'Most Innovative Startup 2020' by RSA - Watch the pitch videoView More
SECURITI.ai has been working closely with IAB EU to align our solution with their TCF v2.0 framework, and we’re proud to announce that SECURITI.ai’s Consent Management Platform is officially TCF v2.0 approved by the IAB.
IAB EU TCF v2.0 is a framework to support ePrivacy Directive and GDPR by providing transparency and consent in a publisher’s digital marketing environment. It gives publishers the ability to work with their vendors in compliance with GDPR. In addition, publishers are able to offer their consumers the ability to provide or withdraw consent regarding the processing of data from these vendors. Lastly, the vendors are able to rely on the TCF v2.0 in order to determine and honor the consent preference of these consumers.
IAB EU TCF v2.0 is seamlessly integrated with SECURITI.ai’s Cookie Consent solution. Publishers can easily enable support for the TCF v2.0 framework to start collecting consent across the digital advertising ecosystem in compliance with TCF v2.0, the GDPR, ePrivacy Directive and more in just a few easy steps!
Publishers can configure the IAB TCF list of registered vendors and updated definitions of Purposes, Special Purposes, Features, and Special Features on their preference center specific to their site. Under TCF v2.0, consumers can provide their consent preference or exercise their GDPR “right to object” to personal data being processed on the basis of legitimate interest. SECURITI.ai generates a consent string under the framework that provides action signals to vendors to honor the user’s consent.
From August 15, 2020 onward, publishers who are looking to participate in the IAB EU Framework must deploy a TCF v2.0 solution. SECURITI.ai is here to help you every step of the way.
Get started for free. Click here to register for a SECURITI.ai freemium account.
On 6 April, the Data Protection Commission of Ireland (DPC) released a substantive Guidance Note on cookies (Guidance) and provided organizations a grace period of six months to ensure compliance. After the end of the six-month window, which is 5 October 2020, the Irish DPC may act to enforce the Guidance and can hold organizations liable for failing to obtain valid consent before the processing of cookies.
This Guidance was issued based on the report released by the DPC on the findings of a “cookie sweep survey”. The survey was conducted on around 38 organizations operating within the territory of Ireland and around 35 of those companies were found to be significantly lacking in cookie compliance requirements. The DPC noticed the following non-compliance practices of organizations, among others:
Based on its identification of the above non-compliance areas, the Irish DPC released the comprehensive Guidance for organizations. The Guidance explains the purposes of cookies as well as it adheres to the requirements of the GDPR, e-Privacy Directive, and the Guidelines on Consent of the European Data Protection Board, released on 4 May 2020 that declared cookie walls invalid.
The Guidance also complements the landmark decision by the Court of Justice of the European Union in the Planet49 case that declared the use of pre-checked boxes as an invalid mechanism of obtaining users’ consent.
Some of the key points of the DPC Guidance are set out below:
Data controllers must obtain valid consent of users before the processing of cookies except the processing of strictly necessary cookies and communication cookies, i.e. cookies that are processed for carrying out the transmission of a communication over a network. A user’s consent must be freely given, specific, informed, and unambiguous as per Article 4(11) of the GDPR.
Data controllers must allow individual cookie selection by purposes and the user’s consent must be specific to each purpose of the cookie.
Data controllers must allow users to withdraw their consent to the processing of cookies via a user-friendly and easy method.
The duration of each cookie must be proportionate to its purposes.
Data controllers are not allowed to use pre-checked boxes for the processing of non-essential cookies.
Data controllers must reaffirm the user’s consent after every six months.
Data controllers must arrange controller-processor contracts when they use a third-party payment company to process payments for goods or services of the data controller. In such a case, the controller-processor contract must be in accordance with the requirements of Article 28(3) of the GDPR.
Data controllers must conduct data protection impact assessments for certain types of data processing such as processing that involves systematic monitoring or tracking of individuals’ locations.
The DPC acknowledges the use of Consent Management Platforms. Data controllers must maintain records of users’ consents as part of the processing activities as per the requirements of Article 30 of the GDPR.
This Guidance Note reminds data controllers that they need to comply with the requirements of the valid consent before the processing of cookies as per the GDPR and e-Privacy Directive. Data controllers must bring their cookie consent practices in line with the DPC’s Guidance Note before 6 October to avoid any penalties for non-compliance.
SECURITI.ai’s Cookie Consent Banner Solution enables companies to build cookie consent banners in accordance with the applicable legal requirements with cookie auto-blocking, periodic scanning, and preference center features. SECURITI.ai’s Universal Consent Management Solution captures consent and automates revocation fulfillment.
Ask for a DEMO today to understand how SECURITI.ai can help you comply with the consent requirements of GDPR, e-Privacy Directive, Irish Data Protection Commission’s Guidance, and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.
Since the European Data Protection Board (EDPB) has released updated Guidelines on Consent, Consent Management Platforms (CMPs) have been reevaluating their practices in relation to governance, collection and management of users’ consent. Gone are the days of Cookie Walls and pre-selected boxes.
The Interactive Advertising Bureau’s (IAB) Transparency and Consent Framework (TCF) is a set of technical solutions whereby website publishers can obtain users’ consent for the processing of their data. All website publishers that are intending to participate in the European Framework of IAB (IAB-EU) are required to deploy a TCF v2.0 solution that is consistent with the new requirements set forth by EDBP, GDPR, and the e-Privacy Directive.
SECURITI.ai’s CMP has been updated and aligned with the IAB EU TCF v2.0 solution and is therefore one of the only CMPs in the market fully compliant with the requirements of EDPB, GDPR, and e-Privacy Directive. Our tool empowers consumers to provide informed and free consent to the processing of their data as well as to object to processing on the basis of a “legitimate interest”, whenever they want. It allows website publishers to derive consent collection in compliance with TCF v2.0, GDPR, e-Privacy Directive and any other applicable data privacy regulation without hassle, while ensuring the consent collection is completely documented and available for easy reference during any privacy audit. Our new CMP has the following new exciting features:
1. User notification ensures users provide freely given, specific, informed and unambiguous consent:
It enables website publishers to require users’ consent before processing their information or loading of tracking technologies. This ultimately ensures that no personal information is collected, used, or processed and no tracking device is installed in the terminal equipment unless and until users provide consent, that is freely given, specific, informed, and unambiguous indication of users’ wishes.
2. User notification at regular intervals ensures data subjects are well-informed:
It enables website publishers to display notifications and alerts at appropriate levels and intervals to ensure that data subjects are well-informed about the processing of their data.
3. Prohibition of Cookie Walls ensures freely given consent of the user:
It demands website publishers to not make access to a service conditional to the users’ consent for the processing of personal data or installation of tracking technologies.
4. The ability to withdraw consent ensures freely given consent of the user:
It enables users to withdraw consent by using the same method and user interface as for obtaining the user’s consent. The data subjects are informed of his or her ability to withdraw their consent before processing their information along with the process and method it requires.
5. Granularity ensures specific consent of the user:
It enables granular consent choices in the secondary user interface layer by providing separate explanations to users for each purpose of the processing of data.
6. Providing clear and comprehensive information ensures informed consent of the users:
It enables website publishers to provide clear and comprehensive information to data subjects about the processing of their data. This includes providing details on the identity of the data controller, the purpose of the processing operations, the type of data that will be collected, used or processed, the existence of data subject’s right to withdraw consent, the mechanism through which consent can be withdrawn, information about the use of the data for automated decision-making or profiling and the potential risks in relation to cross-border data transfers, among other relevant details.
7. Providing information in clear and plain language ensures informed consent of the user:
It enables website publishers to provide information to data subjects about the processing of their data in a clear, plain and understandable language. Such information will be made separate from the terms and conditions of a particular service.
8. Affirmative Action ensures unambiguous indication of users’ consent:
It enables website publishers to obtain written, recorded, and/or oral statements of data subjects, whereby a data subject consents to the processing of personal data or installation of tracking technologies.
9. Prohibition of scrolling and swiping to constitute consent ensures unambiguous indication of users’ consent:
It demands website publishers to prohibit the use of pre-ticked/pre-selected checkboxes to obtain users’ consent as well as to not constitute scrolling, swiping, any inactivity on the part of the data subject or any similar action of the data subject as data subject’s consent.
10. Maintenance of consent records ensures compliance with the legal requirements:
It enables website publishers to maintain a record of users’ consent to assist in demonstrating compliance with the legal requirements pertaining to consent.
Ask for a DEMO today to understand how SECURITI.ai can help you comply with the consent requirements of GDPR, e-Privacy Directive, EDPB’s Guidelines, and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.