CONNECT issue with fb when using pre-fill method

Good evening,

I had the system installed with single sign-on and this worked fine.

Now in the view of GDPR, i wanted the terms and conditions to be approved during registration with facebook, so the only way (as I found in this forum) is to use the pre-filled system.

Now I have several problems

• The pre-filled registration shows the facebook ID-field as a field to "unlink my fb profile" (see screenshot 1) - irrelevant and confusing, as this is a new registration (with facebook)
  The Facebook ID is not stored into the appropriate CB field (and I have mapped it manually - see screenshot 2 & 3)
  The system sends out a double opt-in mail to users registering via pre-filled facebook although the parameters are set to override the normal CB flow
• The account never can log in with facebook login (I guess this is because the ID is missing)
• The system loops between every attempt to login to the pre-filled registration page to complete the registration

Now If I put the CONNECT system to Single sign-on, everything works fine. The facebook ID gets filled into the corresponding field and the login works. But this is not GDPR compliant, as the user has not accepted terms and conditions.

There are no special extra plugins in my environment, only CB Privacy and CB AntiSpam

Using CB 2.1.3 / CB CONNECT 7.1.0

Thanks for you support!

Miguel

But this is not GDPR compliant, as the user has not accepted terms and conditions.

They're explicitly authorizing the application to do this. At Facebook within your App under Settings > Basic supply your privacy policy and terms and condition URLs and that's all you have to do.

The pre-filled registration shows the facebook ID-field as a field to "unlink my fb profile" (see screenshot 1) - irrelevant and confusing, as this is a new registration (with facebook)

Looks like a bug with one of the IF checks. It should just state what provider account is about to be linked. Checkbox usage is meant for profile edit. Fixing for next build.

The Facebook ID is not stored into the appropriate CB field (and I have mapped it manually - see screenshot 2 & 3)

It's possible this is due to the above bug, which have fixed and tested to be working fine. Mapping the id fields also doesn't do anything as it won't map those.

The system sends out a double opt-in mail to users registering via pre-filled facebook although the parameters are set to override the normal CB flow

You can't override Confirmation or Approval when using Pre-filled mode.

But this is not GDPR compliant, as the user has not accepted terms and conditions.

It actually is. GDPR is about giving clear consent. Ensure your Facebook application is setup to make that clear. It provides inputs to link to your privacy policy and terms and conditions URLs. Be sure to clearly state what your Facebook application collects and what for. GDPR is not a design limitation. It is all about being clear what you're doing with a users data and collecting consent.

Hi Krileon,

Thanks for your quick reply.Thanks also for the fix.

The T&C links were all in place on Facebook, but there the checkbox to accept my site's T&C is nowhere shown, so my lawyer tells me it is only implicidly accepted, which is against GDPR. There should be an extra checkbox. But that is on the facebook side. Nothing you can do about it.

On top of that the T&C field in CB is not 'checked' as 'accepted' after registration with facebook, so according to my local system the user has not accepted the T&C. I'll try to fix that on the registration page with some legal blah blah. But maybe not a bad idea to foresee some solution for this on the CB side in the long run.

Have a great evening!

Miguel

Have added a feature ticket to check if there's any terms and condition fields that have not been accepted after single sign on and if there are to show them before finalizing the synchronization. Basically same as how the email address field works when a provider doesn't give email address. If they don't accept then nothing will synchronize and register. This should workaround providers lacking support for GDPR in their application authorization pages.

forge.joomlapolis.com/issues/7152