Consent for Digital Experiences

Regulations on the collection of customer data from digital experiences are on the rise across the globe.

March 12, 2024 will mark 10 years since the European Parliament demonstrated strong support for the GDPR directive by voting 621-10 with 22 abstaining. Enacting the directive would take another year or two in Europe, and over the last several years the GDPR has inspired regulations in countries, states, and provinces everywhere.

The United States are legislating individually, leading to many questions around how businesses should handle the consent of cookies, customer data collection, and analytics/conversion tracking. The CPRA enforcement date for California kicks in on March 29, and “do not sell” might not mean what you think it means.

Getting help in this area has been difficult across the board. It can appear that we have a number of snake oil sales teams selling pop-up windows. That is, after all, how it started. All the providers seemed to have a tool, but even today they step back when you ask for advice.

To cut through this lack of clarity, I put together three actual recommendations for businesses that operate across multiple states in the US, or who are based in the US and operate internationally.

Recommendation 1: Assign a data owner

This gets lost in technical talk about “processors” and “controllers”. Having a “data owner” means someone within the organization owns the decisions when it comes to what customer data is maintained for.

Recommendation 2: Identifiable data pathing

Make sure the data owner is aware of how and where identifiable customer data is maintained and/or shared with external systems.

Recommendation 3: Update policies/technologies

Update policies and collection technologies to act in accordance with user consent. This will look different for every organization, however at a minimum this should include declaring purposes for cookies and external technologies, and allowing for opt-out.