Show Session-based User Consent Banner for Externally Embedded Media

1 Initial Problem

The General Data Protection Regulation (GDPR) requires that organizations obtain explicit consent from users before transferring their personal data to external providers. This includes embedding external content such as YouTube or Vimeo videos, map objects like Google Maps or OpenStreetMap, or content from organization's own media platforms (images, audio, video). Users must be informed about what personal data will be transferred, to whom it will be transferred, and for what purpose, and they must have the opportunity to consent or decline.

Failure to obtain consent for such transfers of personal data could indeed violate GDPR requirements, as users' data is being processed without their knowledge or explicit consent.

2 Conceptual Summary

User stories with increasing maturity levels (building on each other).

Maturity Level One (Minimal Viable Product):

A-1 As an administrator, I can globally store and activate a user consent banner for all external content in the configuration of the page editor (1) ,the media object (2) or maps (3).

B-1 As a user, I consent to the use of external sources in the current browser session.

Maturity Level Two:

A-2 As an administrator, I can manage external sources for embedding third-party content in a white list, in which I can specify external sources, URLs and store/activate a user consent text for the respective source.

Maturity Level Three:

B-2 As a user, I can manage and consent (allowance and revocation) to the use of external sources in my personal profile.

Maturity Level Four:

A-3 As an administrator,  I can manage external sources for embedding third-party content for all native ILIAS objects via a consent service, that can also be implemented by modules and custom plugins.

2.1 Need for user stories

• before external media are displayed (and data like IP adresses are transferred) a banner should be shown in place if the media object which prompts the user to the implications of doing so
• the banner offers an interaction " Show external content" which will load the external media without doing a server round trip
• the decision should be saved for the current user session (i.e. it should be stored in the session cookie)
• the text for the user consent banner can be changed by editing the respective language variable
• the banner text will be generic and does not differentiate which external platform is embedded 

Additional need for user story A-2 and B-2:

• the banner text can be defined for each external embedded source

3 User Interface Modifications

3.1 List of Affected Views

• ILIAS Page Editor Page
• Global Administration > Repository and Objects > Media Objects

3.2 User Interface Details

Activation in the Global Administration of "Media Objects"

Mockup 1: suggestion for enabling user consent banner

Mockup 2: suggestion for enabling user consent banner

Mockup 1: suggestion for displaying YouTube content

Mockup 1: The mockup image is meant as a placeholder, the text can be customised in the general configuration of the consent banner.

{ For each of these views please list all user interface elements that should be modified, added or removed. Please provide the textual appearance of the UI elements and their interactive behaviour. }

Interactive behaviour:

Consent banner only blocks the view of the media object, and not the entire screen. This banner may contain the following information:

1. The title of the service/site from which the content is embedded in ILIAS (e.g. YouTube);
2. Short explanation, e.g. "To display the content of this page, we use a service that may process personal data. We value your privacy, so we ask for your permission to use the service." - The text can be customised depending on the service;
3. If applicable, also the link to the privacy policy or general terms and conditions of the service/site;
4. The  "Accept" Button or the "I agree" checkbox in combination with the "Show content" (possible: "Play video" or "Show map"  if YouTube videos or Maps are embedded) button. After the user clicks on "Accept" / "Show content", the content will be displayed.

3.3 New User Interface Concepts

{ If the proposal introduces any completely new user interface elements, you might consult UI Kitchen Sink in order to find the necessary information to propose new UI-Concepts. Note that any maintainer might gladly assist you with this. }

3.4 Accessibility Implications

{ If the proposal contains potential accessibility issues that are neither covered by existing UI components nor clarified by guidelines, please list them here. For every potential issue please either propose a solution or write down a short risk assessment about potential fallout if there would be no solution for the issue. }

4 Technical Information

{ The maintainer has to provide necessary technical information, e.g. dependencies on other ILIAS components, necessary modifications in general services/architecture, potential security or performance issues. }

5 Privacy

For user stories A-1, A-2, and B-1, the data will be stored in the session cookie. For user story B-2, the data must be stored in the user's profile rather than the session cookie.

{ Please list all personal data that will need to be stored or processed to implement this feature. For each date give a short explanation why it is necessary to use that date. }

6 Security

This FR aims to raise awareness about the undesired inclusion of third-party content or transfer of personal data to third parties.

{ Does the feature include any special security relevant changes, e.g. the introducion of new endpoints or other new possible attack vectors. If yes, please explain these implications and include a commitment to deliver a written security concept as part of the feature development. This concept will need an additional approvement by the JourFixe. }

7 Contact

• Author of the Request: Koch, Tobias [kochtob]
• Maintainer: {Please add your name before applying for an initial workshop or a Jour Fixe meeting.}
• Implementation of the feature is done by: {The maintainer must add the name of the implementing developer.}

8 Funding

If you are interested in funding this feature, please add your name and institution to this list.

• …

9 Discussion

2024-02-16 Mela, Alix [ILIAS_LM]
Please write the byline positively to avoid misunderstandings. (Today the screenshot says: "If deactivated users need to consent to loading the externally embedded media to prevent unwanted transfer of user data. This will be stored in the user session.")

2024-02-23 Seidel, Elyesa [seidel]
How about "If activated, users' consent is required for loading externally embedded media to prevent unwanted transfer of user data. This consent will be stored in the user session."?

10 Implementation

{ The maintainer has to give a description of the final implementation and add screenshots if possible. }

Test Cases

Test cases completed at {date} by {user}

• {Test case number linked to Testrail} : {test case title}

Privacy

Information in privacy.md of component: updated on {date} by {user} | no change required

Approval

Approved at {date} by {user}.