What are cookies? And how do they present a privacy issue?

• Cookies are bits of data that are passed from the website and stored on a visitor’s browser. The purpose of cookies is to remember and identify visitors when then return to a website. This is how websites and third-party tools like Google Analytics are able to track a visitors activity on a website. Such third-party tracking cookies compile data about a visitor’s actions on multiple websites and compile their browsing history. Which in turn, causes a privacy issue.

What does the EU Cookie Law require me to do?

• When a user first visits your site, you need to display a cookie banner. You also need to block non-necessary cookies (e.g. via Google Analytics, Facebook Ads/Like widgets, Adsense etc.) before user gives consent. The  cookies should only be loaded after informed consent has been provided by the user (prior consent). The website also needs to provide a compliant cookie policy.

If I have a US based business, do I still have to worry about the EU Cookie law?

• If a website gets visitors from EU countries, it needs to comply with the EU Cookie Law. And even if you don’t get website visitors from EU countries, the state of California has introduced a regulation called CalOPPA (California Online Privacy Protection Act) that has much of the same requirements as the GDPR and EU Cookie Law.

Do I need to comply with CalOPPA even if my website is non-ecommerce and non-commercial?

• According to CalOPPA, a commercial website is any website that helps you make money in some way. For example, if you offer services on your website, it’s still considered a commercial website. Also if you use third-party tracking services such as Google Analytics, you need to comply with privacy regulations.

How does this plugin Identify the Cookies on my website?

• The WP GDPR Cookie Consent plugin has a one-click scanner, that’ll scan your website for all the cookies. After the scan, it will show you the list of cookies used across your website. It will also automatically classify the non-exempt cookies into Marketing, Analytics and other categories. You can review and change the category if you need to.

Do I need to do Prior Blocking of Cookie Scripts?

• Some cookies are not necessary to be blocked, for e.g. Technical Cookies – These are session cookies, preference cookies which are necessary for the website to function. Cookies which are used for statistics or analytics which don’t profile a user or anonymized data is stored are also not needed to be blocked. The plugin provides you with an interface in the admin to choose which scripts you want to block before accepting user consent.

‍Do visitors now have to accept/reject cookies in order to use websites?

• No. Only the ‘necessary’ cookies will be loaded until the user gives consent.

Who does CCPA apply to?

The CCPA applies when your business website targets Californian consumers, and meets at least one of the following conditions:

• annual gross revenues exceed twenty-five million dollars; or
• earns 50 percent or more of annual revenue from selling the personal information of visitors; or
• buys, receives, sells, or shares the personal information (including IP address) of 50,000 or more consumers annually for the business’ commercial purposes.

What is considered as personal information under CCPA?

CCPA considers the following as personal information:

• IDs such as a real name, alias, postal address, IP address, email address, account name, social security number, driver’s license number, passport number, etc.
• Commercial information, including records of personal property, products or services purchased, or other purchasing or consuming histories.
• Biometric information.
• Location data.
• Internet usage or other electronic network activity information, including browsing history, search history, and information relating to website interaction.
• Employment or education related information.

How to comply with CCPA?

Steps to comply with CCPA:

• Inform visitors about what personal information is collected, why it is collected, and how it’s stored before or at the point of collection.
• Provide access to this personal information or remove it, when a visitor makes a verified request.
• Allow visitors to tell you, when they don’t want their personal information to be sold to third-parties.
• Do not sell personal information of visitors below the age of 16.