When it comes to the compliance of your analytical data with the GDPR, the collection of the Internet user\u2019s consent for the deposit of cookies is a key issue. Figures from a study published in May by our partner Empirik reveal that even though 93% of websites display a cookie banner, 78% trigger tracking analytics even before the Internet user\u2019s consent action \u2013 and 42% of sites continue tracking even though the Internet user has refused consent!<\/p>\n
In response to this, the CNIL has toughened its
\nstance for 2020 by preparing a new recommendation \u2013 which could have
\nsignificant ramifications.<\/p>\n
Previously in the GDPR saga\u2026<\/strong><\/h2>\nThe CNIL has so far imposed a series of record fines for non-compliance. Google<\/a> was hit with a \u20ac50 million fine from the French authority for lack of transparency, with information that was unclear and difficult for users to access (sometimes up to 5 clicks to obtain the relevant info). In particular, the tech giant was blamed for violating the rules on consent. Another example was a real estate company sentenced to a fine of \u20ac400K for non-compliance with the storage period for cookies.<\/p>\nComplaints and sanctions are increasing and highlight the fact that many companies are still far from being compliant. The CNIL has nevertheless been criticised by various associations that defend Internet users (notably the \u2018Quadrature du net\u2019 \u2013 the French advocacy group that promotes digital rights and freedoms of citizens) that accuse it of being too lax (indeed when it condemned Google, it failed to apply the fine of 4% of its turnover as stated in the GDPR) and other groups of publishers\/advertisers such as the GESTE<\/a> who have asked the CNIL to give more time to businesses to adapt and comply\u2026 It\u2019s a minefield out there!<\/p>\nThe CNIL strikes back<\/strong><\/h2>\nThe French privacy \u2018police\u2019 nevertheless announced new guidelines last July. Through this new text, the aim is to simplify the applicable law so that it is better understood and respected. The scope of the law (for example: what is the precise definition of a \u201ctracker\u201d) and the procedures for obtaining consent are explained.<\/p>\n
Some important new features to remember: <\/p>\n
\n- An end to scrolling \u2013 the continuation of navigation (scroll) is no longer be considered a valid expression of consent. <\/li>\n
- Proof of consent \u2013 operators using trackers must be able to prove that they have obtained consent.<\/li>\n
- No more cross-referencing to browser settings \u2013 this will no longer be a method of managing consent. The appearance of the cookie banner and the methods of collection will be clearly defined in the upcoming recommendation. <\/li>\n<\/ul>\n
\u00a0The draft recommendation<\/a> \u2018cookie and other trackers\u2019 was published on the 14th<\/sup> January this year. Its purpose is to set out the practical arrangements for obtaining consent. A public consultation<\/a> with professionals and civil society was launched until the 25th<\/sup> February.\u00a0 To be continued\u2026<\/p>\nDigital analytics compliance \u2013 the 2 potential scenarios<\/strong><\/h2>\nBackground: you manage your website(s) using
\nyour analytics solution and, as controller, you have to choose (tagging method,
\nactivation of options, etc.) how to bring your practice into compliance.
\nDifferent scenarios are possible: <\/p>\n
Scenario 1: Consent.<\/strong> You need to obtain the Internet user\u2019s consent: for example, you use a CMP-type market solution (or a customised solution) that is based on the categorisation of cookies or an IAB framework.<\/p>\nThe consequences in terms of analytical
\nmeasurement: <\/p>\n
\n- The cookie can only be deposited after the consent action (in this case, clicking on the acceptance button).<\/li>\n
- Failure to measure pre-click traffic can potentially alter your analyses: incorrect volumes and rebound rates, truncated navigation routes or a break in source identification. Unless<\/strong> you use a data reconciliation method after consent<\/a><\/strong> of the Internet user (1st cookie)<\/li>\n<\/ul>\n
In summary: you practice more advanced web
\nanalytics on the part of users who have consented to the processing of their
\npersonal data. <\/p>\n
Scenario 2: Exemption.<\/strong> You choose to be exempt from the requirement to obtain consent: the CNIL allows an exemption under certain conditions (article 5 of the CNIL deliberation of 4 July 2019)<\/a>.<\/p>\nThe consequences on the analytics measurement: <\/p>\n
\n- The measurement is made from the first page of the visit. You have comprehensive data reflecting the reality of the Internet user\u2019s journey.<\/li>\n
- You must comply with several conditions imposed by the CNIL, ranging from the impossibility of cross-checking with external data to compliance with the storage period. More info here<\/a>. <\/li>\n<\/ul>\n
In
\nsummary: you have comprehensive analyses on all your users that ensure your
\nnon-intrusive web analytics practice so that you do not have to collect
\nconsent.<\/p>\n
AT Internet compliance <\/strong>tools<\/strong><\/a>:<\/strong><\/h3>\nThe world
\nof analytics is therefore divided into 2 categories. Those who choose to
\ncollect consent and others who prefer the exemption. In all cases, the CNIL
\nimposes rules and it is your responsibility to activate some of these options
\nto respect the legal framework. Talk to your legal department to find out which
\noption to choose. AT Internet offers methods and tools for compliance in both
\ncases. And to get an even clearer perspective, check out our latest privacy webinar:\u00a0\u00a0 <\/p>\n
Complaints and sanctions are increasing and highlight the fact that many companies are still far from being compliant. The CNIL has nevertheless been criticised by various associations that defend Internet users (notably the \u2018Quadrature du net\u2019 \u2013 the French advocacy group that promotes digital rights and freedoms of citizens) that accuse it of being too lax (indeed when it condemned Google, it failed to apply the fine of 4% of its turnover as stated in the GDPR) and other groups of publishers\/advertisers such as the GESTE<\/a> who have asked the CNIL to give more time to businesses to adapt and comply\u2026 It\u2019s a minefield out there!<\/p>\n The French privacy \u2018police\u2019 nevertheless announced new guidelines last July. Through this new text, the aim is to simplify the applicable law so that it is better understood and respected. The scope of the law (for example: what is the precise definition of a \u201ctracker\u201d) and the procedures for obtaining consent are explained.<\/p>\n Some important new features to remember: <\/p>\n \u00a0The draft recommendation<\/a> \u2018cookie and other trackers\u2019 was published on the 14th<\/sup> January this year. Its purpose is to set out the practical arrangements for obtaining consent. A public consultation<\/a> with professionals and civil society was launched until the 25th<\/sup> February.\u00a0 To be continued\u2026<\/p>\n Background: you manage your website(s) using Scenario 1: Consent.<\/strong> You need to obtain the Internet user\u2019s consent: for example, you use a CMP-type market solution (or a customised solution) that is based on the categorisation of cookies or an IAB framework.<\/p>\n The consequences in terms of analytical In summary: you practice more advanced web Scenario 2: Exemption.<\/strong> You choose to be exempt from the requirement to obtain consent: the CNIL allows an exemption under certain conditions (article 5 of the CNIL deliberation of 4 July 2019)<\/a>.<\/p>\n The consequences on the analytics measurement: <\/p>\n In The worldThe CNIL strikes back<\/strong><\/h2>\n
\n
Digital analytics compliance \u2013 the 2 potential scenarios<\/strong><\/h2>\n
\nyour analytics solution and, as controller, you have to choose (tagging method,
\nactivation of options, etc.) how to bring your practice into compliance.
\nDifferent scenarios are possible: <\/p>\n
\nmeasurement: <\/p>\n\n
\nanalytics on the part of users who have consented to the processing of their
\npersonal data. <\/p>\n\n
\nsummary: you have comprehensive analyses on all your users that ensure your
\nnon-intrusive web analytics practice so that you do not have to collect
\nconsent.<\/p>\nAT Internet compliance <\/strong>tools<\/strong><\/a>:<\/strong><\/h3>\n
\nof analytics is therefore divided into 2 categories. Those who choose to
\ncollect consent and others who prefer the exemption. In all cases, the CNIL
\nimposes rules and it is your responsibility to activate some of these options
\nto respect the legal framework. Talk to your legal department to find out which
\noption to choose. AT Internet offers methods and tools for compliance in both
\ncases. And to get an even clearer perspective, check out our latest privacy webinar:\u00a0\u00a0 <\/p>\n
![\"\"](\"https:\/\/blog.atinternet.com\/wp-content\/uploads\/2020\/01\/RS-EN-1024x576.jpg\")
<\/a><\/figure>\n<\/div>\n