Entity Legal
Create versionable, trackable legal forms for site users, such as Terms and Conditions and Privacy Policies.
entity_legal
Overview
The Entity Legal module provides a solid, versionable, exportable, and flexible method of storing legal documents such as Terms and Conditions and Privacy Policies. It creates custom entity types for legal documents, their versions, and user acceptances.
Users can be forced or soft-suggested to re-read and re-accept legal documents when they change, with a full audit trail of which user has accepted which version and when. The module supports multiple legal documents simultaneously, each with custom settings for how users accept them during signup or as existing users.
The module comes with multiple notification methods for prompting users to accept documents: popup dialogs, Drupal status messages, and full page redirection. Site administrators can also create custom delivery methods using the module's plugin API.
Features
- Support for multiple legal documents on a single site (e.g., Terms of Use, Privacy Policy, Terms and Conditions)
- Full version history for each legal document with ability to create and switch between versions
- Track which users accepted which version and when (complete audit trail)
- Require new users to accept legal documents during registration with checkbox on signup form
- Require existing users to accept new versions via popup, warning message, or page redirect
- Customizable acceptance labels with token support for dynamic content
- URL alias support for legal document pages
- Multilingual support with translatable document versions
- Optional Views integration showing all document acceptances per user
- Extensible plugin system for creating custom acceptance delivery methods
- Migration support from Drupal 7 Entity Legal module
- Token integration for dynamic content in acceptance labels and titles
- Automatic cleanup of acceptances when users are deleted
Use Cases
GDPR Compliance
Create a Privacy Policy document that new users must accept during registration. When GDPR requirements change, create a new version and configure existing users to re-accept via popup. The audit trail proves when each user accepted, useful for compliance audits.
Terms of Service Updates
Maintain Terms of Service with version history. When terms change significantly, publish a new version and use the redirect method to force all users to read and accept the new terms before using the site. Previous acceptances are preserved for historical records.
Multiple Legal Agreements
Create separate documents for Terms of Service, Privacy Policy, and Cookie Policy. Each can have independent settings - Terms of Service might require re-acceptance via redirect while Cookie Policy uses a popup. New users see all required documents on the registration form.
Soft Notification of Policy Changes
Update a Privacy Policy and use the message method to display a warning asking users to review changes. Users are reminded but not forced to accept immediately, suitable for minor policy updates.
User Agreement Audit
Use the Acceptances view to audit which users have accepted which versions of legal documents. Filter by user to see their complete acceptance history across all documents, useful for legal or compliance investigations.
Role-Based Requirements
Configure different requirements for different user roles using the 'Re-accept' permissions. For example, require staff members to accept an Employee Code of Conduct while regular users only need to accept standard Terms of Service.
Tips
- Use tokens in acceptance labels to create dynamic links: 'I agree to the <a href="[entity_legal_document:url]">Terms of Service</a>'
- When updating a document, create a new version rather than editing the published one. This preserves the acceptance history for the old version.
- Reverting to a previously published version will not prompt users who already accepted that version to re-accept.
- Use the path module to create friendly URLs like /terms-of-service instead of /legal/document/terms
- The module integrates with Manage Display for document versions, allowing you to customize how the document content is rendered on the acceptance page.
- Custom acceptance methods can be created by implementing plugins in Plugin/EntityLegal namespace with the @EntityLegal annotation.
Technical Details
Admin Pages 6
/admin/structure/legal
Main administration page for managing all legal documents. Lists all existing legal documents with links to view, edit, and delete them. Provides an 'Add' action to create new legal documents.
/admin/structure/legal/add
Form for creating a new legal document entity. After saving, you will be redirected to create the first version of the document.
/admin/structure/legal/manage/{entity_legal_document}
Edit an existing legal document's settings and manage its versions. Shows a table of all versions with options to set the published version, edit, delete, or translate each version.
/admin/structure/legal/manage/{entity_legal_document}/add
Create a new version of a legal document. New versions automatically copy content from the current published version as a starting point.
/admin/structure/legal/manage/{entity_legal_document}/acceptances
View all user acceptances for a specific legal document. Shows document version, user name, and acceptance date. Includes filtering by user name. Requires the Views module.
/legal/document/{entity_legal_document}
Public-facing page showing the current published version of a legal document. For authenticated users who must accept the document, an acceptance form with a checkbox and submit button is displayed below the document content.
Permissions 4
Hooks 1
hook_entity_legal_document_method_alter
Alter available user notification methods for legal document acceptance. Allows modules to add custom acceptance delivery methods.
Troubleshooting 4
Check that: 1) A published version exists for the document, 2) The 'Require existing users to accept' checkbox is enabled, 3) Users have the 'legal re-accept [document]' permission, 4) Users don't have 'administer entity legal' or 'bypass entity legal acceptance' permissions.
Ensure jQuery UI Dialog library is available in your theme. The popup method depends on core/drupal.dialog library. Clear caches after enabling the module.
The module automatically excludes password reset flows from the redirect requirement. If issues persist, check that the pass-reset-token parameter is properly passed in the URL.
The acceptances view is provided as optional configuration. Ensure the Views module is enabled, then reimport the configuration from config/optional/views.view.legal_document_acceptances.yml or recreate the view manually.
Security Notes 4
- Users with 'administer entity legal' or 'bypass entity legal acceptance' permissions are never prompted to accept documents
- Acceptance records include user data dump for verification purposes
- When users are deleted, their acceptance records are automatically removed
- The redirect method properly handles password reset flows to prevent users from being locked out