Cookie Management - How To

We've all had to decide whether to accept or reject cookies on a website. But the big issue is that most people don't really know what cookies are or what they do, and this lack of awareness is problematic, as a lot of companies fail to comply with cookie regulations. This includes well-known companies like Amazon, which in 2021 faced a GDPR fine of €776 million, due to not complying to mandatory regulations.

If you're someone who wants to grasp the concept of cookies and discover how companies should safeguard your user rights and data, or if you're a company looking to steer clear of potential risks associated with cookie compliance and ensure strict adherence to regulations, this article is for you.

What are Cookies and Cookie Compliance 

Cookies are small pieces of information, normally consisting of letters and numbers, which online services generate when users visit them. Cookies store user information in-between website visits: they can be used to make certain website processes easier, such as remembering login usernames, and are also used when analysing traffic and user behaviour.

Cookie compliance, however, refers to aligning your use of cookies with data privacy laws. It is critical for organisations to comply to cookie regulations as it is mandated by law, but also compliance fosters user trust by demonstrating transparency, and respects users' ability to control their digital footprint.

Risks to not comply: 

1. Legal Consequences 

Data subject rights empower users to take legal action against any organisation if their privacy rights are violated. In the case of non-compliance, the severity of the punishment varies, depending on the data protection regulations. Under GDPR, companies face two legal risks of not complying: the company might be faced with a private action lawsuit, or may face Administrative Fines which go as high as 20 million Euros or up to 4% of global annual turnover. For example, Amazon, Meta and TikTok have previously faced GDPR fines of €746 million, €405 million and €345 million respectively.  

2. Losing User Trust 

Growing concerns about online safety and data handling practices are evident among users. As society increasingly becomes privacy conscious, the absence of clear consent mechanisms and user control may make users feel that their privacy and personal preferences are not being adequately respected. Non-compliance could therefore significantly damage the company’s reputation, as it undermines consumers' trust and potentially hinders the efforts to attract and retain customers. 

3. Data Security Risks 

Organisations inadvertently generate a significant volume of sensitive data, such as user behaviours, and preferences. When a company operates without transparency, its data collection methods may extend beyond authorised boundaries or become excessively intrusive. Unregulated data gathering increases the risk of data breaches and exposure of sensitive user information. 

4. Missed Marketing Opportunities 

If instead of having adequate cookie management processes in place, an organisation instead opts to not use cookies at all, they may find it challenging to accurately target specific user groups and offer tailored customers journeys and experiences.

To ensure your organisation's compliance with essential cookie regulations, we've created a step-by-step guide to help you navigate cookie management regulations.

1. Conduct a Cookie Audit 

Begin by conducting a comprehensive audit to identify all cookies being utilized on your website. This will provide insight into what data is being collected, how it's being used and will allow you to ensure no data is being collected unknowingly.

2. Assess User Experience 

Put yourself in the shoes of a website visitor and navigate through your site. Document any areas where users are informed about cookies, as well as any shortcomings in meeting compliance requirements. Are users given clear options to accept/reject the different levels of cookies - 'Necessary', 'Statistical' and 'Marketing'?

3. Ensure Mandatory Compliance 

• Inform visitors about cookies upon their first visit to the website. 

• Delay activating non-necessary cookies until users provide consent. 

• Enable users to easily withdraw consent or update their preferences at any time. 

• Classify cookies accurately, allowing users to reject non-necessary ones without affecting their browsing experience. 

• Ensure the cookie banner is well-displayed on all devices. 

• Clearly explain the purpose of cookies in plain language and provide easy access to a Cookie Policy for further details. 

4. Strictly Adhere to Necessary Cookie Use 

• Use strictly necessary cookies only for their intended purpose. 

• Ensure these cookies are not used for any other function or tracking purposes.

5. Implement Recommended Practices 

• Offer users granular choice over accepting cookies, allowing them to accept all, some, or none. 

• Inform users about the impact of certain cookies on website functionality and how their experience may change if they choose to reject these. 

• Provide access to the Cookie Policy without requiring cookie acceptance. 

• The Cookie Policy should comprehensively list all placed cookies, excluding those not placed, and accurately describe the use and need for strictly necessary cookies. 

• Ensure any third-party links in the Cookie Policy are up-to-date and relevant to maintain compliance.