Change Details

NOTE: this task is opened since 10 November **2023** - public details: https://phabricator.wikimedia.org/T351755#9857642 - original private details: https://wiki.wikimedia.it/wiki/Discussione:CiviCRM#Tracciamenti_in_CiviCRM The newsletter of WMIT usually has many links, but, all of them, are replaced from this: https://www.wikimedia.it/privacy/ https://www.wikipedia.org/ To this (just an example - do not visit these links): ```counterexample https://sostieni.wikimedia.it/civicrm/mailing/url?u=10001&qid=123 https://sostieni.wikimedia.it/civicrm/mailing/url?u=10002&qid=123 ``` We know that other organizations may need such link tracking, but in WMIT we have more disadvantages than advantages. This tracking should be de-activated (requested since 2023) at least for internal communication to members. ## Reasons - **Increase User Security** - Users should always check the final destination of a link and //before// visiting the link. This is a basic cybersecurity practices when reading emails. - Maybe better described here: - (IT) (2022): https://wiki.wikimedia.it/wiki/Linee_guida_scrittura_email - (IT) (2022): https://wiki.wikimedia.it/wiki/Linee_guida_sui_link#Evitare_short_URL.2C_evitare_URL_spoofing - **Follow Original Intentions from Tech Stakeholders** - Thanks to CiviCRM, WMIT migrated away from a similar tool called "GIVE". The "GIVE" was a proprietary tool, to do newsletter, but doing aggressive link tracking. So, CiviCRM should be used as solution. CiviCRM should not be used to replicate the same aggressive link tracking. - {T323815} - **Simplify User Consensus** - It's not clear whenever users agreed to be actively monitored, whatever click they do in newsletter contents. We never received a legal confirmation, saying that our link tracking is legit. - **GDPR Minimization Principle** - Knowing who opens an email, when, which link was clicked, has never been a "success metric" (and it should not - probably). So, for the GDPR "Minimization Principle" we should just avoid to collect such data, unless otherwise requested for specific campaigns for specific external patners. - **Avoid Double Tracking** - The organization already has a content tracker: Matomo (https://wiki.wikimedia.it/wiki/Matomo). So the organization is collecting both all clicks in newsletter links, and web visits. It's unclear why we cannot just have "less aggressive link tracking" - for example - we could adopt the Matomo campaign URL builder - which would be less aggressive - https://matomo.org/faq/tracking-campaigns-url-builder/ - **Follow-Up Assemblies** - From WMIT assembly of November 2024 (https://wiki.wikimedia.it/wiki/Associazione:Assemblea_WMI_novembre_2024/Verbale) - (IT) //«Valerio Bozzolan come socio membro della Commissione tecnica, esprime apprezzamento per l'abbandono del software precedentemente usato per gestire i dati dei soci, che tracciava la navigazione attraverso i link. Segnala però che anche nel nuovo applicativo CiviCRM è abilitato il medesimo tracciamento e chiede che vengano rispettare le linee guida, presenti in wikina, sulla scrittura delle email e sulla di scrittura dei link (che devono essere in chiaro per, per ragioni di sicurezza) e __chiede che il tracciamento venga eliminato dalla mailing list e da tutte le comunicazioni ai soci__. Chiede inoltre che le richieste ai fornitori siano pubbliche e tracciabili, ad esempio su Phabricator. Ringrazia tutti coloro che contribuiscono agli sviluppi software.»// - From WMIT assembly of May 2025 (https://wiki.wikimedia.it/wiki/Associazione:Assemblea_WMI_maggio_2025/Verbale) - (IT) //«Punto 1: Risoluzione tracciamento newsletter Rispetto allo scorso verbale dell'assemblea di novembre, ribadisce i rischi nel tracciare ogni link della newsletter dei soci, e __chiede di essere autorizzato a risolvere direttamente la cosa__ col fornitore CiviHost. »// ## Proposal De-activate the tracking URLs in CiviCRM. This should be done, at least, for all communications to members.