GDPR compliance

cformsII uses PHP sessions which use cookies by default. On the dashboard an additional cookie is used.

Is there a way to avoid the PHP session cookie (PHPSESSID)?

Yes. E.g., you can use a setting to transmit the session ID via URLs. That can be a security issue depending on what data is stored in the session. In cformsII the stored data is essentially the form data of multi-session forms.

How can I make sure, that the contact form it GDPR conform concerning the checkbox the user has to check, that he has read the information, that his data will be worked with…

how can I build that functionality in the contact form?

@bgermann Thank you! Do I understand that rightly, that a session isn’t necessary on single page forms?

@berlindave That’s right.

@worldpeace2020 I do not know about the GPDR requirements but I guess you can just use a checkbox and make it mandatory.

@bgermann So would it be possible to have an option to drop the session cookie? Is that a useful enhancement suggestion?

You can use PHP’s session.use_cookies = 0. Please read in the documentation about how to set it.

@bgermann Thank you!

Aside, as it was me starting this thread

I spent some more time researching the issue since and found there’s a lot of paranoid interpretations of the law. According to 1&1 session cookies as such are not the problem, as they are regarded as ‘necessary’.

Certain cookies that are considered ‘strictly necessary for the delivery of a service requested by the user’ don’t have to be declared, because they are of far higher benefit to the user than the company. This includes cookies used to track shopping carts in e-commerce and to store important login information that the user requires. …

… For the use of most cookies, website operators in the EU now require permission from the user. This covers all cookies that don’t meet the requirement mentioned above of being ‘necessary’. This means that advertising cookies for retargeting, analysis, and social media cookies now require permission from the user.
German version here

My guess is a hosting business their size has consulted their lawyers before publishing info with the potential to harm their own customer base on a big scale.

As long as there’s only cformsII used, the data not stored in the db and no third party cookies for tracking and targeting involved on a site, I decided to take the risk.

I doubt that in case somebody is willingly transmitting personal data to you via your contact form, he could sue you for using this info for the sole purpose of fulfilling the request he himself submitted. Therefore such a checkbox on a contact form reminds me of “fat-free”-labels on water bottles I saw in California. Afaik, there’s no such kind of over-protective “consumer protection”-laws in the EU.

Sorry to interrupt, your views on the topic may vary.