10

I am searching a lot since last few days but not getting an answer. I am in process of preparing Privacy Policy of site. I am not providing any user registration or user login facility but anonymous user can post comments. Now, question arises after I read following Q&A on DA,

Don't collect IP addresses in Drupal 7

Now, since I have no intention to collect any user information(have not enabled statistics module), then I can simply write, "I do not collect any user information". Again, question comes, what if the code is collecting IP address/Hostname without our knowledge.

So, if there is a way to know what information are collected, and how saved then we can be sure about that, and can state in privacy policy or If Drupal core is not collecting any data, then also we can be sure about that and write "We do not collect any visitor's data". Is there a way we can know?

Note: Please let me know, if this question is going toward Privacy policy(away from drupal), I will move this to SO. But, again it is related Drupal CMS code, so I thought to ask here first.

UPDATE:

Have raised the issue at Drupal core: Legal privacy policy statement of Drupal core

and it you see the comment there is a link to other issue: Privacy Concerns as GDPR Compliance, which says there is already work going on and regarding this module creation is underway, module will be General Data Protection Regulation.

Please add comments in issue, if you want to add some suggestion.

Improve this question
1
  • 1
    The linked question should still be fairly accurate, but it is missing watchdog or syslog module. Those modules also records data temporarily (if cron is run), and are there not for statistical analysis but for informational analysis by a trusted administrator.
    – mradcliffe
    Commented Feb 5, 2017 at 15:00

1 Answer 1

Reset to default
3

The answers and comments in the linked question for Drupal 7 are still valid, with one exception. Drupal 8 gets the client ip address from Symfony\Component\HttpFoundation::getClientIps(). This returns the client ip from the header REMOTE_ADDR, unless you set up a trusted proxy. In this case you would have to configure this proxy to obfuscate the visitor's data.

In all other cases it should be enough to overwrite part or all of the ip address in a Symfony middleware.

Improve this answer
5
  • Hi, sorry for late comment. Till this day I am trying to understand this whole thing. Sorry if I was not clear, but by giving that example, I've explained issue further in question. My question and its subject is "Does Drupal collect any data or use any cookies(ultimately for data) or any information which belongs to user?" Moreover, I have raised issue in Drupal core, which I have added as update in Q. Suppose, If I am using just drupal core, so can I confidently right in my website's privacy policy that, I am not using any users data? No because there is no reference of that in drupal core.
    – CodeNext
    Commented Feb 9, 2017 at 5:52
  • Just to give an example, if you refer Piwik software, it describing all things what user want to know about their data, how their software interact with user data, what they are using, how they are processing user data.
    – CodeNext
    Commented Feb 9, 2017 at 5:56
  • 2
    My answer is from a code perspective. You asked if Drupal collects visitor's data by default. You can't control where and when the client ip is used inside of Drupal, see the discussions. So you need to obfuscate the IP. In D8 requests are handled by Symfony. You can do this in a proxy (setup as trusted proxy) or in a Symfony middleware before any Drupal specific code is run.
    – 4uk4
    Commented Feb 9, 2017 at 7:51
  • 1
    Cookies is a different question. Drupal doesn't assign cookies to anonymous traffic by default. If you extend Drupal so that it does, you probably will add also the necessary messages for the user to confirm.
    – 4uk4
    Commented Feb 9, 2017 at 8:05
  • From your both comments, now I am understanding how things are going. Now, I can be sure, Drupal does not use cookies on non-logged in user and regarding IP addresses, it needs to be done something in between. Very very thanks for these infos. Much Appreciated.
    – CodeNext
    Commented Feb 9, 2017 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.