How the New Cookie Policy Affects eCommerce

Legal matters and data protection are always difficult, and for most people, they can be somewhat daunting. However, they are also critical for conducting our online activities with guarantees.

 

In recent years, we have seen significant updates in this area come into force. If you have been in the business for a while, you surely remember the stir caused by the famous GDPR.

 

Well, as of January 11, 2024, we have new regulations that specifically affect cookie management, which you should be aware of and implement.

Although we understand you probably know this, a brief reminder is worthy. This will help us better understand the scope of the regulatory change.

 

Basically, cookies are small pieces of code that are installed in the browser and collect certain data. They personalize visitor's experience and, additionally, offer greater security.

 

There are several types of cookies depending on their purpose. We can distinguish between:

 

 

In summary: these types of cookies serve, in the case of eCommerce, for example, to remember preferences such as language in multilingual stores, products that have been added to a cart during a session, or access data when the user decides they should be remembered.

 

Also, to recover abandoned carts, generate reports with web analytics, prevent fraud, make product recommendations, display our advertising campaigns...

It is easy to realize how critical the use of cookies is on any website, especially in an online store.

 

As mentioned in the introduction, both community and national bodies (such as the famous Spanish Data Protection Agency) have become increasingly strict with the application of their privacy policy.

 

The change in question comes precisely from the update of the AEPD's cookie guide. According to this agency, the goal is to make users aware of the relevance of their data and clear about what companies collect and how it is used, so they can proactively decide, with full knowledge, whether or not they want to give their consent.

 

A practice that is no longer acceptable is what is known as a "cookie wall."

 

This is a pop-up window that blocks access to content until cookies are accepted. Right now, that is illegal unless the user is given an alternative to consent that is not necessarily free.

 

Therefore, you have probably seen media outlets with cookie walls that offer the option to browse without cookies through a paid subscription, something that does not make sense in eCommerce, but you should be aware of it.

 

The most important thing is that from now on, the way we interact with the famous cookie notices will change and will require us to adapt.

Something we have not mentioned yet, which is relevant, is that not all cookies are affected by the new directive.

 

Those that are strictly functional and necessary for the provision of the service are exempt. We're talking, for example, about user entry cookies, authentication and login cookies, multimedia player cookies, session cookies for interface personalization, etc.

 

What happens with the rest? Well, we must offer our visitors an interactive notice that lists the cookies we use and allows them, through a button or slider, to select which ones they permit and which ones they do not, including the possibility to reject them all.

 

Let's not forget that what is sought is the greatest possible transparency, so we must explain in a very accessible, clear, and intelligible way:

 

 

Therefore, we need to update the cookie banner itself, as well as the privacy policy, and configure the cookies appropriately.

 

I insist on something very important: the user's consent is the basis for compliance with the regulations. Forget about any method that does not involve direct acceptance.

 

It is worth emphasizing that these obligations are set out in the second section of Article 22 of Law 34/2002, of July 11, on services of the information society and electronic commerce, and there are penalties that can be high.