Repository: dotkom/onlineweb4

Issue:
The job mailing list should be set to False as default for Onlinemembers
As the job mailing list is not directly connected to Online, and easily can be considered spam, it should not be set to True by default for new (or old) users which matches the criteria is_member.

This issue includes changing this line to false:
https://github.com/dotKom/onlineweb4/blob/028bc046998545114bd2e96b3d79ef5e13cb1036/apps/authentication/views.py#L144

And running a set to False on all existing members in the Django shell.

An alternative solution can be to offer the opt IN field while the user is registering as this may make the option more visible.

The job mailing list should be set to False as default for Onlinemembers
As the job mailing list is not directly connected to Online, and easily can be considered spam, it should not be set to True by default for new (or old) users which matches the criteria is_member.

This issue includes changing this line to false:
https://github.com/dotKom/onlineweb4/blob/028bc046998545114bd2e96b3d79ef5e13cb1036/apps/authentication/views.py#L144

And running a set to False on all existing members in the Django shell.

An alternative solution can be to offer the opt IN field while the user is registering as this may make the option more visible.



Discussion:
I don't think that it is up to us to decide how that should work, though?

If that's the case I think we should notify signed up users who get automatically subscribed, with an email, telling them that they are now subscribed and can unsubscribe at any time.

I would like to give users the option to opt out upon registering/verifying their account.

I find some interesting reading regarding this question in this [document](http://www.forbrukerombudet.no/asset/3278/1/3278_1.pdf). Especially "§ 15. Begrensninger i bruk av visse kommunikasjonsmetoder" and the deeper elaboration about this in chapter 2.6.1. Apart from this, I think Online should handle this like every serious webpage on the Internet, and have this as a checkbox during registration of an user account.  

Nice find @hakloev, definitely something to take into consideration.

We've already notified everyone about the mailing list when it was first published, and people know they are on it or they have unsubscribed from it. If we now force everyone off it (set to False for all users) people who want to stay on it but did not opt out will have to manually opt in again.

Hmm, that document had some interesting points that affects how this should be handled.

Section 2.6.1 states:

> Henvendelser som inneholder en kombinasjon av nyheter/brukerinformasjon
> og markedsføring, omfattes også av ordlyden i § 15. Det kreves derfor
> på samme måte som for andre markedsføringshenvendelser, at forbrukerne
> på forhånd må ha gitt samtykke til å motta denne typen henvendelser. 

Section 2.7.1 regarding consent states quite clearly what is considered an informed consent:

> Frivillig:
> Samtykket må avgis frivillig. Forbrukeren skal kunne kalle samtykket tilbake når som helst.
> 
> Uttrykkelig:
> Samtykket må avgis ved at det foretas en aktiv handling. Forbrukeren kan
> ikke bindes ved passivitet. Dette medfører at et forhåndsavkrysset felt eller
> et vilkår i en kontrakt ikke er tilstrekkelig til at skal kunne sies å foreligge et
> gyldig samtykke. Den næringsdrivende må legge det opp slik at forbrukeren
> må huke av i en egen boks eller lignende for å bekrefte at samtykket
> gis.
> 
> Informert:
> Når den næringsdrivende henter inn samtykke fra forbrukeren, for
> eksempel ved registrering på en internettside, må forbrukeren i direkte
> tilknytning til spørsmålet om han vil gi samtykke, gis informasjon om hva
> vedkommende samtykker til (samtykkeerklæring). Forbrukeren må i denne
> forbindelse informeres om hva det innebærer å avgi et samtykke, blant
> annet om hvor ofte vedkommende vil motta markedsføring og om hvilke
> typer produkter som vil bli markedsført

Well, first and foremost, this should probably not be discussed here as it is of very little technical interest, but all right. 

The discussion is about whether this should be opt in or opt out. We decided to do this opt out as it is something new that we want to reach our users with and as everyone knows: it's much harder to get users to actively do something than the other way around. We did however make it easy to opt out, and intend to inform about this in all correspondence. I know that not everyone agrees with this reasoning, but we weighted the benefits of reaching a wider audience more, than the minor inconvenience it is to unsubscribe for the few that are not interested. I should also note that I have been campaigning hard to not make this list a "shitlist" where we throw everything and nothing in. We do screening for information we feel our users will find useful, and as can be seen by the fact that nothing has been sent out the last couple of weeks, most things do not pass. 

Now, since you did bring up legalities of the practice I have to address that as well First of all we are in a special position with regards to "Markedsføringsloven" as our users are not simply customers in the traditional sense where we try to sell them a product or service. Sometimes they are, but other times they are simply members attending our events or enjoying other benefits. Anyway, I did some digging around and I'm going to take you through the steps that brought me to my conclusion. Pardon the mix of language here, but it is needed to get the point out. 

mfl §1

> Loven gjelder kontroll med markedsføring, handelspraksis og avtalevilkår i forbrukerforhold og stiller krav til god forretningsskikk mellom næringsdrivende.

§ 5 punkt d

> handelspraksis: enhver handling, utelatelse, atferd eller framstilling, kommersiell kommunikasjon, herunder reklame og markedsføring, fra en næringsdrivendes side, som er direkte knyttet til å fremme salget av, selge eller levere en ytelse til forbrukerne,

The question here is whether it can be argued that the sending out these mails is regarded as "markedsføring" related to "levere en ytelse". My argument is that we will not use these messages to promote any product or service we (or others) intend to sell you. We want to inform about minor jobs, conferences or otherwise useful information. There is no commercial intention behind this. That is a key point as is argued in the laws "forarbeider" that I find to support my argument quite well. 

Forarbeider til mfl. [4.4.1.4](https://www.regjeringen.no/no/dokumenter/otprp-nr-55-2007-2008-/id510165/?q=&ch=4)

>  Til utformingen av definisjonen har enkelte høringsinstanser tatt opp spørsmålet om lovens virkeområde blir for vidt dersom definisjonen ikke inneholder presiseringen av at praksisen er « direkte knyttet til å fremme salget (…) til forbrukere». Departementet er etter en ny vurdering kommet til at det kan være klargjørende med et tilknytningskrav i definisjonen. Det vil for eksempel gå en grense mot fremstillinger der en **næringsdrivende ikke har som formål å påvirke forbrukernes økonomiske valg.** 

I hope this clears things up. 

## 

Pedandisk Nils, out! 

Would an acceptable solution be to have users agree to join the mailing list upon registration? If so, we should do this upon solving #866 

> On 18 Nov 2015, at 23:45, Nils Herde notifications@github.com wrote:
> 
> Would an acceptable solution be to have users agree to join the mailing list upon registration? If so, we should do this upon solving #866 https://github.com/dotKom/onlineweb4/issues/866

To have a opt-in checkbox at registration would solve this issue. But it will not solve the problem with all the users that has been forced to the list.

I don't think that it is up to us to decide how that should work, though?

If that's the case I think we should notify signed up users who get automatically subscribed, with an email, telling them that they are now subscribed and can unsubscribe at any time.

I would like to give users the option to opt out upon registering/verifying their account.

I find some interesting reading regarding this question in this [document](http://www.forbrukerombudet.no/asset/3278/1/3278_1.pdf). Especially "§ 15. Begrensninger i bruk av visse kommunikasjonsmetoder" and the deeper elaboration about this in chapter 2.6.1. Apart from this, I think Online should handle this like every serious webpage on the Internet, and have this as a checkbox during registration of an user account.  

Nice find @hakloev, definitely something to take into consideration.

We've already notified everyone about the mailing list when it was first published, and people know they are on it or they have unsubscribed from it. If we now force everyone off it (set to False for all users) people who want to stay on it but did not opt out will have to manually opt in again.

Hmm, that document had some interesting points that affects how this should be handled.

Section 2.6.1 states:

> Henvendelser som inneholder en kombinasjon av nyheter/brukerinformasjon
> og markedsføring, omfattes også av ordlyden i § 15. Det kreves derfor
> på samme måte som for andre markedsføringshenvendelser, at forbrukerne
> på forhånd må ha gitt samtykke til å motta denne typen henvendelser. 

Section 2.7.1 regarding consent states quite clearly what is considered an informed consent:

> Frivillig:
> Samtykket må avgis frivillig. Forbrukeren skal kunne kalle samtykket tilbake når som helst.
> 
> Uttrykkelig:
> Samtykket må avgis ved at det foretas en aktiv handling. Forbrukeren kan
> ikke bindes ved passivitet. Dette medfører at et forhåndsavkrysset felt eller
> et vilkår i en kontrakt ikke er tilstrekkelig til at skal kunne sies å foreligge et
> gyldig samtykke. Den næringsdrivende må legge det opp slik at forbrukeren
> må huke av i en egen boks eller lignende for å bekrefte at samtykket
> gis.
> 
> Informert:
> Når den næringsdrivende henter inn samtykke fra forbrukeren, for
> eksempel ved registrering på en internettside, må forbrukeren i direkte
> tilknytning til spørsmålet om han vil gi samtykke, gis informasjon om hva
> vedkommende samtykker til (samtykkeerklæring). Forbrukeren må i denne
> forbindelse informeres om hva det innebærer å avgi et samtykke, blant
> annet om hvor ofte vedkommende vil motta markedsføring og om hvilke
> typer produkter som vil bli markedsført

Well, first and foremost, this should probably not be discussed here as it is of very little technical interest, but all right. 

The discussion is about whether this should be opt in or opt out. We decided to do this opt out as it is something new that we want to reach our users with and as everyone knows: it's much harder to get users to actively do something than the other way around. We did however make it easy to opt out, and intend to inform about this in all correspondence. I know that not everyone agrees with this reasoning, but we weighted the benefits of reaching a wider audience more, than the minor inconvenience it is to unsubscribe for the few that are not interested. I should also note that I have been campaigning hard to not make this list a "shitlist" where we throw everything and nothing in. We do screening for information we feel our users will find useful, and as can be seen by the fact that nothing has been sent out the last couple of weeks, most things do not pass. 

Now, since you did bring up legalities of the practice I have to address that as well First of all we are in a special position with regards to "Markedsføringsloven" as our users are not simply customers in the traditional sense where we try to sell them a product or service. Sometimes they are, but other times they are simply members attending our events or enjoying other benefits. Anyway, I did some digging around and I'm going to take you through the steps that brought me to my conclusion. Pardon the mix of language here, but it is needed to get the point out. 

mfl §1

> Loven gjelder kontroll med markedsføring, handelspraksis og avtalevilkår i forbrukerforhold og stiller krav til god forretningsskikk mellom næringsdrivende.

§ 5 punkt d

> handelspraksis: enhver handling, utelatelse, atferd eller framstilling, kommersiell kommunikasjon, herunder reklame og markedsføring, fra en næringsdrivendes side, som er direkte knyttet til å fremme salget av, selge eller levere en ytelse til forbrukerne,

The question here is whether it can be argued that the sending out these mails is regarded as "markedsføring" related to "levere en ytelse". My argument is that we will not use these messages to promote any product or service we (or others) intend to sell you. We want to inform about minor jobs, conferences or otherwise useful information. There is no commercial intention behind this. That is a key point as is argued in the laws "forarbeider" that I find to support my argument quite well. 

Forarbeider til mfl. [4.4.1.4](https://www.regjeringen.no/no/dokumenter/otprp-nr-55-2007-2008-/id510165/?q=&ch=4)

>  Til utformingen av definisjonen har enkelte høringsinstanser tatt opp spørsmålet om lovens virkeområde blir for vidt dersom definisjonen ikke inneholder presiseringen av at praksisen er « direkte knyttet til å fremme salget (…) til forbrukere». Departementet er etter en ny vurdering kommet til at det kan være klargjørende med et tilknytningskrav i definisjonen. Det vil for eksempel gå en grense mot fremstillinger der en **næringsdrivende ikke har som formål å påvirke forbrukernes økonomiske valg.** 

I hope this clears things up. 

## 

Pedandisk Nils, out! 

Would an acceptable solution be to have users agree to join the mailing list upon registration? If so, we should do this upon solving #866 

> On 18 Nov 2015, at 23:45, Nils Herde notifications@github.com wrote:
> 
> Would an acceptable solution be to have users agree to join the mailing list upon registration? If so, we should do this upon solving #866 https://github.com/dotKom/onlineweb4/issues/866

To have a opt-in checkbox at registration would solve this issue. But it will not solve the problem with all the users that has been forced to the list.


Resolving patch:
diff --git a/apps/authentication/views.py b/apps/authentication/views.py
--- a/apps/authentication/views.py
+++ b/apps/authentication/views.py
@@ -141,7 +141,6 @@ def verify(request, token):
             # Check if Online-member, and set Infomail to True is he/she is
             if user.is_member:
                 user.infomail = True
-                user.jobmail = True
 
         user_activated = False
         if not user.is_active:
@@ -153,8 +152,12 @@ def verify(request, token):
 
         if user_activated:
             log.info('New user %s was activated' % user)
-            messages.success(request, _('Bruker %s ble aktivert. Du kan nå logge inn.') % user.username)
-            return redirect('auth_login')
+            user.backend = "django.contrib.auth.backends.ModelBackend"
+            auth.login(request, user)
+            messages.success(request, _(
+                'Bruker %s ble aktivert. Du er nå logget inn. '
+                'Kikk rundt på "Min Side" for å oppdatere profilinnstillinger.') % user.username)
+            return redirect('profiles')
         else:
             log.info('New email %s was verified for user %s' % (email, user))
             messages.success(request, _('Eposten %s er nå verifisert.') % email)


Test patch: