Standing Down Cookies

00:01

welcome everyone to lessen 6.3.

00:04

As I promised to you a moment ago. In this lesson, we will review how to stand down cookies.

00:10

We will review the technical and organizational controls you can put in place to actually operationalize some of these objectives.

00:17

Let's jump right into it.

00:19

The learning goals and objectives for this lesson are actually fairly straightforward.

00:23

Number one.

00:24

We will review the steps your company needs to take to provide California residents the opportunity to opt out of cookies.

00:31

Why? Because that constitutes a sale of personal information to a third party

00:36

again. Remember, cookies equal sale of personal information.

00:40

You have to keep playing that back into your head.

00:43

Then item number two. We will review helpful tools that are already in the marketplace that can help you again maintain CCP a compliance in this space.

00:54

Those are our learning goals and objectives.

00:56

Before we completely dive in headfirst to everything that there is to know about opting out of cookies.

01:00

I'm sure at this point you probably have already looked at some of the cookie banner templates that are available online. If you haven't done so, please do that. Now

01:10

you might be saying to yourself,

01:11

Hold on,

01:12

that doesn't line up with what Jason said A moment ago, he said that there were four requirements of cookie banners.

01:19

I'm seeing other things in these templates.

01:21

I don't trust him anymore.

01:23

I apologize if you see differences in cookie templates, But much of that is probably because you are looking at a cookie template from another data privacy law.

01:30

If you look at the right side of your screen, remember the CCP. A Onley requires that businesses provide consumers the ability to opt out of the sale of personal information.

01:40

But there are far more restrictive regimes out there.

01:42

For example,

01:44

if you look at the middle of your screen, the Gramm Leach Bliley Act in the Fair and Accurate Credit Transaction Act, better known as Fact up,

01:52

requires that companies provide the ability to opt out of all third party data transfers

01:57

in Europe. Under the GDP are

01:59

consumers actually must be provided the ability to opt into a cookie that is going to transfer data to a third party or even collect the information to begin with.

02:08

Everything there is to know about cookies in Europe. It's outside of the scope.

02:13

But just remember that in Europe

02:15

they do need to establish a legal basis.

02:17

They have different requirements over there.

02:20

That might be something that you're seeing in the cookie templates.

02:23

It's an opt in regime over there.

02:24

It's a consent based regime over there

02:27

that you need to have a legal basis over there.

02:30

That is not what's required over here in the United States.

02:34

If you are on Lee trying to build out a CCP a compliance regime, focus on the requirements I mentioned in the last lesson.

02:40

Now,

02:42

to that point, the responsibility of ensuring CCP a compliance rest with you and your company.

02:47

I have seen all too frequently an attitude in many conference rooms where, okay, these cookies actually belonged to a third party.

02:54

Well, therefore, all the CCP a compliance aspects of that cookie are They're not our responsibility because they're not even ours.

03:01

They don't even belong to us.

03:05

That is the wrong mentality.

03:07

Please forgive me for the aggressive photo here on the left. But the point here is that this is an action item that falls on your plate.

03:14

You cannot subcontract away your CCP a compliance obligations to a third party,

03:19

for example, using the I P P privacy policy that were reviewed in section 6.2.

03:23

I assure you that they're not looking to Marcato to ensure their CCP a compliance.

03:29

No, they are going to ensure it themselves.

03:32

Why? Because they need to be able to disable ad tech on their own website.

03:38

They are responsible for it.

03:39

They being the I a p p.

03:42

So

03:43

how do we do this?

03:45

Fortunately, in 2010 group of industry leaders established this group called the Digital Advertising Alliance.

03:51

You might have already heard of them.

03:53

They and participating companies all ensured that the cookies and ad tech devices that those companies push out are designed to be opted out off.

04:01

If you've ever seen that logo in the middle of your screen where I have the pink arrow, you see that sideways triangle.

04:06

I bet you know if you are going to go surfing through the Internet, you would come across cookie banners with that logo.

04:14

That means that cookie or the cookie banner is powered by a company that subscribe to the digital advertising alliance, meaning that they will assist you in complying with the c c p a.

04:25

Now. A moment ago, I said that the CCP a compliance rest with you.

04:29

Remember that angry looking photo with the man pointing you in the last slide?

04:32

That is still true,

04:33

however,

04:34

the D A. Has established a mechanism that you must operationalize but can in fact follow through on to ensure that individuals who visit your website can opt out of cookies.

04:46

Once again,

04:46

these companies include brand advertisers, agencies, publishers, ad networks and tech companies.

04:53

This encompasses a large piece of the market.

04:56

My recommendation to you in this case is if there are going to be cookies on your websites, try to get cookies again. Assuming this decision does not rest with, you get cookies that are part of the D A network because that's going to make CCP a compliance for you

05:10

again. It is your responsibility, but it's going to make it infinitely easier. I would humbly subscribe to you having worked through this before in the past,

05:18

that is the D A.

05:20

They're not the only ones, though, that are helping companies maintain CCP a compliance by making cookies more user friendly.

05:29

Big tech has also answered the call

05:30

one of the most frequently deployed cookies out there are Google Analytics Cookies.

05:35

Included in those devices are opt outs that are built into the platform.

05:41

Feel free to go to Google's website.

05:43

You can read up more on how they have built and incorporated mechanisms to ensure that cookies can indeed be opted out of by a user visiting your website.

05:51

Feel free again toe Pause the video and check out their cookie protocols because

05:56

I think that will really help drive the point home.

06:00

This also, by the way,

06:02

intersects very quickly with the other requirements of the c c p. A.

06:06

If you remember, the personal information of a child cannot be sold to a third party unless apparent has opted into it.

06:14

Suppose a child is visiting your website.

06:16

Your website is using cookies to redirect information and sell information to a third party automatically.

06:23

That child all they're doing is exiting out of

06:26

or even perhaps accepting all

06:28

without really understanding what's happening there.

06:31

In that scenario, you are selling the personal information of a child to a third party without the parents consent.

06:39

There is already litigation right now for this very violation

06:42

It is also an offshoot of the YouTube settlement because again, in that case, Google and YouTube, we're getting ad revenue from in part

06:49

add technology that was being sold off to third parties.

06:53

It was Children who were visiting certain videos that were, by design, going to be viewed by Children anyway.

07:00

Again,

07:00

cookies cannot be present on your website unless you have a mechanism to opt out of it.

07:05

The burden is to ensure that a child's personal information is on Lee being sold via cookies. If there's an opt in basis for that,

07:15

please be careful.

07:15

If you have a company that is frequently visited by Children, you need to really take a look at the cookies that are on your website.

07:21

I think that there's enough there to summarize everything as it relates to cookies and Children.

07:27

But feel free to give me a call if you have any questions

07:31

in summary

07:32

Lesson 6.3.

07:34

This concludes the module on cookies.

07:36

I hope at this point I have driven home for you the importance of standing down cookies

07:42

again. It's a sail under the CCP A of personal information to a third party.

07:46

There are several methods available for standing down cookies.

07:50

I reviewed the D A. Add Choice network.

07:54

Big tech, including Google, already has solutions to help users opt out of cookies

07:59

again. As I mentioned a moment ago,

08:01

cookies are particularly important as it relates to the collection of personal information of Children because that is an opt in regime,

08:09

not an opt out regime