Such information is incredibly valuable in creating an accurate profile of what kind of purchases might interest a visitor. If they’re using a device that has a 6-inch screen, then they’ll be shown ads designed to cater to that size. Similarly, if they’re using iOS, they’ll be shown ads that are personalized for Apple product users.
What Does the Law Say About Tracking Cookies?
Now that it’s clear what tracking cookies are used for, the different kinds of cookies, and what information is stored as a result, it is important to know what users’ rights are related to these. In other words, what does the law say about them?
Since there are different data protection laws and regulations around the world, read about what some of the major regulations around the world have to say regarding tracking cookies below:
Tracking Cookies Under GDPR
Since the General Data Protection Regulation (GDPR) was the first piece of legislation that dealt with how customers’ data was being handled and processed, tracking cookies took a center stage under Article 4 of the GDPR. As per Article 4(1) of the GDPR, personal data is any information relating to an identified or identifiable natural person such as an online identifier. Since the definition of “personal data” under the GDPR refers to the possibility of identifying an individual and the possibility remains with the use of cookies, cookies can be considered “personal data”. Under the GDPR and e-Privacy Directive, data subject’s consent is required for the use of non-essential cookies and similar tracking technologies.
The consent requirements are the same for both the use of first and third-party cookies since both are able to identify individuals and build user profiles. Such consent must be freely-given, informed, specific, and unambiguous.
As a result, without any affirmative action performed by the users, no site has permission to store non-essential cookies.
Tracking Cookies Under CCPA
The California Consumer Privacy Act (CCPA) took a different approach than the GDPR on the subject of cookies. Under the CCPA, websites are allowed to install non-essential cookies and similar tracking technologies without user’s consent provided they have informed the users about the use of such technologies and provided them an opportunity to opt-out of the sale of their personal information.
The CCPA requires all websites to communicate with users about the use of cookies at or before the point of collection of their personal information and indicate a “Do Not Sell My Personal Information” link or button on their cookie consent banners enabling users to opt-out of the sale of their personal information.
Tracking Cookies Under LGPD
Brazil’s data protection law known as Lei Geral de Proteção de Dados Pessoais (LGPD) came into effect in August 2020 after being signed into law the previous year. This legislation requires websites to be a lot more proactive in informing and educating their customers about their cookie policies. It follows an opt-in consent model, i.e, requires websites to obtain user’s consent before installing any non-essential cookies or similar tracking technologies.
Customers must be given a proper reason why cookies need to be stored, who’ll be in possession of the data, how to withdraw consent, and how to deny cookie permissions from the start.
All of this must be presented on a banner on the site with neutral language being used to properly educate the users about all their options and what to expect in their browsing journey as a result of their choices.
Final Note
In the end, are tracking cookies spyware? Not really. They’re not particularly dangerous to any device or any information on it as well. The real danger of having tracking cookies on a device comes from what exact data is being collected, and perhaps more importantly, who’s in possession of that data.
With data protection laws around the world becoming more and more strict about websites properly informing and eliciting consent from their users on the collection of their data.
Securiti is a market leader in developing Cookie Consent Management regimes. It is designed to ensure that all data protection regulation requirements worldwide, such as GDPR and CCPA, are met.
Additionally, its PrivacyOps platform can flawlessly automate Cookie consent to ensure your website can remain compliant in real-time with minimal fuss online.
