The ICO (Information Commissioner’s Office) has put cookie banners back in the news and back onto the agenda for some firms. Whilst they have created uncertainty and many firms are lying in wait of some clearer guidance, some companies are using this news as an opportunity to get closer to their stakeholders.
why are cookies back in the news?
The banner is what has been in the news recently. As more and more companies have put banners on their sites, the measure has now stopped achieving what it was intended to do in the first place. They slow down our online journeys, so most users just click “accept” to get rid of them.
what does this mean for businesses?
Also, for those businesses who work across the EU and have EU users, they will need to comply with EU GDPR anyway…
In order to answer the question “is it better for business?” we need to go back to the beginning.
what is a cookie?
Even the least tech-savvy among us will know that a cookie is more than just something to be dunked in tea. Although talking about them does make us fancy one…
Anyway! A cookie is a “small text file that is downloaded onto ‘terminal equipment’ (e.g. a computer or smartphone) when the user accesses a website. It allows the website to recognise that user’s device and store some information about the user’s preferences or past actions.” [ICO definition]
In a nutshell, cookies are what makes it possible for websites to remember our activity on a website.
are cookies bad?
Online cookies, much like my favourite cookie (choc chip if you’re asking), aren’t inherently bad. But, they aren’t all good either! Whilst they can enhance our experience on the internet, they can also lead to our data being shared. As data can be personal in nature, the GDPR kicks in when this is the case and requires companies to get consent first.
what do we all need to do to comply?
The basic rule is that you must:
- tell people the cookies are there;
- explain what the cookies are doing and why; and
- get the person’s consent to store a cookie on their device.
The ICO is the best place to go for general guidance on cookies. They have produced a useful checklist for companies that includes checks on how well you understand cookies. It also helps you audit your use of them and gets companies to think about consent and their documentation and review of cookies.
so what do we do now?
What the ICO has done is highlight that in complying with the law the user has been forgotten. This is something that legal design strives to overcome, so on the face of it, this is a helpful step.
When GDPR came in, there was a lot of discussion around how it could help companies get closer to their customers. It highlighted that data is valuable and that companies should be transparent when they collect and use it. Where companies could demonstrate this to customers, the trust would increase. However, the cookie banner has ironically had the opposite effect. Few customers understand what is collected, for what purpose, and the implications. There is a lot of distrust and worry about what is happening with their data.
how can legal design help?
We have a four-stage process that we go through with our clients when they are facing a legal change or challenge:
Our approach starts with a taking wide-angle view. This approach helps get buy-in, (importantly) remembers the users, and works out whether implementation is needed in the first place.
Looking at the business case for the change, we answer two questions:
- Is it part of the business’ future plans and aligned with its forward planning?
- What’s in it for the business and its customers?
The businesses that we have been doing this exercise with, in the context of cookies, have been thinking about the impact on their users of their cookie banners. They have been scanning the industry to think about how they can lead best practice. They have been cognisant of the fact that customers are untrusting of what is happening with their data and are growing annoyed by banners that are less than transparent.
This discussion then leads us to think about stakeholders. Here we explore questions such as:
- Who has skin in the game?
- Who in the business needs to authorise this?
- Who is effected and who has to build tech to support the change?
Again, with cookie banners this has led us to consider a range of stakeholders internally (marketing, development, product design, sales) and externally. It has produced conversations around global teams with an eye on the bigger picture for business.
What this approach does is it helps answer the question “what do we need to do now?” not just from a legal perspective (in this case, technically “nothing”) but from the expanded perspective of “what is the best thing for our business to do now?”.
Where it is decided that there is something that needs to be implemented, this runs more smoothly because buy-in is already there and the relevant stakeholders have already been consulted.
Smart cookies…sorry, we mean smart companies are thinking about how they can change the dialogue with their customers. Rather than use technical cookie banners, which do little to explain to the customers the benefits of clicking accept, they are explaining what happens when they do and what the benefits to them are of doing it. This builds transparency and increases the likelihood of people saying yes to cookies.
are cookie banners the only change on the horizon?
The other change on the horizon is more “data adequacy” partnerships. This is where data can be shared internationally. As a result of Brexit, the UK is now free to negotiation more of these outside of the EU (with whom we already have such a partnership).
let us help you stay ahead.
The proposed changes seem positive. However, they also mean that in-house teams are going to need to be alert to the changes or they might find themselves on the back foot. Again, in-house teams can get themselves ahead of the curve by starting to think about the business case and engaging stakeholders early on, so that if any implementation is needed, they already have the right thinking in place to move forward.