View Issue Details

This issue affects 1 person(s).
 14
IDProjectCategoryView StatusLast Update
19958Bug reportsUsability/user experiencepublic2026-04-27 15:34
Reportertassoman Assigned ToDenisChenu  
PrioritynoneSeverityminor 
Status closedResolutionfixed 
Product Version6.6.x 
Summary19958: Public registration is not compliant to GDPR
Description

Hello there, when a survey is set with "public registration" = true, a web form asking for personal data is exposed at first, before privacy page is seen.
Although "sending an email" is itself a personal data usage purpose itself. E-Mail address is considered itself personal data by GDPR.

Themes must display privacy informative message and agreement before registration page, not behind, it's too late.

Steps To Reproduce

Steps to reproduce

Create a new survey
Put it in closed access list
Enable privacy text display
Enable public registration
Enable survey
Open survey in a private window
See: registration form

Expected result

Open survey in a private window
See: privacy policy text agreement
Submit: agreement
See: public registration form
Submit: form

Actual result

Registration form is submitted without any privacy agreement display.

Tagsdata protection, email, GDPR, participants, privacy, public registration, theme, ux
Bug heat14
Complete LimeSurvey version number (& build)6.10.x
I will donate to the project if issue is resolvedNo
BrowserAny
Database type & versionAny
Server OS (if known)Any
Webserver software & version (if known)Any
PHP Version8.2

Relationships

related to 19972 new Privacy agreement are done without server control and do not have date or anything else 

Users monitoring this issue

DenisChenu, tassoman

Activities

DenisChenu

DenisChenu

2025-02-12 08:16

developer   ~82006

Last edited: 2025-02-12 08:18

My opinion : Must show privacy policy in registering process (option to no to have semver API compatible system)

PS : i think we can have

Open survey in a private window
See: privacy policy text agreement and public registration form
can not submit form without policy agreement checked (javascript, user control) , and if policy agreement is not checked (PHP control, server control) : don't save token

tassoman

tassoman

2025-02-12 16:29

reporter   ~82014

Hello @DenisChenu thanks for your comment. In italy, public sector is "automagically" allowed to deal with personal data, just by providing informative context before data handling.
In public sector scenario, obtaining explicit consent is not mandatory when data is not published or disclosed to 3rd parties and other situations.
I agree with you that a server side validation is safer. Simply, maybe can be configured not a mandatory check by advanced customization?
I guess Italian Public Sector have same allowance of other EU countries so this feature could be useful to any public sector organization inside EU, using LS.

tassoman

tassoman

2025-02-17 14:22

reporter   ~82038

I'm working on a custom theme based on Vanilla core theme. I was able to display privacy logic by adding an inclusion command inside ./views/subviews/registration/register_form.twig

{% include('./subviews/privacy/privacy.twig') %}

It's only a display, no validation logic is included.

DenisChenu

DenisChenu

2025-02-19 14:57

developer   ~82085

It's only a display, no validation logic is included.

It's the case too with Survey : same issue : no server validation.

DenisChenu

DenisChenu

2025-02-19 14:57

developer   ~82086

It's the case too with Survey : same issue : no server validation.

I report this issue

DenisChenu

DenisChenu

2025-02-19 14:58

developer   ~82087

@tibor.pacalat : adding this line fix the issue, but need an option ? Theme option at on or off by default ?

tibor.pacalat

tibor.pacalat

2025-02-20 16:24

administrator   ~82102

I would put an option and off by default since we are not only available in EU, so it doesn't make sense to adhere to GDPR outside of EU.

DenisChenu

DenisChenu

2025-02-20 17:02

developer   ~82105

OK ! Great :)

DenisChenu

DenisChenu

2025-05-17 19:56

developer   ~82699

https://github.com/LimeSurvey/LimeSurvey/pull/4285

DenisChenu

DenisChenu

2025-11-13 12:11

developer   ~83770

What is your decision here ? Theme settings or Survey setting ?

c_schmitz

c_schmitz

2025-11-13 17:51

administrator   ~83781

Please put it into Survey settings under Privacy policy.

DenisChenu

DenisChenu

2025-11-13 17:53

developer   ~83782

OK :)

DenisChenu

DenisChenu

2025-11-13 17:54

developer   ~83783

(and need a solution for complete updated theme)

DenisChenu

DenisChenu

2026-04-14 10:30

developer   ~84635

I think we need multiple options

  1. Show on survey start
  2. Show on register
  3. Show on token form

Each can be checked separately.

OK ?

tibor.pacalat

tibor.pacalat

2026-04-14 12:17

administrator   ~84650

@c_schmitz what do you think about Denis' proposal?

DenisChenu

DenisChenu

2026-04-14 12:19

developer   ~84651

I just added 2 dropdowns here :)

DenisChenu

DenisChenu

2026-04-14 18:54

developer   ~84653

New version on https://github.com/LimeSurvey/LimeSurvey/pull/4880

Wait for CI and coderabbit

DenisChenu

DenisChenu

2026-04-16 17:04

developer   ~84666

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=39549

DenisChenu

DenisChenu

2026-04-16 17:30

developer   ~84667

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=39550

tassoman

tassoman

2026-04-16 18:11

reporter   ~84669

Thank you team for your effort. Was very appreciated. Will be included into next LS 6.16.17 ?

DenisChenu

DenisChenu

2026-04-16 18:35

developer   ~84670

https://github.com/LimeSurvey/LimeSurvey/pull/4887

tibor.pacalat

tibor.pacalat

2026-04-21 15:14

administrator   ~84710

I have tested this on this branch and noticed a few things:

  1. The new options on survey level always go back to inherited value (watch the screencast)
  2. Why are there 2 sets of same options (one at "Privacy policy" view and one at "Participant settings")
  3. I don't understand the wording under these new fields "Only if show survey policy is activated.".
    Should this possibly say "Only if privacy policy is shown."? - since you can also hide privacy policy from "Theme options".
  4. On vanilla, bootswatch and fruity when I open the policy text (Collapsible text) the Continue button doesn't have any distance from the dialog (look at the screenshot)
tibor.pacalat

tibor.pacalat

2026-04-21 15:14

administrator   ~84711

Video for the message above:

DenisChenu

DenisChenu

2026-04-21 15:32

developer   ~84712

The new options on survey level always go back to inherited value (watch the screencast)

I check, this , strange i think i have issue but fixed it.

Why are there 2 sets of same options (one at "Privacy policy" view and one at "Participant settings")

because it's related to both :) Must have same value.
Else : Privacy policy are not in group/global options

I don't understand the wording under these new fields "Only if show survey policy is activated.".

maybe https://github.com/LimeSurvey/LimeSurvey/pull/4887#pullrequestreview-4128978258 Only applies when 'Show privacy policy text with mandatory checkbox' is set to Inline text or Collapsible text. ?

On vanilla, bootswatch and fruity when I open the policy text (Collapsible text) the Continue button doesn't have any distance from the dialog (look at the screenshot)

Not the case with current button ?

DenisChenu

DenisChenu

2026-04-21 15:49

developer   ~84714

Not the case with current button ?

Navigator have margin, not included in regsiter oart. I think i add some margin-button for the privacy part

DenisChenu

DenisChenu

2026-04-21 16:05

developer   ~84715

since you can also hide privacy policy from "Theme options".

What ? I didn't check it.

DenisChenu

DenisChenu

2026-04-21 16:16

developer   ~84716

since you can also hide privacy policy from "Theme options".

It's not privacy info; it's anonymous block.
https://github.com/LimeSurvey/LimeSurvey/blob/e1c7911c31453b93e219b9405b89b69936b51c90/themes/survey/fruity_twentythree/views/subviews/privacy/privacy.twig#L23-L41

New issue to report here, sentence is bad.

DenisChenu

DenisChenu

2026-04-21 16:18

developer   ~84718

I have tested this on this branch and noticed a few things:

All done, discussion open about the help sentence :)

LimeBot

LimeBot

2026-04-21 17:31

administrator   ~84722

Fixed in Release 6.17.0+260421

DenisChenu

DenisChenu

2026-04-22 09:25

developer   ~84731

Still open :)

Limebot is a dumb bot ;)

DenisChenu

DenisChenu

2026-04-22 15:58

developer   ~84732

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=39599

LimeBot

LimeBot

2026-04-27 15:34

administrator   ~84746

Fixed in Release 6.17.1+260427

Related Changesets

LimeSurvey: master fc54f28c

2026-04-14 18:53

DenisChenu


Details Diff
Fixed issue 19958: Public registration is not compliant to GDPR
Dev: Add 2 new survey settings with inherit showregisterpolicy and showtokenpolicy
Dev: need survey policy activated (use it for view)
Dev: use it in 2 parent template
Dev: fix ButtonGroupWidget to allow aria-descridedby
Dev: fix ButtonGroupWidget to allow optionnal ariaLabel
Affected Issues
19958
mod - application/config/version.php Diff File
mod - application/controllers/RegisterController.php Diff File
mod - application/extensions/ButtonGroupWidget/views/buttongroup.php Diff File
mod - application/helpers/SurveyRuntimeHelper.php Diff File
add - application/helpers/update/updates/Update_649.php Diff File
mod - application/models/Survey.php Diff File
mod - application/models/SurveysGroupsettings.php Diff File
mod - application/models/services/SurveyAggregateService/GeneralSettings.php Diff File
mod - application/views/admin/survey/subview/accordion/_tokens_panel.php Diff File
mod - application/views/admin/survey/subview/tab_edit_view_datasecurity.php Diff File
mod - installer/create-database.php Diff File
mod - themes/survey/fruity_twentythree/views/subviews/logincomponents/token.twig Diff File
add - themes/survey/fruity_twentythree/views/subviews/logincomponents/token_privacy.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/privacy/privacy_modal.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/privacy/privacy_text.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/registration/register_form.twig Diff File
add - themes/survey/fruity_twentythree/views/subviews/registration/register_privacy.twig Diff File
mod - themes/survey/vanilla/views/subviews/logincomponents/token.twig Diff File
add - themes/survey/vanilla/views/subviews/logincomponents/token_privacy.twig Diff File
mod - themes/survey/vanilla/views/subviews/privacy/privacy_modal.twig Diff File
mod - themes/survey/vanilla/views/subviews/privacy/privacy_text.twig Diff File
mod - themes/survey/vanilla/views/subviews/registration/register_form.twig Diff File
add - themes/survey/vanilla/views/subviews/registration/register_privacy.twig Diff File

LimeSurvey: master 787cd523

2026-04-16 17:23

DenisChenu

Committer: GitHub


Details Diff
Revert "Fixed issue 19958: Public registration is not compliant to GDPR" (#4886)

Dev: sorry
Affected Issues
19958
mod - application/config/version.php Diff File
mod - application/controllers/RegisterController.php Diff File
mod - application/core/LSETwigViewRenderer.php Diff File
mod - application/extensions/ButtonGroupWidget/views/buttongroup.php Diff File
mod - application/helpers/SurveyRuntimeHelper.php Diff File
mod - application/helpers/update/updatedb_helper.php Diff File
rm - application/helpers/update/updates/Update_649.php Diff
mod - application/models/Survey.php Diff File
mod - application/models/SurveysGroupsettings.php Diff File
mod - application/models/services/SurveyAggregateService/GeneralSettings.php Diff File
mod - application/views/admin/survey/subview/accordion/_tokens_panel.php Diff File
mod - application/views/admin/survey/subview/tab_edit_view_datasecurity.php Diff File
mod - installer/create-database.php Diff File
mod - themes/survey/fruity_twentythree/views/subviews/logincomponents/token.twig Diff File
rm - themes/survey/fruity_twentythree/views/subviews/logincomponents/token_privacy.twig Diff
mod - themes/survey/fruity_twentythree/views/subviews/privacy/privacy_modal.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/privacy/privacy_text.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/registration/register_form.twig Diff File
rm - themes/survey/fruity_twentythree/views/subviews/registration/register_privacy.twig Diff
mod - themes/survey/vanilla/views/subviews/logincomponents/token.twig Diff File
rm - themes/survey/vanilla/views/subviews/logincomponents/token_privacy.twig Diff
mod - themes/survey/vanilla/views/subviews/privacy/privacy_modal.twig Diff File
mod - themes/survey/vanilla/views/subviews/privacy/privacy_text.twig Diff File
mod - themes/survey/vanilla/views/subviews/registration/register_form.twig Diff File
rm - themes/survey/vanilla/views/subviews/registration/register_privacy.twig Diff

LimeSurvey: master 0f6235e3

2026-04-22 15:58

DenisChenu

Committer: GitHub


Details Diff
Fixed issue 19958: Public registration is not compliant to GDPR (04887) Affected Issues
19958
mod - application/config/version.php Diff File
mod - application/core/LSETwigViewRenderer.php Diff File
mod - application/extensions/ButtonGroupWidget/views/buttongroup.php Diff File
mod - application/helpers/SurveyRuntimeHelper.php Diff File
mod - application/helpers/update/updatedb_helper.php Diff File
add - application/helpers/update/updates/Update_649.php Diff File
mod - application/models/Survey.php Diff File
mod - application/models/SurveysGroupsettings.php Diff File
mod - application/models/services/SurveyAggregateService/GeneralSettings.php Diff File
mod - application/views/admin/survey/subview/accordion/_tokens_panel.php Diff File
mod - application/views/admin/survey/subview/tab_edit_view_datasecurity.php Diff File
mod - installer/create-database.php Diff File
mod - themes/survey/fruity_twentythree/views/subviews/logincomponents/token.twig Diff File
add - themes/survey/fruity_twentythree/views/subviews/logincomponents/token_privacy.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/privacy/privacy_modal.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/privacy/privacy_text.twig Diff File
mod - themes/survey/fruity_twentythree/views/subviews/registration/register_form.twig Diff File
add - themes/survey/fruity_twentythree/views/subviews/registration/register_privacy.twig Diff File
mod - themes/survey/vanilla/views/subviews/logincomponents/token.twig Diff File
add - themes/survey/vanilla/views/subviews/logincomponents/token_privacy.twig Diff File
mod - themes/survey/vanilla/views/subviews/privacy/privacy.twig Diff File
mod - themes/survey/vanilla/views/subviews/privacy/privacy_modal.twig Diff File
mod - themes/survey/vanilla/views/subviews/privacy/privacy_text.twig Diff File
mod - themes/survey/vanilla/views/subviews/registration/register_form.twig Diff File
add - themes/survey/vanilla/views/subviews/registration/register_privacy.twig Diff File

Issue History

Date Modified Username Field Change
2025-02-11 18:23 tassoman New Issue
2025-02-11 18:25 tassoman Tag Attached: GDPR
2025-02-11 18:25 tassoman Tag Attached: data protection
2025-02-11 18:26 tassoman Tag Attached: email
2025-02-11 18:26 tassoman Tag Attached: participants
2025-02-11 18:26 tassoman Tag Attached: privacy
2025-02-11 18:27 tassoman Tag Attached: theme
2025-02-11 18:27 tassoman Tag Attached: ux
2025-02-11 18:28 tassoman Tag Attached: public registration
2025-02-11 18:28 tassoman Issue Monitored: tassoman
2025-02-11 18:28 tassoman Bug heat 0 => 2
2025-02-12 08:16 DenisChenu Note Added: 82006
2025-02-12 08:16 DenisChenu Bug heat 2 => 4
2025-02-12 08:16 DenisChenu Issue Monitored: DenisChenu
2025-02-12 08:16 DenisChenu Bug heat 4 => 6
2025-02-12 08:18 DenisChenu Note Edited: 82006
2025-02-12 11:38 tibor.pacalat Assigned To => DenisChenu
2025-02-12 11:38 tibor.pacalat Status new => assigned
2025-02-12 16:29 tassoman Note Added: 82014
2025-02-12 16:29 tassoman Bug heat 6 => 8
2025-02-17 14:22 tassoman Note Added: 82038
2025-02-19 14:57 DenisChenu Note Added: 82085
2025-02-19 14:57 DenisChenu Note Added: 82086
2025-02-19 14:58 DenisChenu Status assigned => feedback
2025-02-19 14:58 DenisChenu Note Added: 82087
2025-02-19 15:22 DenisChenu Relationship added related to 19972
2025-02-20 16:24 tibor.pacalat Note Added: 82102
2025-02-20 16:24 tibor.pacalat Bug heat 8 => 10
2025-02-20 17:02 DenisChenu Note Added: 82105
2025-02-21 16:01 DenisChenu Status feedback => assigned
2025-05-17 19:56 DenisChenu Note Added: 82699
2025-05-17 19:57 DenisChenu Assigned To DenisChenu => tibor.pacalat
2025-05-17 19:57 DenisChenu Status assigned => ready for code review
2025-11-13 12:11 DenisChenu Assigned To tibor.pacalat => c_schmitz
2025-11-13 12:11 DenisChenu Status ready for code review => in code review
2025-11-13 12:11 DenisChenu Note Added: 83770
2025-11-13 17:51 c_schmitz Note Added: 83781
2025-11-13 17:51 c_schmitz Bug heat 10 => 12
2025-11-13 17:53 DenisChenu Note Added: 83782
2025-11-13 17:54 DenisChenu Note Added: 83783
2025-11-14 15:02 c_schmitz Assigned To c_schmitz => DenisChenu
2025-11-14 15:03 c_schmitz Status in code review => assigned
2026-04-14 10:30 DenisChenu Note Added: 84635
2026-04-14 12:17 tibor.pacalat Note Added: 84650
2026-04-14 12:19 DenisChenu Note Added: 84651
2026-04-14 18:54 DenisChenu Note Added: 84653
2026-04-15 09:32 DenisChenu Assigned To DenisChenu => gabrieljenik
2026-04-15 09:32 DenisChenu Status assigned => ready for code review
2026-04-16 17:04 DenisChenu Changeset attached => LimeSurvey master fc54f28c
2026-04-16 17:04 DenisChenu Note Added: 84666
2026-04-16 17:04 DenisChenu Assigned To gabrieljenik => DenisChenu
2026-04-16 17:04 DenisChenu Status ready for code review => resolved
2026-04-16 17:04 DenisChenu Resolution open => fixed
2026-04-16 17:30 DenisChenu Changeset attached => LimeSurvey master 787cd523
2026-04-16 17:30 DenisChenu Note Added: 84667
2026-04-16 18:11 tassoman Note Added: 84669
2026-04-16 18:35 DenisChenu Status resolved => ready for testing
2026-04-16 18:35 DenisChenu Note Added: 84670
2026-04-16 19:25 DenisChenu Assigned To DenisChenu => tibor.pacalat
2026-04-21 15:14 tibor.pacalat Note Added: 84710
2026-04-21 15:14 tibor.pacalat File Added: Screenshot 2026-04-21 at 15.03.12.png
2026-04-21 15:14 tibor.pacalat Note Added: 84711
2026-04-21 15:14 tibor.pacalat File Added: Screen-2026-04-21-124049.mp4
2026-04-21 15:32 DenisChenu Note Added: 84712
2026-04-21 15:49 DenisChenu Note Added: 84714
2026-04-21 16:05 DenisChenu Note Added: 84715
2026-04-21 16:16 DenisChenu Note Added: 84716
2026-04-21 16:16 DenisChenu Assigned To tibor.pacalat => DenisChenu
2026-04-21 16:18 DenisChenu Note Added: 84718
2026-04-21 16:18 DenisChenu Assigned To DenisChenu => tibor.pacalat
2026-04-21 16:18 DenisChenu Status ready for testing => in testing
2026-04-21 17:31 LimeBot Note Added: 84722
2026-04-21 17:31 LimeBot Status in testing => closed
2026-04-21 17:31 LimeBot Bug heat 12 => 14
2026-04-22 09:25 DenisChenu Status closed => in testing
2026-04-22 09:25 DenisChenu Note Added: 84731
2026-04-22 15:58 DenisChenu Changeset attached => LimeSurvey master 0f6235e3
2026-04-22 15:58 DenisChenu Note Added: 84732
2026-04-22 15:58 DenisChenu Assigned To tibor.pacalat => DenisChenu
2026-04-22 15:58 DenisChenu Status in testing => resolved
2026-04-27 15:34 LimeBot Note Added: 84746
2026-04-27 15:34 LimeBot Status resolved => closed