ePrivacy: How to respond to it through Data Quality

The CNIL is disrupting the data landscape. It requires website managers to constantly adapt to changes in RGPD and ePrivacy regulations, which aim to protect the personal data of Internet users.

But sites are also evolving, and the mechanisms put in place to control compliance do not necessarily remain effective over time.

We hosted a webinar with Converteo that deals with these topics.

Discover the replay of our webinar presented by Charles THUMERELLE Product Owner at Seenaptic and Valentin SVAHN Lead Analytics/Digital Products at Converteo, on the theme “How to respond to privacy challenges through “Data Quality”.

In this article, we will discuss the following topics:

A reminder of the CNIL context with our recommendations to ensure data protection while remaining in compliance with the RGPD and the ePrivacy Directive.

• Data protection called into question with the Cloud Act
• Managing tags and cookies
• CMP control: Customer case

The protection of the personal data of Internet users in relation to the ePrivacy Directive

Reminder of the context of the CNIL

Before February 10, 2022, Google Analytics had a strong predominance with more than 80% of the market for web analysis tools. But the CNIL has put on notice several site managers because of their use of Google Analytics, considering the tool not respectful of the RGPD concerning in particular the location of data. Some go so far as to think that Google Analytics will never be legal again. This explains why the analytics landscape is being redesigned and balanced. Moreover, players are beginning to consider European web analysis solutions or UX Analytics tools.

Data protection called into question with the Cloud Act

American laws have extraterritoriality. This means that via the Cloud Act, (a series of laws on data processing), any American intelligence agency can access the data of an American solution that hosts its data on American territory or elsewhere.

There is therefore the question of personal data (IP address, GA cookie, GA cookie, CRM ID, loyalty card ID, transaction ID) that is stored and accessible by American intelligence agencies.

Do we need to:

• Change tools in favor of a solution hosted within the European Union?
• Continue to use a tool that is located outside the European Union and that involves leaving out all PII (Personal Identifying Information)?

How do you ensure data protection and remain compliant with the GDPR and the ePrivacy Directive?

To answer this question, we offer you 3 solutions:

• The control of tags and cookies, by browsing the site to identify all the tags and cookies present on the pages,
• The verification of the CMP (Consent Management Platform) and the respect of the consent formulated by the Internet user,
• The protection of personal data, by verifying that the data of Internet users is not sent to third parties against your will.

First and

foremost, you need to make sure that the cookie consent banner is present throughout your site. Sounds basic, but it's not always the case!

Control of tags and cookies

When the user gives you their consent, make sure that it is respected.

To control all your tags and cookies, we advise you to check:

• The triggering of the tags,
• The data contained in the data layer,
• The deposit of cookies.

Indeed, tags can be triggered on your site without you being aware of it, this is called piggybacking.

What

is piggybacking exactly?

We talk about piggybacking (or tag encapsulation) when tag A is triggered on your site, it calls tag B which calls tag C which themselves have their own trigger rules.

The problem is that you've applied consent on the “top level” tags. Excluding the TMS (Tag Management System) includes tag A which has its own trigger rules.

So there was no consent and you do not have control over it (see diagram below).

Some solutions to remedy it?

• Prefer tags such as image pixels,
• Go through serverside solutions,
• Set up a CSP (Consent Security Policy).

How to use seenaptic to control tags and comply with the ePrivacy directive?

We check all the tags on your pages through automated tests. When a tag that is faulty, slow to load, malicious or simply not listed in your repository is triggered, we alert you.

Case 1: The tool will check that the cookies are correctly placed and that the tags are triggered in the right place with the right parameters. If not, an alert will be sent.

Case 2: We simulate the case of an Internet user who refuses to accept cookies. If a tag is triggered despite the refusal of consent from your users, we alert you

.

CMP control: Customer case

One of our customers uses seenaptic to

monitor his CMP.

The marketing team wants to:

• Ensure the presence of the consent banner on the group's 120 sites,
• Identify the tags that are triggered,
• Identify the deposits of associated cookies despite the refusal of the user.

To do this, automated tests on paths that refuse cookies are carried out daily on all sites. Alerts are sent in case of non-compliance with user consent.

Thanks to the alerts, the marketing team was able to identify that:

• The CMP was absent at more than 15 sites,
• More than 20 tags were triggered despite the lack of user consent.

hbspt.cta.load (8501110, 'abf1ff2f-ada9-4427-bd26-b80eed8be0e7', {"useNewLoader” :1): true”, "region”: “region”: “na1"}); The protection of Internet users' personal data The GDPR

requires that Internet users' data remain in Europe.

In order to control this, you can:

• Control the location of the data,
• Monitor personal data.

Controlling the location of data

Let's take the case of a site hosted in France on which you are browsing. The website server returns you an HTML page containing tags like Google Analytics.

When the browser reads these tags, data will be sent to Google Analytics, potentially to an IP address located outside the European Union.

We therefore invite you to ask yourself 3 questions:

• Is the company subject to the Patriotact?
• Does this personal data transit through foreign countries?
• Where is the data stored?

Monitoring and tagging personal data (PII)

Personally Identifiable Information (PII) is a set of data that can be used to distinguish a specific individual. For security purposes, this type of data is encrypted when collected and sent to the tool in question

.

But the complexity of a site and the number of stakeholders around it (internal and external) mean that itIt is complicated to ensure that this personal data is well encrypted and that none is recovered by a third party in accordance with the GDPR and the ePrivacy Directive. We then talk about data leakage.

This sensitive data therefore requires particular attention and can be subject to a dedicated check in Seenaptic. In this case, automated tests are carried out on paths that collect personal data.

Teams are alerted:

• In case of data leakage. They can quickly identify where the data leak is coming from,
• If user data is no longer hidden.

Data quality and GDPR issues in connection with the ePrivacy Directive must be subject to constant checks and thus mobilize all employees in the organization.

By using a dedicated tool such as Seenaptic, federate your employees and above all have a control process with the CNIL.

Do you want to test on your site how to control the protection of your users?