Join our webinar on democratizing data in the cloud with Forrester, Snowflake and TIAA - Sign up here

Start Now

In today’s digital world, businesses collect a wealth of personal data, rely on it, and use it for assessing data subjects’ preferences, building their profiles and sending targeted advertisements, promotions, customized products and recommendations or suggestions that you see on your web browser. For this purpose, personal data is collected, shared, disclosed, and sold via cookies and other similar tracking technologies such as pixels, beacons, local storage, and more. Since cookies identify website users, build their profiles, and collect and sell their information to several  other parties including ad-tech companies, there has been a growing concern for the user’s data privacy.

Cookies are small pieces of data that are stored on the user’s terminal equipment (Terminal equipment refers to computers, laptops, mobile phones and any other electronic device used to access the internet) every time they visit a website. Its primary purpose was to remember and recall stateful information and create a customized web page for each specific consumer. This was evolved when organizations started using cookies to analyze a consumer’s behavioural pattern and develop targeted  marketing activities.

What are the two types of consent regimes?

When it comes to relying on a user’s consent as a lawful basis of data processing, global privacy regulations can be classified as either an opt-in or opt-out consent regime.

  • Opt in consent

In an opt-in consent regime, user consent is required before the processing of personal data and users are explicitly asked to provide their consent and they are  free to grant or deny consent. Some of the examples of opt-in consent regimes are European Union, Brazil, and New Zealand.

  • Opt out consent

In an opt-out consent regime, the user’s consent is not required before the processing of personal data. However, organizations are still required  to provide users an option to object to processing of their data and provide relevant information about the use of cookies.  Some of the examples of opt-out cookie consent regimes are United States, Hong Kong, and Estonia.

Is European Union an opt-in consent regime?

The General Data Protection Regulation (GDPR) and e-Privacy Directive are two major laws that govern the use of cookies and other tracking technologies in the European Union (EU). The EU offers an opt-in consent regime.

The GDPR defines consent of the data subject as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data belonging to him or her”. Although the GDPR does not expressly mention cookies, it classifies cookies as a type of “online identifier” meaning that cookies may be considered personal data under certain circumstances. As a result, all GDPR principles pertaining to the processing of personal data will automatically apply to the use of cookies and other identification technologies.

The e-Privacy Directive further requires organizations making use of cookies to provide clear and precise information to users about the purposes of cookies and provide users an opportunity to refuse to have a cookie stored on their terminal equipment.

Read about the EDPB’s Updated Guidelines on Consent here.

How do organizations collect user consent?

Organizations subject to privacy regulations can use a cookie consent banner to collect user consent. They must ensure that the cookie consent banner include the following:

  • Clear and comprehensive information about cookies:

The cookie consent banner must contain plain and understandable information about the cookies that an organization intends to use. The information must  include at least, the information on general purposes of cookies, the user’s ability to withdraw and change consent along with the method of doing so, data controller’s name and identity, data processors’ names and identities, full list of recipients or categories of recipients who will obtain personal data through the processing of cookies, and information on individual cookie properties.

  • User’ ability to withdraw and change the consent:

The cookie consent banner must give equal prominences to accept and reject options. The user must be allowed to withdraw consent or change consent at any time, without any detriment in a user-friendly mechanism.

  • Selection and deselection of individual cookies:

The cookie consent banner must allow selection and deselection of individual cookies by purposes and must have separate opt-in and opt-outs for separate types of cookies.

  • No pre-selected checkboxes or cookie walls:

The cookie consent banner must not have pre-selected preferences by default for non-essential cookies. Similarly, an organization must not make access to a service or functionality of a website conditional on the user’s consent to the processing of non-essential cookies.

These requirements help organizations ensure consent is freely given, specific, informed, and an unambiguous indication of users’ preferences.

Additionally, organizations must maintain up to date and comprehensive cookie consent records. These records must include information provided to users at the time of obtaining consent, information of the session in which consent was expressed, consent workflow at the time of the session including subject identity, cookie category, consent status, consent date, and information on first and third parties of cookies.

third party vendors

How Securiti can help?

Where organizations leverage consent as a legal basis of data processing, they must ensure that all elements of valid consent are fulfilled. Securiti’s PrivacyOps approach, based on automation, enables organizations to ensure adequate fulfillment of valid consent and effective cookie consent management in the following manner:

  • Automatic scanning and cookie classification:

The first step of effective cookie consent management is automatic scanning of the website to determine what cookies and other tracking technologies a website utilizes on a data subject’s visit to the website. Automatic scanning leads to the classification of cookies and other tracking technologies as per their types and expiry periods and auto-blocking of non-essential cookies on landing pages that are not needed for the provision of the service, before the collection of data subject’s consent.

  • Cookie consent banners:

After website scanning and cookie classification, the next step is to obtain the data subject’s consent of the use of cookies and other tracking technologies. This requires organizations to deploy cookie consent banners customized to geographical locations.

Scan your website and maintain GDPR/CCPA/LGPD compliant cookie consent - FREE

Provide a simple and secure way for your visitors to exercise their right to opt out of the sale of their information to advertisers.

  • Preference center and honoring consent revocations:

If users choose to revoke consent at any time, the preference center enables organizations to honor their request. With the assistance of the preference center builder, organizations could easily configure and deploy a page for users to update their preferences on the use of cookies and withdraw consent. It allows organizations to immediately and adequately honor consent revocations across multiple systems.

cookie preferences
  • Audit trail:

The audit trail enables organizations to maintain updated consent records of users’ consents as well as the types of cookies and tracking technologies they consented.

To learn more, sign up for  a Demo and learn how we can help you comply with GDPR, e-privacy and other global regulation cookie consent requirements.

Share this

Our Videos

View More

China’s PIPL

China has drafted its new data protection law, Personal Information Protection Law (PIPL) that will strengthen the regulatory framework for privacy and data protection in China.

Learn More
View More

South Africa’s POPIA

The video gives an overview of South Africa's Protection of Personal Information Act (POPIA).

Learn More
privacy policy and notice management View More

Dynamic Privacy Policies & Notices

Automatically Update & Refresh Your Policies and Notices

Learn More
View More

Universal Consent & Preference Management

Simplify and automate universal consent management

Learn More
View More

Cookie Consent Management

Automate and manage the entire consent life cycle with efficiency for various cookie compliance regulations around the world.

Learn More
View More

Sensitive Data Intelligence

Discover granular insights into all aspects of your privacy and security functions while reducing security risks and lowering the overall costs

Learn More