Yes - Most Websites Use Cookies
Almost every website uses cookies, and depending on your level of analytics tracking, digital marketing, personalization and security you could be using more than you realize. Tracking and marketing platforms like Google Analytics and Facebook rely on cookies to identify users actions across multiple visits, but both have multiple cookies that allow them to do this.
One of the easiest ways to see the cookies being used on your website is to open Developer Tools in your browser. You’ll find a list of cookies under the Application tab in Chrome and Edge, and under Storage in Firefox. Some cookies might look familiar based on their naming convention aligning with a certain platform (_ga for Google Analytics, _fbp for Facebook) while others might not be immediately obvious. Websites like cookie.is allow you to search cookies by name to help you determine what services they align with.
While looking in your browser’s Developer Tools is a quick way to see which cookies are on your website, it doesn’t always give you the full picture.
- If you’ve already chosen a CMP for implementing a cookie banner, they’ll be able to do a thorough scan of your website and give you the full list of cookies, often with a description of what they are used for.
- If you’re still in the early stages and haven’t chosen a CMP there are some vendors with a free tier (including Ketch which ZAG typically recommends), where you can perform a cookie scan.
- For most CMPs, pricing is based on the number of users visiting your website, so the free tier is likely appropriate for smaller websites only. CookieYes also offers a free scan and can be a helpful first step.
ZAG is happy to recommend the right Cookie Management platform based on your unique needs.
Setting up your Cookie Banner
Depending on which CMP you choose and which policies you’re adhering to, the actual implementation of a cookie banner will vary greatly.
- For some companies or institutions, they just disclose their use of cookies with an “I agree” type of button, without giving users the ability to opt in or out. This can typically be accomplished without an external CMP and instead just building out the banner within your website’s framework.
- Some website CMS platforms have built-in cookie management, but require more work to configure than if you’re working with an outside CMP. If you’ve decided that a more robust solution is needed it’s likely you’ll be partnering with a third-party CMP vendor like Ketch or OneTrust.
Apart from the initial scan of your website, the main steps you’ll be taking are:
- Outlining Geographic Policies – Platforms like Ketch already have pre-built jurisdictions to be opt-in for users in more restrictive areas, and opt-out for those that are more lenient. The decision to fire cookies based on specific geographies should ultimately be dictated by your own legal counsel.
- Updating Cookie Banner Wording – Many CMPs have templated solutions that come with pre-written verbiage about disclosing and accepting cookies, though you should be able to edit it based on your specific needs. This text should be thoroughly reviewed by your legal department before going live.
- Designing your Cookie Banner – While this step is separate from any cookie-based legal guidelines you will want to make sure any colors and fonts you select are WCAG 2.2 compliant. You can use the default template or update the look to match your brand. Be sure to thoroughly test on desktop, tablet and mobile to ensure it’s not conflicting with any other global, clickable elements like chat.
- Updating Code for Compliance – Adding a cookie banner to your website requires you to add the provided CMP script to your site code. You’ll also need to configure tags which decide whether a cookie will fire or not fire based on a user’s selections in the banner. CMP banner script and tag updates are typically implemented using Google Tag Manager but can also be added directly to site code, or both as this varies depending on the various cookie-based technologies your website uses. You can also add code to remove cookies after someone opts out if required.
A Detailed Cookie Policy
In addition to implementing a cookie banner through a third-party CMP, it can also be a good idea or even a requirement by legal and compliance departments to have a section of your website that details how cookies are being used. This can be its own page or even a subheading of your Privacy Policy in line with other disclosures, but typically will include the following items. As with any content like this, please work closely with your legal and compliance team for your specific company of institution.
- Types of Cookies – There are different categories of cookie based on what they are used for, and typically these are broken out in a Cookie Policy to describe their purpose and how your website uses them. Different CMP providers will have their own names for them, but they typically differentiate Necessary, Analytics and Marketing cookies.
- Cookie Details – Many CMPs will provide a full list of cookies, the associated vendor, the duration of the cookie and the category it falls under. This list can be added to your website either by adding another piece of code or enabling certain settings in the CMP.
- How to Opt-Out – While you may have already given users the chance to opt-out via the cookie banner you can also detail the ways they can request additional data or remove any previously tracked data from big tech platforms like Google and Meta. These additional steps will ultimately be dictated by your legal counsel and the specific jurisdictions you’re complying with.
Launch it and Leave it? That’s How Cookies Crumble.
As with any digital solution this is by no means something you set up once and then walk away from. Depending on the evolution of your website and marketing strategy it’s possible that new cookies will be detected and need to be disclosed. The cookie banner should also be tested on an ongoing basis to ensure it’s working and that all geographic policies are being adhered to. Any new tags added by your marketing team or outside agencies will also need to be configured to be fully compliant with their appropriate cookie category. Most companies find that revisiting this monthly is smart, but if you update your site less often, reviewing them quarterly can be sufficient.
ZAG Interactive has been helping our clients implement and maintain cookie banners for years through a variety of trusted third-party CMPs. While all final decisions will come from your own legal team, we can take your specific requirements and ensure they are being met. This includes banner customizations, ongoing testing and training of all involved parties. Contact us to discuss your cookie requirements.
This article should not be taken as legal advice. Your specific business or institution will have individual legal requirements so please work with your legal and compliance teams to develop a solution that best matches your needs.
