In terms of core requirements, the European Court of Justice made it clear in its 2019 Planet 49 judgment (in line with the EU General Data Protection Regulation and ePrivacy Directive) that for EU website visitors, informed and affirmative consent is required prior to placing all but “essential” cookies. The California Consumer Privacy Act, on the other hand, requires notice of what personal data is being collected by cookies, but rather than consent, organizations need only allow visitors to opt out of the sale of their personal data, which may include exchanges of value based on personal data collected by cookies.

Perhaps the most challenging aspect of gaining compliance with these requirements is not just getting the right banner and consent mechanism in place, but rather doing the underlying work that supports the proper and accurate functioning of these mechanisms. This requires identifying all cookies being placed and ascertaining what personal data they collect, the purposes of the collection (e.g., are they essential cookies, functionality cookies, performance cookies, marketing cookies, etcetera), and whether there is a sale of data taking place. While the resulting cookies banner with appropriate choices may appear reasonably straightforward, quite a bit of work will go into putting underlying structures in place so that, for example, non-essential cookies are not placed on browsers of EU residents until they consent, and cookies are appropriately categorized to allow the application of website visitors’ choices.

While organizations may choose between conducting this process on their own or with the assistance of a cookie compliance tool (e.g., OneTrust, TrustArc), each approach will require manual steps for the identification and categorization of cookies, as well as continuous communication with internal stakeholders and third-party service providers.

Website and cookie inventories

Depending on the size and nature of its business, an organization may operate multiple websites under multiple domains, each of which may set different types of cookies for different purposes. An organization undertaking a cookies compliance initiative should develop an inventory of all websites that includes the domain name, the purpose of the site, the types of visitors using the site, the geographic region(s) being served and any service providers that are engaged to update the site. Just obtaining this baseline information will require communication with and cooperation from multiple internal teams and service providers.

After obtaining a clear picture of different domains being operated and the website for each domain, the cookies being served to the browsers of visitors to those websites must be identified. Organizations may choose automated tools to conduct scans of their website that will generally produce a list of cookies, which may include, depending on the cookies, the name, lifespan, category and description of each cookie. There are a variety of methods for identifying cookies being placed, including tools like OneTrust and TrustArc, as well as browser extensions, such as Cookie Inspector or Ghostery, and scanner websites, like Cookie Serve. This can also be accomplished by reviewing the content settings on a web browser. Experience shows that certain methods may pose issues with accuracy and consistency, so conducting multiple scans via different methods will help to create and maintain a comprehensive list.

Cookie categorization

Having developed a list of cookies for each web domain, the cookies need to be categorized so that consent or appropriate preferences choices can be provided to visitors. Categorization also supports the determination of which cookies may be covered by applicable exemptions.  

Categories

At a high level, all cookies will fall under two large categories: essential and non-essential.

Essential cookies (also commonly referred to as “strictly necessary”) are necessary for the website to function and are only used to provide those essential services to the visitor. These cookies are exempt from the EU opt-in requirements or the CCPA opt-out-of-sale requirements and, therefore, may be placed on devices and remain on the devices to the extent necessary to provide the essential functions.

Non-essential cookies are any cookies that do not fall within the definition of an essential cookie and may fall into one of several subcategories, commonly including:

• Performance and analytics cookies, which collect information about how visitors use a website to analyze visitor behavior and improve website services.
• Functionality cookies, which collect and “remember” visitor choices to provide a more personalized and functional user experience.
• Targeting and advertising cookies, which are used to target and display content, including advertisements, based on user preferences.

Categorization process

Determining the appropriate category for each cookie can be time-consuming and challenging, depending in part on the sophistication of the website. It must, however, be done diligently, as essential cookies improperly categorized as non-essential could be disabled by a website visitor, impacting the website functionality. Additionally, non-essential cookies that are miscategorized as essential may result in violations of applicable requirements.

If the organization is working with a web services provider to manage their site, that service provider should support the determination of which cookies are essential to the site’s functionality and support the categorization of any other non-essential cookies. This approach will likely require consistent communication between the service providers and internal stakeholders, requiring a fair amount of diligence to keep the process thorough and efficient.

Organizations using a cookie compliance tool should start by looking into the scanning resources offered by that tool. These tools can categorize the bulk of the more well-known cookies, but any cookies that are not recognized by their system or are that are specific to your site will remain “unknown.”

For unknown cookies or organizations performing the categorization manually, there are online resources that may be helpful. Cookiepedia, for example, a public OneTrust site, provides categories for cookies that exist within their database. Additionally, inputting the cookie name into a search engine will often return results providing sufficient information to correctly categorize the cookies or enough information to deduce the purpose (e.g., cookie whose descriptions including words like “required” may be essential, whereas those with descriptions such as “advertisers” or “targeting” would appear to be non-essential). Such manual categorizations can be challenging and should be verified by the website manager or web services provider.

Putting the results to work

Accurate cookies categorization requires commitment, first to get it right and then to periodically validate that categorizations remain accurate. The efforts, however, pay off in putting in place the structure to enable effective cookies compliance and management. Upon completing the inventory and categorization, an organization will be in a position to:

• Develop and publish a cookie policy. This can realistically only be done after the cookies have been identified and categorized, as the policy must inform visitors of the categories of cookies being placed and what types of personal data are being collected.
• Design and implement a cookie banner. The banner is critical as the initial point at which the website visitor has the opportunity to learn what cookies will be placed and make choices about those cookies.
• Implement user preference and consent management. This represents a critical interaction point with your website visitors, facilitating more granular choices than are available on the initial cookies banner.

A thorough and complete cookies categorization initiative will provide the proper foundations to implement key components of your cookies compliance efforts, including blocking non-essential cookies until an EU website visitor provides consent, and delivering opt-out-of-sale options to California residents.

Photo by Jason Jarrach on Unsplash