The regulations around data collection are constantly evolving. First, there was the RGPD and its obligation to build and maintain a repository of all tags on the site. Then the ePrivacy regulation, which requires the user to obtain explicit consent before depositing cookies and triggering tags while browsing.
The year 2023 was marked by several significant events:
- The formal notice of Google Analytics by the CNIL, which created a real upheaval among advertisers. This situation has led them to reconsider the use of their analysis tools, especially with the arrival of Google Analytics 4 on the market .
- The record fines imposed by the CNIL due to breaches of compliance with the RGPD regulations.
- Continued uncertainty about Privacy Shield and data transfers between the United States and Europe. This situation raised numerous questions about the protection of user data.
- The emerging and growing attention of the CNIL on mobile applications, which is not surprising given that 87% of 12-year-old French people own a smartphone, making it a preferred way to access the Internet.
In this article we present the various functionalities of our platform allowing you to confirm that your tracking is in compliance with the ePrivacy regulations.
- A summary view of compliance.
- A downloadable report as proof of compliance.
- The control of user consent to meet the requirements of ePrivacy.
- Mapping to have an exhaustive view of the tags present on your site.
- The trigger tree to identify the tag behind the piggybacking.
- The detection of sensitive data of your Internet users
Compliance control: towards more autonomy and visibility for DPOs.
Within the company, the DPO plays a crucial role as a spokesperson and guarantor of compliance. Its mission is to ensure that data processing practices fully comply with GDPR regulations.
However, in reality, this responsibility results in a significant dependence of DPOs on data teams. On the one hand, they often have little visibility on the data collection and data control system. On the other hand, in the event of an audit by the CNIL, they do not have the autonomy necessary to gather evidence attesting to the conformity of the data collection.
A summary view of compliance.
We offer a summary view of compliance in order to gain visibility but also in reactivity in the event of a tracking anomaly.
After the nutri-score and the energy performance diagnosis, here is the seenaptic compliance score?!
Visual and easily interpretable, it allows you to see at a glance the status of the compliance of websites.
We based this score on 4 key compliance criteria:
- The consent of the users,
- Sensitive data of Internet users,
- The location of data storage,
- The cookies placed.
In the event of an anomaly, the score established on a ranking from A to E (A = Everything is fine; E = nothing is fine anymore) deteriorates and the teams can immediately see where the regression comes from. As a reminder, this feature complements our alerting system, no need to be permanently connected to seenaptic !
A downloadable report as proof of compliance.
In the event of an audit by the CNIL, DPOs can now launch a compliance check independently. They will then receive an audit report, an essential document to quickly build up the necessary evidence.
The report can be downloaded in a simple click, allowing DPOs to easily generate it, whether before or after the implementation of possible compliance-related corrections.
This before-and-after functionality represents a major asset in justifying the commitment to compliance and demonstrating the positive effects of corrective actions taken.
Controlling user consent to meet e-privacy requirements
When an Internet user arrives on your site, he must accept or refuse the deposit of cookies and the triggering of tags during his navigation.
To do this you use tools. There is your TMS that allows you to manage the tags that must be present on your various types of pages as well as the data that they must collect throughout the consultation of the site. And there is the CMP, which allows you to authorize or block the triggering of said tags according to the choice that your user has made to you in terms of consent to the collection of data. However, we regularly encounter cases where a first web analysis tag is triggered during a first navigation on the site before the user has even accepted or refused cookies.
Various factors can lead to the triggering of tags that go against the choice of your user:
- The integration of a new partner that has not been updated in the CMP,
- A configuration error in your CMP incorrectly allows the presence of tags.
Review your CMP configuration and ensure that you respect user consent.
In seenaptic, you will be able to program tests to control the site by refusing cookies and ensure that only authorized tags are triggered. If tags are present when tracking has been expressly refused, you will receive an alert so that you can correct them as soon as possible.
Mapping to have an exhaustive view of the tags present on your site.
Is it useful to remind you that the RGPD requires you to know and control all the tags present on the pages of your site.
There are analytics and media tags that are part of your marketing data scope and that you are aware of for managing your campaigns. And then there are the others. These are the tags that interest us.
Again, a multitude of cases can explain the presence of tags on your site without necessarily explaining their usefulness in terms of your data collection:
- You have cancelled a partner but the information has not circulated internally and the partner's tag continues to be triggered on your site.
- One of your partners has updated his tag and brings a new tag with him when it is triggered on your pages.
Map your tags with seenaptic Seenaptic
will analyze all the resources on the page and determine precisely what path allowed the resource to be triggered. In this way, we can know what the precise trigger tree for each tag is: which tag has embedded which other tag to finally fully understand the sequence of tags on the page.
Go further with the trigger tree to identify the tag that caused piggybacking.
In addition to the mapping of the tags, we allow you to go up the thread until you know the tag at the initiative of the presence of the unexpected tag.
Piggybacking: the case of Microsoft and Clarity
Microsoft offers Bing Ads for the distribution of acquisition campaigns aimed at increasing traffic and lead generation. Bing Ads works through a tag.
Clarity, for its part, is Microsoft's new tool for collecting more or less accurate data about visitors to its website. When updating the Bing Ads tag, Microsoft decided to include the Clarity tag as well.
Tag mapping has allowed several of our customers using this service provider to receive alerts informing them of the pPresence of a new Clarity tag on their site. Thanks to the trigger tree, they were able to identify that Bing Ads was causing it.
The detection of sensitive data of your Internet users
We have just seen that tags can collect user data without your knowledge. In the most critical cases, this collection may concern the personal data of Internet users.
The collection of personal data is regulated. It must be the subject of particular attention in order to guarantee the respect of the privacy of Internet users. To do this, site managers use several techniques to project them: during their collection, they can be anonymized or even hashed for example.
Prevent the collection of sensitive data.
When seenaptic checks the site's tracking and simulates user journeys through its scenarios, it ensures that all the personal information available on the page is protected. If a tag is triggered and sends the user's email to their server, an alert can be issued to verify that this behavior is expected. In this way, no tag can “steal” your users' personal information without your being notified.
To find out more about your GDPR compliance and compliance with the ePrivacy Directive, request a demo now.
