I need to add Flags to one of my content types. Two kinds, actually:

  1. I'll take care of it
  2. Solved

Second flag should be available only to node author, and only if first one was already raised. But that's simple part. First kind of flag is trivial for logged in users, too.

The point is - I need to make first kind of flag available for anonymous users, too. And I need to make sure I have their valid email addresses. Standard confirmation link in mail would be OK - so how do I do that?

I know I can develop custom module from scratch, and I will if needed, but I was sure there is already a out-of-the-box solution, and I simply can't find it now.

Just to make some things clear:

  • Flag module works for anonymous users if you install Session API. No problem here.
  • I planned to keep emails in Email Field attached to flag itself. For logged in users it defaults to their email, and if they decide to change it, so be it, I have a way to reach them anyway. For anonymous, I want it verified by link in email, and if it is not verified in time, I want to delete flag. Deletion will be easy with CRON and Rules or simple helper module, it's verification that's complicated (and I hope solved already).
  • Just to double check, you need something that will 1. capture email temporarily (until the flag is done), and 2. email the user to double check that that email is correct (I'm assuming so they can be notified once their flag is completed)
    – Jance
    Dec 3, 2014 at 14:43
  • @Jance I want email in email field attached to flag itself. For logged in users it defaults to their email, and if they decide to change it, so be it, I have a way to reach them anyway. For anonymous, I want it verified by link in email.
    – Mołot
    Dec 3, 2014 at 14:49
  • I think you have to create custom module and ask user for email when click on flag. A module is there drupal.org/project/flag_anon but it shows the login/register link. Dec 3, 2014 at 14:49
  • @SumitMadan See this issue anonymous flagging is already possible if you have Session API. My question is about mail verification, not how to make them able to flag :) For reasons explained under answer, I cannot make people create accounts.
    – Mołot
    Dec 3, 2014 at 14:50
  • 1
    There is a verification module out there that works for anonymous comments (unfortunately not flags), but it might be a decent jumping off point (drupal.org/project/comment_verification)
    – Jance
    Dec 3, 2014 at 15:08

5 Answers 5


I would use hook_flag_link_type_info() to provide a link type like the 'confirm' link type provided by the flag module. Copy their approach, but on the 'confirm' form you ask for the users e-mail address (if the user is anonymous). You save the value to the email field you added to your flag and the Rules module should be able to do the rest for you. It requires a bit of custom code (not too much I would guess), but the major part of the functionality (flagging, unflagging, rules integration, ...) still comes from the Flag module.

[EDIT] For the verification part: Add a boolean field to your flag ('Verified') which you change with the verification link you send by mail. The "Solved" flag can be hidden/shown with hook_flag_access().


I have done 2 modules which sends emails. One for authenticated user to receive by email their flagged content and one to send to a friend a URL you like.

I think it's a bit long to post all the code here, so I've put a zip online to upload

Maybe you can do a mix of both to achieve your goal.

Hope it helps.


I must say, I wish I would have used Jelle's way. But I didn't. So I don't know if it works.

Here is the way I did it

  1. I created a flag with email field. I made flag button to lead to form, so users would need to fill it. There are some fields required for everyone, anyway.

  2. Required by role made email required for anonymous. Logged in users may fill it if they want different email, and in that case they still should get verified, so far so good.

  3. I installed Email Field Verification, enabled it, turned it on the email field attached to flag, and set it to delete content if field is not confirmed.

Why I wish I didn't

These modules are buggy. Especially Email Field Verification - all it's bugs needed to be worked around. It took me some patches and hacks to make it all work the way it should. I believe it might be easier to write it myself, actually. Well, at least I hope I'll be able to contribute patches.


As far as I know, there is only one anonymous user, whose account is shared by all anonymous users. If you want to track the email address of anonymous users, then can't the be given their own accounts?

The only way I can think of storing information for anonymous users, is to set a cookie, which is stored on their computer. But there would be an issue of different anonymous users shared a computer, or the anon user used two different devices.

  • No, they can't get accounts. They are supposed to be able to flag as easily as possible, and want their mail to be forgotten once their flag is done (post marked solved by the author). Just enter mail, submit, click confirmation link. That's what my users want it to be for their readers. Creating account for someone who visited once, one node, and will probably never return, makes little sense. Not to mention law requirements. They are more strict if I would open account creation to general public. Personal data protection. So no, that's not an answer for me.
    – Mołot
    Dec 3, 2014 at 14:39
  • Couldn't you make a temporary account on the fly (with no real user data), and remove it after process ?
    – laniol
    Dec 3, 2014 at 14:46
  • @laniol Might work, but lawyer to make it work would be as expensive as registering personal data database officially would, I'm afraid. I will not dare to risk it.
    – Mołot
    Dec 3, 2014 at 14:52

I may be missing some of your requirements here, but I would have thought that once you have an anonymous user's email address, they are no longer anonymous. If that is accepted, maybe instead of attributing flags to anonymous users, you could work with the drupal system and simply create them a low level account when they flag something. You could then differentiate flag access by role instead.

In order to do this you would need to get the user immediately logged in, using something like the User Registration Password module. You could alter the flag action to send them to registration page first (simplified to email address only), with the flag details maintained as a destination in the query string, thus applying the flag only after the user is logged in, but prompting email confirmation.

  • See this older comment - no, they can't get accounts, for various reasons.
    – Mołot
    Dec 10, 2014 at 11:57
  • Understood. I am not sure that there is much of a legal distinction between opening an account (which can be deleted later if required), which only has the user's email address and no other personal information, and simply storing the email address. Both result in persistent storage of the same information. Dec 10, 2014 at 13:26
  • In my country distinction exists. In theory line is blurred, in practice keeping it only for the exact purpose it was entered bears no significant risk of lawsuit.
    – Mołot
    Dec 10, 2014 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.