ConfirmationEmailTemplate
1 month ago
ImportExport
1 month ago
RestApi
3 weeks ago
Statistics
1 month ago
BulkActionController.php
3 weeks ago
BulkActionException.php
2 months ago
BulkConfirmationEmailResender.php
3 months ago
ConfirmationEmailCustomizer.php
3 months ago
ConfirmationEmailMailer.php
3 months ago
ConfirmationEmailResolver.php
3 months ago
EngagementDataBackfiller.php
3 months ago
InactiveSubscribersController.php
3 weeks ago
LinkTokens.php
3 months ago
NewSubscriberNotificationMailer.php
3 months ago
RequiredCustomFieldValidator.php
3 months ago
SegmentsCountRecalculator.php
1 month ago
Source.php
3 months ago
SubscriberActions.php
3 months ago
SubscriberCustomFieldRepository.php
3 years ago
SubscriberIPsRepository.php
2 years ago
SubscriberLimitNotificationEvaluator.php
3 months ago
SubscriberLimitNotificationMailer.php
3 months ago
SubscriberLimitNotificationScheduler.php
3 months ago
SubscriberListingRepository.php
1 month ago
SubscriberPersonalDataEraser.php
3 months ago
SubscriberSaveController.php
3 weeks ago
SubscriberSegmentRepository.php
1 month ago
SubscriberSubscribeController.php
1 month ago
SubscriberTagRepository.php
4 years ago
SubscribersCountsController.php
1 month ago
SubscribersEmailCountsController.php
1 month ago
SubscribersRepository.php
3 weeks ago
TrackingConsentController.php
1 day ago
index.php
3 years ago
TrackingConsentController.php
111 lines
| 1 | <?php declare(strict_types = 1); |
| 2 | |
| 3 | namespace MailPoet\Subscribers; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\Entities\SubscriberEntity; |
| 9 | use MailPoet\Settings\SettingsController; |
| 10 | use MailPoet\Settings\TrackingConfig; |
| 11 | |
| 12 | /** |
| 13 | * The single answer to "may we track this subscriber?" (CNIL/Garante). |
| 14 | * |
| 15 | * Used by BOTH enforcement points — send-time pixel removal and serve-time |
| 16 | * recording suppression — so they can never drift apart. |
| 17 | */ |
| 18 | class TrackingConsentController { |
| 19 | const SETTING_SUBSCRIBER_CHOICE = 'tracking.consent.subscriber_choice'; |
| 20 | |
| 21 | /** Track everyone, don't ask. Default: no recipient-facing controls anywhere. */ |
| 22 | const CHOICE_TRACK_ALL = 'track_all'; |
| 23 | |
| 24 | /** Ask new subscribers. Everyone already on the list keeps being tracked. */ |
| 25 | const CHOICE_ASK_NEW = 'ask_new'; |
| 26 | |
| 27 | /** Ask everyone. Nobody is tracked until they allow it. */ |
| 28 | const CHOICE_ASK_ALL = 'ask_all'; |
| 29 | |
| 30 | const CHOICES = [ |
| 31 | self::CHOICE_TRACK_ALL, |
| 32 | self::CHOICE_ASK_NEW, |
| 33 | self::CHOICE_ASK_ALL, |
| 34 | ]; |
| 35 | |
| 36 | private SettingsController $settings; |
| 37 | |
| 38 | private TrackingConfig $trackingConfig; |
| 39 | |
| 40 | public function __construct( |
| 41 | SettingsController $settings, |
| 42 | TrackingConfig $trackingConfig |
| 43 | ) { |
| 44 | $this->settings = $settings; |
| 45 | $this->trackingConfig = $trackingConfig; |
| 46 | } |
| 47 | |
| 48 | public function isTrackingAllowed(SubscriberEntity $subscriber): bool { |
| 49 | // The existing global switch still wins. Settings > Advanced > basic |
| 50 | // already means "no engagement tracking at all" for the whole site. |
| 51 | if (!$this->trackingConfig->isEmailTrackingEnabled()) { |
| 52 | return false; |
| 53 | } |
| 54 | |
| 55 | switch ($subscriber->getTrackingConsent()) { |
| 56 | case SubscriberEntity::TRACKING_CONSENT_GRANTED: |
| 57 | return true; |
| 58 | case SubscriberEntity::TRACKING_CONSENT_UNKNOWN: |
| 59 | // 'unknown' = we never asked. Sites under the opt-in regime (new FR |
| 60 | // and IT contacts) set this to false; everyone else keeps today's |
| 61 | // behaviour. |
| 62 | return $this->shouldTrackUnknownConsent(); |
| 63 | case SubscriberEntity::TRACKING_CONSENT_DENIED: |
| 64 | default: |
| 65 | // Denied — and, defensively, any unrecognised value — is never tracked. |
| 66 | // Storage is constrained to the three states (Assert\Choice on the |
| 67 | // entity), so 'default' should be unreachable; deny rather than fall |
| 68 | // back to the permissive unknown path for a compliance-critical flag. |
| 69 | return false; |
| 70 | } |
| 71 | } |
| 72 | |
| 73 | /** |
| 74 | * The site's "Subscriber choice" state. Anything unrecognised falls back to |
| 75 | * the default rather than to a stricter or looser state, so a corrupt value |
| 76 | * cannot silently change what recipients are shown. |
| 77 | */ |
| 78 | public function getSubscriberChoice(): string { |
| 79 | $choice = (string)$this->settings->get(self::SETTING_SUBSCRIBER_CHOICE, self::CHOICE_TRACK_ALL); |
| 80 | return in_array($choice, self::CHOICES, true) ? $choice : self::CHOICE_TRACK_ALL; |
| 81 | } |
| 82 | |
| 83 | /** |
| 84 | * Whether recipient-facing consent controls may be shown at all: the |
| 85 | * manage-subscription checkbox, and the auto-added form/checkout checkbox and |
| 86 | * footer opt-out link once those exist. |
| 87 | * |
| 88 | * Internal handling is deliberately NOT gated on this. Subscribers who are |
| 89 | * already denied stay untracked, and import/export and stats keep honouring |
| 90 | * consent, whatever the site has chosen here. |
| 91 | */ |
| 92 | public function areSubscriberControlsVisible(): bool { |
| 93 | return $this->getSubscriberChoice() !== self::CHOICE_TRACK_ALL; |
| 94 | } |
| 95 | |
| 96 | /** |
| 97 | * Whether subscribers who have never been asked ('unknown' consent) may be |
| 98 | * treated as trackable. True unless the site asks everyone, so existing lists |
| 99 | * keep today's behaviour until the site deliberately opts into strict consent. |
| 100 | * |
| 101 | * Background jobs that infer intent from missing engagement (inactive sweep, |
| 102 | * resend to non-openers, re-engagement) use this so that, when asking |
| 103 | * everyone, untracked 'unknown' subscribers are excluded the same way |
| 104 | * 'denied' ones are — otherwise their frozen engagement would wrongly mark |
| 105 | * them disengaged. |
| 106 | */ |
| 107 | public function shouldTrackUnknownConsent(): bool { |
| 108 | return $this->getSubscriberChoice() !== self::CHOICE_ASK_ALL; |
| 109 | } |
| 110 | } |
| 111 |