There are several privacy laws and guidelines that govern how websites collect and process personal information about their visitors.
As a business and website owner, it is essential that you understand your obligations under these laws, as failure to comply could result in you facing hefty penalties.
In this article, we are going be focusing on the privacy laws surrounding the use of cookies.
What are cookies?
By cookies, we are referring to small files or pieces of data that websites place on their visitors’ devices, so that they can identify and store information about each user.
A few different types of cookies exist. For example, cookies can be either first-party (where they are placed on a visitor’s device by the website itself) or third-party (where this is done by a third party, such as an analytic or marketing company).
They may also be either sessional (where they are placed on the visitor’s device only temporarily, and disappear when they close their web browser) or persistent (where they remain on the visitor’s website indefinitely, until they are erased by either the user, their device, or their browser).
Why do websites use cookies?
There are several reasons that websites may use cookies to collect data about their users (or data subjects). These include:
- Because they are essential for the site’s functioning – for example, when e-commerce stores use cookies to keep your items in your cart while you continue browsing
- To record your preferences – for example, when websites save your username and password so you can log in automatically, or when they save your language or location
- To record statistics about your browsing patterns and activity on the site – for example, what pages you visited, and which areas of the site you visit most often
- For marketing purposes – for example, when advertisers track users’ online activity so that they can select and display targeted advertisements that are likely to interest that person
What is the problem with cookies?
Cookies are usually harmless. However, there is the possibility that they may collect and store personal information about website users that could potentially identify them without their consent.
Because of this, websites are required to comply with laws that ensure users consent to having information collected about them, and understand how this information will be used. The practice of ensuring your business and website complies with these requirements is known as “cookie compliance”.
What privacy laws do I need to be aware of in relation to cookie compliance?
The most well-known privacy law that governs cookie compliance is the European Union’s General Data Protection Regulation (GDPR), which protects internet users who live in an EU country.
Under this privacy law, all websites that collect and process personal data from EU residents are required to comply with a series of cookie compliance regulations, including:
- Notifying users if your site uses cookies
- Obtaining consent from your website’s users before using cookies
- Giving users a clear choice to either provide or refuse consent – for example, through the use of a consent banner
- Providing your website’s users with a detailed explanation of what information will be collected, and how it will be used
- Accurately keeping records that show you have obtained consent
- Providing users with the opportunity to easily withdraw their consent without having to alter their browser settings
It is important to note that even if you are not based in the EU, you may still be required to ensure GDPR cookie compliance – for example, if your website has visitors from the EU from whom you collect and process information. Even if you don’t have visitors from the EU now, you may also be required to comply with the GDPR if you might have them in future.
Being GDPR compliant has another benefit. Because the EU’s privacy and cookie compliance laws are among the strictest in the world, if you achieve GDP compliance, there’s a good chance that you’ll also be in compliance with the other regulations out there. However, you should always double-check the laws that apply to you to be sure.
The ePrivacy Directive is another example of a privacy and data protection law that will impact how you process the personal data of your website’s visitors.
This also applies to website users in the EU, and covers many of the same points as that covered in the GDPR.
However, there are some distinctions, so if your website services users from the EU, it is important that you familiarise yourself with both.
The California Consumer Privacy Act (CCPA) is another example of a privacy law that can affect cookie compliance. This is also an example of how privacy laws may govern cookie compliance on a state level, rather than a broader one as with the GDPR and ePrivacy Directive.
In conclusion
As you can see, there’s a lot to know when it comes to making sure your website is cookie compliant.
It's worth bearing in mind that the cookie compliance laws that apply to you may vary depending on where in the world people are visiting your site from.
Because what is considered “cookie compliance” can vary from country to country and state to state, so you should always do your research to find out what your obligations are based on the countries of origin of your website’s visitors.
Several tag manager and cookie consent management tools exist that can help to simplify this process. However, it is always best to consult with a website development or maintenance professional who is experienced in this area to ensure you are fully meeting your compliance obligations.
Want to find out more about your business’s cookie compliance obligations? Get in touch with Tomedia today at admin@tomedia.com.au or 0419 697 016.