CNIL Consent Exemption
On October 1, 2020, the French Data Protection Authority (the “CNIL”) published a revised version of its cookie guidelines (the “Guidelines”) and its final recommendations on obtaining users’ consent to store or read non-essential cookies and similar technologies on users’ devices or browsers (the “Recommendations”).
The Guidelines provide a limited exemption to the consent requirement (“Consent Exemption”). The Consent Exemption applies to analytics cookies whose purpose is limited to measuring the audience of the site or app only on behalf of the web publisher. The Guidelines provide that for the Consent Exemption to apply, the following conditions must be implemented:
- 25-month data retention max. You can review your current data retention settings under Analytics > Admin > Data Governance. Data Retention
- Disable third party cookies in ECID. disableThirdPartyCalls, disableThirdPartyCookies, and disableIdSyncs
- 13-month cookie limit. You can override your analytics cookie expiration using the
cookieLifetimevariable. Experience Cloud cookies including Analytics and ECID extend the cookie expiration date with each visit. To set a static, non-rolling cookie expiration, you can either: (1) write custom code to set a date on which to delete the cookie, or (2) use your CMP to control the date of the cookie reset. cookieLifetime and Experience Cloud Cookies - Limited scope. The scope of the cookie must be limited to a single site or application. Browser Cookies
- Anonymization. Anonymize the last octet of the IP Address. General Account Settings
- Hide visitor ID from reporting. The visitor IDs are not visible in Adobe Workspace and Adobe Reports and Analytics by default. Visitor IDs are available in Data Feeds and Data Warehouse. Access to Data Feeds and Data Warehouse can be limited by Access Permissions in Admin Console and Data Feed Column Reference
- Geolocation parameters. Geolocation can be no more precise than postal code level. Zip Option and General Account Settings
- Set opt-in options. The opt-in service lets you set visitor protocols to determine if you can set a cookie on the user’s device or browser when visiting your site. Opt-In Service
- Prevent data sharing. To preclude data sharing to Adobe Audience Manager, use the
opt.dmpcontext variable for Privacy Reporting to block hits from being shared. - Access and delete ability. Utilize the Privacy Service for access and delete requests. Analytics & Privacy Service
Additional Considerations for Data Collection
The following additional considerations apply:
- Adobe Analytics operates data processing centers in the United States, United Kingdom and Singapore in order to provide flexibility to all customers to collect, process, and store their data regionally. When configuring the initial set-up of Adobe Analytics, customers may select their desired data processing center location. Customers’ data is ultimately stored within their selected region for the core Analytics product.
- Consider collecting the opt-in status in an Analytics variable in order to separate opted-in data from opted-out data for segmentation, virtual report suites, or to route to separate end-points.
- No measurement outside the site or app without prior consent, for example no off-site campaigns, email campaigns, or iFrames.
- Collection of personal information in variables is not permitted without consent. Control Experience Cloud Activities Based on User Consent
- Data is only to be used to produce anonymous statistics, without combination with other data.
- Data is not used to cross-reference actions.
- GPS geolocation data is not collected.
- When end-user consent has been given, the above settings can be modified and restrictions relaxed.
IMPORTANT
This document is not intended as legal or regulatory advice and does not constitute any warranty or contractual commitment on the part of Adobe. We encourage customers to seek independent legal advice on customer’s legal and regulatory obligations on issues related to this subject matter.
For more information, see the CNIL Cookie Exemption website.
recommendation-more-help
2969e653-1f9b-4947-8b90-367efb66d529