The DPC gave a six-month grace period, with all websites needing to be compliant by October 5th 2020. This announcement followed the revelation that after a review of 40 organisations, just two were actually compliant and posed no serious concerns.
What are the requirements?
Hold tight, because there are quite a few:
- Users must give their consent to receive any cookies for non-essential purposes
- Cookies should be grouped into clear categories relating to their function
- Users must have the option to opt in or opt out of each category separately (apart from cookies essential for the website to function)
- If a user opts out of any cookies, they should not be stopped from using the website altogether (remember when overseas companies gated their websites after GDPR came into effect?)
- The information given to users regarding the cookies you use must be specific and easy to read
- Users should be able to change or update their consent status at any time
- The lifespan of each cookie should be appropriate and relative to the purpose of the cookie
- Implied consent (‘if you continue to browse this website, you automatically agree to receive cookies’) is no longer going to fly – users must explicitly express their consent
- Cookies should not automatically be set on a user’s first visit to the website – they should be set only after consent has been given
- The rules apply to all data, not just personal data
Of course, it’s great news that users have more control over their personal data – but if swathes of users start to opt out of all but necessary cookies, this will affect how marketers and analysts alike make decisions, since the dataset won’t be as complete as we’re used to.
It’s already been two weeks since the grace period ended, and there are still plenty of questions. With that in mind, here’s our take on some of the most common questions we’ve been asked recently by our clients.
If cookies now have to be grouped, will this create an imbalance across platforms?
Almost certainly. Now that users have the choice to opt out of marketing cookies but opt in to analytics cookies (or vice versa) the proportions of user activity captured by both platforms can vary.
Not only will you have the ‘usual’ attribution headaches when comparing the reported conversions in Google Ads vs Google Analytics for example, but now you’ll be faced with the additional mystery of just how many users each dataset represents.
How will I know the amount of users that opted out of tracking?
This will all depend on the cookie management platform you choose to integrate with. We’ve chosen OneTrust as our platform, since its dashboard shows the proportion of site visitors who have opted into each cookie type.
Not all platforms provide this, however. In this situation, you’re a little stuck.
Imagine you’re reviewing October’s analytics data. You notice the number of users is 4,000 less than you received in October last year.
How do you determine whether:
- You’ve had roughly the same amount of monthly users, but 4,000 of them have opted out of analytics cookie?
- You’ve had 3,000 less users to your site, and another 1,000 have opted out of analytics cookies?
The simple answer is, unless your cookie management platform can verify this for you, you’re going to be left in the dark.
What does this mean for my KPI targets?
This will depend on whether your cookie management platform gives you a view of the number of users who opted out of each category.
If it does, you’ll be able to perform a calculation that will give you a best estimate of the total conversions gained in a given timeframe.
Let’s say you’re reporting on October’s Google Ads activity and you can see that 27% of users opted out of marketing cookies. You can do the following calculation:
( reported conversions / 73 ) * 100 = estimated total conversions
Here, 73 represents the percentage of users who opted in to marketing cookies and therefore should be represented in your data as normal.
If 40% of users opted out, you would instead divide by 60 (as 60% should be opted-in and therefore already reported).
Of course, if your cookie management platform doesn’t indicate the proportion of user opt-outs, you won’t be able to work all this out.
But don’t panic! You may have a few options here. Do you have a CRM that can link internal sales data with initial traffic source? If so, you may be able to use this to base growth targets on. Still, this should be treated as a worst-case scenario, particularly if what you are advertising has a long first click-to-conversion time frame.
Is there any way I can regain data accuracy?
In the future (all being well, the near future) you’ll have the option to track interactions without the need for cookies. Google currently has its new ‘Consent Mode’ feature in beta (seen below), which allows conversion data to be sent via ‘pings’ instead of the usual first-party cookie method when a user opts out of being tracked.
According to Google, ‘pings’ include:
- Browser and operating system
- Whether a user arrived on the website via a Google Ad
- Simple information on the consent state of a user
It’s reassuring to know that we can glean some insight from these pings, rather than having them function as a simple counter – a little like the crude visitor counters of the late-90s web.
As you might have already guessed, this solution will cover the affected Google products, but other networks (like Microsoft Ads and Facebook) will need to provide their own cookie-less tracking solutions.
If they don’t already have enough incentive to do so, Google has announced it will no longer support third-party cookies of any kind in the Chrome browser by early 2022. This follows measures already in place in Apple’s Safari and Mozilla’s Firefox browsers to limit the lifespan of third-party tracking cookies.
Essentially, what all of this means is that we’re now faced with the challenge of being in the ‘awkward middle stage’ of the transition. Not only do marketers and analysts have to compensate for the partial loss of data we’ve taken for granted for so many years, we also have to prepare for the alternative solutions on the horizon.
Soon enough, we’ll all be embracing a new era of the web where personalisation and privacy operate in a different balance.