The European Union General Data Protection Regulation (GDPR) went into effect in May 2018. However, the policy is not all straight-forward, especially with regards to cookies.
What are Cookies?
A cookie is a piece of data that is stored on a user’s browser in form of code. For example, when your browser automatically signs you into your Facebook account, it is cookies that enable it to remember your password and log you in.
Cookies are important for providing a good user experience online. The cookies help to identify users, remember their preferences and save their login information for various websites and apps.
When you visit a website, the server hosting the site will send a message called “cookie.txt” to your browser. As you continue browsing, information about the sites you visit is recorded in this cookie file. Moreover, your data such as login credentials, website pages visited, preferences, etc. are saved on the file.
Types of Cookies
There are two types of cookies: lifespan cookies and domain cookies.
i) Lifespan Cookies
The time that a cookie remains on your browser is referred to as a lifespan. Session cookies have a short lifespan as they are erased when you close the browser.
On the other hand, persistent cookies have a longer lifespan. These cookies remain on your browser depending on the amount of time you have defined for them. The information in these cookies is preserved even when the browser is closed.
ii) Domain Cookies
Domain cookies identify the location from where information is retrieved and where it’s sent. Under domain cookies, there are first-party and third-party cookies.
First-party cookies share a visitor’s information with just one domain on the server (usually the site that the person has visited). On the other hand, third-party cookies may share a visitor’s information with other domains. For example, if you have advertisements on your website, the advertiser is collecting your visitors’ data.
The problem with third-party cookies is that website visitors often don’t realize that the information they left on one site may be shared with other website owners, who can then target advertisements to them based on their past behaviors.
If you have ever visited a website and then when you log into Facebook, you start seeing the website’s ads, this is made possible by third-party cookies.
GDPR Cookie Guidelines
ePrivacy Directive “Cookie Law” Update
The EU ePrivacy Directive, also known as the EU cookie directive, is a 2002 legal framework meant to streamline how online publishers collect data from visitors. However, this framework placed the burden on users by requiring them to consent to cookies being served on their browsers every time they visited a website.
With the implementation of the GDPR, the ePrivacy Directive requirements have been overridden with the new ePrivacy Regulation.
The ePrivacy Regulation is still being negotiated but one of its main highlights is the need for publishers to use plain language to inform users about the information they collect and how it can be used.
How to Obtain Cookie Consent on Your Website
Your website cookie consent should address two different types of cookies:
These are cookies used to enable business operation, such as:
Remembering the login details or other information that users put in a form
Saving a user’s shopping cart items
Ensuring the website works properly
General website administration
Sometimes, cookies may be required to provide visitors with a streamlined experience. These cookies may not necessarily be used for business operations but to:
Collect marketing information
Remember a visitor’s preferences over website appearance
Remember the browser so that the website can display in the most appropriate format
Remember that a user has consented to be served with cookies
Remember visitors when they come back to your website
To reduce the complexity of EU GDPR compliance, you can use regulatory compliance software to manage your documentation. The software will act as a single-source-of-truth for document management, allowing you to see your current risk exposure and prioritize compliance tasks.