⏺️ Recording consent - Overview

[nickvergessen]

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

For compliance reasons with various privacy rights it is really helpful if the operator can prove that everyone agreed that a call was recorded. Therefore they had the idea that users should actively agree that the call gets recorded.

1. When someone joins the room while a call is recorded it is easy: We already show a "warning" in the device dialog that the call is recorded, we could add a checkbox there. The user can only join the room/call when they checked the checkbox.

2. For people already in the room it is a bit more tricky when someone want to start the recording. Some ideas they had:

   • We could ask the users for consensus, e.g. with a pop up when the moderator starts the recording
   • When everyone agreed the recording starts directly
   • When not everyone agrees:
     • The moderator can see who agreed/disagreed in the sidebar (e.g. a icon next to each user).
     • The moderator can remove the user from the room (once the room only consist of people who agreed the recording starts)
     • The moderator can overrule the user (Maybe a important participant you don't want/cant kick out but know that ultimately he will be fine with the recording)

The process would be logged in the database, similar to the ToS-App so that the admin can later prove that everyone agreed to the recording. An admin can then request the list of "agrees" for a given conversation via OCC

Some additional thoughts:

• This process might be to strict for some users. Therefore we would probably need a admin settings "require active approval for call recording" or something similar so that a admin can decide if they want to enforce it or not.
• We could add a room property and when it is "recording consent required" we always show the modal (like when the recording was started before) and add a tick box in front of the warning and disabling the "Join/start call" unless the checkbox was ticked.

---

• API API "Recording consent" #10408
• Frontend Frontend "Recording consent" #10409
• Android Support "Recording consent" talk-android#3289
• iOS Support "Recording consent" talk-ios#1345

[marcoambrosini]

@nickvergessen I agree with most of the specs you described above. A couple of things: I'd like to avoid adding yet another icon to the participant list item and I'd add bulk action on top of single participant override. I propose a banner on top of the participants list with info about how many people didn't accept and some quick actions:

• Record anyway as the main button
• Action menu with other items like
  • Show consent popup to people again
  • Kick people who didn't accept and start recording
  • Show only participants who didn't accept
  • Cancel recording

Also the recording icon in the top bar could be primary or warning instead of red or gray (the two states we already have for "recording" and "starting a recording" respectively)

cc @nextcloud/designers what do you think?

It could look something like this

For mods:

For regular users who are prompted to give consent:

[nickvergessen]

After some internal discussions we are more and more leaning towards a global setting and then we don't have these cases of "User did not consent yet".

[marcoambrosini]

Could you elaborate a bit more? I don't understand that

[marcoambrosini]

@nimishavijay suggestion: debounce the countdown of participants so that it doesn't go down too fast and stays readable.

[nickvergessen]

Could you elaborate a bit more? I don't understand that

MVP

To reduce the scope and complexity the feature will be an appconfig for now. So it's on or off and we know it up front.
This allows us to go with a simple "Consent checkbox" on the device picker and just always bring that up, if consent feature is enabled on the instance and we simply deny joining the call without consent.

Version 2

We can add a per conversation setting which can only be enabled when no call is in progress, but would still need the admin option on top of it, to allow admins to enforce the consent when required.

Version 3

Allow enabling/asking during an existing call, with poking the users, ignoring missing consent (unless enforce by admin), kick others after X seconds, etc.

---

Basically your design drafts are for version 3, but I don't think we will have the time to implement that version for the initial release.