Keeping Consent Compliance on Track After Launch
The hours after the launch of a new website or digital advertising campaign are often the best. There’s just been a flurry of activity and a lot of stress, but the team has done it! Everything is live, all the checkboxes are checked, and it’s still a day or so away from when numbers start pouring in and the stress can start about if it is resonating with the audience. For the privacy compliance section of the launch checklist: the CMP banner is in place, the tracking is set up for consent, all is compliant. Out of sight, out of mind.
Or is it?
Consent compliance rarely breaks at launch. It drifts after launch, as new tags, vendor script changes, and missed consent triggers add up faster than one team can track.
Unbeknownst to the marketing and tag management teams, a week after launch one of the conversion pixels that is in use is the subject of an uptick of CIPA allegations across dozens of industry websites. A month later, someone at the media agency adds a new tracking tag and forgets to add a blocking rule for consent. Around the same time, one of the tracking pixels in use starts injecting other trackers silently without anyone at the organization knowing.
At the 60 day evaluation of the new website experience going live, from the marketing perspective it’s been a resounding success. But for legal and privacy teams, it has become a ticking time bomb just waiting to be a costly disaster. The new website has become a public invitation for litigation threats, regulator scrutiny, and loss of consumer trust that could cost the organization millions of dollars.
Why Tag & Cookie Consent Compliance Fails
The core problem for most organizations is the absence of a documented consent policy that is shared and actioned across all relevant teams – marketing, privacy, legal, and IT.
The only constant is change. Websites and digital experiences frequently add new tracking tags, terms of service get updated by existing vendors shifting their risk profile, consent triggers get missed in tag implementation, and new laws get passed. In an analysis conducted by InfoTrust of over 3,000 websites over a 12 month period, a net new tracking technology appeared on a typical website every 45 days, on average. Nearly 9 in 10 websites experienced new targeting tags being injected via piggybacking within the period. While everything can appear buttoned up at launch, in the absence of a defined and documented privacy program for consent compliance, every change becomes a compliance risk.
- Day 45
- Day 90
- Day 135
- Day 180
- Day 225
- Day 270
- Day 315
- 12 months
A net new tracking technology, every 45 days on average
A targeting tag injected by another vendor’s tag (piggybacking)
Nearly 9 in 10
websites had new targeting tags injected via piggybacking within the period
InfoTrust analysis of over 3,000 websites over a 12 month period.
The Three Pillars to Ongoing Consent Compliance
Ongoing consent compliance is reliant upon three core needs:
- Define and document a Consent Policy
- Implement tracking tags and pixels aligned to the Consent Policy
- Proactively monitor live tracking tag behavior to identify Consent Policy violations
To accomplish these, there must be efficient alignment of three cross-functional teams.
- Marketing (the business) – Defines data requirements, the tracking technologies that need to be used, and how data is planned to be used.
- Legal and privacy – Evaluates those technologies for risk, assigns how each technology needs to be managed for consent, and how legal requirements need to be operationalized for compliance.
- IT and tag management – Implement the tracking tags responsible for data collection, technically configure the Consent Management Platform (CMP) to manage the consent experience and signals, and implement the tracking tags to collect data as needed by marketing aligned to the consent standards defined by privacy and legal.
These three teams need a shared language of understanding to align all of these distinct responsibilities. This is where a shared, documented consent strategy comes in. We will now walk through the three core needs and the cascade of actions necessary to accomplish each.
Define and Document the Consent Policy
| Step | Privacy/Legal | Marketing | IT |
|---|---|---|---|
| Define the Organization’s Risk Tolerance | Responsible | Consulted | Informed |
| Map How Consent Standards Will Be Operationalized Across Regions and Brands | Responsible | Not involved | Not involved |
| Create Descriptions and Definitions for Categories of Consent | Responsible | Not involved | Not involved |
| Assign Consent Categories to all Tracking Technologies in Use | Responsible | Consulted | Consulted |
| Define Consent Standards and Category Mapping | Responsible | Informed | Informed |
| Define Governance Standards for How the Consent Policy Will Be Implemented (Consent Architecture) | Informed | Consulted | Responsible |
- Responsible
- Consulted
- Informed
Define the Organization’s Risk Tolerance
Responsible: Privacy/Legal
Consulted: Marketing
Informed: IT
How does the organization weigh privacy compliance risk against business demands? Some organizations – due to locations, brand positioning, volume of data processed, or applicable legal requirements – will have a very low risk tolerance. These organizations may choose to be extremely conservative in their consent policies, requiring explicit consent for all data collection. Others may prioritize maximal data collection and be more apt to leverage strategies focused on notice, opt-out consent, and technical solutions like restricted data processing options wherever possible. It is important to have the conversation early to align all teams around the organization’s philosophical approach to data collection and consent. When expectations are set up-front, marketing and business teams have proper expectations. They are often able to design appropriate strategies to understand consumer behavior and accomplish targeted advertising despite privacy constraints. Meanwhile, legal and privacy teams are able to prepare necessary documentation and strategies to address expected legal risks.
Map How Consent Standards Will Be Operationalized Across Regions and Brands
Responsible: Privacy/Legal
Legal requirements for consent differ across regions and industries. All legal requirements and obligations must be translated into a clear segmentation of what consent standards must be applied for each region and brand.
For example, one global organization with websites targeted to users in the United States, United Kingdom, and the EU may have consent standards unique to California, the rest of the United States, the UK, and EU due to differing legal obligations and risks present in each jurisdiction. Another organization with the same global footprint may instead decide to define consent standards more generally, with one set for all of the United States and a second for all of continental Europe. The decision here will mostly depend upon the risk tolerance defined above, how the privacy/legal organization is structured, and the capacity for technical overhead to be able to implement and maintain differing standards.
The segmentation defined here will dictate how many unique operational consent policies are to be defined and implemented in the consent architecture.
Create Descriptions and Definitions for Categories of Consent
Responsible: Privacy/Legal
The categories of consent are the categories of processing behavior which are included in notice to users in both the privacy notice and consent/cookie banner experience. An organization should clearly list the categories they will use ( for example essential, functional, performance, and targeting) along with descriptions and decision criteria to evaluate a tracking tag/pixel for assignment to each.
It is recommended to define standards for the categories of processing to be used globally. Different regions will have different specific requirements for language used, for example “selling and sharing personal information” in California’s CCPA. In such cases these local requirements can be treated as unique exceptions for that specific region. To do this, map globally defined category standards to these unique jurisdiction-specific categories (i.e. any tag/cookie categorized as ‘targeting’ and ‘social media’ per the global definitions would be mapped to the unique category used in California of ‘do not sell or share my personal information.’)
Assign Consent Categories to all Tracking Technologies in Use
Responsible: Privacy/Legal
Consulted: Marketing, IT
With the clear definition of category expectations and the necessary decision criteria for assignment in each, marketing and IT teams can be empowered with the ability to provide initial categorization and justification for each tracking technology in use, greatly simplifying the process of legal/privacy review for confirmation. Put simply, privacy and legal teams too often do not have clear visibility into what technologies are in place and how data collected by each is used. This context lives with the marketing and advertising teams. Clear decision criteria allows these teams to align their knowledge of how data is used with the standards set by privacy and legal. It starts the meaningful conversation to formalize category assignment.
Every tracking technology in use must be assigned to a consent category and approved by privacy/legal. Any exceptions due to differing use of data by a particular website, or jurisdiction-specific categorization should be documented along with the standard global category assignment for each tag/pixel/cookie. This aspect of the consent policy is the shared language that can be leveraged across teams to understand expectations.
Define Consent Standards and Category Mapping
Responsible: Privacy/Legal
Informed: Marketing, IT
With the standard consent categories defined for each region/policy, each can now be mapped to what is allowed and not allowed to load and collect data for each user consent state. These standards will align with legal obligations for explicit consent, opt-out consent, and nuances for what purposes of processing (categories) should be allowed for users that take each action.
These consent standards and the category mapping is what forms the basis for the technical implementation architecture, both within configurations in the Consent Management Platform (CMP) and loading logic for each tag and pixel implemented on the website. Each defined Consent Policy (as defined in the segmentation of consent standards above) should have a unique consent mapping table for clarity in expected behavior.
Define Governance Standards for How the Consent Policy Will Be Implemented (Consent Architecture)
Responsible: IT
Consulted: Marketing
Informed: Privacy/Legal
Armed with formal, documented Consent Policies defining how all tracking tags, pixels, and cookies are categorized for consent as well as how each category should behave for users across available consent choices, IT and tag management teams can then architect how the CMP and all tags should be implemented on websites. Governance standards defined here are things such as how tags of different types should be managed (through a Tag Management System, through a loader script, directly on the website, etc), how the CMP should be technically configured to provide region-specific consent experiences and signal consent selections by users, and how tags should be configured to conditionally load based upon the consent signals present.
Standards ensure uniformity in configurations and provide a practical guide to how any new technology should be implemented in the future to ensure consent compliance moving forward on the website.
With all of the above component pieces, the Consent Policy standards can be aggregated for clear documentation and ongoing alignment.
Implement Tags and Pixels According to the Consent Policy
The step of execution. Having a living, documented Consent Policy is going to provide the guide, now all teams with the ability to implement tracking technologies on a website must implement tags and pixels as dictated by the policy documentation. Operational controls, such as the Policy documentation and processes defined for how new tracking technologies can be added and who is responsible for review, approval, and deployment are all necessary to ensure ongoing compliance.
Unfortunately, perfect policy and process still leave gaps in the ability to maintain consent compliance. Any third-party tracking tag implemented on a website is, by definition, third-party controlled javascript. Each of these scripts can be updated by the vendor to modify the data being collected as well as to inject additional third-parties to send personal data to other entities. It is for this reason that proactive technical monitoring of consent compliance is necessary.
Ongoing Monitoring of Live Tag/Pixel/Cookie Behavior
What happens in practice inevitably will drift from what is expected in principle. No organization is perfect.
- The rush to get a new campaign live results in a process being circumvented and a tag getting added without appropriate consent logic.
- An existing vendor’s tag begins injecting another third-party that is not accounted for in notice to users.
- Data collected by a tag initially only to measure the performance of the conversion funnel starts being used to additionally develop user profiles for targeting.
All of these changes result in a change in practice on the website that can be identified by proactive auditing of tag behavior across all pages. A technical consent auditing solution, such as Tag Inspector, can help automatically flag these violations of the established Consent Policy to initiate immediate remediation of the issues and maintain consent compliance month after month.
How InfoTrust Helps
Creating a formal Consent Policy, implementing it in practice, and maintaining the standards over time is difficult. Different teams, differing goals for each, and a lack of shared knowledge make ongoing consent compliance a major area of privacy risk for all websites. It’s important to be able to rely on partners to help with the complexity.
InfoTrust’s comprehensive offering of solutions can support at every step.
- Tag Inspector – the consent auditing solution that will first generate a comprehensive inventory of tracking tags, pixels, and cookies loading across a website provides the necessary foundation to enable the consent categorization and mapping requirements for a defined Consent Policy. Once policies are defined, ongoing monitoring identifies any live behavior in violation to support proactive monitoring and fast remediation of consent compliance issues.
- InfoTrust Suite – marketing data observability across your analytics and tagging setup. Proactive monitoring of the technical configurations for tags deployed in a Tag Management System helps to ensure that the consent architecture, as defined by IT, is configured in practice across all containers an organization operates.
- Implement – configures your tag management system and CMP to follow your consent policies.
Keep Your Consent Policy True After Launch
Tag Inspector flags live tags that break your Consent Policy. InfoTrust Suite checks that your tag manager setup matches the consent architecture you defined.
