#cookiebanner

Cookie Law as passed in 2009 got a new enforcement life after GDPR. Court of Justice of the European Union in the Planet49 case ruled that storing cookies required active consent(GDPR standard). Following the judgment Data Protection of Authorities of Ireland, Germany, Spain, and others have started enforcement actions against websites that do not have a GDPR compliant cookie consent banner on their website.

5 steps to create a GDPR compliant cookie consent solution for your website

Give users a notice using a banner or pop-up with clear and comprehensive information on the use & purposes of cookies. Ensure you add a link to your cookie policy or privacy policy in the notice

Set the cookies only when the user has given consent for cookies

Give users an option to Accept and Reject cookies

Create a second layer where users can give consent to each purpose of cookies separately

Create a permanent link or button for users to withdraw cookie consent. This should be placed on your home page or privacy policy page.

On implementing the above steps, your website should have the following flow for cookie consent:

GDPR Compliant Cookie Consent Banner

Table of Contents

What’s cookie consent

Cookie Consent Banner Design

GDPR Cookie Consent Examples

Cookie Consent Script

Cookie Consent for Google Tag Manager

Cookie Consent for Website Builders

Conclusion

What’s cookie consent

Cookie Consent is the process by which websites take user’s consent to set cookies. It started with Europe’s ePrivacy directive or the cookie law. With ePrivacy, it was mandatory for websites to take consent from users before storing or accessing cookies from user’s devices. However, websites termed consent as showing cookie banners with just an Ok button or implying consent by use of the website. GDPR clearly defines what constitutes as a legal consent and hence now cookie consent has to include an option to deny alongside accept and a method to give consent based on purposes or use of cookies like Targeting, Analytics amongst others.

When is cookie consent needed?

Cookie consent is needed:

If you offer your product or service to EU customers, including a free product or service. For example, media websites like Techcrunch are free services for EU customers

If you are targeting EU customers, this is indicated if you have an EU domain like .eu, .de or you offer local currencies, local language on your website or you are advertising to EU users like an American university advertising for its courses in EU

What happens if you don’t comply with cookie consent?

Users can file a complaint against your company with the Data Protection Authority of your country and this could lead to fines under GDPR. Recently, the Data Protection Authority of Ireland, Germany have started a sweep of websites to check if they comply with cookie consent and will be sending notices soon. Here are some actions are taken for not complying with cookie consent:

Planet 49: CJEU Rules on Cookie Consent

Oracle & Salesforce hit with class action GDPR lawsuit

IKEA was fined 10,000 Euros for cookie consent violations

Vueling Airlines was fined 30,000 Euros for not allowing users to give granular consent

Cookie Consent Banner Design:

A cookie consent banner has the following requirements to make it legal:

Cookie Consent Text: This is also termed as Cookie Consent Notice and is used to inform in a simple, clear language that you use cookies on your website.

Cookie Policy: This is a detailed version of your cookie consent notice explaining why you use cookies, a list of cookies with purposes and a method for users to withdraw consent for cookies

Accept & Deny Buttons: These are options for your users to either accept or deny the cookies. You should ensure that you don’t use dark design patterns to give more weight to Accept over Deny. For you cookie consent to be valid in EU, you have to ensure that for users ease of accepting and denying cookies is same.

Cookie Preferences: This should open up a preference center where users can give granular consent for each purpose. ePrivacy allows websites to set Strictly Essential Cookies without consent so that can always be on, for other purposes like Targeting, Analytics you should allow users to switch them on or off.

Is your website cookie compliant?

Scan your website for cookies and generate a compliance report

GDPR Cookie Consent Examples

Cookie Consent is the first interaction that users will have on your website, you should ensure that it is styled according to your website. Smashing Magazines list some ways to create user-friendly cookie consent banners. Some examples we liked and you can take inspiration from:

Techcrunch does a good job with the cookie consent notice. They explain to the users that they are using cookies, explains the use of the cookies, and also links to both privacy and cookie policy. However, they don’t have an option to Reject cookies and thus not a great experience for users who want to reject the use of cookies.

GDPR Cookie Consent Example: Techcrunch

AirBnB gives a preference center for users to give consent on each purpose separately. Here they have clearly defined Performance as one of the purpose explaining the use of cookies. Also, they allow users to switch off cookies for this purpose completely or switch off each cookie individually. In our opinion, consent for each cookie is overkill for users and you should be good with just giving a purpose level option to users.

GDPR Cookie Consent Example: AirBnB

Asos’s cookie banner is well styled but does not give option to users to reject or change cookie settings. This is something we would not recommend.

GDPR Cookie Consent Example: Asos

Webflow gives a nice banner at the bottom but does not give option to the user to accept or reject cookies. You can change your preferences, it would have been much better if we had the buttons on the banner itself.

GDPR Cookie Consent Example: Webflow

Cookie Consent Script

Cookie consent script blocks and unblocks cookies based on the user’s consent. It ensures websites comply with the ePrivacy Directive and GDPR. There are two ways in which the script can function:

Manually block cookies:

Change the class of each script that is setting a script from </type = javascript to </type=text & class = website-category>

The class value will allow you to handle granular cookie consent

Once the user gives you consent, change these scripts to type = javascript and execute them

One of the problems with the manual method is it takes a lot of time and you can miss some scripts which will make your website non-compliant.

Automatically block cookies:

Scans the website for cookies and allows you to categorize them into different categories

Automatically blocks the scripts and unblocks them once the user gives cookie consent

Sign-up to Privado and automatically block cookies with our cookie consent script.

Cookie Consent for Google Tag Manager

Your cookie consent solution should also ensure cookies set via tags from Google Tag Manager are blocked until the user gives consent. Here is how you can you use our cookie consent solution to do that:

Download the container from our dashboard

Import the container to your GTM, it will add the triggers to block and allow tags in your GTM account. Some examples are Allow Analytics, Block Analytics

You can either use the Allow triggers to fire these tags or use the Block triggers and add as an exception for your tags

Go to preview and your tags should only be fired once the user gives consent

‍

Cookie Consent for Website Builders

We offer integration with the following third-party website builder tools to seamlessly display a cookie consent banner:

Conclusion

Cookie Consent seems simple on the outside but involves you to set the right cookie banner, blocking cookies, tags, pixels with the help of a script, and allowing users to change cookie consent from your home page or cookie policy. This guide will help you with setting all these elements for your website.

You can also use this free cookie consent tool and make your website compliant with privacy laws across the world including GDPR.

‍

Every time a visitor says no to your cookie banner, your Meta Pixel goes dark. They browse. They buy. They leave. And Facebook never saw any of it.

In regions with strict privacy laws, this happens to 30–60% of your site visitors. Your ROAS looks terrible. Your best campaigns look average. Your budget shifts to the wrong places.

Meta Consent Mode sends a cookieless signal to Meta when consent is declined. No personal data — just an anonymous ping. Meta models the rest. Within 48 hours, your conversion reports start showing what actually happened.

Im Zeitalter von Big Data, künstlicher Intelligenz und digitalem Konsum ist Personalisierung das A und O im modernen Marketing. Kaum ein Unternehmen verzichtet heute darauf, Kundenprofile zu analysieren, Inhalte individuell auszuspielen oder Kampagnen an persönliche Vorlieben anzupassen. Doch wo verläuft die Grenze zwischen nützlicher Relevanz und übergriffigem Tracking? Zwischen smarter User…

10 Examples of GDPR Cookie Consent

Cookies are small text files that get downloaded on the site visitor’s device when they visit a website. It allows the website to recognize the device and store additional information, such as user preferences, location, etc.

Developers and businesses use cookies to improve and enhance the user experience. However, when your website uses cookies, you are required to declare it to the site visitors. Thereafter, you will have to gain explicit cookie consent from the user for GDPR compliance.

However, things are not that straightforward. There are several factors that determine whether your cookie consent practice is great or sketchy. Some of these factors include your cookie consent notification, the language used in it, the accessibility of the cookie policy, and so on.

In this post, we will take a look at GDPR Cookie Consent notice, different types of cookie notifications, along with GDPR Cookie Consent examples across all domains.

What is GDPR Cookie Consent Notice? Why Does it Matter?

Laws like the General Data Protection Regulation (GDPR) and ePrivacy mandate that users must explicitly grant their consent before websites can deploy or install cookies on user computers. Hence, if the user or the business is based in the EU, they must adhere to these regulations.

As such, Cookie Consent Messages emerge as banners, pop-ups, and notifications on a website offering the user the option to consent, deny, or change the preferences of the use of cookies.

The key highlights of cookie consent as per GDPR guidelines include:

Cookie Consent Message must be clearly visible and must display when the user first visits the website.

The consent collection must be through an explicit opt-in action with dedicated buttons to accept, reject, or modify cookie settings.

It should include a link to the website’s cookie policy.

All the non-exempt cookies and scripts must be blocked from running until the user consents.

Different Types of Cookie Notifications

There are several ways in which you can display your cookie consent message. Some of the common ones are listed as follows:

Cookie Banner: These alerts are located as headers and footers and are fixed in their position. Its inconspicuous location ensures that it does not eclipse any content and is yet prominently located.

Cookie Consent Pop-Up: These messages emerge as pop-up notifications that may be located bang in the middle of the website or as a corner box on either side. Users can interact with the box to access the website content.

Implied Consent: In implied consent, websites assume that the user has agreed to the terms and usage of cookies if they continue to interact with the website. While it is not one of the best practices, considering that the user does not offer explicit consent, adding a link to explore cookie policy and modify settings could ensure GDPR Cookie Compliance.

10 GDPR Cookie Consent Examples

Following are 10 Cookie consent examples from various live websites:

1.

BT

British communication giant, BT, checks all the boxes and follows the best cookie consent practices, making it first on our list of GDPR cookie consent examples. Visitors receive a Cookie Consent Popup notifying them about BT’s Cookie Policy. Users can choose to accept the cookies as is or modify them through the “Edit Cookies” button.

It allows you to navigate panel-by-panel the different types of cookies that the website collects and their purpose.

Thus, you can accept or reject the cookies individually, depending on your preferences. Alternatively, you can select the “Allow all cookies.”

Additionally, after you have set the cookies, you can change these cookie settings using the dedicated cookies button at the bottom of every webpage.

As such, BT sets a great example of implementing GDPR Cookie Consent and GDPR Cookie Compliance.

2.

The Guardian

The Guardian displays a highly detailed banner at the footer that educates the user on the website’s cookie policy and usage. After going through the briefing, the users can grant explicit cookie consent with the “Yes, I’m happy” button or modify the settings through the “Manage my cookies” button.

3.

Puma

Puma has a floating banner at the footer. Users can check out the additional information through the “Cookie Settings” or directly agree to the preferences preset by the site with the “Accept all cookies” button.

4.

Kitchn

The culinary website keeps it simple with a plain footer declaring the change in the cookie policy as per GDPR guidelines. A single-click “Accept” button offers a blanket consent for the cookies. Alternatively, the “Learn more” link redirects to the GDPR Cookie policy page that contains all the necessary information.

5.

Financial Times

The Financial Times has the cookie consent message positioned as a corner box. Users can accept and continue browsing, or they can manually manage their cookies. Rather than following the obsolete practice of the persistent cookie wall, FT pushes for the subscription plans.

6.

H&M

The retail website has a persistent cookie consent corner box that displays on all pages. Clicking on the link in the cookie consent message redirects the user to the complete privacy notice issued by the company.

7.

British Airways

British Airways uses implied consent, declaring that the use of the website indicates the user’s consent for storing cookies. However, it maintains transparency by sharing the T&Cs, Use of Cookies, and Privacy Policy.

8.

Glamour Magazine

Glamour Magazine starts off with the standard cookie consent message. On clicking on the “Show Purpose” option, Cookie Consent Manager offers a buffet of cookies and their usage to users that they can toggle on or off to accept or decline their preferences.

9.

Harper’s Bazaar

Harper’s Magazine has a brief message of the cookie policy and a link to all the IAB vendors that gain access to these cookies. Users can accept them all in one go with the “Accept” button or individually select their choices through the “Learn More.”

10.

Nescafe

Visitors receive a Cookie Consent Popup on visiting the Nescafe website. The message links to the company’s privacy notice and GDPR cookie policy. Users can change and set their preferences through the link in the message or directly decline or accept the cookies with the buttons presented below.

Summary

Whether you use Shopify or WordPress, cookie consent forms a crucial part of any website, regardless of its purpose. Most websites that have a well-defined cookie consent flow make use of a Cookie Consent Manager to facilitate it. Cookie consent reinforces privacy and ensures compliance with regulations like GDPR.Here is a link for a free cookie consent solution.

Now that we have seen different examples, In this Article you can read about how to implement cookie consent on your website in 5 simple steps.

Die DSGVO schreibt vor, dass Webseitenbetreiber lückenlos erfassen, welche User ihnen welche Zustimmung zum Speichern von Daten gegeben haben. Aufgabe der Consent Management Plattform (CMP) ist es, diese Zustimmungen zu dokumentieren und maschinenlesbar bereitzuhalten.

Quelle: Pixabay von Tumisu Was darf gespeichert werden? Dürfen Cookies gesetzt werden? Mit dem aktuellen EuGH-Urteil („planet49“) zum Setzen von Cookies wurde noch einmal präzisiert, dass eine vorangekreuzte Checkbox als Zustimmung nicht ausreicht. Notwendig ist eine dezidierte Abfrage der geplanten Nutzung und die jeweilige Möglichkeit zum Widerspruch (Opt-Out) durch den User. Ein simpler OK-Banner mit dem Hinweis auf das erfolgende Datensammeln und der Hinweis auf die Datenschutzseite mit Link dürfte langfristig zu kurz greifen. Für Webseiten, bei denen die Daten der User nicht verarbeitet oder werblich genutzt werden, ist dies sicherlich ausreichend. Sobald man aber Tracking-Tools wie beispielsweise Google Analytics einsetzt, besteht Handlungsbedarf. Es besteht jedoch keine Panik, wenn man noch diese Methode bei sich auf der Seite einsetzt. Man sollte jedoch die nächsten drei Monate nutzen, um technisch aufzurüsten und eine Consent Management Plattform (CMP) zu verbauen. Der IAB (Interactive Advertising Bureau) hat dazu gerade einen Standard – das IAB Consent Framework – in der Version 2.0 veröffentlicht. Sofern man beabsichtigt, am digitalen - und vor allem am programmatischen - Werbemarkt teilzunehmen, dürfte dieser Standard bald die Grundvoraussetzung sein.

Quelle: https://www.iab.it/wp-content/uploads/2019/08/TCF-Infographic-How-It-Works.pdf Was leistet eine Consent Management Plattform (CMP)? Mittlerweile sind verschieden CMPs auf dem Markt, die teilweise sogar kostenlos sind. So hat z.B. der Springer-Konzern mit der Open Source Plattform Oil ein kostenloses Tool ins Netz gestellt. Hier fehlen dafür einige Komfortmerkmale. Daher haben wir uns zusammen mit unserer Beteiligung Quantyoo für die Lösung des deutschen Unternehmens Usercentrics entschieden. Weitere Anbieter in diesem Bereich sind das dänische Unternehmen Cookiebot, die niederländische Factor.io, Didomi aus Frankreich oder SAP Costumer Consent. Wie bereits erwähnt, ist es aus unserer Sicht unverzichtbar ein Tool einzusetzen, das auf dem IAB Consent Framework 2.0 aufsetzt, da es alle notwendigen Informationen enthält, um am digitalen Werbemarkt teilzunehmen. Mit den Informationen in der Consent Management Plattform (CMP) ist der Webseitenbetreiber in der Lage, über jeden Kontakt - also sein angebotenes oder ausgeliefertes Inventar - exakt zu wissen, ob die Zustimmung (Consent) zur Speicherung und Verarbeitung der dazugehörigen Daten vorliegt. Diese Informationen werden mit dem Inventar übergeben und die Gegenseite ist in der Lage abzuprüfen, ob der Consent des Users vorliegt. Bereits heute wird von den meisten DSPs - also der Nachfrageseite - Inventar ohne eindeutigen Consent konsequent abgewiesen.

Quelle: https://usercentrics.com Was ist ein Privacy Center? Unter einem Privacy Center versteht man das Infofenster (Cookie Banner), dass dem User beim Öffnen der Webseite angezeigt wird. Hier wird die Zustimmung abgefragt. Dazu werden dem User alle auf der Seite eingesetzten Tracking- und Werbetechnologien aufgelistet. Diese Liste kann dabei schon heute sehr lange sein. Über Checkboxen kann der User dann individuell seine Einstellungen und Zustimmungen vornehmen. Dadurch hinterlegt er, welchen Arten der Datenspeicherung und Datenverarbeitung er zustimmt. Die Auflistung der hinterlegten Webtechnologien und deren Granularität, liegt im Ermessen jedes einzelnen Webseitenbetreibers. Da dies rechtlich höchst relevant ist, sollte hier sehr gewissenhaft und regelmäßig die Liste überprüft werden. Bei der von uns favorisierten Technologie sind bereits 600 unterschiedliche Webtechnologien hinterlegt, die einzeln aktiviert werden können.

Quelle: https://usercentrics.com Fazit Wir empfehlen allen Unternehmen und vor allem den von uns betreuten und vermarkteten Unternehmen, innerhalb der nächsten drei Monate eine Consent Management Plattform (CMP) auf IAB-Standard 2.0 einzubauen. Hierzu haben wir, die notwendigen Vorkehrungen getroffen, und unsere Sender aufgefordert, dieses Thema in den Etat- und Ressourcenplanungen für 2020 zu berücksichtigen. Gerne leisten wir hierbei Hilfestellung.

Unnötige Panikmache? Oder riskieren Sie eine Abmahnung durch einen falschen Cookiehinweis? Der Europäische Gerichtshof hat am 01.10.2019 geurteilt, dass Webseitennutzer der Anwendung von Tracking ausdrücklich zustimmen müssen. Weil das in der Regel kein Nutzer macht, könnten Seitenbetreiber nun ein Problem haben.

Worin besteht das Problem?

Die Cookiebanner auf jeder Webseite informieren den Nutzer darüber, welche Trackingmethoden und Cookies eingesetzt werden. Meistens kann der Besucher diese Dinge dann abwählen (Opt-out-Verfahren). Doch nun hat der EuGH entschieden, dass die gängigen Trackingmethoden, die gerne für Onlinemarketing verwendet werden, nicht mehr genutzt werden dürfen, wenn nicht der Kunde vorher in diese Nutzung eingewilligt hat. Ausgenommen von dieser Regel sind solche Cookies, die technisch notwendig sind. Das ist dann wohl das Ende des Marketings, wie wir es kennen. Warum ist das so? Nun, der Nutzer klickte bisher einfach die nervige Cookie-Einblendung weg. Seine voreingestellten Cookie- und Trackingmethoden bleiben aktiv. Doch nun soll der Nutzer das Cookiebanner wirklich lesen und auch noch aktiv den Haken setzen, mit dem er den Einsatz von Cookies genehmigt. Doch welches Interesse hat der Nutzer überhaupt, einen Haken für Tracking zu setzen? In der Regel möchte der Nutzer keine Werbung. Wenn er sich für einen Adblocker entschieden hat, wie soll der Seitenbetreiber da eine Zustimmung einholen? Ist nun das Onlinemarketing tot? Fest steht: Wesentliche Marketingformen sind nicht ohne Tracking umsetzbar. Und Tracking wiederum ist ohne Zustimmung nicht umsetzbar. Der Nutzer hat jedoch keine Lust, seine Zustimmung zu erteilen.

Welche Lösung gibt es?

In Zeiten der DSGVO müssen sich Webseitenbetreiber neue Lösungen einfallen lassen. Da gibt es beispielsweise die Lösung des kostenpflichtigen Zugangs, ganz ohne Werbung und Tracking. So kann der Nutzer dann entscheiden, ob er lieber mit seinem Geld oder mit seinen Daten zahlen will. Daneben gibt es individuelle Profi-Lösungen wie das Consent Tool. Es funktioniert für die meisten Webseitentypen unabhängig von dem verwendeten CMS. Wichtig wird vor allen Dingen sein, dass die wichtigsten Tools wie Facebook Pixel, GoogleMaps, Google Analytics, YouTube, Twitter, Xing und Google TagManager in Übereinstimmung mit dem Datenschutz umgesetzt werden. Unser Kundenversprechen an Sie: Wir helfen Ihnen rechtzeitig. Wir prüfen notwendige Schritte und prüfen für Sie, welche Erweiterungen oder Skripte problematisch sind. Wir prüfen für Sie die Umsetzung und Einstellung der entsprechenden Werkzeuge und nutzen dazu rechtskonforme Zusatzmodule.

Fazit