TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Tracker | The ePrivacy Regulation: It’s not just about cookies anymore Related reading: European Commission proposes formal ePrivacy Regulation



The European Commission's draft ePrivacy Regulation, published earlier this month as the EU works to replace the ePrivacy Directive (aka "the cookie law"), is a game changer for online privacy. It is a big push for a structured framework on technology enablers for companies doing business within Europe. The regulation makes a minimal effort to address the actual use of "cookies," and getting user consent through cookie banners has been left in the dust. Instead, the regulation goes into great length explaining case scenarios on technology enabler examples required to have enhanced privacy protection that include an end-user's consent and transparency on expected usage. The definition of these technology enablers has expanded under the regulation — highlights include, but are not limited to:

  • MAC address
  • IMEI device number
  • IP Address
  • Spyware
  • Web bugs
  • Hidden identifiers
  • Local storage
  • Pixels
  • Other tracking tools 

The regulation looks comprehensive at face value, especially when considering the breadth of highlighted technology enablers. It includes anyone processing electronic communication, whether be it through an OTT (over-the-top) service, IoT (Internet of Things) providers, or any website that uses any technology enablers to collect data from European visitors.

Under the regulation, all such technology enablers are required to have enhanced privacy protection that include end user consent and transparency on expected usage. Now, this is great in theory. In practicality, it’s an operational nightmare.

The regulation will force providers to establish an operational framework for every technology enabler used — whether it’s the website operator or the extended relationships with affiliated vendors that provide targeted advertising, fulfillment or analytics. This is where it’s going to get cloudy for operators. These days, there seems to be audience segments for all sorts of analytics. Currently, there are multiple layers and elements collected online in the name of "analytics." As a matter of fact, analytics providers have expanded into basic analytics offering in a plethora of marketing and advertising services based on the data gathering. The regulation on these data gathering and usage methods will put analytics collectors in a tailspin. If the regulation stands in its current form, getting affirmative consent and disclosing usage in transparency will play havoc for operators. Especially considering operators don’t always know how the data will be used until after the fact.

The regulation also tries to establish a firm distinction between analytics and targeting. Let’s say you truly have gone through the analytics "analysis" and think you have a good rationale as to why the data collection is classified as analytics and not targeting. Great, well I hope you have this analytics working in-house or collected through true "first-party" cookies, otherwise the third-party data collection and passage will pose a problem to comply with the regulation. Per the regulation, third-party cookies are not allowed without additional provisions. Operators that need to collect information through third-party analytics may be forced to address this scenario through a binding agreement between the user and operator. The challenge will be how to implement this affirmative consent process before placing any third-party technology enablers on the user's browser.

The regulation also talks about centralizing consent in software such as internet browsers. However, do-not-track signals were introduced over seven years ago, yet there still is no consistency and commonality on how to interpret such signals. To compound the scenario, there still is no consistency on the technology enabler platform — as highlighted above, there are multiple competing technologies for how such data is gathered. Every technology differs on what that do-not-track signal would look like. It’s easier said than done to have do-not-track signal be opted in and out in such a diverse ecosystem.

The biggest evidence to highlight this dilemma is the advertising ecosystem. This has been a swirling discussion within the industry for quite some time now. As much spin as there seems to be the around lack of agreement, there does seem to be a consensus on moving toward the right direction. On Jan. 25, the Digital Advertising Alliance finally came out with an enforcement commitment for its members as of Feb. 1,  just two days after FTC released a transparency report on cross-device tracking with best practice recommendations for truthful disclosure, consumer choices, gaining affirmative consent and maintaining reasonable security. Between best practice recommendations from the FTC and DAA’s self-enforcement commitment, there is hope for some sort of standardization in recognizing the do-not-track signals.

Finally, the regulation expects websites to obtain affirmative active consent before any cookie is placed, and a separate consent is still expected for each type of cookie used on any given site. In practicality, it is extremely difficult to operate by this model. Website operators drop cookies and information collection practices ensue the moment you land on a site. The regulation dictates that website owners will need to be able to demonstrate that users have consented. In addition, website owners (i.e., first parties) will be responsible for managing consent needed for third-party tracking.

The regulation suggests that operators have pre-defined categories of data collected and technology enablers along with a concrete roadmap in place that defines such collection and usage practices. In reality, operators do not always know how to interpret the collected data and what aspect to use the data for until after the fact. Boundaries between analytics and marketing type data will be extremely difficult to pre-define. If the regulation stands in its current form, we may see a very mixed type of implementation from companies operating in Europe.

The regulation is certainly advanced in its ask, but the technology and its standardized treatment of collection enablers, including how to interpret into actual consent and truthful transparency is still lacking. 

1 Comment

If you want to comment on this post, you need to login.

  • comment Mike O'Neill • Feb 3, 2017
    I would like to correct some of the inaccuracies in this post.
    Article 8 of the EPR clearly says that processing and storing of any information (not only personal data) on users' equipment is prohibited unless they have given their "freely given, informed and specific" consent or if another of a limited set of exceptions apply. These exceptions are the same as those in the original 2009 amended Directive, with the addition of processing "necessary for web audience measuring",  but only when
    "such measurement is carried out by the provider of the information society service requested by the end-user". This is much wider than "third-party cookies are not allowed without additional provisions", it is not based on how cookies are handled but who is using the data. It only applies to the site the user has visited, not for example a third-party analytics provider such as Google.
    It is also unhelpful to misrepresent the work of the W3C Tracking Protection Working Group (WG) and say that there is "no consistency and commonality on how to interpret" Do-Not-Track or that "every technology differs on what that do-not-track signal would look like". The WG has developed clear guidance on this, and both the interpretation TCS and technical specification TPE documents have been stable for many years. They were subject to a lengthy public comment stage 2 years ago and are both now Candidate Recommendations. 
    The WG has recently been re-chartered to focus on an extended implementation phase "to demonstrate the viability of TPE to address the requirements for managing cookie and tracking consent that satisfies the requirements of EU privacy legislation".
    If anyone wants help with implementing the recommendation we have published a guide  
    The DAA’s self-enforcement commitment does not mention Do-Not-Track. The AdTech industry did not want to extend that much clarity and effectiveness to user control, and simply continue to offer the tired and unpopular AdChoices opt-out procedures. These are unwieldy to use, are often ineffective and rely on users accepting and retaining  third-party cookies.
    Hopefully with the strengthening of enforcement powers in the GDPR and the forthcoming EPR, AdTech companies will see the light and get engaged once more before the full Do-Not-Track recommendation is finalised.