An Overview of Privacy and Cookie Consent Management
Why privacy compliance has become a critical business issue for every website owner
If you are reading this, you’ve likely heard that regulations and lawsuits are increasing the need for websites to include “cookie consent banners” and other privacy-related features.
For years, most assumed that website privacy centered on large technology companies and online retailers. That is no longer a safe assumption.
Expanding state privacy regulations and a growing number of website privacy lawsuits have changed the risk landscape. In states like Florida, lawyers are applying decades old communications and surveillance statutes to modern websites. Small businesses in Tallahassee and the surrounding area have been targets.
As a web design and support agency, we are working to help clients better understand these issues and implement technical solutions to help reduce risk. This includes consent management platforms (CMPs), properly configured cookie consent banners, and privacy-related policies.
It is important to understand, however, that website privacy compliance is ultimately the responsibility of the website owner. We attempt to provide technology, implementation assistance, and education, but we cannot determine a client’s legal obligations or guarantee compliance. Clients should consult qualified legal counsel when appropriate.
By design, some website services collect visitor data
A typical small business website does much more than display text and photographs. It may use services such as Google Analytics, advertising pixels, embedded videos, live chat, appointment scheduling, maps, CRM systems, and other third-party services.
Often these services communicate with outside companies when someone visits the site. Cookies can record website activity, recognize returning devices, and support advertising and analytics. Other technologies – including pixels, scripts, tags and session-replay tools – can also collect information and transmit it to third parties.
These tools have helped make the web user-friendly, encouraging growth and innovation. In the past, they were viewed as beneficial, but attitudes around individual privacy are changing.
More details on how we are approaching the issues surrounding compliance
What even are cookies?
Cookies are small text files stored on a visitor’s device through their web browser. They can enable the website to do things like recognize a visitor on a return visit, hold items in a shopping cart, or save login status to improve the user experience.
Privacy laws are expanding across the United States
In the European Union, an overriding privacy regulation called GDPR was the first – and still considered the strictest – data privacy law. In the United States, however, there is no national equivalent. Instead, website owners must contend with a patchwork of varying state laws.
California led the way, and numerous other states have since enacted their own privacy laws. And more are coming.
Importantly, a website is not necessarily affected only by laws in the state where the business is located. A Tallahassee business, for example, can receive visitors from California, Colorado, or even Europe. Therefore, they may have to comply with the regulations from those areas as well.
Our role as a web agency is to help clients implement appropriate technology once their needs are identified. It is our position that the best approach is to err on the side of caution by attempting to satisfy the widest swath of regulations, even if they may not be required for your business today.
The lawsuit problem is different from the regulatory problem
For local businesses in Tallahassee and across Florida, litigation is the immediate concern.
The current wave of Florida lawsuits are not citing modern comprehensive privacy statutes, but using old laws governing wiretapping, communications interception, and recording. They argue that just as they applied to analog phone systems in the past, they apply to modern web technologies today.
Courts have not given a definitive answer, and the law continues to evolve. Regardless, responding to a demand letter or defending a lawsuit can be expensive even when you believe the claim lacks merit.
While most agree individual privacy is a good thing, current website privacy decisions are really about risk management.
The timing of consent has become particularly important
Consider what happens when someone first visits a website with a cookie consent banner. A message appears saying, asking the visitor to “Accept” or “Reject” cookies.
But what if Google, Meta or another third-party service has already received information about the visitor before the visitor has had an opportunity to make a choice?
The banner may look compliant, but the technology behind it is broken. Simply having a cookie banner is not the same thing as having a properly functioning consent system. The banner must actually control the website.
This is why we believe simply adding a banner without properly configuring and testing it is insufficient. As part of our work with clients, we can help implement consent management technology and address the technical interaction between the consent management platform and the website.
'Copy and paste' privacy policies are no longer okay
Technical controls are only part of privacy compliance. Businesses also need to accurately explain their privacy practices. Appropriate disclosures can include a comprehensive privacy policy, cookie policy, terms and conditions, and disclaimers.
In the past, it was common for businesses to copy a privacy policy from another website and make a few minor customizations. Then it remained unchanged, on the site year after year. These old policies tended to focus on the selling or sharing of personal information.
“We don’t share our customer list,” was a common theme. But even if you don’t “sell” it, changes in privacy laws hold a website owner responsible if they provide visitor information to third parties without consent. This can lead to a lawsuit.
Comprehensive privacy policies should address how your site handles each type of personal information. For example, how do you collect, use, and potentially share things like IP address, search history, and geolocation. It should specifically address children’s privacy, and it should always include up-to-date contact information for the person at your organization a visitor can contact for assistance.
This is just the Privacy Policy. Ideally you should also have a specific cookie policy, terms and conditions, and disclaimers.
Remember, a policy cannot fix what the website is actually doing. The two sides should agree. The policy says what is happening while the consent management platform and banner make it happen.
Consent and privacy policy management is risk reduction, not a a guarantee
Installing a consent management platform, cookie consent banner, and comprehensive privacy policies does not guarantee that a business won’t be sued, nor does it automatically make a website compliant with every privacy law.
Privacy obligations depend on the business, its customers, the information collected, the technologies being used, and the jurisdictions involved. Our goal as a web agency is to help clients reduce risk by providing the technical tools and support needed to implement an approach that balances compliance and cost.
Who is ultimately responsible?
Compliance is ultimately the responsibility of the website owner. It is the company that owns the website that is the party named in, and responsible for, litigation. Our agency is not a law firm and cannot provide legal advice or guarantee that a particular website configuration will satisfy every applicable privacy law.
The practical takeaway for small business owners
Small business owners do not need to become privacy attorneys or web developers. But they should no longer assume that a privacy policy copied from another website – or a simple “We use cookies” popup – is sufficient.
We want to work with you to make this process manageable. We can provide and maintain technology designed to identify website tracking, manage visitor consent, control certain cookies and trackers, and provide appropriate privacy-related policies and disclosures.
Remember, a privacy banner should not merely tell visitors they have choices. The technology behind the website should respect those choices.
More details on how we are approaching the issues surrounding compliance
This article provides general educational information and is not legal advice. Privacy requirements vary by jurisdiction and circumstance. Website owners are responsible for determining and meeting the legal requirements applicable to their businesses and should consult qualified legal counsel when appropriate.
VISIT OUR OFFICE
LET'S TALK
Call: 850-391-8745
Text: 850-391-8743
