iSeek are seeing an increase in the number of customers asking about compliance with data laws and, in particular, with data privacy and cookie notices.
First to clearly state: iSeek / Seek Internet Solutions Ltd are not legal experts nor data privacy experts and we have compiled the information below from reading industry news and using our experience as web developers. We make no guarantee that this information will ensure your compliance with any regulations.
Clients often ask us to add a generic cookie notice, similar to what they see on most other sites, thinking this will make their site compliant with the regulations.
However, the vast majority of sites currently do not comply with the data regulations. So, to copy what they are doing will not make your site compliant.
Here is a summary of some of the most common cookie options for website owners:
- Cookieyes – https://www.cookieyes.com/welcome/?ref=iseek – This is our current recommended cookie consent manager for the majority of our clients, we like it as it is easy to setup, works well with WordPress, the cookie banner is much smaller than Cookiebot, the cookie banner has the cookie policy listed in it saving clients the trouble of having to do a seperate cookie policy page, it can generate a privacy policy if you want and finally it is free for site with up to 100 pages and even after this the cost is low compared to other popular services.
- Generic Cookie Notice such as https://wordpress.org/plugins/cookie-notice/ This means the client needs to write a cookie policy page. They tend to write a very generic overview page similar to a lot of sites. This plugin will display a notice to new users and have an “accept all” button for them to accept the cookies – This sort of solution will NOT make your site compliant.
- Partial Compliance such as https://wordpress.org/plugins/complianz-gdpr/ This plugin presents a questionnaire to the site owner on a number of common cookies sites use and it creates and displays a cookie policy based on their answers. In our experience, in most cases clients give incorrect answers, or there are other services on the site the questionnaire does not cover, and so these are missed in the policy that is created.
- Cookiebot – https://www.cookiebot.com/en/pricing/ We have used this service on many sites. It needs careful setup to make it GDPR compliant, or at least very close to it. You can see a report from the Irish DPC where it states that many firms wrongly thought the default, out-of-the-box setup of cookie-bot made them compliant. The plugin will scan your site and create the cookie policy and update this monthly and it will create the cookie notice, which is much more closely compliant with GDPR so far. However, a recent review by the Data Commissioner found it still recorded cookies when not asked to, so there is a big question mark over the plugin as a solution. The plugin is free for sites with less than 50 pages; for larger sites, you need to pay for it.
There are thousands of other providers and all promise compliance so it is really difficult for the average website owner to know which to go with.
Why are so many site owners delaying or avoiding complying with the new regulations
- Most micro and small business owners have little knowledge on data privacy regulations and how that relates to their website
- The more compliant cookie notices are bigger as they need to display more content. To customise the colour and logos on them often means you have to pay and if you don’t do this, it does not provide a good user experience for your visitors
- The 3rd party services that can be setup to be compliant, split cookies into categories. Marketing cookies like those used by Google Analytics cannot be pre-selected and most people just hit the first accept button they see. This means Google Analytics will stop recording stats effectively.
- Additionally you may have to change how 3rd services are configured, e.g., to be compliant you need to modify what Google Analytics records, such as having to anonymise ip addresses. Which again reduces the usefulness of the data you can then get in your stats.
- The data privacy area is a minefield and very hard to be sure about. Moreover, there are further changes coming in the next year or two and there are a lot of legal cases still ongoing to determine what is allowed and not. Many businesses are taking a wait-and-see approach and until they see businesses similar to them getting fined will not take action.
- Getting a legal professional to advise you on this area can be expensive and will still require a lot of input from a business owner. Such a professional could potentially discover other data privacy issues which require changes, such as the accountancy software your firm uses to store customers data.
If you would like our help please send an email to support@iseek.ie
Appendix – Summary of Irish Data Protection Reports and Findings
The Irish DPC – https://dataprotection.ie recently published guidance on cookies and similar technologies.
They sent a questionnaire to 40 organisations between August and December 2019
Read the full report here – https://dataprotection.ie/en/dpc-guidance/guidance-cookies-and-other-tracking-technologies
The below was sourced from https://www.huntonprivacyblog.com/2020/04/08/irish-dpc-publishes-new-cookie-guidance/
DPC Findings
Key findings of the sweep include:
- Non-necessary cookies set on landing: On almost all the websites examined, cookies were set immediately on the landing page. This included, in many cases, non-necessary cookies.
- Pre-checked consent boxes: 26% of the responding organisations presented pre-checked boxes to signal consent to cookies, including to marketing and analytics cookies.
- Implied consent: Two-thirds of the organisations specifically stated that they were relying on (1) a model of “implied consent” to set cookies, based on the wording of their cookie banners (e.g., “by continuing to browse this site you consent to the use of cookies”), and/or (2) the user controlling cookies via their browser settings.
- Misclassification of cookies as “necessary”: Many organisations miscategorised the cookies deployed on their websites as “necessary” or “strictly necessary.”
- Badly designed cookie banners and consent-management platforms (“CMPs”): Badly designed cookie banners and CMPs were also a feature on some websites (e.g., cookie banners offering no choice other than an “accept” button without any link to additional information about cookies, and with the cookies policy or privacy policy in the page footer obscured by the banner; and CMPs using sliders with a binary colour choice only, i.e., sliders which are not marked clearly to denote the “on” and “off” positions).
- Bundling of consent for all purposes: For most organisations, consent was “bundled,” i.e., users were unable to provide consent to particular purposes for which cookies were being used.
- No visible functionality to change cookie settings: Most websites did not offer tools for users to vary or withdraw cookie choices at a later stage, despite the deployment of third-party vendors’ CMPs by some organisations.
About 15 of the 38 organisations who responded signalled either that they were aware they may not be compliant with the existing rules, or that they had identified improvements that they could make to their websites in order to demonstrate compliance. However, “it was clear from some responses,” the DPC stated, “that even the changes proposed by controllers may not serve to bring them into full compliance.”
New Cookie Guidance
Key takeaways from the DPC’s new cookie guidance include:
- Organisations must ensure that no non-necessary cookies and similar technologies (including local storage objects or “flash” cookies, software development kits (“SDKs”), pixel trackers (or pixel gifs), “like” buttons and social sharing tools, and device fingerprinting technologies) are set on the landing page of their site or app;
- Obtaining users’ consent by implementing a cookie banner or pop-up is acceptable, provided that:
- the cookie banner or pop-up outlines that the organisation is requesting consent for the use of cookies and similar technologies for specific purposes, and allows the user to reject non-necessary cookies and similar technologies, or to request more information about the use of cookies and similar technologies. Wording such as “by continuing to use the site, you consent to the use of cookies” is no longer permissible;
- the cookie banner or pop-up is not designed in a way that “nudges” a user into accepting cookies over rejecting them. In practice, if there is an “accept” button on the banner, the banner must give equal prominence to a “reject” button, or to an option which brings users to a second layer of information and allows them to manage their cookie settings; and
- this second layer of information must provide more detailed information about the types and purposes of cookies or other technologies being set, and the third parties who will process information collected when those cookies and similar technologies are deployed. It also must provide users with options to accept or reject such cookies/similar technologies by cookie type and purpose, e.g., via check-boxes that must not be pre-checked, or sliders that must not be set to “on” by default. Check-boxes or sliders should be clearly marked as “on” or “off”, even if they also have a binary colour choice so that users do not have to guess at their functionality.
- Users must also be able to change their cookie preferences at any time, e.g., via a cookie button (or a “radio button”) available on each web page, which reveals sliders or on/off options.
- If a cookie is used to store a record that a user has given consent to the use of cookies, this cookie should have a lifespan of 6 months. Like the CNIL in France, the DPC considers obtaining users’ renewed consent after 6 months appropriate.
- Any record of consent must be backed up by demonstrable organisational and technical measures that ensure a user’s expression of consent (or withdrawal) can be effectively acted on.
- Analytics cookies, targeting cookies and marketing cookies require users’ prior consent. However, first-party analytics cookies are considered potentially low risk and therefore are unlikely to be a priority for any formal enforcement action by the DPC.
- Organisations must also must examine the role of the third parties using cookies and similar technologies on their website or app as (joint) data controllers or data processors. In particular, they must examine the possible joint data controller issues arising from the use of third-party assets and plugins. Where necessary, they must put in place the appropriate data processing agreement with these third parties, which must reflect the actual facts of the processing.
The DPC made it clear that they expect organisations (acting as data controllers) to comply with the current cookie law rules. Organisations have a six-month window to get in compliance with the DPC’s new cookie guidance; after that period, the DPC may take action to enforce the guidance