[#45443] - Cookie Manager
- New
- Medium
- Build: 5.3-dev
- # 45443
Is your feature request related to a problem? Please describe.
Many countries and regions have passed laws regulating cookies over the last decade, but Joomla still doesn't have a cookie manager out of the box, which is what almost every website needs, and if all websites need this tool to comply with the laws of many countries and regions, then it should be part of Joomla's core.
California Consumer Privacy Act (CCPA/CPRA) - 🇺🇸 USA
Personal Information Protection Law (PIPL) - 🇨🇳 China
Lei Geral de Proteção de Dados (LGPD) - 🇧🇷 Brazil
Digital Personal Data Protection Act (DPDPA) - 🇮🇳 India
Protection of Personal Information Act (POPIA) - 🇿🇦 South Africa
Personal Data Protection Act (PDPA) - 🇸🇬 Singapore
Revised Data Protection Act (UK GDPR) - 🇬🇧 United Kingdom
Swiss Data Protection Act (Revised 2023) - 🇨🇭 Switzerland
Personal Information Protection and Electronic Documents Act (PIPEDA) - 🇨🇦 Canada
Act on the Protection of Personal Information (APPI) - 🇯🇵 Japan
Personal Information Protection Act (PIPA) - 🇰🇷 South Korea
Describe the solution you'd like
I propose to create a Cookie Manager extension for @joomla
The cookie categories should be something like this:
By Source
- 1st party cookies: created when one visits a website to remember preferences (i.e. cart items, login details, or language settings). These expire when the browser closes and are typically session-based.
- 3rd party cookies: placed by external partners/domains (i.e. analytics tools, advertisers etc ) to track cross-site behavior for analytics and targeted ads. These raise privacy concerns and persist longer...
By Functionality
- Strictly necessary Cookies: required for a website's core functionality (i.e. shopping cart, login etc). ✅
- Performance/Analytics Cookies: tracks user interactions (i.e. page visits, bounce rates) mostly to optimize a site's performance.
⚠️ GDPR requires consent. - Functional Cookies: enables non-essential features (i.e. preferences saving).
⚠️ GDPR requires consent. - Targeting Cookies: used for ad personalization.
⚠️ GDPR requires explicit consent.
By Security Attributes
- Secure cookies: to prevent interception, these are only transmitted only over HTTPS.
- HTTP-only cookies: they protect sensitive data and block access to client-side script
- SameSite cookies: to mitigate CSRF attacks, they restrict cross-site sharing.
✅ - Consent is not required under GDPR.
Additional context
I made this feature request based on an article from Joomla Magazine.
Best practices for cookie notices - https://web.dev/articles/cookie-notice-best-practices
Wiki - https://en.wikipedia.org/wiki/HTTP_cookie#EU_cookie_directive
joomla-cms-bot
- | Labels |
Added:
No Code Attached Yet
|
||
We had this discussion several times in the production department about adding a cookie manager. I'm a supporter of such a solution, however the majority of people unfortunately voted against this, which is why this wont be in Joomla in the forseeable future. The main reason is, that we fear legal issues and a lot of maintenance work, which we simply don't have the (wo)man power for. The project currently simply can't research the legal situation for all countries out there and also can't keep monitoring it, so that our solution is reliably safe to use for everyone. At the same time, the expectation of most people is that such a function would provide an automatic solution for the whole data privacy issue on their site and that is also not something we can guarantee and provide. That is why (at least for now) we are rather pointing towards third party solutions instead of a core extension.
As I have written elsewhere
Adopt and integrate an existing open-source cookie management system into Joomla. This approach minimizes development overhead while ensuring a reliable and maintainable solution.
| Labels |
Added:
Feature
|
||
The team does not see the issue in creating the cookie manager once, but in managing the legal stuff around it. When a court rules against the solution as insufficient, is Joomla liable? And even if not, can we risk the legal confrontation? Every legal battle costs money and binds resources.
Then you need to read and understand the licence that is used. Joomla uses the GPL which provides no warranty and the library I recommended uses the MIT licence which also provides no warranty.
Again: I'm not the one against such a feature. I have a different opinion about the whole thing, but there were just 2 votes for this feature and the rest of the team voted against it.
were they voting in principal or voting about that terrible non-working pr
in principal
The problem with this crap, that having cookie manager is not always enough nowadays.
For serious business it need a "certified cookie manager provider", otherwise no lawyer will be happy to work with you.
Something is better than nothing
When a court rules against the solution as insufficient, is Joomla liable?
Joomla cannot be held responsible for this, nor can the developers of cookie extensions, because the responsibility always lies with the website owner who MANUALLY CONFIGURES the cookie manager on his website.
It's complete nonsense if you think that Joomla will be involved in legal proceedings because one of the website owners incorrectly configured this extension with his own hands.
Joomla does not sell this extension for money and is not involved in the sale of this extension, which means that the webmaster uses this extension at his own risk, just as he uses the CMS at his own risk, because no CMS is insured against hacking and leakage of users' personal data, for which legal liability occurs in many countries, including all countries that have already adopted laws on cookies, but you forget about it when you vote against the cookie extension for Joomla.
You have not enabled the Cookie Manager in Joomla because you are afraid of legal liability, but what about legal liability for the personal data of users?
The owner of the website is always and in all countries responsible for all this, and not the one who provided the extension for free use at their own risk.
Does Joomla have a user registration system out of the box?
Yes, Joomla has a user registration system, which means that Joomla websites have the ability to save personal data of users, which is also regulated by the laws of all countries that have adopted cookie laws.
You could at least provide the technical ability to independently configure cookies for each website owner, and then each website owner will configure this extension in accordance with the laws adopted in his country.
^ All of this data is subject to laws in each country that has a cookie law, but for other types of data, you have never had any questions about whether or not such features should be implemented into the core of Joomla.
#35278 (comment)