Everything you need to know about third-party cookies
When browsing the web, there’s a high chance that you’ve come across a popup notification telling you that the website uses cookies. Many times, users go ahead and hit agree without fully knowing what they are signing up for. For all you know, you agree to first-party or third-party cookies.
Internet cookies aren’t those artery-clogging goodness made by grandma. Instead, an internet cookie is a small piece of data from a particular website stored on a user’s computer while they browse the web.
One of the common purposes of internet cookies is to track users as they browse through multiple websites and display them with personalized ads (based on their web searches, likes, and dislikes). Before further ado, let’s get down to third-party cookies, how they collect user data, and their legal implications.
What are Third-Party Cookies?
Unlike a first-party cookie set by the website’s server, a third-party cookie is usually set by a third-party domain/server (i.e. an ad-based vendor). Third-party cookies are dropped via a specific vendor code or tag deployed on a particular website and stored under a different domain. A third-party cookie is available to any website that loads the third-party server’s code.
Third-party cookies have multiple purposes, such as keeping track of users’ browsing activities to show them personalized ads of goods and services. For instance, if you search for a Halloween costume, you may see your screen filled with ads regarding Halloween costumes on multiple websites, especially on social media sites such as Facebook.
Even if the user terminates the session or closes their browser, ads will continue targeting as the tracking data is stored on the users’ computer.
Simultaneously, cookies also have native functions such as remembering a user’s login credentials for a particular website, enabling them to instantly log in without manually adding their email address and password.
How Third-Party Cookies Work?
Third-party cookies work by embedding JavaScript from one website into another. This enables them to transfer the habits of a user across multiple websites. Third-party cookies accumulate data gathered between browsing sessions and map a clear picture of the user.
For instance, when users are on a shopping site, they browse through multiple categories, scrolling through the items they like. Typical cookies injected by the shopping site would allow it to remember the things a user has looked at and added to their cart. On the other hand, third-party cookies would not forget this data but may share it with other websites.
With third-party cookies in place, once you revisit the site, you will be shown the items you’ve previously looked at along with related articles that you might like (based on your previous selections). Again, the primary aim of such third-party cookies storing a user’s online activity is to increase the likelihood of a conversion.
Users who scratch their heads thinking why they’re being displayed ads on sites they’re visiting for the first time, the answer is most of the time simple — third-party cookies. Third-party cookies are one of the most reliable ways to send users targeted ads across the web.
What Does Major Global Privacy Laws Say about Third-Party Cookies?
While third-party cookies are a great way of marketing products and services for advertisers, not all users want to be targeted. Multiple data regulation laws put relentless pressure on companies who engage in ad display and transferring cookie information.
GDPR and Third-Party Cookies
The General Data Protection Regulation (GDPR) requires websites to collect explicit consent from the user regarding any cookies collected or shared other than the ones necessary to run the site.
GDPR has strict measures in place governing how user data should be prioritized and protected. Under the GDPR, consent means requiring a “clear affirmative action.”
The conventional pre-checked box or a popup cookie banner stating that users consent to the website using cookies is no longer sufficient. This means that users must willingly opt-in to having their data collected and used for marketing purposes.
To voluntarily consent to cookies, GDPR requires companies to ask the users in a “clear, concise, and not unnecessarily disruptive way.” This means that the site must have a user-friendly consent mechanism that doesn’t contain technical or legal jargon.
Additionally, GDPR requires websites to have a seamless mechanism in place where users have the option and the right to take back their decision to grant data collection, also known as the “right to be forgotten.”
CCPA and Third-Party Cookies
The California Consumer Privacy Act, routinely referred to as CCPA, explicitly states that cookies’ data is personal information.
Although CCPA doesn’t emphasize that businesses attain opt-in consent for cookies like the GDPR, it requires them to disclose any types of data they have collected via cookies. Furthermore, CCPA demands firms to reveal what they have been doing with the accumulated data.
Like GDPR, CCPA compels businesses to take the necessary steps to comply with the law by embedding the option of opting out of the sale of personal information collected by users via cookies.
LGPD and Third-Party Cookies
Brazil’s Lei Geral de Proteção de Dados (LGPD) or the General Personal Data Protection Law states that companies are responsible for providing prior notice and obtaining consent regarding cookies.
The law specifies that it’s the data holder’s responsibility to obtain the user’s consent in writing or any other means. Once the cookie has been collected, the data holders must have clear records to prove they complied with LGDP cookie consent.
Furthermore, entities collecting cookies must explain whenever data is collected beyond the scope of the objective formerly informed to the user. Failure to justify could result in fines. Without any legal basis, the data controller must acquire consent from the user to process cookies. As such, proper mechanisms should be deployed to facilitate consent from users.
In a Nutshell
Websites and companies can collect third-party cookies if they respect local and international laws put in place by data regulators and governments. The legalities of collecting and sharing cookies should be followed by the law to avoid any controversial use of internet cookies or have fines imposed by data regulators.
If you’re unsure your business website complies with data protection laws related to cookies, make use of the cookie consent management tool that scans your websites to detect and classify cookies that are dropped.
The tool visualizes and tracks 1st and 3rd party code that runs on your websites, providing a simple and secure way for website visitors to exercise their right to opt-out of online tracking. Simultaneously, businesses can avoid conflicts and fines from data regulators by complying with cookie consent requirements.
