Make consent options mutually exclusive

[brotkrueml]

With #20 and #23 the two options "requireConsent" and "requireCookieConsent" were introduced. However, both can be enabled in the configuration at the same time. This does not make sense as they are mutually exclusive. This should also be obvious in the configuration.

One way would be to move both options out of the checkbox list of options and introduce a new field "Consent" with three options:

• none
• require consent
• require cookie consent

Acceptance criteria:

• A new field "Consent" with the three options described above is available.
• The value is written to a new YAML setting "matomoIntegrationConsent".
• A migration wizard is available which migrates the old setting under "matomoIntegrationOptions" to the new setting.
• The documentation is adjusted.
• A changelog entry is available.

[schmidt-oliver]

Good morning @brotkrueml.

I have some news on this topic: It is possible to use both options in combination if you use the undocumented flag of the setConsentGiven function to avoid setting cookie consent as well. So it would be great to have requireConsent and requireCookieConsent as separate options in the TYPO3 backend as mentioned before. You can read about this possibility on the official Matomo repo. I think they will document this in the future.

It should be easier and more future-proof to add an additional checkbox than to replace the existing checkbox with a menu of options. And as long as you set the default value of the requireConsent checkbox to false, it's not a breaking change either. I hope this information comes in time. Have a nice day.

[brotkrueml]

@schmidt-oliver I just looked at your proposal, sadly the argument is not documented by now, the docs are not updated:
https://developer.matomo.org/guides/tracking-consent#b-if-you-use-your-own-consent-tool-to-remember-the-consent

I don't want to introduce some internal stuff from Matomo which is not "officially" supported/documented and may break in the future from Matomo-side without proper deprecation/breaking note.

[schmidt-oliver]

@brotkrueml Don't worry, I understand. I commented again. Let's see if they will document it. Thank you.

[brotkrueml]

@schmidt-oliver I started with the development of the 2.0 version. I am unsure how to proceed here. For now, I think, I will leave it open and move the issue to the 3.0 release (maybe end of year, when v11 is not supported anymore).

When you need both methods, you may override the according event listener (using the same identifier):
https://github.com/brotkrueml/typo3-matomo-integration/blob/main/Configuration/Services.yaml#L50-L53
I haven't tested it, but should work, I assume.

[brotkrueml]

The current Matomo documentation of the documentation is clear, that the three options "Disable cookies", "Require tracking consent" and "require consent cookie" are exclusive:
https://matomo.org/faq/tag-manager/how-to-configure-consent-in-the-matomo-configuration-variable/

Also in the Matomo GUI, the other options are hidden, if one option is selected:

When you select one consent option, the other two unselected checkboxes are hidden.

Considering this, there should be four options, only one can be selected:

• None (Use setting defined in Matomo or custom implementation)
• Disable cookies (useTrackingCookies=false when activated)
• Require tracking consent (requireConsent=true when activated)
• Require consent cookie (requireCookieConsent=true when activated)

[brotkrueml]

@schmidt-oliver I read over the issue in the Matomo repository again. As I understand correctly, setConsentGiven() can pass a parameter false to disallow cookie tracking on given consent, and per default true to allow cookie tracking when consent has been given.

As I don't support setConsentGiven() out-of-the-box, you can achieve this with a custom listener to the PSR-14 event BeforeTrackPageViewEvent. Seen that way, the described way above (with a new Consent select box and the four options) are a way for the normal user?

Do I see that correctly? Or, as another possibility, should the requireConsent and requireCookieConsent be removed altogether in the options and handled manually by listeners?

We currently use only disabled cookies as our GDPR officer gave his okay for cookieless tracking without consent for every visit/action. So, I am not really into the practical implications of the consent options.

I want to release the next major version 3.0 in the next weeks (to prepare compatibility with upcoming v14) and as this may breaking this would be the possibility to adjust it (or wait for the next major version 4.0).