As we work with our consulting clients on site-builds, we are often asked to include modules related to newsletters and analytics. Sometimes, our clients don't fully understand the ramifications of adding external scripts to their sites, so we end up having a larger data privacy discussion. In most cases, we recommend to our clients that they limit external embeds and scripts on their site mainly in the interest of user privacy.
We figured it was about time that we took a closer look at our own site. With that in mind, we recently made the decision to remove most 3rd-party embeds and tracking scripts from this site with a few exceptions:
- Our Mautic marketing automation system (which we self-host and completely control.)
- Termageddon (affiliate link) content for our Terms of Service and Privacy Policy pages.
- Embedded YouTube videos.
We have removed:
- All embedded EventBrite forms (which we haven't used in a very long time!)
- All references to Mailchimp (again, we haven't used it in a long time.)
- Google Analytics
- Embedded Facebook, Flickr, and Twitter posts.
- Embedded Podbean content (podcast audio is now hosted from our own AWS S3 bucket.)
- Embedded Vimeo content.
- Amazon.com tracking pixels related to an affiliate code (from 2009!)
Why did we do this?
The short answer is that we want to practice what we preach. We encourage our clients to own as much of their own data as possible, and not to subject their users to unnecessary tracking scripts - we felt we should lead by example.
We have updated our Klaro content forms (the little lock icon in the lower right of this window) to reflect all of this. We encourage you to review your consent settings and consider enabling more services - especially the "DrupalEasy updates (Mautic)" one, as this will help us provide more relevant content without sharing your data with anyone.
How did we do this?
It all started as we were using AI to fix some long-standing (minor) issues that we kept seeing popup in this site's Recent log messages report. A few were related to our Klaro settings and our site's Content security policy. One thing led to another and before we knew it, we were reviewing everything related to embedded scripts and content on the site.
This site uses both the Security Kit and Klaro Cookie & Consent Management modules - both of which we recommend to most of clients.
Our coding harness (Claude Code) did a great job of helping us diagnose issues, find content that needed to be updated (mainly removing embedded content from other sites), and then updating both our Security kit and Klaro configurations. The Miscellaneous services section in the Klaro content form that end users see should include absolutely nothing at this point in time. Enabling/disabling it shouldn't change the anonymous user experience one bit.
Add new comment