Comment cookies are completely disabled when "Show comments cookies opt-in checkbox" is not enabled

[pputzer]

#44373 introduced a setting to disable the comment cookies opt-in checkbox introduced in 4.9.6. Unfortunately, the patch neglected to set $cookies_consent to true in that case in wp-comment-post.php. This means that when the setting (in options-discussion.php) is disabled, no cookies will be set.

To fix the issue, the line

$cookies_consent = ( isset( $_POST['wp-comment-cookies-consent'] ) );

should be changed to

$cookies_consent = ( isset( $_POST['wp-comment-cookies-consent'] ) || ! get_option( 'show_comments_cookies_opt_in' ) );

[pputzer]

Replying to dhavalkasvala: Is there a reason you didn't use the line as suggested in the ticket description? I think it makes more sense semantically (since cookie consent is implied if the checkboxes are not displayed).

[dhavalkasvala]

replying to @pputzer i just checked for opt-in checkbox disable then cookies will be not set because there is a condition for comment_consent is not set.

[pputzer]

Replying to dhavalkasvala:

replying to @pputzer i just checked for opt-in checkbox disable then cookies will be not set because there is a condition for comment_consent is not set.

I'm not sure I understand this answer. Obviously, my original suggested solution also checks for the status of the option, but in the place where the $cookie_consent variable is set (because disabling the checkbox implies consent for cookies).

[dhavalkasvala]

Replying to pputzer: I think you say like cookies consent checkbox is not appear with status right?

I'm not sure I understand this answer. Obviously, my original suggested solution also checks for the status of the option, but in the place where the $cookie_consent variable is set (because disabling the checkbox implies consent for cookies).

[pputzer]

Replying to dhavalkasvala:

I think you say like cookies consent checkbox is not appear with status right?

I'm saying that semantically the option check should be moved to the definition of $cookie_consent:

$cookies_consent = ( isset( $_POST['wp-comment-cookies-consent'] ) || ! get_option( 'show_comments_cookies_opt_in' ) );

[dhavalkasvala]

when opt-in disable still there is checkbox for cookies_consent is appear with status right in comment form.

[dhavalkasvala]

Replying to @pputzer :

when opt-in disable still there is checkbox for cookies_consent is appear with status right in comment form you want that.

[pputzer]

Replying to dhavalkasvala:

Replying to @pputzer :

when opt-in disable still there is checkbox for cookies_consent is appear with status right in comment form you want that.

I am sorry, but I'm still uncertain what you mean by that.

[ThemeZee]

This should not be changed. Cookies should never be set without the consent of the user, because then it violates the GDPR. That was the reason to introduce the checkbox in the first place.

There should be two options:

1) Disable comment cookies completely

2) Enable the checkbox, which asks the user for consent to save comment cookies

Right now the current implementation does that. Changing it might lead to website owners violating the GDPR without knowing it, when they deactivate the checkbox.

[pputzer]

Replying to ThemeZee:

There should be two options:

1) Disable comment cookies completely

2) Enable the checkbox, which asks the user for consent to save comment cookies

Right now the current implementation does that. Changing it might lead to website owners violating the GDPR without knowing it, when they deactivate the checkbox.

While I'm all for privacy by default, I disagree that the current implementation is tenable. The wording of the checkbox is completely misleading and there is the additional issue of backwards compatibility. You are right that @mirkoschubert requested exactly this functionality, but the discussion in the ticket veered in a different direction and the commit results don't match with that.

[mirkoschubert]

I think, it needs a little bit of clarification... I completely agree with @ThemeZee on this one (what a surprise), because there are two ways that this would be GDPR compliant:

1. The comment cookies should never be set in the first place.
2. If comment cookies are being used, there should be a user consent - cf. Article 6(1)(a) GDPR. That's the checkbox for.

If the website owner only can choose to set the checkbox or not and the cookie would be set anyway, then the possibility of a violation of the GDPR is very high. Not everyone knows the GDPR as much as we do.

In addition, lawyers here in Germany tend to advice, that the user consent should be logged with date, time and IP for proofing purposes. :D

I'm very strict when it comes to privacy by default - and so is the European Union. So as a website owner I want to store as little personal information about the user as possible. To me, setting a cookie for storing information, only that users don't have to type their information twice is pretty useless.

You may be right, the wording of the new setting could be misleading. Maybe it should be clarified that the cookie will not be set if there's no checkbox. But the outcome should definitely be the same.

[pputzer]

Replying to mirkoschubert:

2. If comment cookies are used, there should be a user consent - cf. Article 6(1)(a) GDPR. That's the checkbox for.

It could be argued that they are technically necessary for a part of the comment functionality and therefore covered under 6(1)(b). I'm not sure I agree with this argument, but I'd like to highlight that "consent" might not be the only reasonable lawful basis for data processing in this case.

[mirkoschubert]

Replying to pputzer:

Replying to mirkoschubert:

2. If comment cookies are used, there should be a user consent - cf. Article 6(1)(a) GDPR. That's the checkbox for.

It could be argued that they are technically necessary for a part of the comment functionality and therefore covered under 6(1)(b). I'm not sure I agree with this argument, but I'd like to highlight that "consent" might not be the only reasonable lawful basis for data processing in this case.

Yes, you are right, there are more than one reasons for justification under Art. 6(1) GDPR. But 6(1)(b) requires a contract to be involved somehow. And a comment has nothing to do with any contract. ;) In addition, a technical necessity isn't given in this case. The commenter can obviously live without saving his data for the next time. It's convenient, not necessary. And if he (and the website owner) want this kind of behaviour, he can register as a subscriber in WordPress.