Please note that this information on consent management is current as of Q1 2024. We will do our best to continue to update as we get more and more information.
Also friendly reminder that this article's perspective is simply that, our opinion. It's based on decades of experience in web publishing and it is not legal advice.
(It's also fairly technical, so if you need a plain language translation please connect with us).
As laws protecting privacy have been launched at various places around the world, the need to keep up with them has become a required part of digital media publishing and high-traffic website ownership.
The two critical geographies that affect digital publishers are:
Lack of consent management compliance opens publishers up to lawsuits, fines, or other enforcement punishments. It also opens the door for Alphabet to restrict or refuse access to Google's ad network and advertising tools, which would have a negative monetary impact on ad serving across the individual site, the publisher’s network, or even the entire network of vendors serving ads.
At the most basic level, the CCPA regulations provide for an “opt-out” structure. This means that publishers are able to collect data about their users, drop cookies onto their users’ browsers, and share that data with their advertiser network or other partners by default — as long as they share this information inside of their Privacy Policy.
However, California residents have the right to opt-out through a standard process. This process must be made available by the publisher and has two requirements:
Both of these links must be present and functional for California residents, and any UX that makes them difficult to find or use is also prohibited. Whether this applies to them when they are physically located outside of California is up for debate, and the technical means for identifying whether they are within the state of California (e.g., by GeoIP technology that looks up their IP address, by location sharing from their mobile device, etc) is outside of the scope of the written regulations and is likely to be decided by the courts instead through various attempts to enforce the regulation.
The conservative approach for a publisher, outside of simply never tracking the users at all and enforcing their advertisers not tracking them, is to display these links to all users of the publishers websites, which avoids the need to detect which users count as California residents. A more standard approach we have seen is for publishers to use a GeoIP based detection to either offer the functionality to consumers within the United States or even more restrictively within whatever the GeoIP detection tool detects as California.
The GDPR regulations apply to anyone operating within the European Union and takes a more conservative approach to tracking where the consumers cannot be tracked unless they knowingly and explicitly grant permission to be tracked and targeted. The rules around wording of the links and mechanisms of detection are not as explicitly laid out, which leads to a lot more opportunity (and ambiguity) on what is acceptable.
The main complexity in handling GDPR is the order of operations problem of how to handle analytics and advertising before a user has granted or rejected permission. When a page loads, it is possible to load ads on it with targeting disabled and make some money, but then you may need to wait another 30 seconds before loading targetable ads.
Additionally, Google Analytics (and most other analytics platforms) default to leaving a cookie to be able to stitch Pageviews together into Sessions and Sessions together into Users. If you fire Google Analytics before Consent is granted, then you need to do it without tracking cookies, which artificially inflates Users and Sessions. If you fire it after Consent is granted only, then you may deflate Pageviews, Users and Sessions, but the numbers are more relevant to who actually agreed to engage with your content, so this is the Flexpress standard structure.
GDPR provides a few requirements for how the user interface has to appear when collecting consent:
The consent manager is allowed to drop a cookie to indicate that the user has made their decision and this cookie falls within the “Strictly Necessary” category. This is to support the “six month” requirement above.
Beyond that, the publisher is required to keep a record of when the consent dialog was shown, which version of it was shown, what messaging was included, and what the user’s decision was in a centralized database that can be made available for audits.
One partner for consent management is OneTrust, and it is offered as an easy out-of-the-box integration within publishing platforms like Flexpress. Alternatively, if a customer has a consent manager of their own that is compliant with all of the above requirements, then Flexpress can be rolled out alongside that consent manager with no extra effort.
Organize OneTrust into three different regions:
-----
Any other questions about consent management? Please reach out to us so we can help: hello@flexpress.ai.