Securiti Named a 2022 Cool Vendor in Data Security by GartnerDownload Now
Published on May 24, 2022 AUTHOR - Privacy Research Team
In today’s digital world, businesses collect a wealth of personal data, rely on it, and use it for assessing data subjects’ preferences, building their profiles, and sending targeted advertisements, promotions, customized products, and recommendations or suggestions that you see on your web browser.
For this purpose, personal data is collected, shared, disclosed, and sold via cookies and other similar tracking technologies such as pixels, beacons, local storage, and more. Since cookies identify website users, build their profiles, and collect and sell their information to several other parties including ad-tech companies, there has been a growing concern for the user’s data privacy.
Cookies are small pieces of data that are stored on the user’s terminal equipment (Terminal equipment refers to computers, laptops, mobile phones, and any other electronic device used to access the internet) every time they visit a website.
The initial purpose of cookies was to remember and recall stateful information and create a customized web page for each specific consumer. This was evolved when organizations started using cookies to analyze a consumer’s behavioral pattern and develop targeted marketing activities.
When it comes to relying on a user’s consent as a lawful basis of data processing, global privacy regulations can be classified as either an opt-in or opt-out consent regime.
In an opt-in consent regime, user consent is required before processing their personal data, and users are explicitly asked to provide their consent and they are free to grant or deny consent. Some of the examples of opt-in consent regimes are the European Union, Brazil, and New Zealand.
The EU’s data privacy legal framework requires data controllers to obtain opt-in consent where the data processing is based on the data subject’s consent.
The GDPR defines consent of the data subject as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data belonging to him or her”.
Organizations subject to GDPR and e-Privacy Directive must ensure that the cookie consent banner includes the following:
The cookie consent banner must contain plain and understandable information about the cookies that an organization intends to use. The information must include at least, the information on the general purposes of cookies, the user’s ability to withdraw and change consent along with the method of doing so, the data controller’s name and identity, data processors’ names and identities, full list of recipients or categories of recipients who will obtain personal data through the processing of cookies, and information on individual cookie properties.
The cookie consent banner must give equal prominences to accept and reject options. The user must be allowed to withdraw consent or change consent at any time, without any detriment in a user-friendly mechanism.
The cookie consent banner must allow the selection and deselection of individual cookies by purposes and must have separate opt-in and opt-outs for separate types of cookies.
The cookie consent banner must not have pre-selected preferences by default for non-essential cookies. Similarly, an organization must not make access to a service or functionality of a website conditional on the user’s consent to the processing of non-essential cookies. This means the use of cookie walls is prohibited.
These requirements help organizations ensure consent is freely given, specific, informed, and an unambiguous indication of users’ preferences.
Additionally, organizations must maintain up-to-date and comprehensive cookie consent records. These records must include information provided to users at the time of obtaining their consent, information of the session in which consent was expressed, consent workflow at the time of the session including subject identity, cookie category, consent status, consent date, and information on first and third parties of cookies.
Where organizations leverage consent as a legal basis of data processing, they must ensure that all elements of valid consent are fulfilled. Securiti’s PrivacyOps approach, based on automation, enables organizations to ensure adequate fulfillment of valid consent and effective cookie consent management in the following manner:
The first step of effective cookie consent management is automatic scanning of the website to determine what cookies and other tracking technologies a website utilizes on a data subject’s visit to the website. Automatic scanning leads to the classification of cookies and other tracking technologies as per their types and expiry periods and auto-blocking of non-essential cookies on landing pages that are not needed for the provision of the service, before the collection of data subject’s consent.
Provide a simple and secure way for your visitors to exercise their right to opt out of the sale of their information to advertisers.
The audit trail enables organizations to maintain updated consent records of users’ consents as well as the types of cookies and tracking technologies they consented.
June 21, 2022
When the California Privacy Rights Act (CPRA) comes into effect, replacing the existing California Consumer Privacy Act (CCPA), organizations will have to change their current business practices around personal information handling. One significant change will be Regular Risk...
June 20, 2022
Privacy laws and regulations are enacted to bring transparency and accountability to an organization’s behavior when it comes to collecting and processing users’ personal data. Before the introduction of the GDPR article 30, accountability and transparency associated with...
billed annually or monthly
|Number of domains||1||1|
|Configurable preference center||1|
|Automated website scanning|
|Automated cookie categorization|
|Automated banner code generation|
|Auto-blocking of 1st and 3rd party cookies|
|Geo-based cookie banner|
|IAB EU TCF v2.0 support|
PO Box 13039,
Coyote CA 95013