Blog

Update September 2022: Condemned by the Belgian Data Protection Authority (CNIL) for violation of the GDPR, including a fine of 250,000 EUR, the European division of the Interactive Advertising Bureau has appealed this decision. The Market Court (appeals court for the case in Belgium) has since referred several preliminary questions to the Court of Justice of the European Union. It is only after the position of the CJEU is taken that the Market Court will make its decision. Therefore, legal threats will continue to weigh heavily on the IAB's TCF protocol for a long time due to the length of the procedures.

You’ll probably have seen Leonardo DiCaprio’s film Don’t Look Up on Netflix. It’s about scientists who realise a meteorite is coming, and it’s going to destroy the whole planet in a couple of weeks. 

In summary, it's the story of warnings of an announced catastrophe, which no-one took seriously.

This story is the same as the one about the IAB and GDPR: a protocol is introduced to collect personal data in bulk (the TCF), it breaches the GDPR, but most of the Marketing industry is encouraged to use it anyway.

Most CMPs - whose purpose is the collection of personal data in line with GDPR - would rather not reject the TCF protocol as “everyone else is using it” and it, so far, seemed to be a good way to get more clients and revenue.


But, by overstepping the mark and giving European Data Protection Authorities the finger, a serious backlash was to be expected. 

Now, it’s a done deal and all those who chose a “TCF-compatible CMP” are kicking themselves as they now face unsolvable problems.

The DPA (Belgium's Data Protection Authority) has said the party’s over, and other European Data Protection Authorities have followed that decision. Thanks to the one-stop-shop mechanism that standardises decisions in the EU, this ensures that every member country makes the same judgement.

In reality, the consequences are serious, onerous and potentially costly. We’ll look at some detail below. 

For transparency purposes, each point will include the relevant reference from the decision so you can check what the decision says for yourself.

Make a coffee, get comfy and have a read. As Mulder said, “the truth is out there”.

1. My company uses cookies provided by a CMP using the IAB’s TCF protocol. Does the DPA's decision affect me?

The summary is provided by Hielke Hijmans, Chairman of the DPA’s Litigation Chamber, who explains: the press release: “The BE DPA to restore order to the online advertising industry: IAB Europe held responsible for a mechanism that infringes the GDPR”)

There are defensive communications being issued saying that only RTB (Real-Time Bidding: programmatic advertising that auctions each impression independently) is affected by the ban: this is not true.

The decision states that the TCF protocol clearly violates the provisions of the GDPR.

Therefore, by collecting data via this protocol, even indirectly, you are liable for a sanction. Why? Because the GDPR includes joint-responsibility mechanisms ensuring that all stakeholders are involved in guaranteeing compliance. Every player in the compliance chain must make sure partner, processor and data controller abide by the GDPR.

If not, each individual stakeholder can be held jointly responsible for any irregularities.

The DPA mentions this in point 371 of its decision (page 81): To summarise, the responsibility held by other compliance chain players does not limit the IAB’s responsibility.

The DPA establishes a real chain of responsibility, which is no surprise: it’s part of the GDPR.

The DPA devotes an entire chapter to it in its decision titled: “B.3 Joint controllership of publishers, CMPs and adtech vendors with regard to the means and purposes of the processing of personal data within the context of the TCF and of the OpenRTB” (page 79).‍

The DPA titles its official communiqué as follows: “Serious and multiple violations found by the supervisory authority: the TCF is incompatible with the GDPR.”


Simply because the supervisory authority notes that the IAB has imposed a protocol with a design that violates the key provisions of the GDPR: 

“The current TCF does not provide a legal basis for the processing of user preferences” (point 535, page 115): this isn’t a basis error, but the absence of a basis allowing data to be collected. It’s hard to imagine a more serious or astonishing situation...


Breach of Articles 12 and 13 of the GDPR: “Users of a website or an application participating in the TCF are not given sufficient information about the categories of personal data collected about them, nor are they able to determine in advance the scope and consequences of the processing.” (Point 535: pages 115-116 of the decision).


Breach of Articles 24, 25, 5.1.f and 32 of the GDPRwithout any technical or organisational measure to ensure that this consent signal is valid

The truth is, everything stems from the qualification of the TC String used by the IAB. 

The DPA defines it thus: "The TC String is meant to capture in a structured and automated way the preferences of a user when he visits a website or app of a publisher that has integrated the CMP. This concerns in particular the capturing of consent (or not) to the processing of personal data for marketing and other purposes, whether or not to share personal data with third parties (adtech vendors) and the exercise or not of the right to object.”

“the Litigation Chamber notes that the TC String, as an expression of users’ preferences on the processing purposes and the potential adtech vendors being provided through the CMP interface, constitutes the cornerstone of the TCF.”

In its decision, the DPA mentions complainants’ argument that a “(...) unique identification number, such as the TC String generated and stored in a cookie, is personal data within the meaning of Article 4(1) of the GDPR (...)” (Point 93, page 25).

The Belgian supervisory authority objectively raises the point that if “(...) it is not conclusively established that the TC String, due to the limited metadata and values it contains, in itself allows for direct identification of the user (...)”, the fact remains that “(...)when the consent pop-up is accessed by script from a server managed by the CMP, it inevitably also processes the user's IP address, which is explicitly classified as personal data under the GDPR (...). CMPs have the technical means to collect IP addresses (...) and to combine all information relating to an identifiable person. The possibility of combining the TC String and the IP address means that this is information about an identifiable user. (...)” (Point 304, page 65).
‍

3.The obligation to delete all data collected up to now via CMPs using the TCF protocol.


Billions of pieces of personal data have been collected under the TCF. The inevitable question is therefore what should happen to this illegally collected data. 

The consequences are dire, especially for users of CMPs with the TCF protocol. This is one of the points with the most serious repercussions. 

In point C1 535 of its sanction, the supervisory authority states: “(...) it is the responsibility of the CMPs and the publishers who implement the TCF, to take the appropriate measures, in line with Articles 24 and 25 GDPR, ensuring that personal data that has been collected in breach of Articles 5 and 6 GDPR is no longer processed and removed accordingly.”

What does this mean? All data collected since 25.05.2018 via a CMP subject to the IAB’s TCF protocol has been collected illegally and must therefore be destroyed... 

And if a company doesn’t destroy it, it will face the sanctions in Article 83 of the GDPR summarised as follows by the CNIL: “the amount of financial penalties can be up to 20 million euros or in the case of a company up to 4% of the annual worldwide turnover.”‍

4. A decision that applies to all countries in the European Union and beyond...


Decision 21/2022 of 2 February 2022 has been made in the context of the one-stop-shop procedure. What is this?

The CNIL explains on its website that the one-stop-shop mechanism set out in the GDPR aims to standardise, at the European level, decisions made by Data Protection Authorities about cross-border processing. These authorities should coordinate with each other about all these decisions.

Hence why the Belgian DPA refers to this collaboration on page 5 of its decision: “The following supervisors have indicated their willingness to act as concerned supervisory authorities (...): the Netherlands, Latvia, Italy, Sweden, Slovenia, Norway, Hungary, Poland, Portugal, Denmark, France, Finland, Greece, Spain, Luxembourg, Czech Republic, Austria, Croatia, Cyprus, and Germany (...), Ireland (...)."

The DPA also states:suggesting that other decisions of the same type may follow in the coming months.

We learn that “On 23 November 2021, the Litigation Chamber submitted its draft decision with the other concerned European supervisory authorities” (point 275, page 59 of the decision) and that the Dutch authority (point 277, page 59) and the Portuguese authority (point 279, page 59) requested further information on the decision.

And this is what the one-stop-shop procedure provides: a formidable and effective collaboration between countries applying the GDPR. It goes beyond the European Union as GDPR also applies to countries that are members of the EEA (European Economic Area): Iceland, Lichtenstein and Norway.

The DPA’s decision will not be questioned by other supervisory authorities and will therefore apply in similar situations across the whole “GDPR zone”.

To be fair, we don’t do false modesty at Axeptio. It wasn’t easy to reject the TCF: the GDPR principles meant an array of potential clients were off-limits to us. This is however something we’ve always accounted for and accepted.

But now, we’re proud to be able to say we made the right choice. Anyone who wants to get involved in the data business can do so with our solutions and comply with the texts and the spirit of “Marketing you consent to” rather than “Marketing sprung upon you”.

Update September 2022: Condemned by the Belgian Data Protection Authority (CNIL) for violation of the GDPR, including a fine of 250,000 EUR, the European division of the Interactive Advertising Bureau has appealed this decision. 

The IAB's TCF protocol violates GDPR

Axeptio

Shockwaves in the CMP world: the IAB's TCF protocol violates GDPR!

Google Analytics (ga) is with the aid of far the maximum popular analytics tool in the marketplace and allows you to investigate internet site traffic and collect treasured information about user behavior. However, accumulating analytics data requires compliance with statistics protection rules consisting of GDPR. for purchasers and agencies who cost the privateness of their data, this is alarming. The query as a consequence arises: “is google analytics GDPR-compliant?” maybe now not. But a simple sure or no is difficult to present ...

Not all website analytics software are created equal.

Most of the tools track personally identifiable information (like IP Address, geolocation, or attribute demographic information like age and gender to visits). Website analytics tools like that assume our personal information is useful for making a website and take actions!

But for most website owners and businesses, it’s not. And, while it’s creepy, it also creates some legal ramifications if privacy policies and terms aren’t very specifically laid out, worded and displayed on websites.

Some website analytics tools now focus on website visitor privacy. They still track website usage for our customers, but they do this without collecting creepy amounts of data about visitors on websites with their tracking codes. And it is incredibly important because it very specifically relates to privacy laws that are so important to consider in 2021.

Can Google Analytics work without cookies?

Fundamentally, Google Analytics is primarily based on the usage of cookies. they set a couple of cookies to perceive internet site site visitors across distinctive browsing classes so that facts can be used to consider what site visitors have executed in previous sessions at the internet site.

however, despite the fact that Google Analytics switched from cookies to some thing specific, like localstorage, they would still war to conform with privacy laws without explicit consent notices, because they’d still be the use of something (cookies or in any other case) to track private information from site visitors.

Further to privateness notices relating to legal guidelines and regulations, web sites and agencies that use Google Analytics have numerous requirements they should legally adhere to for his or her website.

For instance, they ought to have a privacy policy that makes observations of the cookies or identifiers used to gather information, which then needs to be furnished to all internet site visitors in a clear and comprehensive way. Further, if google analytics users also allow things like demographic or re-advertising facts, their notices and privacy guidelines ought to be even extra in-intensity and complete.

Privacy-oriented alternatives to Google Analytics for 2021

We discovered  Plausible just recently, but they deserve to be on pinnacle of this listing for us. Their platform is completely Open Source on github beneath the mit license.

Their most inexpensive plan starts at a month (just if paid every year) and for 2 a month you get 100k pageviews across limitless websites. in addition they submit a roadmap to hold you up-to-date with what’s coming. So If you needed a javascript-primarily based analytics nowadays, attainable would be a nice choice!

Matomo : https://matomo.org/ (formerly Piwik)

Matomo is a precious web-analytics platform, and has a huge deal of capability that maximum direct marketers could need to investigate web site visitors, campaigns, and consumer behavior on their websites for the ones companies that need to hold strict manipulate over their personal information, Matomo, especially as an installation, has a few blessings over its major competitor Google Analytics.

Being open supply gives a bargain extra flexibility in modifying Matomo for one’s desires, but as is likewise common with such publishing fashions, this variation would require a vast quantity of human capital.

Matomo is mainly robust in the place of actual-time analytics, making it feasible to music live pastime on a website all through a advertising and marketing campaign. However, the satisfactory cost that Matomo appears to provide calls for the usage of their cloud hosting or purchasing the plugins that cope with this capability.

The conversion optimization functions, which include heatmaps, shape analytics, and funnels can be precious for many direct advertising groups who want to get a clean imaginative, and prescient of the way nicely person campaigns are operating while the consumer gets to the actual point of sale.

As part of privacy legislation worldwide including GDPR, CCPA, PECR, and ePrivacy, it is required to display a cookie banner informing users about cookies, or consent must be obtained before tracking visitors’ data. However there is a solution available: you can use Matomo tool without needing consent and without a cookie banner, by following all these steps.

A lot of exclusive features for a privacy-friendly analytic software

Heatmaps and session recording like Hotjar

Tag manager included to replace Google Tag Manager

29$ can be too expensive for many startups and SMB

Free version is not available in the cloud (On-Premise only, so you'll certainly need a developer to install it in your source code

Fathom analytics is a powerful yet simple analytics platform. The simplicity is what got us enthusiastic about it. We clearly get to see all informations when touring my dashboard. We can even see all goals at a glance.

If you run multiple websites or apps, you don’t need to create an account for each website. Switching between sites is very easy, and you'll gonna live it, for sure ! Easier than Google’s Accounts => Properties => Views. Don't you think ?

Very easy to create goals (like events in GA)

14$ can be too expensive for small companies

Not enough data, metrics and features for webmarketers

AT INTERNET : https://www.atinternet.com/

How does AT Internet comply with GDPR, CCPA and other legal guidelines?

First of all, they store all collected analytics data within the EU. A few examples of personal data collected and the length of storage:

Their cookies are active during a fixed period of 13 months, after which they disappear from a user’s computer. (AT Internet’s cookie only contains a unique alphanumeric ID – no other data is stored in the cookie)

French company (like Axeptio 💛🤘🇫🇷)

Too expensive for small startups and SMB  (355€/month)

Analytics tools: Privacy-friendly alternatives to Google Analytics

Please welcome our new friends! More than 200 new solutions have just been added in our back-office. Ready-to-use, that way you would save time and energy for your next projects.

It's also a great opportunity to discover a lot of new tools.

Of course, you can still create new cookies if you can't find your solution in our list.

Please welcome our new friends! More than 200 new solutions have just been added in our back-office. Ready-to-use, that way you would save time and energy for your next projects. 

With this post, we take the opportunity to share you the most recent guidelines from EU national authorities. We'll try to update this consent cheatsheet if things change.


2020 Cookie guidelines on DPA website + Cookie FAQ

2020 Guidelines on the “Processing of personal data of website visitors“ | 2019 Executive Order (“EO”) regarding cookies (still applies unless the above 2020 document states differently)

*guidelines apply to any consent-based processing of personal data, not only to cookies or trackers, strictly speaking.

2020 Cookie Guidelines | Cookie Recommendations

2020
Summarizing article (English) | Information on the Finnish Traffic and Communication Authority’s website

2020 Guidance from the supervisory authorities for providers of telemedia

2014 Identification of simplified procedures for information and the acquisition of consent for use | Clarifications on the implementation of the legislation on cookies

2020 Data Protection Commission guidelines on the use of cookies | Survey on the use of cookies

2019 Guide to PECR: Cookies and similar technologies

2020 EDPB Guidelines 05/2020 on consent under Regulation 2016/679 (English)

With this post, we take the opportunity to share you the most recent guidelines from EU national authorities. We'll try to update this consent cheatsheet if things change.

GDPR : What are the differences between European countries on cookies consent ? 

We’re sure you’ve noticed this when browsing on the Web. As soon as the page loads, a notification appears asking you whether you’re OK with cookies on the site.

Chances are, you click this without thinking. It makes sense to learn a little more about it, and how your company and website is affected.

The reason for such notifications is a recent ruling by the European Court of Justice. It says thatInternet users must actively consent to be tracked around the internet with cookies.

Earlier, there was the ​General Data Protection Regulation​ (​GDPR​), a strict privacy and security law drafted and passed by the European Union. This imposes obligations on to organisations anywhere, if targeting or collecting data related to people in the EU.

The basic purpose of these stringent regulations is to give individuals more control over how their data are collected, used, and protected online. It’s an important part of ePrivacy.

Here are a few of the most important requirements of this ​GDPR​ and ​cookie policy:

Websites can only track their users if they provide explicit and active consent and pre-ticked checkbox assenting to the tracking is not enough.

Service providers have to fully inform users, including details about how long the cookies would operate for, and whether any third parties would have access to the gathered data.

In general, the ​GDPR​ states that lawfulness, fairness and transparency are to be maintained at all times.

The principles of personal data minimisation, storage limitation, confidentiality and accountability should also be followed.

What You Should Do About Data Protection Rules

​is important. Otherwise, you can risk enforcement action from regulators associated with the EU. There’s also a growing feeling among consumers that only those websites fair and honest about data use should be trusted.

Permission marketing and ethical marketing, then, are important considerations. As a first step, you could conduct a cookie audit. This will show you:

the nature of each cookie found on your site, and their purpose

the third parties setting cookies on your site

the best way to inform site visitors of these tracking mechanisms

One of the best ways to let your consumers know of ​cookie consent​ and ​data protection​ is to have a preference centre on your website. It's a visual dashboard which allows users to manage parameters to do with ​personal data​. It allows for a fluid and lasting relationship built on trust. This not only boosts your brand image, but it also reduces the risks of claims and can increase traffic.To find out more about ​GDPR​ ​compliance​ and other provisions you should be aware of, as well as preference centres, do check out​ ​this blog​ today. ‍

We’re sure you’ve noticed this when browsing on the Web. As soon as the page loads, a notification appears asking you whether you’re OK with cookies on the site. Chances are, you click this without thinking. It makes sense to learn a little more about it, and how your company and website is affected.

The New Cookie Rules and the Best Way to Follow Them

La seule formule qui vous permet de multiplier la confiance à l’infini avec vos clients !

ax-laptop-bulb-min.png

On a imaginé une recette spéciale, avec tout plein de pépites, rien que pour vous.

ax-suitcase-min.png

Vous êtes gourmand ? transparent et direct ? fun et sympathique ? Nous aussi !

hands-clapping.png

Can be configured and installed in 7 minutes on any website

ax-cookie-solo-min.png

Your terms and conditions at their finest : less after-sales service, fewer disputes

icones site 2022 jaune propre_cupcake.png

Informed and optimized opt-in: better segmentation, less churn

ax-star-curtains-min.png

Se paramètre et s’installe en 7 minutes sur n’importe quel site internet.

Vos CGV sous leur meilleur jour : moins de SAV, moins de litiges

L'opt-in éclairé et optimisé : une meilleure segmentation, moins de désabonnement

The only formula that allows you to multiply trust with your clients infinitely!

We've cooked up a special recipe, full of extra nuggets, just for you.

Are you hungry for more? Transparent and direct? Fun and friendly? So are we!

BlogWhat‘s up Axeptio ?

Shockwaves in the CMP world: the IAB's TCF protocol violates GDPR!

Analytics tools: Privacy-friendly alternatives to Google Analytics

Please welcome our 200 new cookies!

GDPR : What are the differences between European countries on cookies consent ?

The New Cookie Rules and the Best Way to Follow Them