On October 1, 2020, the French Data Protection Authority (the “CNIL”) published a revised version of its cookie guidelines (the “Guidelines”) and its final recommendations on obtaining users’ consent to store or read non-essential cookies and similar technologies on users’ devices or browsers (the “Recommendations”).
The Guidelines provide a limited exemption to the consent requirement (“Consent Exemption”). The Consent Exemption applies to analytics cookies whose purpose is limited to measuring the audience of the site or app only on behalf of the web publisher. The Guidelines provide that for the Consent Exemption to apply, the following conditions must be implemented:
25-month data retention max. You can review your current data retention settings under Analytics > Admin > Data Governance. Data Retention
13-month cookie limit. You can override your analytics cookie expiration using the cookieLifetime variable. Experience Cloud cookies including Analytics and ECID extend the cookie expiration date with each visit. To set a static, non-rolling cookie expiration, you can either: (1) write custom code to set a date on which to delete the cookie, or (2) use your CMP to control the date of the cookie reset. cookieLifetime and Experience Cloud Cookies
Limited scope. The scope of the cookie must be limited to a single site or application. Browser Cookies
Hide visitor ID from reporting. The visitor IDs are not visible in Adobe Workspace and Adobe Reports and Analytics by default. Visitor IDs are available in Data Feeds and Data Warehouse. Access to Data Feeds and Data Warehouse can be limited by Access Permissions in Admin Console and Data Feed Column Reference
Adobe Analytics operates data processing centers in the United States, United Kingdom and Singapore in order to provide flexibility to all customers to collect, process, and store their data regionally. When configuring the initial set-up of Adobe Analytics, customers select their desired data processing center location. Customers’ data is ultimately stored within their selected region for the core Analytics product.
Consider collecting the opt-in status in an Analytics variable in order to separate opted-in data from opted-out data for segmentation, virtual report suites, or to route to separate end-points.
No measurement outside the site or app without prior consent, for example no off-site campaigns, email campaigns, or iFrames.