent for external data processing by the provider.

For locally hosted providers like llama, this is not an issue, but when a user communicates with (as an example) a chatbot, they need to be aware their input may be sent outside of the website.

I'd still say that is something for the site's GDPR and consent management to worry about, not this specific module, but if you want to do it have at it.

It's not that simple.

There has to be a hint for data transfer as soon as an administrator wants to store a key to activate an AI. This is indeed an issue for all modules that access external data sources. That's why the issue is in good hands here. At the latest before activating the connection between Drupal and the AI service, the site operator should have a corresponding passage in his privacy policy. To do this, however, they must know that we transfer data to third parties as soon as the key has been saved.

I'm just saying this to make it easier to understand. This will certainly require corresponding interfaces from the Ai module to Klaro and possibly even to the GPR module. That's why the issue fits here. A note that you should check your privacy policy before activating a Ki provider is the minimum.

Is this issue up to date with the Drupal CMS recipe? The recipe integrates with Klaro and configures consent management as part of the recipe. So I think this can be closed?