German privacy acts demand fulfilling three requirements when sending mass mailings using tracking technology and I wonder how to achieve this. Because I think CiviMail's and CiviCRM's core and therefor all german users would benefit from a generic solution, I'd prefer handling this in civi itself. But walking the customization way is an option too.
Pseudonymization
The tracking information has to be detached from all data which may identify the corresponding contact.
AFAIK civi does not provide such a possibility or does it?
How could we hook into database and reports to cut the link between tracking information and the civi contact? If the link is just a civicrm_contact_id in a tracking table, could we create a pseudonymic fake contact and generally override the db field with it's id?
Ability to contradict
The possibility to opt-out from tracking is mandatory.
How to implement a new communcation setting named somethin like "Do-not-track" besides "User opt-out" which tells the system to not insert tracking links or beacons in a contact's mails?
Or – as a customization approach – should we add a custom field, edit it in the mails via a link to a custom extension's function and read it using some thing like hook_civicrm_alterMailContent?
Transparency
Users have to be informed about all tracking that is done. Easy as it is a just a matter of text. But maybe we could add a default snippet.
Any help appreciated.