Make Your Website Compliant With the UK Data Protection Act (UK GDPR) - in Less Than 1 week.

ICO stands for the Information Commissioner’s Office of the United Kingdom. This is the UK’s public authority that enforces data protection laws in the country. Among other things, it publishes guidelines that help businesses comply with privacy laws (UK Data Privacy Act 2018, GDPR) easily.

Here we will explain in plain language the most important aspects of their cookie guidelines. Should you respect these guidelines, data protection compliance will be effortless for you.

PECR stands for Privacy and Electronic Communications Regulations of the UK. Among others, it covers the use of cookies and similar technologies for storing and accessing users’ information.

Cookies are small text files that are being injected in your device in order to collect some data. Such data may be:

• Supporting users to log in on a website
• Remembering the user’s shopping cart
• Tracking user’s behaviour on the website for analytics purposes
• Tracking user’s browsing behaviour, etc.

Cookies make websites work more efficiently and provide data to website owners. Such collected data can be personal or non-personal data. When they collect personal data, they are subject to data protection laws.

There are many ways to make a distinction between different types of cookies.

• Session v persistent cookies
  
• First-party v. third-party cookies
  
• Strictly necessary cookies v. all other cookies
  

Cookies are not the only technology used for tracking users over the internet. The so-called “similar technologies” are tracking technologies that provide website owners with information about users, sometimes including their personal data. As a result, these technologies are also the subject of data protection rules.

Some examples of similar technologies are:

• HTTP header information
• Installed plugins
• Device fingerprints
• CSS information, etc.

You can freely use essential cookies, but you must obtain explicit user’s consent for the use of non-essential cookies and similar technologies.

In addition, you must obtain the consent the right way, which means:

• Ask for consent for each specific purpose. If you use different cookies for different purposes (preferences, analytics, advertising), then ask for consent for each specific purpose. Getting one consent for analytics cookies doesn’t mean that you are free to use the advertising cookies.
• Inform users about cookies. Tell them what cookies you use for what purpose. Do that in plain language that doesn’t mislead them.
• You need affirmative action. The user has to click on “ACCEPT” or a similar button to accept the cookies. Staying on the website doesn’t mean consent. Also, pre-ticked boxes are not allowed - the user should tick them.
• The consent must be freely given. You must not prevent the user from accessing the website if they do not consent on cookie use.

If your organization/business interacts or does business with EU citizens, such as selling products/services or monitor individual behavior online, then you are applicable to GDPR.

If you use third-party tools such as Google Analytics from Google, for example, which collect personal data, then you need to collect valid GDPR cookie consent before placing cookies or any other form of tracking technology on the visitors’ computer. One of the ways you can accomplish this is through using cookie consent tools/cookie consent plugin.

If you have contact forms or newsletters collecting data from EU citizens then you need to be compliant with GDPR and need to ensure you do lawful processing of their personal data.

Many websites use tracking technologies, including cookies, pixels and tags, to advertise, collect statistics and perform marketing campaigns. To ensure your website is GDPR compliant, you are required to provide a cookie notice/GDPR cookie consent banner and obtain user consent for each one of these technologies. Make sure to do a web audit of your website and see what trackers you have enabled and running.

If you are unsure what trackers you have on your website, then use our GDPR cookie consent plugin tool. It is free and will provide you a result within 5 minutes or less. Our tool identifies the cookies and tracking on your website, and our cookie script blocks them into groups determined by their function

There are specific requirements for how to obtain valid consent when it comes to GDPR and cookies. Primarily, GDPR cookie consent must be informed, unambiguous, explicit, freely given, specific and have the right to withdraw written in plain language that is clearly visible in your cookie banner. For consent to be informed, both the GDPR and ePrivacy Directive, state that an individual must receive at least the following information from your cookie consent notice:

• the identity of the organization processing data;
• the purposes for which the data is being processed;
• the type of data that will be processed;
• the possibility to withdraw the given consent (for example, an unsubscribe link at the end of an email)
• if the consent is related to an international transfer, the possible risks of data transfers to third countries.

Below is one of the GDPR cookie consent banner examples you can use to communicate different cookie preferences and receive a valid consent:

The standard text phrase that is included in most cookie consent banners, “by using this site, you accept cookies,” will not be sufficient under GDPR cookie compliance requirements, as it only suggests implied consent, which is ambiguous and generic. You will now need granular levels of control with separate consents for tracking, analytics, and other cookie categories, as well as mechanisms to signal customer consent. They need to make an affirmative action to guarantee GDPR compliant cookie consent.

It should be as easy to withdraw as to give consent. Furthermore, you need to inform your users how they can exercise this with the help of a GDPR compliant cookie banner. If user consent is withdrawn your company/organization can no longer process the data. Once consent has been withdrawn, your company/organization needs to ensure that the data is deleted unless it can be processed on another legal ground (for example storage requirements or as far as it is a necessity to fulfill the contract).

If the data was being processed for several purposes your company/organization can’t use the personal data for the part of the processing for which consent has been withdrawn or for any of the purposes, depending on the nature of the withdrawal of consent.

Example: You’re providing an online newsletter. Your client gives their consent to subscribe to the online newsletter that allows you to process all the data on their interests to build a profile of what articles they consult. One year on, they inform you that they no longer wish to receive the online newsletter. You must delete all personal data relating to that person collected in the context of the newsletter subscription from your database, including the profile(s) relating to that person.

Your cookie consent notice must clearly identify each party for which user consent is being granted. It isn’t enough to state the category name, such as analytics, but should include the identity of the organization, e.g. Google, which processes the data for your business to be considered as having a GDPR compliant cookie policy.

To learn how our cookie blocking works, please see this guide.

Yes, we offer ICO readiness tests, website audits, training and more. Please schedule a call here.

Yes, we offer full support for a wide range of privacy laws including GDPR, CCPA and LGPD.

Yes, we offer volume discounts. Please schedule a call here.

Yes, you can. We offer a FREE trial. You can cancel anytime.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.