iSeek are seeing an increase in the number of customers asking about compliance with data laws and, in particular, with data privacy and cookie notices.
First to clearly state: iSeek / Seek Internet Solutions Ltd are not legal experts nor data privacy experts and we have compiled the information below from reading industry news and using our experience as web developers. We make no guarantee that this information will ensure your compliance with any regulations.
Clients often ask us to add a generic cookie notice, similar to what they see on most other sites, thinking this will make their site compliant with the regulations.
However, the vast majority of sites currently do not comply with the data regulations. So, to copy what they are doing will not make your site compliant.
Here is a summary of some of the most common cookie options for website owners:
There are thousands of other providers and all promise compliance so it is really difficult for the average website owner to know which to go with.
Why are so many site owners delaying or avoiding complying with the new regulations
- Most micro and small business owners have little knowledge on data privacy regulations and how that relates to their website
- The more compliant cookie notices are bigger as they need to display more content. To customise the colour and logos on them often means you have to pay and if you don’t do this, it does not provide a good user experience for your visitors
- The 3rd party services that can be setup to be compliant, split cookies into categories. Marketing cookies like those used by Google Analytics cannot be pre-selected and most people just hit the first accept button they see. This means Google Analytics will stop recording stats effectively.
- Additionally you may have to change how 3rd services are configured, e.g., to be compliant you need to modify what Google Analytics records, such as having to anonymise ip addresses. Which again reduces the usefulness of the data you can then get in your stats.
- The data privacy area is a minefield and very hard to be sure about. Moreover, there are further changes coming in the next year or two and there are a lot of legal cases still ongoing to determine what is allowed and not. Many businesses are taking a wait-and-see approach and until they see businesses similar to them getting fined will not take action.
- Getting a legal professional to advise you on this area can be expensive and will still require a lot of input from a business owner. Such a professional could potentially discover other data privacy issues which require changes, such as the accountancy software your firm uses to store customers data.
If you would like our help please send an email to firstname.lastname@example.org
Appendix – Summary of Irish Data Protection Reports and Findings
The Irish DPC – https://dataprotection.ie recently published guidance on cookies and similar technologies.
They sent a questionnaire to 40 organisations between August and December 2019
Read the full report here – https://dataprotection.ie/en/guidance-landing/cookies
The below was sourced from https://www.huntonprivacyblog.com/2020/04/08/irish-dpc-publishes-new-cookie-guidance/
Key findings of the sweep include:
- Non-necessary cookies set on landing: On almost all the websites examined, cookies were set immediately on the landing page. This included, in many cases, non-necessary cookies.
- Pre-checked consent boxes: 26% of the responding organisations presented pre-checked boxes to signal consent to cookies, including to marketing and analytics cookies.
- Misclassification of cookies as “necessary”: Many organisations miscategorised the cookies deployed on their websites as “necessary” or “strictly necessary.”
- Bundling of consent for all purposes: For most organisations, consent was “bundled,” i.e., users were unable to provide consent to particular purposes for which cookies were being used.
- No visible functionality to change cookie settings: Most websites did not offer tools for users to vary or withdraw cookie choices at a later stage, despite the deployment of third-party vendors’ CMPs by some organisations.
About 15 of the 38 organisations who responded signalled either that they were aware they may not be compliant with the existing rules, or that they had identified improvements that they could make to their websites in order to demonstrate compliance. However, “it was clear from some responses,” the DPC stated, “that even the changes proposed by controllers may not serve to bring them into full compliance.”
New Cookie Guidance
Key takeaways from the DPC’s new cookie guidance include:
- Organisations must ensure that no non-necessary cookies and similar technologies (including local storage objects or “flash” cookies, software development kits (“SDKs”), pixel trackers (or pixel gifs), “like” buttons and social sharing tools, and device fingerprinting technologies) are set on the landing page of their site or app;
- Obtaining users’ consent by implementing a cookie banner or pop-up is acceptable, provided that:
- the cookie banner or pop-up is not designed in a way that “nudges” a user into accepting cookies over rejecting them. In practice, if there is an “accept” button on the banner, the banner must give equal prominence to a “reject” button, or to an option which brings users to a second layer of information and allows them to manage their cookie settings; and
- this second layer of information must provide more detailed information about the types and purposes of cookies or other technologies being set, and the third parties who will process information collected when those cookies and similar technologies are deployed. It also must provide users with options to accept or reject such cookies/similar technologies by cookie type and purpose, e.g., via check-boxes that must not be pre-checked, or sliders that must not be set to “on” by default. Check-boxes or sliders should be clearly marked as “on” or “off”, even if they also have a binary colour choice so that users do not have to guess at their functionality.
- Users must also be able to change their cookie preferences at any time, e.g., via a cookie button (or a “radio button”) available on each web page, which reveals sliders or on/off options.
- Any record of consent must be backed up by demonstrable organisational and technical measures that ensure a user’s expression of consent (or withdrawal) can be effectively acted on.
- Analytics cookies, targeting cookies and marketing cookies require users’ prior consent. However, first-party analytics cookies are considered potentially low risk and therefore are unlikely to be a priority for any formal enforcement action by the DPC.
- Organisations must also must examine the role of the third parties using cookies and similar technologies on their website or app as (joint) data controllers or data processors. In particular, they must examine the possible joint data controller issues arising from the use of third-party assets and plugins. Where necessary, they must put in place the appropriate data processing agreement with these third parties, which must reflect the actual facts of the processing.
The DPC made it clear that they expect organisations (acting as data controllers) to comply with the current cookie law rules. Organisations have a six-month window to get in compliance with the DPC’s new cookie guidance; after that period, the DPC may take action to enforce the guidance