AEM Sites - GDPR Readiness | Adobe Experience Manager

Last update: Thu Jul 25 2024 00:00:00 GMT+0000 (Coordinated Universal Time)

Topics:
Compliance

CREATED FOR:

Admin
Developer
Leader
User

IMPORTANT

GDPR is used as an example in the sections below, but the details covered are applicable to all data protection and privacy regulations; such as GDPR, CCPA, and so on.

The European Union’s General Data Protection Regulation on data privacy rights takes effect as of May 2018.

AEM Sites is ready to help customers with their GDPR compliance obligations. This page guides customers through the procedures to handle GDPR requests in AEM Sites. It describes the location of private data stored, and how to remove them manually or with code.

For further information see the GDPR page at the Adobe Privacy Center.

NOTE

See AEM GDPR Readiness for further details.

Author Server author-server

User accounts and UGC content on the author server are covered in the Platform GDPR documentation.

Publish Server publish-server

User accounts used to authenticate visitors on the site, and UGC content on the publish server are covered in the Platform GDPR documentation.

By default AEM Sites components do not store form-data entered by visitors on the publish server. It is recommended to forward the data to a third-party system, or Adobe Campaign for further processing.

Opt-In/Opt-Out opt-in-opt-out

AEM has a cookie opt-out service that can be used for managing the opt-in/opt-out for users.

Enhanced Insights by Analytics enhanced-insights-by-analytics

AEM Sites includes an optional integration with Enhanced Insights by Analytics which uses functionality within the Adobe Analytics On-demand Service.

For further information on managing GDPR data subject requests related to Adobe Analytics see Adobe Analytics and GDPR.

Enhanced Personalization by Target enhanced-personalization-by-target

AEM Sites includes an optional integration with Enhanced Personalization by Target which uses functionality within the Adobe Target On-demand Service.

For further information on managing GDPR data subject requests related to Adobe Target see Adobe Target - Privacy and General Data Protection Regulation.

ContextHub contexthub

AEM provides an optional data layer with ContextHub. This keeps visitor-specific data in the browser, to be used for rules-based personalization.

By default, this visitor-data is not stored in AEM; AEM sends rules to the data layer to make personalization decisions in the browser.

NOTE

Prior to Adobe AEM (CQ) 5.6, the ClientContext (an earlier version of ContextHub) did send the data to the server, but did not store them.

Adobe AEM 6.4 and earlier versions are now EOL and not covered by this documentation. See Older versions of Adobe Experience Manager, CQ, and CRX documentation.

Implementing Opt-in/Opt-Out implementing-opt-in-opt-out

The site owner needs to implement an opt-out component according to the following guidelines.

These guidelines implement opt-in as the default. Thus, a website visitor must clearly agree, before any Personal Data is stored in the browser’s (client-side) persistence.

The opt-out component should be included every time the ContextHub component is included.
The terms and conditions that relate to GDPR for the website, must be displayed to the website visitor, allowing them to:
- accept
- reject
- change their previous choice

If a site visitor accepts the site’s terms and conditions, the ContextHub opt-out cookie should be removed:

code language-java
`ContextHub.Utils.Cookie.removeItem('cq-opt-out');`

If a site visitor does not accept the site’s terms and conditions, the ContextHub opt-out cookie should be set:

code language-java
`ContextHub.Utils.Cookie.setItem('cq-opt-out', 1);`

To check whether ContextHub is running in opt-out mode, the following call should be made in the browser’s console:

code language-java
`var isOptedOut = ContextHub.isOptedOut(true) === true; // if isOptedOut is true, ContextHub is running in opt-out mode`

Previewing Persistence of ContextHub previewing-persistence-of-contexthub

To preview persistance used ContextHub, a user can:

Use the browser’s console; for example:
- Chrome:
  - Open Developer Tools > Application > Storage:
    - Local Storage > (website) > ContextHubPersistence
    - Session Storage > (website) > ContextHubPersistence
    - Cookies > (website) > SessionPersistence
- Firefox:
  - Open Developer Tools > Storage:
    - Local Storage > (website) > ContextHubPersistence
    - Session Storage > (website) > ContextHubPersistence
    - Cookies > (website) > SessionPersistence
- Safari:
  - Open Preferences > Advanced > Show Develop menu in menu bar
  - Open Develop > Show JavaScript Console
    - Console > Storage > Local Storage > (website) > ContextHubPersistence
    - Console > Storage > Session Storage > (website) > ContextHubPersistence
    - Console > Storage > Cookies > (website) > ContextHubPersistence
- Internet Explorer:
  - Open Developer Tools > Console
    - localStorage.getItem(‘ContextHubPersistence’)
    - sessionStorage.getItem(‘ContextHubPersistence’)
    - document.cookie
Use the ContextHub API, in the browser’s console:
- ContextHub provides following data persistence layers:
  - ContextHub.Utils.Persistence.Modes.LOCAL (default)
  - ContextHub.Utils.Persistence.Modes.SESSION
  - ContextHub.Utils.Persistence.Modes.COOKIE
  - ContextHub.Utils.Persistence.Modes.WINDOW
  The ContextHub store defines which persistence layer is used, thus to view the current state of the persistence all layers should be checked.

For example, to view data stored in localStorage:

To preview persistance used ContextHub, a user can:

Use the browser’s console:
- Chrome - open Developer Tools > Application > Storage:
  - Local Storage > (website) > ContextHubPersistence
  - Session Storage > (website) > ContextHubPersistence
  - Cookies > (website) > SessionPersistence
- Firefox - open Developer Tools > Storage:
  - Local Storage > (website) > ContextHubPersistence
  - Session Storage > (website) > ContextHubPersistence
  - Cookies > (website) > SessionPersistence
Use the ContextHub API, in the browser’s console:
- ContextHub provides following data persistence layers:
  - ContextHub.Utils.Persistence.Modes.LOCAL (default)
  - ContextHub.Utils.Persistence.Modes.SESSION
  - ContextHub.Utils.Persistence.Modes.COOKIE
  - ContextHub.Utils.Persistence.Modes.WINDOW
  The ContextHub store defines which persistence layer is used, thus to view the current state of the persistence all layers should be checked.

For example, to view data stored in localStorage:

var storage = new ContextHub.Utils.Persistence({ mode: ContextHub.Utils.Persistence.Modes.LOCAL });
console.log(storage.getTree());

Clearing Persistence of ContextHub clearing-persistence-of-contexthub

To clear the ContextHub persistence:

To clear persistence of currently loaded stores:

code language-java

code language-java
`// to be able to fully access persistence layer, Opt-Out must be turned off ContextHub.Utils.Cookie.removeItem('cq-opt-out'); // following call asks all currently loaded stores to clear their data ContextHub.cleanAllStores(); // following call asks all currently loaded stores to set back default values (provided in their configs) ContextHub.resetAllStores();`

// to be able to fully access persistence layer, Opt-Out must be turned off
ContextHub.Utils.Cookie.removeItem('cq-opt-out');

// following call asks all currently loaded stores to clear their data
ContextHub.cleanAllStores();

// following call asks all currently loaded stores to set back default values (provided in their configs)
ContextHub.resetAllStores();

To clear a specific persistence layer; for example, sessionStorage: