According to Article 5(3) of the ePrivacy Directive, organizations must obtain prior informed consent from the consumer before storage or access to information stored via a user’s terminal equipment. Take for example, cookies dropped on websites. Organizations must ask users if they agree to accept these cookies or web beacons before they are placed. The ePrivacy Directive exempts “strictly necessary” which are used solely for carrying out communication transmission.
Privacy professionals need to make sure that their cookie notice includes the following in order to stay compliant with privacy regulations:
- Explain the purpose of the installation of cookies that the site uses, briefly
- State action which will signify consent
- Be sufficiently conspicuous
- Notify consumers on cookie purpose, usage, and related third-party activity.
What is consent collection?
Cookies are small pieces of data that can be used to track and identify a user’s web browsing pattern. This data can then be analyzed by marketers to personalize the consumer’s experience. This is how it was for years, but now under article 6 of the GDPR, as well as other data privacy regulations, the consumer must freely give consent to the organization to use their personal information (in this case, the cookies stored).
First-party vs. third-party cookies
First-party cookies are essential for every website as they allow businesses to remember key pieces of information about users and to collect analytical data. Third-party cookies allow publishers to monetize their websites, and brands to run advertising and marketing campaigns, making it essential for Adtech organizations. In order to make this process of consent collection smooth, organizations need to integrate a consent management platform.
What is consent management platform?
Consent management is a process which allows websites to meet global regulatory requirements regarding consent collection. With a consent management platform (CMP) in place, websites can harness the technical capability to inform visitors about the types of data they’ll collect and ask for their consent for specific data-processing purposes.
Some of the regulatory obligations facilitated by consent-management platforms include:
- Users getting consent pop-ups and widgets
- Collecting and storing the consumer’s information about consent decisions, and keeping records
- Before consent is given, collecting only pre-approved data by firing only accepted tags
- Collecting and managing data-subject requests
A functional consent management platform should cover the whole visitor life cycle, from getting the consent of a new visitor of the website to handling their data-subject request.
The process of effective consent management always begins with the right notifications. First off, users must be informed that their personal data is being processed. Detailed information about the scope of data processing must be included in the Privacy Policy, in a pop-up notice, or both. Users must be empowered to decide if they agree to the specific purpose of processing. Consent must be captured and consolidated.
This consent should then be propagated to approved third-party solutions to meet business objectives, while mapping and correlating all the consent given by the consumers. A strong consent management system should be able to track, govern and manage consent in a swift and efficient manner.
How automation can help with cookie consent?
Consent is a major requirement in every data privacy regulation worldwide, but fulfilling this regulation using manual methods is tedious, costly and risky. Given the increase in frequency and severity of data breach incidents, these data privacy regulations will only get tougher as time goes by.
It’s wise to invest in automation from an early stage of the compliance process and bolster a business for all data privacy regulations – not just the existing ones but also those that are in the works. Adopting the PrivacyOps framework can help the organization in the following ways:
- Automatically discover and categorize cookies by scanning websites
- Assist in updating the privacy policy or cookie policy and publish it in a hosted, customizable privacy portal
- Automatically map and correlate consent actions to a unique identity or data subject
- Assist in search and visualization of consent for a particular identity, location, datastore etc.
- Automatically propagate consent (grants and withdrawals) to business applications
- Automatically keep an audit trail of all the steps taken to collect and manage consent
- Automatically integrate consent reporting into data subject rights tickets to indicate how consent was collected for particular personal data processed by the organization
- Automatically integrate consent reporting into data maps and seamlessly ensure that it makes it into Article 30 reports
Conclusion
Data intelligence is becoming an integral part of any business practice and privacy professionals need to incorporate automation if they hope to comply with global privacy regulations such as the CCPA and GDPR. Data intelligence can help organizations easily integrate security and governance, while also enabling swift cloud migration.
Automation is becoming increasingly necessary for any organization that is hoping to comply with any regulations. The need for a PrivacyOps platform has never been greater and organizations need to adopt this fast if they are hoping to avoid any fines or penalties with regards to non-compliance.
