GDPR compliance using wowchemy hugo academic template - howto?

[tvercaut]

Hi,

Thanks for the great tool! I am wondering what the recomended solution is to create a GDPR compliant website with the wowchemy hugo academic template.

I have read about the wowchemy privacy pack here but it does not explicitly mention GDPR:
https://wowchemy.com/docs/get-started/#core-parameters
also, the cookie information banner doesn't seem to be an opt-in but seems to only provide information. As such, I am not sure it is sufficient.

I have also read the main Hugo GDPR documentation:
https://gohugo.io/about/hugo-and-gdpr/
but it mentions that

These settings work with the internal templates. Some theme may contain custom templates for embedding services like Google Analytics. In that case these options have no effect.
and its unclear to me whether wowchemy relies on these internal templates for google analytics, etc.

It's also unclear if even with these internal template using privacy-friendly google analytics settings (sorry for the quasi-oxymoron) such as:

[privacy]
  [privacy.googleAnalytics]
    anonymizeIP = true
    disable = false
    respectDoNotTrack = true
    useSessionStorage = true

is enough to be GDPR compliant without opt-in.

For the record, I also read this relevant blog page:
https://liatas.com/posts/hugo-gdpr-cookie-consent-banner/

Thank you,
Tom

[gcushen]

The function of the optional integrated privacy pack is specifically:

The Privacy Pack can also be activated from the Site Features section. When the privacy pack is enabled, a cookie consent message will be shown to visitors (linking to your Privacy Policy) and visitor IPs anonymized in Google Analytics (if enabled).

Each site can have different third-party integrations and be subject to different laws. This is a free, open source project. For legal advice on your compliance with regulations in the law, you'll need to consult with a lawyer. The integrated open source privacy pack is provided by https://www.osano.com/cookieconsent . Osano (and their competitors) offer more comprehensive services that you might be interested in: https://www.osano.com/

[tvercaut]

Thank you. I fully appreciate this is an open source project and am only looking for information on good practices rather than legal advice.

Regarding osano/cookieconsent, it's a unclear to me how it integrates with other cookies-enabled services within the current template. From a quick look at the osano documentation, there should be a callback hook to start/stop using cookies in things like disqus, analytics, etc. Without being familiar with the code base, I couldn't find those callbacks in wowchemy/academic/hugo

If this needs to be done by myself, it would be great to see some examples of how to integrate this within a wowchemy/academic powered website.

[tvercaut]

If anyone is interested, I realised that even without any analytics or commenting features, a privacy policy was required to inform the user about the use of google fonts and font awesome icons + the use of a contact form.

I also decided not to use the default github / twitter buttons to avoid poluting the privacy policy (See #1944).

I currently chose to use the free iubenda plan to implement the privacy policy. My work in progress hugo / wowchemy / academic website can be seen here: https://h2020faros.eu

I also found the osano free privacy audit quite useful. Still some work to do though on HSTS, CSP headers, Referrer Policy, Subresource Integrity (SRI), and HTTP headers.

That's a lot of work for what is in many respects a straightforward academic website. I hope this discussion can help others but equally, I'd be interested in tips from the community!

For example, did people start looking into the google analytics Consent mode (beta):
https://support.google.com/analytics/answer/9976101?hl=en
I'm still interested in avoiding the opt-in cookie banner while getting some simple analytics if that's even a possibility.

[gcushen]

If you prefer your site not to use a Google Font based font theme, you can set font to native in params.toml.