mahara-contributors team mailing list archive

[Kristina Hoeppner <1885664@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

Google automatically tracks anyone viewing an embedded a YouTube video.
There is a solution to be GDPR compliant: It's to use youtube-
nocookie.com

See https://dri.es/how-to-remove-youtube-tracking for the background.

It would be good to include that URL as default in our 'Allowed iframe
sources' list.

Furthermore, since we want to be GDPR compliant / need to in certain
circumstances, I wonder if we should make it a default in the config.php
that system admins can say that all YouTube videos should be converted
to the nocookie URL (would need to be regular YouTube URLs as well as
ones from mobile devices and the YouTube shortened ones I guess). We
already convert the URL into proper iframe code and could add that as
regex.

It would be good to have it available in the site admin area but also be
able to override it in the config.php so that site admins can't easily
change things. The default would be nocookie to comply better with
privacy from the start.

We may need to have a button to update all URLs (like we have for clean
URLs when they are set for the first time) if we can't make that
conversion on the fly. YouTube URLs appear in the 'Embedded media' block
as well as in serialised text in journal entries, text blocks, and
notes. That serialised text might be difficult to change. This is
important for sites that would be switching from the regular to the
nocookie URL.

If we make it a setting and someone changes from nocookie URL to regular
YouTube URL then we are not updating all URLs though in case someone had
set the nocookie URL specifically. The update would only be for YouTube
-> YouTube-nocookie.

** Affects: mahara
     Importance: Wishlist
         Status: Confirmed


** Tags: gdpr privacy

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1885664

Title:
  Add YouTube-nocookie to youTube filtered URLs and make it a config
  setting

Status in Mahara:
  Confirmed

Bug description:
  Google automatically tracks anyone viewing an embedded a YouTube
  video. There is a solution to be GDPR compliant: It's to use youtube-
  nocookie.com

  See https://dri.es/how-to-remove-youtube-tracking for the background.

  It would be good to include that URL as default in our 'Allowed iframe
  sources' list.

  Furthermore, since we want to be GDPR compliant / need to in certain
  circumstances, I wonder if we should make it a default in the
  config.php that system admins can say that all YouTube videos should
  be converted to the nocookie URL (would need to be regular YouTube
  URLs as well as ones from mobile devices and the YouTube shortened
  ones I guess). We already convert the URL into proper iframe code and
  could add that as regex.

  It would be good to have it available in the site admin area but also
  be able to override it in the config.php so that site admins can't
  easily change things. The default would be nocookie to comply better
  with privacy from the start.

  We may need to have a button to update all URLs (like we have for
  clean URLs when they are set for the first time) if we can't make that
  conversion on the fly. YouTube URLs appear in the 'Embedded media'
  block as well as in serialised text in journal entries, text blocks,
  and notes. That serialised text might be difficult to change. This is
  important for sites that would be switching from the regular to the
  nocookie URL.

  If we make it a setting and someone changes from nocookie URL to
  regular YouTube URL then we are not updating all URLs though in case
  someone had set the nocookie URL specifically. The update would only
  be for YouTube -> YouTube-nocookie.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1885664/+subscriptions