Securiti launches Gencore AI, a holistic solution to build Safe Enterprise AI with proprietary data - easily
View
Product Marketing Manager at Securiti
Listen to the content
Before aiming to be cookie consent compliant, it is important to really understand what tracking cookies are. Different cookies serve different purposes for different cookie owners. Additionally, there are several misconceptions about what tracking cookies are and what they do.
They’re nothing sinister, they’re actually the very reason there’s so much data available online about how the internet traffic behaves. But what exactly are they? How do they work? And most importantly, are they legal?
This article aims to answer these questions and cultivate a better understanding of what tracking cookies and as a result make the path towards cookie consent compliance easier:
Right off the bat, the term tracking can set alarm bells off in the mind of any user. There’s no paucity of movies or shows that depict how a simple piece of tracking software on a victim’s PC can leave them completely vulnerable to being hacked. Rest assured, tracking cookies are nothing of the sort.
Tracking cookies are nothing more than small pieces of text that automatically save certain information about the user. The information collected helps personalize the online experience. Particularly, it stores relevant marketing data for the purpose of showing any visitors better ads.
What does “better” mean? Well, these cookies are able to track browsing habits, purchasing patterns, and other relevant on-page activities to show visitors better-targeted ads. In other words, tracking cookies help companies show their visitors ads that have higher chances to convert.
That being said, there are various different kinds of tracking cookies. Each of these has a similar purpose but they collect, store, and use information differently. As a result, it’s important to know exactly what sets them apart from one another.
First-Party cookies are the tracking cookies stored directly by the website users' online visits. Suppose a customer logs in to their Facebook account and asks to allow cookies.
In this case, the First-Party cookies will store their login info in addition to other data such as language settings, time zone, the browser they’re using, etc. Such information is helpful for Facebook in keeping its analytics updated in real-time and seeing how it is performing across different audience segments.
The browser saves this information under “Facebook.com” on the computer. In case a user does not allow cookies when prompted, they won’t be automatically logged in the next time they visit facebook.com. It would require them to log in separately each time they visit the site since there’s no information being stored that would automate the login process.
Third-party tracking cookies function almost exactly the same as First-party cookies. The only difference is that they’re not based on the actual site itself. Taking the earlier Facebook example, suppose a user “likes” a Facebook page on another site. That “like” creates a third-party cookie, which then stores itself on their computer, tracking the same information as a first-party cookie.
The primary purpose behind having third-party tracking cookies is that it is easier to track users’ behavior across websites.
Another way of looking at third-party cookies is that each time a user goes to a website but doesn’t eventually purchase the product/service on offer, they’ve still created a cookie that stores info that they might be interested in that product/service. This is why the user might keep seeing related ads on a second website that might not have anything to do with the product/service being advertised.
Suppose a user heads over to a website. As soon as they land on the page, and allow the cookies to be stored on their computer, these cookies assign a unique ID number to them. This unique ID number is fundamental in helping cookies store information about them, which is then passed on to the owner of the cookies. Information passed may include browsing history, session timings, browsing patterns, frequency of visits to a site, etc.
This information is then used to create targeted ads that have a better likelihood of converting since they’ll be shown ads that have a much better chance to elicit a conversion from them.
This is arguably the main thing a user should consider when asking, “are tracking cookies dangerous?”. As mentioned above, tracking cookies are effective ways for a website to create a profile of what their customers’ purchasing habits might look like. As a result, they are able to target their visitors with ads that have the best probability of getting them to buy.
To do so, tracking cookies store a wide variety of data. This can include browsing history, what browser they’re using, whether they’re on a phone or a computer, what the time zone might be, how much time they spend on a particular page, which sites they frequently visit, where they’re visiting a particular site from, what operating system are they using, what language are they using, and if they came to a page from a specific link.
Such information is incredibly valuable in creating an accurate profile of what kind of purchases might interest a visitor. If they’re using a device that has a 6-inch screen, then they’ll be shown ads designed to cater to that size. Similarly, if they’re using iOS, they’ll be shown ads that are personalized for Apple product users.
Now that it’s clear what tracking cookies are used for, the different kinds of cookies, and what information is stored as a result, it is important to know what users’ rights are related to these. In other words, what does the law say about them?
Since there are different data protection laws and regulations around the world, read about what some of the major regulations around the world have to say regarding tracking cookies below:
Since the General Data Protection Regulation (GDPR) was the first piece of legislation that dealt with how customers’ data was being handled and processed, tracking cookies took a center stage under Article 4 of the GDPR. As per Article 4(1) of the GDPR, personal data is any information relating to an identified or identifiable natural person such as an online identifier. Since the definition of “personal data” under the GDPR refers to the possibility of identifying an individual and the possibility remains with the use of cookies, cookies can be considered “personal data”. Under the GDPR and e-Privacy Directive, data subject’s consent is required for the use of non-essential cookies and similar tracking technologies.
The consent requirements are the same for both the use of first and third-party cookies since both are able to identify individuals and build user profiles. Such consent must be freely-given, informed, specific, and unambiguous.
As a result, without any affirmative action performed by the users, no site has permission to store non-essential cookies.
The California Consumer Privacy Act (CCPA) took a different approach than the GDPR on the subject of cookies. Under the CCPA, websites are allowed to install non-essential cookies and similar tracking technologies without user’s consent provided they have informed the users about the use of such technologies and provided them an opportunity to opt-out of the sale of their personal information.
The CCPA requires all websites to communicate with users about the use of cookies at or before the point of collection of their personal information and indicate a “Do Not Sell My Personal Information” link or button on their cookie consent banners enabling users to opt-out of the sale of their personal information.
Brazil’s data protection law known as Lei Geral de Proteção de Dados Pessoais (LGPD) came into effect in August 2020 after being signed into law the previous year. This legislation requires websites to be a lot more proactive in informing and educating their customers about their cookie policies. It follows an opt-in consent model, i.e, requires websites to obtain user’s consent before installing any non-essential cookies or similar tracking technologies.
Customers must be given a proper reason why cookies need to be stored, who’ll be in possession of the data, how to withdraw consent, and how to deny cookie permissions from the start.
All of this must be presented on a banner on the site with neutral language being used to properly educate the users about all their options and what to expect in their browsing journey as a result of their choices.
In the end, are tracking cookies spyware? Not really. They’re not particularly dangerous to any device or any information on it as well. The real danger of having tracking cookies on a device comes from what exact data is being collected, and perhaps more importantly, who’s in possession of that data.
With data protection laws around the world becoming more and more strict about websites properly informing and eliciting consent from their users on the collection of their data.
Securiti is a market leader in developing Cookie Consent Management regimes. It is designed to ensure that all data protection regulation requirements worldwide, such as GDPR and CCPA, are met.
Additionally, its PrivacyOps platform can flawlessly automate Cookie consent to ensure your website can remain compliant in real-time with minimal fuss online.
Learn how you can leverage Securiti’s Data Command Center to address data security, privacy, governance, and compliance.
See a demo
Get all the latest information, law updates and more delivered to your inbox
January 1, 2024
The California Privacy Rights Act (CPRA) of 2020 which goes into effect on January 1, 2023, is expected to replace the California Consumer Privacy...
November 10, 2023
When a person logs on to a website, the server assigns them a distinctive, user-specific identity. This identity is stored on the mobile or...
August 13, 2023
The global hunger for data collection is increasing exponentially. With businesses starting to collect more and more personal data, a rapid emergence in data...
At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2024 Securiti · Sitemap · XML Sitemap
info@securiti.ai
Securiti, Inc.
300 Santana Row
Suite 450
San Jose, CA 95128
