Amplitude Cookies lifetime are not GDPR compliant

[Vadorequest]

Amplitude default cookie configuration doesn't respect GDPR, as it states cookies tracking users should live no longer than 13 months (according to French CNIL) and 12 months according to GDPR itself (https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%20have%20an,you%20do%20not%20take%20action.), while those created by the JS SDK live for 10 years by default.

I strongly suggest you change the default lifetime of cookies created by Amplitude SDKs to match this requirement (12 months). Here is a screenshot of cookies created by Amplitude JS SDK at https://nrn-v2-mst-aptd-at-lcz-sty-c1-amplitude-g.vercel.app/fr

This single violation of the GDPR makes Amplitude non GDPR compliant (according to my attorney).

Also, I haven't found any way of changing that behavior through configuration of the JS SDK at https://developers.amplitude.com/docs/javascript-sdk-reference, and I suggest such option gets added for people who'd have even stricter rules regarding cookies (or to gracefully handle any future change in the GDPR itself, regarding this particular matter).

[Vadorequest]

@kelvin-lu Thanks for prioritizing this. Any idea when it might be done? Rough ETA? Q3/Q4 2020?

Also, could you elaborate on what is intended to be done here? Change the default value? Add an option to customise the default value? (more flexible, IMHO)

[kelvin-lu]

@Vadorequest we'll likely start with a fix this week /next week to change the default value to be gdpr compliant, and then look into optioning later on!

[kelvin-lu]

@Vadorequest I started looking over this (briefly) and I noticed that there's a cookieExpiration option that can be passed in to configure the # of days the cookie lives for - have you found this to work?

We're still planning on addressing the default value but wanted to bring this as a possible workaround for the time being!

[Vadorequest]

Thanks for the hint, I hadn't noticed this option, is it documented? It could indeed be a workaround. I'll have a look at it later on!

…

On Fri, Sep 11, 2020, 19:32 Kelvin Lu ***@***.***> wrote: @Vadorequest <https://github.com/Vadorequest> I started looking over this (briefly) and I noticed that there's a cookieExpiration option that can be passed in to configure the # of days the cookie lives for - have you found this to work? We're still planning on addressing the default value but wanted to bring this as a possible workaround for the time being! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#275 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA5BRYW5YDTMT3HLYONPASTSFJNKVANCNFSM4PCVMWIQ> .

[kelvin-lu]

Only very lightly - and not with good documenting practices; apologies! We're in the process of updating our documentation to be more helpful and we'll keep this in mind! :)

[Vadorequest]

I can confirm cookieExpiration: 365 does work! 😄

I believe this solves the original issue, since it allows us to control how much time a cookie can live, and make ourselves compliant with GDPR-related stuff.

[kelvin-lu]

This will be addressed in the next deployment - setting the cookie lifetime to 365 by default.