Securiti Named a 2022 Cool Vendor in Data Security by GartnerDownload Now
Published on February 2, 2022 AUTHOR - Privacy Research Team
A decade later, the average user journey on a website hasn't changed much, except for one major thing. Depending on where the user was accessing the site, the first thing they would see on the website would be a dialogue box, asking them to Accept or Manage cookies.
Thanks to GDPR and several other data protection laws, websites cannot store cookies on a user's device by default when catering to EU and UK residents. They need proper and informed consent from the visitor to do so. The text in the dialogue box, where the user will choose to either accept cookies or manage what cookies they want to be stored, is known as Cookie Text.
As surprising as it may seem, this small piece of text is the current standard way a website uses to convince the consumers to accept cookies on their website.
In simple terms, cookie text is the actual text a user will see on the dialogue box when they are presented with the choice to either accept cookies or reject them. While it may not seem like a big deal, a cookie text is essentially the only tool a website has to gain consent from users to store cookies on their site. Given how cookies can help ensure a user sees highly targeted ads that are more likely to convert and help a website identify its users better, it becomes clear just how vital cookie texts are.
The European Data Protection Board's definition states that "valid consent is a freely given, informed, specific and unambiguous indication of a user's wishes. Scrolling and continued browsing on websites is not valid consent, and cookie banners are not allowed to have pre-ticked checkboxes".
Naturally, a website's cookie text should adhere to this definition and seek to elicit consent while guiding users to appropriate resources on the website if they have any further questions on the matter.
Cookie texts are how a website can communicate its exact cookie consent policy. The dialogue box where the cookie text is shown must be precise enough without limiting any information a user must know.
Cookie texts can be thought of as a permission tool as it is the only way a website can make a case for storing cookies on a user's device.
The General Data Protection Regulation (GDPR) set the benchmark for data protection laws. The GDPR required all websites using cookies to take robust precautions to ensure their users' data privacy and elicit proper consent before collecting any form of data. This is known as opt-in consent, where a user has to opt-in with express consent to have their data collected.
As far as cookie text is concerned, the GDPR deals with how a website is supposed to inform its users about cookies. Any cookie text on any webpage on a website must contain the following information:
The California Consumer Privacy Act (CCPA) has a somewhat different approach towards cookies than the GDPR. While the GDPR follows the opt-in consent model, the CCPA follows the opt-out model. Under the opt-out model, websites have the right to store cookies and collect information on a user by default. A user can only ask a website not to share or sell any data collected on them to a third party. Furthermore, websites are under no obligation to discontinue data collection even after a user requests so.
Under the opt-out model, a website must make it easier for users to opt-out of having their data sold or shared with third parties by making a "Do Not Sell My Personal Information" link clearly available and accessible on every website's webpage. The cookie text for such a Do Not Sell My Personal Information must fulfill the following requirements:
Here are some examples of cookie text from various websites from different countries adhering to various data protection laws from across the world:
It should be clear by now that there is no "one size fit all" approach when it comes to your cookie text. Owing to the different legal requirements of various data protection laws around the world, it is likely that a website may need to alter its cookie text per country. Or in the case of the US, this alteration in cookie text will be needed on a state level since different states have their own data protection laws.
However, there are some key practices that any website can inculcate in their cookie text wherever they may be operating from to ensure they remain legally compliant without making things more complicated than they need to be.
Cookie consent management has taken an unprecedented level of importance in 2022. Several data protection laws are being enacted worldwide that mandate all websites ensure their users are adequately informed and educated about their digital privacy rights. Businesses have to figure out how they can continue trying to optimize their users' browsing experience without breaching any consent requirements.
A robust and instantly adaptable cookie consent management system is the key to achieving that goal. And such a robust and instantly adaptable cookie consent management system can only be achieved via automation. Owing to the sheer amount of data involved, it makes sense for businesses to automate this vital process to ensure effectiveness and efficiency.
Securiti is a market leader in providing AI and machine-learning-based enterprise solutions to various data compliance-related problems such as cookie consent management.
Request a demo today to see Securiti's tools in action and learn how Securiti can help your business.
See how easy it is to manage privacy compliance with robotic automation.
billed annually or monthly
|Number of domains||1||1|
|Configurable preference center||1|
|Automated website scanning|
|Automated cookie categorization|
|Automated banner code generation|
|Auto-blocking of 1st and 3rd party cookies|
|Geo-based cookie banner|
|IAB EU TCF v2.0 support|