Creanimo
commented
6 years ago Thanks for posting it here! To elaborate on that:
Purpose and reason
As mentioned above showing iFrames and oEmbeds on the first visit is problematic because cookies and privacy policies might apply that the user of our website didn't give consent to - especially if they haven't confirmed the banner yet.
Description
Feature 1: Iframes and OEmbeds should automatically be replaced by
Minimum: A text notice saying that this content will be available if the user accepts the privacy policy. There should be a clickable button or text link to activate a specific consent or cookie. Good solution: A predefined placeholder image (could also just be div with a nice CSS gradient) spanning the approximate size of the oEmbed (16:9 for YouTube and vimeo, 1:1 for Instagram, 2:3 for facebook) with the text notice on top of it. Best solution: A thumbnail fetched from the source and cached on our own webspace with a semi transparent div overlay with the text notice on top of it. Maybe a mix with a generic placeholder when a preview cannot be fetched.
Settings in admin area: Minimum:
- Define the placeholder text for every oEmbed type (so we can link to the external privacy policies)
- Checkbox: Switch on and off
- Dropdown: "Make consent necessary every time", "Make consent necessary for every single oEmbed individually", "don't block content anymore anymore after consent was given once"
Good solution:
- Define placeholder image general or for specific oEmbeds
Best solution:
- Checkbox: Caching of thumbnails on and off
- Styling options
Optional:
- Dropdown: Options for what the user can click on: "I accept button", "Slider/Ceckbox for consent", "Just click on the overlay"
Feature 2: A shortcode to hide any type of content if (a specific) consent wasn't given
This way we can potentially hide any scripts or iframes embedded on the frontend. Shortcode: [have_consent][/have_consent] Variables: consent=" ", content only shows when user gave a specific consent (if this is not defined, a click on "I understand" on the banner is necessary). cookie=" ", content only shows when a specific cookie is active. option_type=" " defines what is appended where the user can click on to give consent
- button: An "I agree" button setting general or a specific consent or cookie
- checkbox: A checkbox setting general or a specific consent or cookie (maybe with a button to submit the choice?)
- text: An "I agree" text link.
- settings: A button leading to the settings overlay so the user can set the consent/cookie there. Should be open on the correct page if it is for a specific one. If general consent or the specific one is missing there should be a message that can be predefined in the settings with a button that opens the user's privacy settings. If a specific consent or cookie is necessary it should already show the specific setting. no_consent_message=" " can be used to enter a custom message for the consent needed notice. Optional Shortcode: [msising_consent][/missing_consent] with variables constent= and cookie=, which displays a content when general or a specific consent/cookie isn't active.
What could set the GDPR plugin apart from others
- Support for all oEmbeds and iFrames
- Consent can be saved, so user doesn't have to give consent every singel time.
fclaussen
Barrans
C44Supra
kasperkamperman
maxammann
From: darkmoonxarx
One of the challenges of GDPR is YouTube, facebook and instagram embeds, because they save cookies from external sources. In some cases a general “I understand” click at the beginning doesn’t suffice. So how about if your plugin could detect iframes and oEmbeds, replace them with a thumbnail with some legal info and don’t load them until they are clicked. This is a plugin that does this with YouTube links: https://github.com/michaelzangl/wp-video-embed-privacy Your plugin could go one step further and save the consent, so the user only has to click once. Also functionality for all oEmbeds, iFrames and potentially a shortcode to hide any type of content until permission is given would be awesome.