ePrivacy Directive, a 10 steps framework to be as compliant as possible for marketing

#3 Cookies are not so appetizing anymore
ePrivacy Directive: to be "as compliant as
possible”?
Brussels December 7th 2022
1

aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
A plan, mainly for Ad&MarTech I
1. List digital properties:
a. Websites: who manages DNS, domain name servers, at your company?
b. Are there other digital properties where your company acts as a data
controller? Landing pages in other tools than your content management
solution (CMS)?
c. Start thinking about apps in mobile
2. Scans for cookies, pixels, trackers
a. Be ready for uncertainty as results vary so does classification (purpose)
3. Work with the CMO to decide which processors to keep
4. Find the DPAs for those data processors
5. Clean out the code of those unwanted trackers
2

A plan, mainly for Ad&MarTech II
6. Set-up a cookie policy
a. Define what is required: name of cookie, duration, how to exercise rights, ..
b. As with your privacy policy, give this policy a date stamp
7. Define those trackers who need consent
a. Classify those necessary vs. those requiring consent
b. Be prepared for additional uncertainty
8. Set-up some form of a consent mechanism – CMPs?
9. Create a process to keep these lists & DPAs dynamic
10. Audit twice a year through scanning, update cookie policy & archive
3

Uncertainty in 7b: depends on configuration
4

Tool set-ups matter!
5

Why does this classification matter?
6

Direct marketing => lead generation
The cookies in ePrivacy are just one
part of the story
The boarder picture is about direct
marketing driving leads
On your website you’d want to know:
1. where they came from and
2. what they did
They might fill in a form and this data
is ingested into a CRM where GDPR
also plays a role
7
Source: https://marketinginsidergroup.com/wp-
content/uploads/2019/04/sales-pipeline.png

Some forms drop cookies
Cookies in forms can be used for fraud detection
while others for marketing
Suggestion work outside in:
1. From ePrivacy consent
obligations
2. To forms impacted by
GDPR
3. To sales support using
CRM data and other
lawful basis beyond consent
8

2 more caveats
1. ePrivacy is more than “just” cookies, see next slide.
In this context it also applies to server-to-server communications.
Saying this mainly for actors talking about moving away from
cookies like Google, see
https://blog.google/products/chrome/update-testing-privacy-
sandbox-web/
2. Globally, such set-ups could be impacted by other legislations such
as California CCPA/CPRA, which also talks of GPC, Global Privacy
Control (similar to DNT and PIMS)
9

From the EDPS replying to the FTC
"The ePrivacy Directive covers processing of personal data and the protection of privacy including provisions on:
the security of networks and services; the confidentiality of communications; access to and storing information
on terminal equipment; processing of traffic and location data; calling line identification; public subscriber
directories. It also lays down general rules applicable to unsolicited commercial communications ("spam").
Initially, it applied only to publicly available electronic communications services (i.e. internet access provision
and telephony services.
Since the entry into application of Directive 2018/1972 establishing the European Electronic Communications
Code on 20 December 2020, it now applies to all ‘interpersonal communications services’, i.e. services
normally provided for remuneration that enable direct interpersonal and interactive exchange of information
via electronic communications networks between a finite number of persons, whereby the persons initiating or
participating in the communication determine its recipient(s) and does not include services which enable
interpersonal and interactive communication merely as a minor ancillary feature that is intrinsically linked to
another service; this includes also ‘number-independent interpersonal communications service’ such as instant
messaging (apps).”
Source: https://www.regulations.gov/comment/FTC-2022-0053-0778
10

About Google Analytics
• The conversations today are mainly about international data transfers
following SchremsII
• France, Italy, Denmark, .. Have ruled it inadequate in light of SchremsII +
the fact that Google is subject to FISA/EO12333
• French CNIL set-up a list of alternatives https://www.cnil.fr/fr/cookies-et-
autres-traceurs/regles/cookies-solutions-pour-les-outils-de-mesure-
daudience (September 2021)
• Google Analytics is being deprecated so a move to another tool is
necessary, see
https://support.google.com/analytics/answer/11583528?hl=en
• Everybody is praying Biden’s EO will solve the issue
• It won’t but what is your time frame for your company’s investments?
11

Thank you for your attention
Aurelie.pols@protonmail.com
12

ePrivacy Directive, a 10 steps framework to be as compliant as possible for marketing

More Related Content

Similar to ePrivacy Directive, a 10 steps framework to be as compliant as possible for marketing (20)

More from Aurélie Pols (20)

Recently uploaded (20)

ePrivacy Directive, a 10 steps framework to be as compliant as possible for marketing