Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use recaptcha.net instead of google.com (EU Cookies law) #548

Merged
merged 1 commit into from
Mar 18, 2024

Conversation

Eseperio
Copy link
Contributor

In current implementation, ReCaptcha is configured to use the google.com domain. While this setup is functional, it introduces potential legal and compliance risks related to cookie management. Specifically, the google.com domain can set additional cookies that may not be directly related to our website's functionality. These extra cookies raise concerns regarding user privacy and the stringent requirements of various cookie laws, such as the EU's GDPR.

Under these regulations, websites must obtain explicit consent from users before any non-essential cookies are stored or accessed on their device. The presence of third-party cookies from google.com, without clear and informed consent, could place us at risk of non-compliance.

To mitigate these risks, I propose we switch the ReCaptcha service to use the recaptcha.net domain instead. This alternative domain offers the same functionality but with fewer implications regarding cookie placement. Using recaptcha.net minimizes the likelihood of inadvertently violating cookie regulations, as it's less likely to introduce unrelated or non-essential cookies. This change will help ensure our compliance with cookie laws while maintaining the integrity and security provided by ReCaptcha.

I've prepared the necessary code changes for this switch and tested them to confirm that ReCaptcha continues to work as expected without any loss in functionality. This update will make our site more privacy-friendly and legally compliant.

Looking forward to your feedback and approval.

Q A
Is bugfix? no
New feature? no
Breaks BC? no
Tests pass? yes
Fixed issues

Recaptcha supports two domains: Google and recaptcha.net. The former may involve more cookies than desired, potentially leading to legal issues for the host. Using the latter has fewer implications.
@maxxer
Copy link
Collaborator

maxxer commented Mar 11, 2024

Add a note to CHANGELOG and I'll merge. Thank you

@maxxer maxxer merged commit 20d19a1 into 2amigos:master Mar 18, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants