Securiti announces a $75M Series C Funding Round
ViewWith the increasing use of cookies and similar tracking technologies, data privacy laws all around the world are increasingly requiring organizations to obtain user’s consent before the use of such technologies. Consider the opt-in consent regime of the European Union, which requires organizations to not load any non-essential cookies on their web pages unless and until they have displayed the cookie consent banner and users have accepted the use of cookies.
On 10 December 2020, the Italian data protection authority (Garante) also revised its guidelines on the use of cookies and similar tracking technologies. These Guidelines were opened for public consultation for 30 days and are now expected to be effective soon.
Some of the key points of the new Guidelines are set out below:
Privacy-by-design refers to integrating data protection considerations in the design stage. Privacy-by-default, on the other hand, requires organizations to ensure, by default, that the strictest privacy setting is available to the user. Garante reaffirms these two principles, as set out in the General Data Protection Regulation (GDPR), and requires organizations to not drop any non-essential cookies or other tracking technologies without obtaining the user’s consent. Similarly, organizations should not make use of cookie walls or pre-selected checkboxes to obtain the user’s consent and all non-essential cookies must be disabled by default.
Garante recognises that there are two main categories of cookies: technical cookies and profiling cookies.
Garante identifies that analytics cookies can be considered technical cookies under certain circumstances and would therefore not require the user’s prior consent. In that case, the use of such analytics cookies must be able to create a reasonable uncertainty as to the identity of the user. This is usually obtained by integrating the structure of the IP address within the cookie and masking portions of the same IP address. Such data minimization measures significantly reduce the identifying power of analytics cookies, and therefore, the cookies can be classified as technical cookies.
Garante’s new Guidelines apply equally to cookies and passive identifiers such as fingerprinting. The Italian data protection authority recognises that fingerprinting is the most common and increasingly used passive identifier to identify users’ devices, build users’ profiles, analyse their behavior, and display personalised advertisements. However, unlike cookies, the user is unable to directly and independently stop the profiling in case of the use of fingerprinting but instead, the user has to resort to the data controller.
In general, scrolling down a website, inactivity on the part of the user, or any other similar action does not constitute valid user’s consent for the use of cookies and other tracking technologies. However, when scrolling down a website is part of a complex series of actions which generates a specific pattern clearly showing the choice of the user to the website manager, it can be considered an unequivocal consent of the user to the use of cookies and other tracking technologies. Website managers are encouraged to make use of advanced methods based on the “dynamic web” to express consent, rather than using traditional virtual buttons. However, users must be informed of the use of such alternative methods.
To ensure that the user is provided with an equal option of accepting the use of cookies and withdrawing it, organizations must use buttons of the same size, emphasis, and colors. The buttons must be equally easy to see and use to ensure that the user is not influenced by the design choice. Garante recommends organizations to display granular and layered information in cookie consent banners. The first information layer of the cookie consent banner must include the following:
The extended cookie policy, on the other hand, must consist of all of the information required to be presented under Articles 12 and 13 of the GDPR. This includes the following information:
Organizations are not required to recollect consent at every visit of the website user. However, they must record consent to be able to demonstrate that valid consent has been obtained from the user. Organizations must reaffirm a user’s consent where the conditions of the collection of consent have changed or if they are not aware that cookies have already been installed on the user’s device in order to be re-transmitted.
Overall, the new Guidelines align with the GDPR which requires organizations to process personal data lawfully, fairly, and transparently. The Guidelines also adhere to the requirements of the e-Privacy Directive and the European Data Protection Board’s guidelines on consent, released on 4 May 2020.
Organizations are now encouraged to bring their cookie consent practices and cookie consent banners in line with the new Guidelines to avoid the imposition of any fines or penalties.
Securiti’s Cookie Consent Management solution enables organizations to build cookie consent notices in accordance with the applicable legal requirements with cookie auto-blocking, periodic scanning, and preference center features.
Elegant Consumer Frontend, Fully Automated Backend, Privacy Regulation Intelligent Everywhere.
Looks like this email is already registered with an existing account.
Looks like there was an error completing your request, Please contact us here for further support.
Please do not close this window while we process your request
Ask for a DEMO to understand how Securiti can help you comply with Italy’s updated guidelines on consent, GDPR, and a whole host of other global privacy laws and regulations, with ease.
Get all the latest information, law updates and more delivered to your inbox
September 7, 2020
Since the European Data Protection Board (EDPB) has released updated Guidelines on Consent, Consent Management Platforms (CMPs) have been reevaluating their practices in relation...
October 2, 2020
Securiti has been working closely with IAB EU to align our solution with their TCF v2.0 framework, and we’re proud to announce that Securiti’s...
October 1, 2020
On 6 April, the Data Protection Commission of Ireland (DPC) released a substantive Guidance Note on cookies (Guidance) and provided organizations a grace period of six...
At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.
Copyright © 2023 Securiti · Sitemap · XML Sitemap
[email protected]
300 Santana Row Suite 450. San Jose,
CA 95128