Every website places tiny text files on your device while you browse. These files are called cookies. Your web browser processes and stores these cookies. When you return to a website you visited before, the server reads the cookies stored in your browser and recalls information about you, like your previous browsing activity on the same website.
In this post, we will discuss what cookies do and why they matter. Different laws and regulations on the use of cookies emerge worldwide. Based on where you live and work, you must have heard something about CCPA cookie consent, GDPR cookie consent, ePrivacy Directive, or ePrivacy Regulation.
We will cover the basics of how cookies are affected by the GDPR, ePrivacy Directive and ePrivacy Regulation.
Cookies are usually harmless; you can view and delete them without a problem. They are just text files, unable to run independently or install anything on your device. They cannot access or modify any other files on your device.
However, cookies have the power to identify you without your consent in some cases. Their primary purpose is to help advertisers reach you with highly customized and targeted ads. In some cases, cookies can store information that is considered personal. For this reason, cookies fall under the GDPR and the ePrivacy Directive.
All eyes are on the recent updates on a cookieless future. To understand cookie compliance rules and regulations, we need to be on the same page on the different types of cookies.
There are three ways to classify cookies:
Let’s start with the duration criterion. Cookies are divided into such categories by their timespan:
As for their origin:
Some cookies don’t quite fit into any category. For instance, Facebook cookies are created by a third party, and working with them requires using Facebook marketing tools. However, you store them on your website like first-party cookies.
The purpose is another criterion for categorizing cookies:
Non-essential cookies can be further subcategorized into:
Now, it should be clear that different types of cookies either concern user privacy or don’t. Since cookies can affect users' privacy, companies are obliged to handle them carefully and in compliance with different regulations that are relevant to them.
The European Union wants to protect the privacy of its citizens with the help of the General Data Protection Regulation (GDPR). The GDPR is the data privacy and security law that includes hundreds of pages’ worth of new requirements for companies from across the globe. So far, it is the most comprehensive legislation that has ever been passed by any governing body.
It only mentions cookies once in Recital 30.
According to the GDPR, cookies qualify as personal data, since they are used to identify users. So, GDPR cookie consent compliance is a must if you are affected by it. Companies can process personal data of the users as long as it can be justified on the grounds of legitimate interests. Here’s an example of legitimate interest: your company has a legitimate interest when processing personal data within the client relationship for direct marketing purposes.
The GDPR recognizes a litany of new privacy rights for data subjects, which aim to give individuals more control over the data they loan to organizations. It’s vital to understand these rights to ensure you are GDPR compliant. If you fall under the GDPR Directive, everything you do in your organization must, “by design and by default,” consider data protection. We recommend seeking legal advice if your business falls under the GDPR to ensure you comply with the 88-page regulation.
GDPR is complemented by the ePrivacy Directive and ePrivacy Regulation. Let’s take a closer look at two of them.
ePrivacy Directive was passed in 2002 and later amended in 2009. The ePrivacy Directive (EPD) has become known as the “cookie law”. It is so because its most visible effect was the proliferation of cookie consent pop-ups after it was passed. It supplements the GDPR and in some cases, overrides it, addressing crucial aspects of the confidentiality of electronic communications and the tracking of Internet users widely.
The ePrivacy Directive gives extensive instructions on how users must be informed and have consent choices when sharing their electronic data. The ePrivacy Directive focuses on the companies' responsibility to collect and handle electronic data from users.
ePrivacy Regulation, although frequently mentioned together with the ePrivacy Directive, is not the same thing. ePrivacy Regulation is a law that turns the ePrivacy Directive into binding law. All data privacy violations are to be handled according to this law.
The ePrivacy Regulation is in the stage of finalizing. It sets clearer rules on cookie usage.
The main points of ePrivacy Regulation are as follows:
If the ePrivacy Regulation is finalized in 2024, it won’t be fully in effect until 2026 due to the 24-month transition period.
To comply with the cookie regulations that fall under the GDPR and the ePrivacy Directive, you must:
Once more, if you fall under the GDPR and the ePrivacy Directive, we recommend seeking legal advice for implementing cookie compliance best practices in your business.
As the laws regarding user privacy become stricter and users become more cautious about sharing their data with third-party businesses, cookieless tracking becomes a hot topic for many businesses.
Server-side tracking is one of the most reliable and privacy-friendly methods of tracking user behavior without relying on cookies. With server-side tracking, the tracking code is executed on the server rather than the user's browser. This means the user's device does not need to store any tracking data, done entirely on the server side.
If you have any questions or need help understanding the concept of cookie-free tracking, contact us. Stape is an expert in server-side tracking. You can try Stape for free to see what it can do for your business.
Stape has lots of tags for server GTM! Click on Try for free to register and check them all.
