UK Cookie Law Compliance: Implications & Answers

Enterprise Tag Management

UK Cookie Law Compliance:
Implications & Answers

23rd May 2012 - The Hospital Club, London
#PrivacyEU

Ensighten Overview

 Enterprise Tag Management solutions

 Customers use Ensighten to manage 3rd party tags (ad
networks, social sharing, analytics, etc.) on their websites
– accelerate website page load

– manage website consumer data collection

– site privacy and compliance (partner with PrivacyChoice)

 Founded in 2009
– Cupertino, CA; London UK

 Solutions for web, mobile apps, flash
 40+ F1000 customers
2 | Ensighten, LLC. - Confidential, All Rights Reserved.

Ensighten technology powers these sites

Agenda

16:20 The ePrivacy Directive: Legal Implications
Stewart Room, Partner, Field Fisher Waterhouse

16:45 ePrivacy: How to face the Cookie Monster
George Thompson, Director, KPMG

17:05 Cookies: View from the ICO
David Evans, Group Manager – Business and Industry, ICO

17:25 A Single Line Of Code: Solving The Compliance Challenge
Des Cahill, VP Marketing at Ensighten

17:35 Panel discussion: What impact will the UK Cookie Law have on digital
marketing strategy?
Mike Weston, Managing Director, Profusion
Stewart Room, Partner, Field Fisher Waterhouse
George Thompson, Director, KPMG
David Evans, Group Manager – Business and Industry, ICO
Des Cahill, VP Marketing at Ensighten

17:55 Conclusions & Next Steps
Adrian James, Managing Director, EMEA, Ensighten

18:00 Drinks Reception


Cookie consent

Stewart Room, Partner
Stewart.Room@ffw.com

• No dropping of cookies without consent (storing in
terminal equipment, accessing information in terminal
equipment)
• Specific, informed, freely given and prior?
• Express and implied
• Subscribers and user and people under a disability
• The consent journey – information but activity
• Terms and conditions and information society
services

• Twitter @StewartRoom
• www.stewartroom.com
• www.ffw.com
• http://privacylawblog.ffw.com/

e-Privacy

How to face the
cookie monster
George Thompson

23rd May 2012

© 2012 KPMG SA, a Swiss corporation, is a subsidiary of KPMG Holding SA, a Swiss corporation, which is a subsidiary of KPMG Europe LLP and a member of the KPMG network of independent firms affiliated with KPMG International Cooperative 9
(KPMG International), a Swiss legal entity. All rights reserved. The KPMG name, logo and „cutting through complexity‟ are registered trademarks or trademarks of KPMG International

Agenda

1. Introduction
2. Compliance survey
3. Clients issues


KPMG survey

Selected major UK organisations across a wide range of sectors – 55
Website analysis
 Presence of Cookie, trackers etc
 Presence of Privacy Policy/T&Cs etc that explain cookie/tracker usage by the site
 Presence of consent mechanism
 Analysis of results
Results
 1 website compliant with consent mechanisms in place
 2 websites with privacy policy stating the site would be in compliance by 26th May
2012
 2 websites with no cookies/trackers
Next Steps: Re-run survey post 26th May


Client requests Challenges

What are my peers doing? Who is responsible?
What do I need to do?  Privacy Officer
 First party  Marketing/HR/IT
 Third party  Third party
Which websites? How do I assess and manage the
risks?
 Corporate
 Compliance risks
 Affiliates
 Technology risks
 HR services
 Contract/Sourcing risks
 Marketing
 Consumer Impact
 Third parties


Defining the scope of the issue

In scope: Other considerations:
Cookies that store and track information  Intrusiveness
about your site visitors
 Data passed to an organisation the
 First / third party individual would not expect
 Session or persistent  Sensitive data
 Flash, web beacons, gifs.  Aggravating factors (e.g., could the
site‟s use of cookies be perceived as
 All equipment (e.g., mobile devices)
disingenuous?)
Not in scope:
 Cookies whose sole purposes is to
facilitate communication over a
network
 Strictly necessary for the provision of
service requested by the user


KPMG approach

I - Discovery
KPMG will run a discovery phase to identify websites
that contain client specific names, brands etc. This data
is used to create an inventory of internet presence II - Data Gathering
(asset inventory) which the organisation uses to assign A crawl, with pre-agreed limits, will be
ownership/responsibility and creates the baseline for performed that gather information on all
compliance reporting. cookies set for each site. This will record
both persistent and session cookies as
well as those issues by any third party
(e.g. analytics or advertisement related).

III – Compliance and Risk Assessment
IV - Remediation Output from previous two phases will
KPMG will advise on which cookies require be compared and any non-compliances
consent as well as advise on potential reported. Further KPMG will provide an
solutions. If required, KPMG can re-do inventory of all cookie data, together
selective crawls to confirm adequacy of any with appropriate summaries of
remediation activity. information collated.


Websites Discovery and Risk Assessment

I - Discovery Phase II - Data Gathering Phase Attributes that can be gathered from
headers or basic trawling, such as:
- Software version
Known URL‟s - Development framework
Detect Websites - Cookie details

Additional information from e.g.:
Gathering of site attributes for websites
- Public registrars
(primarily automated)
- InfoChimps GeoIP data set.
Reconcile Discovery - Technical characteristics of Web site
results with the list of - Geo-location and provider
known URLs. - Site purpose
- Compliance items (Privacy policy, terms and
conditions)
Business value
determined by the impact
that Client aces through
the exposure to their
consumers
IV – Security and Privacy Remediation III - Risk Assessment Phase
For high risk websites: High
Web app testing - Payment handling,
- Old framework with known
- Old frameworks with

Technical Risk
vulnerabilities
Compliance assessment limited security capability
- Brochureware
(e.g. classic ASP)
HL HH
Vulnerability assessment
- Site out side Client control - Gathering of PII.
(sponsorship). - Modern language with
Remediation - Static content, limited known secure options by
Risk assessment drives the information collected. default.
scope and level of assurance and LL LH
the priorities for remediation. Low
Business value High


Further challenges

No clear view on what kinds of consent will be meet requirements:
 Browser settings – unlikely to work
 Pop-ups and similar techniques?
 Terms and conditions?
 Settings/Feature led consent?
 Functional uses?
 Third party cookies?
Evolving models
 IAB industry icon and opt-out page


Thank you

george.thompson@kpmg.co.uk

+44 7802 155857

Cookies: View from
the ICO

Dave Evans
Spring 2012

Introduction and contents
• Where we all are
• What the ICO has seen over the past year
• What we plan to do
• What everyone else needs to do

A man walks into a bar…..
• The case for tailored/targeted/personalised/more relevant
service is easily made in the abstract.
• But just because nobody would volunteer for off-the-
shelf/scattergun/impersonal/irrelevant service doesn‟t mean
they will give up everything in the search for better content.
• The same people who say they want more relevant content
are the same people who do not wish to be tracked online.
• It is important to see the revised „cookie rule‟ as an
opportunity to ensure that people are aware of and
comfortable with what you are doing.

The revised law
6. - (1) Subject to paragraph (4), a person shall not store or
gain access to information stored, in the terminal
equipment of a subscriber or user unless the
requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of
that terminal equipment -
(a) is provided with clear and comprehensive
information about the purposes of the storage of, or
access to, that information; and

(b) has given his or her consent

Where we are
• Almost a year in – remember, the 12 month lead in related
to ICO‟s regulatory approach not to the law itself.
• Guidance and advice has been available from ICO since the
Regulations were passed.
• We are seeing lots of good work – but until it all ends up on
websites there is a risk that bluster, scare tactics and
burying of heads will win the day
• We need to do our job in a responsible and proportionate
way; for this to happen we need assurances that the good
work will continue.

Where we are (2)
• ICO guidance described as being helpful and useless; vague
and clear.
• There have been calls for my office to tell people exactly
what to do.
• Important point: it is not the regulator‟s job to tell people
how to run their business.
• It is far more appropriate to give guidance and advice on
approaches taken and to ensure that the unwilling get their
act together.
• Be careful what you wish for….

What we have seen
• We have seen progress on browser settings
• Browser settings can work and will be one method of
gaining consent for all the cookies which you can honestly
categorise as “privacy” neutral.
• Remember, the law says consent from the browser depends
on the subscriber having taken some form of action
• Many people, particularly those who are using old, creaking
versions of browsers might never have set or amended
anything; how can you show your website is not taking
advantage of this?

A few words about analytics
• They are not exempt
• This is not ICO being awkward or gold plating and we
definitely appreciate how important this functionality is.
• BUT saying that analytics activity allowed by the setting of a
cookie is within the scope of the law is not the same as
saying the law requires an opt-in model.
• Recent guidance from government has been interpreted to
mean “don‟t bother about analytics”
• ICO guidance is that you do need to bother but…..

Future plans (1)
• We will supplement existing guidance in the
following ways:
– Assessment of efforts made so far
– Clarification of the acceptability of implied
consent
– Further detail on our regulatory priorities

Future plans (2)
• There are lots of gaps around at the moment
• Like nature, regulation abhors a vacuum
• We all need to fill those gaps with evidence of good practice,
practical and realistic guidance and consistency across
websites.
• Without genuine efforts at compliance the bluster and scare
tactics will fill the gap between what the law says and what
you are doing.
• The more users become accustomed to good practice the
easier it will be to get consent and the harder it will be for
the unwilling to find an excuse.

Next steps
• Will continue to work with industry and European colleagues
to address difficult areas

• The updated ICO advice is available and will be amplified in
the run up to May

• We know there are organisations out there doing this
properly and their efforts will make the „do-nothings‟ stand
out.

• If cookies are so important why is it that only 13% of users
we confident they know what a cookie was and what it did?

Keep in touch
Subscribe to our e-newsletter at www.ico.gov.uk
or find us on…

www.twitter.com/iconews


ePrivacy – Marketer‟s Perspective
Des Cahill, VP Marketing Ensighten
May 22, 2012

Marketer‟s & ePrivacy - Questions

 Targeted offers vs. consumer privacy
 Sell locally, comply globally
– DNT for U.S., Cookie Law for U.K., what‟s next….

 Who are the internal stakeholders?
– Legal, Privacy, Security, Marketing, Agency

 Brand and privacy
– Brand attribute or hindrance?
 Data collection – want vs. need

31 © 2012 Ensighten - All Rights Reserved.

The Tag/Cookie Continuum

Benefits Benefits
Consumer Website Publisher

Shopping Cart Analytics Ad Network
Remembers items Counts the number makes inventory
in a cart of pages visited available for cross-
site campaigns
Personalization Re-Targeting Real-Time Bidding
Personalizes Shows ads to prior sells audience
content such as site visitors impressions at auction
welcome page


Marketer‟s & ePrivacy - Actions

 What data is collected on my site(s)?
– Tags – javascript for 1st party & 3rd party data collection
– Cookies – in browser consumer online activities
– Action: Get a site tag/cookie audit e.g., tagcert.com

 Site privacy policy and TOU
– What does it say? Revise. Comply
– Action: Review and edit/re-publish

 Enable consumer eprivacy choice
– privacy page opt-out
– preference center
– opt-in/opt-out support (compliance)
– Action: Build or buy (vendor evaluation)


From Across the Pond - Do Not Track


DoNotTrack – Nitty Gritty

 FTC/Obama ask industry for DNT solution by 2013
– threat of legislation, avoid EU opt-in
– dogs (tech) & cats (ad industry) lay together

 Yahoo.com, Google.com, Twitter.com pledge support
– recognize DNT on their sites by 2013

 Safari, Chrome, IE, Opera will all support
– Firefox – 9% web, 18% mobile DNT on

 Ad industry wants:
– DNT is default “off”
– Expanded definition of “affiliate party”
– Data still collected, but promise not to use for targeting


Ensighten Privacy Products

• enterprise grade, customizable privacy gateway
• supports any law, any standard, multi-lingual
• $50k-$150k, Sony, Motorola, Verizon

• fast, easy, free DNT support for any website
• free, no limits on usage, announced 5/15

• fast, easy, free UK Cookie law compliance for any
website
• free, no limits on usage, announcing today

PrivacyEU – Announcing Today

1. UK websites can implement support ePrivacy
Directive quickly with minimal effort
2. Single line of code on website pages
3. Unlimited site traffic volume, domains
4. Available for download 5/26/12
– www.ensighten.com/products/producteu
5. Free


PrivacyEU example – telegraph.co.uk


Install PrivacyEU on telegraph.co.uk

<script src=“//privacy.ensighten.com/YourID/bootstrap.js”></script>

<script src=“//privacy.ensighten.com/telegraph.co.uk/bootstrap.js”></script>


PrivacyEU – telegraph site tags listed


PrivacyEU – decide tags to always allow


PrivacyEU – First party tag


PrivacyEU – telegraph tags all set


PrivacyEU – “Try It”, test consumer view


PrivacyEU – testing consumer experience


Closing thoughts

 Mobile - next great privacy frontier
 Facebook – also next great privacy frontier
 DNT – hot US media topic Q412
 Long term
– will DNT browser based privacy solution move to EU?

 Next 6-18 months in UK will be an interesting time….


Thank you

Des Cahill
VP Marketing, Ensighten
descahill@ensighten.com
www.linkedin.com/in/descahill
@descahill


Timeline & Summary
• Ensighten Privacy enterprise solution
• Available now
• Direct sale – local implementation partners
• Partner sale – Ensighten support

• PrivacyDNT announced
• May 15 Privacy Identity Innovation Summit, Seattle
• Download mid-June

• PrivacyEU announced
• May 23 London launch event
• Download on May 26


Ensighten Privacy Solutions

Fast, easy deployment
– Single line Ensighten Privacy tag placed on site webpages
– Supports PC, phone, tablet and any recent browser

Tag detection
– Ensighten detects, lists and controls all tags on site
– No need to add tags to Tag Management system

Tag categorization
– Ensighten allows site admin to categorize tags by privacy law
– PrivacyChoice provides tag privacy data

Tag gateway
– Controls all tags, not just those in TMS
– Detects any new tags added to site
– Controls tag activation/blocking by site by visitor by applicable
privacy law/standard


How Ensighten PrivacyEU Work for Publishers

Ensighten Privacy
1 Tag placed on site.

acmewidgets.co.uk
<ensighten privacy tag>
Site now recognizes
PrivacyEU detects and UK visitors. Dialog box
2 lists all tags on site. 4 for Consent. Blocking of
unallowed tags.
acmewidgets.com

UK Cookie
Site administrator Law Consent
3 categorizes tags.
Turns PrivacyEU on. YES NO

Detailed privacy info on
tags from PrivacyChoice

How Ensighten PrivacyEU Works for Consumers

Ensighten Privacy Network
acmewidgets.co.uk tags
1st Party Analytics 3rd Party
< > < > < >
< > < > < >
< > < > < >
< > < > < >
< > < > < > Allowed
< >
< >
< >
< >
< >
Ensighten downloads list of
Ensighten detects Ensighten displays dialog allowed tags based on
1 UK site visitor. 2 box for UK Cookie Law 3 consumer wishes. Page
Page load begins. election from consumer. load complete.

acmewidgets.co.uk acmewidgets.co.uk acmewidgets.co.uk
<ensighten privacyEU tag>
UK Cookie
Law Consent
YES NO

Ensighten cookie is set
to note consumer
preferences for next site
or sister domain visit.

Appendix


Other ePrivacy Offerings

 Site Crawl & Tag Audit Report
– nice to have report, but…
– no actual control over tags, no compliance for site owner
– Evidon, Truste and lots of small guys

 Full TMS deployment required
– cost & complexity of TMS deployment
– not all tags go into TMS, can‟t be 80% compliant
– new tags deployed on site not covered
– TagMan, BrightTag


Ensighten Enterprise Grade Technology

1 Ensighten Tag - single line of javascript code
<script src=“//privacy.ensighten.com/YourID/bootstrap.js”></script>

2 Cloud based TMS, privacy
and mobile apps for site tag
audit, monitor and control

3 Global Tag Server Network
for fast tag serving and
blocking by site by visitor

Global multi-cloud network. Handled 46 Billion tag requests in Q1‟12
representing a 300% growth year over year. Powers $16B in ecommerce
revenue across 13,0000 domains for customers like
Staples, Microsoft, Sony, United Airlines, American Express, Symantec.

Ensighten Privacy functionality
Ensighten Privacy monitors the performance and data collection behavior of
3rd party tags on your site vs. your policies


Ensighten Privacy vs other TMS

 Tagman & BrightTag
1. Can control only tags in their TMS
– Moving tags into TMS a complicated, long
process
– Typically not all site tags move into TMS
– New tags added to site are not in TMS
2. TMS is enterprise purchase
– Expensive
– long sale cycle
– long implementation cycle (pro services)


Ensighten Privacy compared to Evidon

 Evidon
1. doesn‟t control tags on site. just sends opt-out request
to ad network
– not all tags honor opt-out requests (e.g., X+1)
– consumer data has already been collected by tag vendor
– no confirmation that ad network has complied
2. opt-out from tag vendor is global across sites
– even when consumer turns off DNT, still opted out from ad
networks
3. paid solution
– wil not have broad publisher market penetration

 Net: Evidon doesn‟t control tags on site, so can‟t
block data collection. Relies on ad network opt-out
process after consumer data collection has already
occurred. Partner.


Ensighten Overview

 Enterprise Tag Management solutions
– for web, mobile apps, flash

 Customers our products to manage 3rd party tags (ad
networks, social sharing, analytics, etc.) on their websites
– accelerate website page load

– manage website consumer data collection

– site privacy and compliance (partner with PrivacyChoice)

 Founded in 2009
– Cupertino, CA; London UK

– 40+ F1000 customers, 13,000 domains, $16B in e-commerce


Ensighten Products

 Ensighten Manage
– Tag Management for Enterprise Websites
– Handles any tag, any use case
– workflow, audit, rollback – javascript cms
 Ensighten Mobile
– extends TMS to compiled apps
– iOS, Android
 Ensighten Flash
– extends TMS to rich media apps
– Flash/Flex/Air
 Ensighten Privacy
– Single line of code deployment
– Controls all tags on site, no TMS required


PrivacyDNT – easy publisher DNT compliance

1. Sites can implement Do Not Track for free, today
and with minimal effort
– Ensighten PrivacyDNT free solution launching 5/15
2. Sites don't need to wait for ad networks to
implement Do Not Track
– PrivacyDNT implements DNT compliance at site level
3. The solution works with and builds on the emerging
DNT standards
– PrivacyDNT web based solution, ongoing updates


How Ensighten PrivacyDNT Works for Publishers

Ensighten Privacy
1 Tag placed on site.

acmewidgets.com
<ensighten privacy tag>
Site now recognizes
EnsightenDNT detects DNT headers. Blocks
2 and lists all site tags. 4 unallowed tags for DNT
“on” visitors.

acmewidgets.com

Site administrator
3 categorizes tags.
Turns PrivacyDNT on.

DNT

Detailed privacy info on
tags from PrivacyChoice

How Ensighten Privacy DNT Works for Consumers

Ensighten Privacy Network
acmewidgets.com tags
DNT NO DNT OK
< > < >
< > < >
< > < >
< > < >
< > < >

< >
< > DNT OK
< >

“DNT” Consumer visits Ensighten sends browser Non-DNT tags (as defined
1 site. Ensighten detects. 2 list of “DNT allowed” tags 3 by acmewidgets.com)
Page load starts. while page loads and cookies stopped.

acmewidgets.com acmewidgets.com acmewidgets.com
<ensighten privacyDNT tag> DNT

DNT is ON Consumer privacy
preference enforced


PrivacyEU – Flip it on….that‟s it


privacyDNT sign-up at ensighten.com


Confirmation Email


PrivacyDNT: Site Admin logs in


PrivacyDNT: detailed tag privacy info


PrivacyDNT: Site Admin re-categorizes tags


Access to PrivacyChoice Tag detail


Mockup of PrivacyEU dialog box


Panel Discussion
What impact will the UK Cookie Law have on digital
marketing strategy?


UK Cookie Law Compliance:
Implications & Answers

Thank you!

UK Cookie Law Compliance: Implications & Answers

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (14)

Similaire à UK Cookie Law Compliance: Implications & Answers

Similaire à UK Cookie Law Compliance: Implications & Answers (20)

Plus de Ensighten

Plus de Ensighten (20)

Dernier

Dernier (20)

UK Cookie Law Compliance: Implications & Answers

Notes de l'éditeur