GDPR Rails (also known as PolicyManager) is a Rails engine—a mountable Ruby gem originally built by the Prey team for preyproject.com—that adds GDPR compliance tooling to Rails applications: configurable consent policies, data portability exports, and script/cookie management.
What is GDPR Rails?
GDPR Rails is a Rails engine that runs inside a host Rails application (Ruby 3.0+, Rails 6.1+, ActiveStorage required). It takes a set of policy rules you define in an initializer and generates consent workflows, management pages, and data export pipelines for end users. The engine provides both HTML views and JSON endpoints, so either server-rendered pages or client-side apps (React, Vue, etc.) can interact with the consent process.
Key Features
- Policy rules — Declare rules like
cookie,age, orprivacy_termswith options forvalidates_on,blocking,sessionless,ifprocs, andon_accept/on_rejectcallbacks. - Sessionless consent — Non-logged users can accept a cookie policy; a cookie is set and can later be persisted when the user signs in.
- Versioning — Policy content can be versioned, so you can retire old terms.
- Portability module — Define exporter rules with a path and resource; the engine generates a static HTML site (plus JSON) containing the user's data, downloads remote images locally, zips it, and delivers an expirable download link via email.
- Script & cookie manager — Declare external scripts (e.g., Google Analytics, Kissmetrics) with environment restrictions, cookie names, and domains; render them conditionally based on consent, and clean up cookies on rejection.
- Admin panel — Comes with a web interface to create policy categories and manage portability requests.
- JSON endpoints — Routes like
pending_user_terms,accept_user_term, andreject_user_termlet frontend apps handle consent programmatically. - ActiveStorage — Uses Rails' ActiveStorage for file handling, so exports can be stored on S3, Google Cloud, or local disk.
Who is it for?
- Rails developers building GDPR-compliant SaaS, ecommerce, or content apps who want a turnkey consent and data-export system without building it from scratch.
- Product teams that need to respond to GDPR data portability requests with downloadable user data in a readable format.
- Companies using client-side frontends (React, Vue, etc.) that need a backend consent API with JSON endpoints.
What can you do with it?
- Cookie consent UX — Set a sessionless cookie rule, render script tags only after acceptance (
current_user.has_consented_cookie?), and delete cookies when the user rejects. - Data portability — Let users request a ZIP of their data; the engine generates a navigable site with their articles, account data, and images.
- Policy management — Add and version consent texts (e.g., "Privacy & TOS", "+16 age confirmation") from the admin panel, and block access until users accept required terms.
How does it work?
Install the gem, run rake policy_manager:install:migrations, mount PolicyManager::Engine at a path like /policies, include PolicyManager::Concerns::UserBehavior in your User model, and define rules and scripts in an initializer. The engine then exposes routes, helpers, and background jobs (ActiveJob) to handle the rest.
FAQ
How do I add GDPR Rails to a Rails app?
Add gem 'gdpr_rails' to your Gemfile, require policy_manager, run the migrations, mount the engine, and add the concern to your user model.
Does it work with Devise?
Yes. Include Devise::Controllers::Helpers into PolicyManager::UserTermsController to get current_user in the engine's controllers.
What are the requirements?
Ruby 3.0+, Rails 6.1+, and ActiveStorage configured in the host app. Paperclip is no longer supported.
