ampproject / amphtml

The AMP web component framework.
https://amp.dev
Apache License 2.0
14.89k stars 3.89k forks source link

Some Questions on <amp-consent> #16617

Closed ghost closed 6 years ago

ghost commented 6 years ago

Hi,

Got some quick questions with regards to <amp-consent> module.

  1. I'm building a cookie consent banner and using the <amp-consent> module however the banner is not displaying when a user loads the test webpage due to this line of CSS:
amp-consent {
    overflow: hidden!important;
}

What would be the best setting for the overflow to make the banner display straight away? I use the following code and it worked fine, but just want to double check:

amp-consent {
    overflow: initial!important;
}

I would like to be able just to add this code:

amp-consent#myUserConsent{overflow:initial}

~But gives the following error:

The text inside tag 'style amp-custom' contains 'CSS !important', which is disallowed.

Maybe can allow the removal of the !important from the source code, to allow users to be able to create banners or overlay of their choice! This file: amp-consent.css code line: 22. Can it be changed to this:

 amp-consent {
  /* Fixed to make position independent of page other elements. */
  position: fixed;
  bottom: 0;
  left: 0;
  overflow: hidden; // Do not remove
  background: rgba(255, 255, 255, .7);
  z-index: 1000;
  width: 100%;
 }
  1. My next three question's are with regards to EU's ePrivacy Laws and <amp-consent> module.

At the moment it doesn't seem to pass ePrivacy laws, the examples on ampbyexample website do not pass ePrivacy laws at all for the following reasons:

2.a) Under ePrivacy Law (Recital 32 and Article 29 working party guidance nov 2017), you need to use a "Granular Opt-In process", this means having a toggle button switching things on/off would not pass the law. You should have a slider or more options, for example a User just switching the Google Analytics on and off would not pass the law. You would need to have a granular setup like:

2.b) Also under ePrivacy Law (Article 4, para 11 and article 13, para 1, C and para 2, F), you need to give "Consent to each item Separately", so adding data-block-on-consent to each thing and letting the user only turn on/off all the code containers with data-block-on-consent would also not pass. For example the code example found here: ampbyexample basic example consent. The example turns off the image and advert at the same time and not separately and gives no option to allow users to be able to have one turned off and one turned on and vice-versa for example.

2.c) Lastly, the <amp-geo> module combined with the <amp-consent> module. I don't understand how the ampbyexample demo shows how to pass GDPR laws? GDPR and ePrivacy apply to EU Members and Citizens, so if they logged in to the internet from a country outside The EU they are still protected by GDPR and ePrivacy laws as they are an EU Citizen, so surely it doesn't matter what country, a user is located - the same laws will still apply to protect those Citizens! So I am questioning this line in the info section (as the GEO holds no weight with regards to consent):

checkConsentHref is required if promptIfUnknownForGeoGroup is not defined.

Most websites have already decided to run the same policy settings for every country! Thus fully covering them by law.

  1. Also is it possible to list the API <amp-consent> module a bit more clearer as to list each thing and say if it's "required" or "optional" the info seems to be spread across several pages, on ampproject.org and github. For example Google writes webpages info like this and it's really easy to understand if each property is required or not? See screenshot:

ssss

jpettitt commented 6 years ago

The consent banner to display is not the amp-consent element itself. It is a separate hunk of html that is referenced in the conset config.

Take a look at the example here https://ampbyexample.com/user_consent/basic_user_consent_flow/ - the element #consentDialog contains the message and it's reference by the application/json script inside amp-consent

A more granular opt in is on the roadmap see #15651

ghost commented 6 years ago

@jpettitt Thank you, I see where I went wrong, thanks for the info!