Skip to content

Anonymous usage data

Drupal CMS is free and open source. We want to make it as useful as possible for our users.

To help guide us, Drupal CMS can, with your consent, send a small amount of usage data to the Drupal CMS team. We use Amplitude to store this data in the European Union and analyze it. Amplitude is fully compliant with GDPR.

This page explains what we collect, and when.

The short version

  • We never collect any identifying information about you.
  • We never collect your site's content, your users' data, or your visitors' data.
  • Data is only transferred between the web server and Amplitude.
  • The browser is never involved: no cookies, local storage, or other client-side information is collected.
  • Custom modules and recipes are recorded as **custom**.
  • Everything we collect is listed on this page.
  • You can turn this off at any time.

How to opt out

When you install Drupal CMS, or deploy it to a new environment, you will see a pop-up message asking whether you consent to sending anonymous data.

You can change your mind at any time by going to the 'Basic site settings' page under Configuration > System > Site information (/admin/config/system/site-information).

You can also opt out without touching the browser:

  • Before installing Drupal, set the DRUPAL_CMS_TELEMETRY environment variable to 0.
  • On an existing site, run drush state:set drupal_cms_telemetry 0.

Your choice is stored in the site's database, so it only applies to that environment. A fresh environment, (e.g., a new local copy or a preview site), will ask again.

What we collect

Event What we send Notes
You install Drupal CMS Which site template was used
You install a module Name of the module and whether it was installed by Project Browser and/or a recipe We only record modules you add after installing Drupal.
You uninstall a module Name of the module
You apply a recipe Name of the recipe and whether Project Browser applied it
Every 30 days Ping Lets us know your site is still active. If this is the first ping from your site, includes an opt-in flag and the name field from the project's composer.json (if it is drupal/cms or drupal/cms_cpanel).
You visit certain admin pages Which page you visited Only applies to the module updates form, the SEO and language checklists, the list of webforms, and Project Browser's lists of recommended add-ons and modules.
You create a code component No additional information
Someone logs in An anonymous user ID The user ID is hashed (and salted) in a way that can't be reversed. This lets us count how many different people log in, without knowing anything about who they are.

Every event also includes:

  • A randomly generated identifier. It's unique to your site, but not connected to you, your server, or anything else in the real world. This identifier lets us tell the difference between "one site that installed ten modules" and "ten sites that each installed one module."
  • A flag that says whether your site appears to be a production site, so we can filter out test data and local environments.

How we identify custom code

We don't want to collect the names of custom modules or recipes, since those could reveal something about your site or business.

A module is considered custom if its info file doesn't have the project key which is normally added by drupal.org.

Custom recipes can set a flag in recipe.yml to identify themselves:

# This will mark the recipe as custom.
type: Custom

# Another way to do it, if your recipe needs to have a specific type.
extra:
  drupal_cms:
    no_telemetry: true