Esther
Good morning and welcome to the Monday morning marketing podcast. My name is Esther
Melanie
And my name's Melanie.
Esther
And today we're talking about cookies. No, not the chocolate chip ones, unfortunately, but the ones you find online. And we have a very special guest joining us today. We have Michelle McGlocklin, solicitor. Welcome, Michelle.
Michelle
Hello, ladies. Delighted to be here.
Esther
Welcome. And finally, we've been able to get online, there's been a lot of problems happening right now and I'm sure most of it is going to compliance and a lot of things. So, Michelle, why cookies? Why are cookies so important?
Melanie
They're so important because there's a whole load of rules and regulations around them and possibly why they've become really important at the moment is because the data protection commissioner has issued new guidelines as to what they believe the standard is that businesses need to come to. So last autumn, the Irish regulator did what they called was a sweep of different websites just to check how compliant businesses were with their cookie policies. So probably for all of us we're probably well aware when we go on to a site for the first time, usually, this pop-up banner pops up on screen and I think a lot of us probably don't read it. And all you can see is there's usually an except button and either you ignore it completely and keep scrolling or you might click the accept button. And that's, I, suppose, maybe the only prompt we have that perhaps there are some cookies on that website and either curiosity, we might read them or usually we're so busy, we probably just keep going with our use of the site and never think about them again.
Esther
Yeah, because there are some cookies that would, you know, potentially steal some of your information, right? I mean, we have to be careful about what we accept.
Michelle
Absolutely. And I think it is perhaps that if you possibly stood back, you might be really surprised about how much information you're actually sharing, while you're on somebody's device, and be that website, an app or even maybe at the house. Now, think of all the things that we have in our household that are connected to the Internet, the Internet of Things. So maybe you bought a new toy for a child, an interactive. How many cookies are on that? What's that tracking? And there's been lots of research and you often see online all of these stories of when somebody looks in the back, they're amazed about if you've got an electronic kettle, for example, that records how many cups of tea or how much water you do per day. And of course, somebody somewhere is reading that information or collating it and using it for a purpose. And I suppose it's really interesting from, you know, what are they doing with all of that information and all of us as marketers, we would love to know why do people visit us so that we can learn from it and improve ourselves. So cookies are good for the business owner. And again, there's no rule to say you can't have cookies. There's just rules about how transparent you are being with the public, and hopefully they're happy to have them all and they'll accept them and everybody would go about their business.
Esther
Yeah, because one of the annoying things about going online is the pop-up banners and the pop-ups that say, you know, do you accept, do you accept, do you accept and it's just constant and sometimes it's you just get to the point where you look, oh, stop, stop sending me these pop ups. And yes, you know, you just accept because you're sick of looking at them. Are there any that we should be really conscious of?
Michelle
There are... Absolutely. The whole purpose of having the pop-up banner is to draw our attention to the fact that there are going to be cookies or that the business owner or Web owner would like to place some cookies on our site. So effectively, what a cookie is doing is, either it's going to store some information on your device to track your usage, what you're doing on it, what pages are you looking at how long you're hovering on pages, or what it is, is it's trying to gain some information and capture it from your device and pull it off into the cloud for their use elsewhere. Again, there are the strictly necessary cookies on the site, which are an example would be you want to buy a product online. It's the magic that works when you click on the product and it automatically gets into the online shopping basket. They are what I call the good functional cookies, but there are also the tracking cookies. So again, an awful lot of us would have an analytics cookie on our site. So we want to know how many people have visited us, what was the top page? What did they open on-site? That would be an analytics cookie. So in order for that to be on your site or to be working on your site, you need the user to click the accept button on it.
Melanie
Is that the Google analytics button?
Michelle
Yes, that would be one of the examples of a lot of us would use Google Analytics to look at the analysis of our site, what's the top-performing site, what's working, what do people like. But to have that working, it automatically should not be running and it should only start working when the person clicks accept on when that pop-up banner happens. And also it's here about as part of the cookie policies. When we click on, you know, usually at the pop-up banner, you usually see, accept or read more. When you click on Read More, it's meant to pop up all the information. So if you wanted to have the time, you could look and see what are all the different cookies that are on our site, what are they doing and how long are they going to be saved on our device? And this is where cookies it's all about being transparent. Yes. You have the entitlement to put them there. But in order for them to, I suppose what I call the language to fire an example here might be Facebook pixel as well. You're waiting for the consent. You want to click the accept button and also what you're meant to be doing is you're meant to give a choice to them so you could say, yes, I'm happy to have Google Analytics watching me, but no, I don't want your marketing tracking cookies to be following me. And you can say yes, no them as you feel like it. So it's giving back control to the user is what's meant to be happening on our devices.
Esther
Yeah, because there's a lot of times that I would see like a different colour button to accept or to decline. And it's usually like a brighter colour for the accept one and the other one's sort of like faded or smaller. Is that allowed?
Michelle
Not really, no, because the guidelines now have made it clear that you cannot nudge a user to accept one preference over the other. So we're meant to give equal prominence. So probably going forward you'll see a button that either says accept or reject, both of equal size and standing, or you might see a situation where you'll have at the moment you'll have accept or further information, read more, learn more. But no, you can't have the one. Again you see a lot of the moments. Okay, "Got it" or "I understand" or even "Happy to have the cookies, even if they're not the edible" type of jokey banners as well. Exactly. They're unfortunately going forward. Yes, we'll have a little giggle when we see them, but they are sort of not compliant. No. Unfortunately for us.
Melanie
I've got a good one. Click here for weight loss cookies.
Michelle
Fantastic. And probably by the time you've read all the cookies in the cookie policy, you might have lost weight or got worried absolutely from it. And again, you can't be surprised when you go down that... I know some sites I've visited. You might see one hundred and twenty, one hundred and thirty cookies when you go down through them. And I'm almost fascinated as to what they're doing. And yeah again, there's all these other things available to you. So again, you can say yes. And by clicking accept to them all - do you know what you've said yes to? And I think that's been the fundamental issue here. And I think is you're right, most of us are just an annoyance for us and we just click accept and then we get surprised when we get all these targeted advertisements following us and we're wondering where did they find us? And you go, well, actually, you clicked on accept. So you gave them the permission. And I think it was at, people... Sometimes you don't know what you're saying yes to. And here it is an option as to whether you want to have a look at it or not. So I think the future is going to change for all of those sites. There's going to be way more information for us to have a read of. And this is completely different to GDPR. This applies where you have to have the "yes", whether it is personal information or just analytical and anonymous information, the same rules are going to apply.
Esther
Wow, that really opens up the field for everybody to have to read through the cookies in a more elaborate way rather than just reality or whatever.
Michelle
Well, you can say "yeah, yeah, yeah" it's your choice that's given it to the public, read them or not read them. The information is available there for you to read. But the accept button is there. You can say accept or reject. You get to decide whether or not to read. One of the other new items that I saw on the guidelines is if somebody has accepted on your site, you have to have an automatic prompter that within six months you go back and ask them to say yes again. So you can't just say "I got an accept four years ago from them, that's fine, I still have their consent". So that's going to be new as well. And then we have
Esther
Every six months
Michelle
They are prompting a new consent. And also, I think now for marketeers, the worry is now people won't say yes, they won't say accept.
Esther
Yes lol.
Michelle
You know, how is that going to change how we marketers, how all of this really useful information we were getting. So we probably have to be more creative in what we're using. And also made for ourselves to think back and to say we need all of these cookies on there. What are the key essential ones that people would be willing to say yes to for our business?
Melanie
I did have one other question. This is all about websites and apps, isn't it?
Michelle
Apps, yes, and tracking devices, yes, of all sorts.
Melanie
So what about Google search?
Michelle
Again, they do track and have a lot of information when you use them, again, as I always say, for any free service, remember, you are the product. So, again, if you could do a whole lot, you go to do Google ads, they know all the terminologies that everybody has been searching. So you everything you're doing on Google is being tracked.
Melanie
So is there any way that you can opt-out of certain cookies, searches, and that sort of thing? Is there anything doing that?
Michelle
Will have a look and see, there's a whole load of different search providers out there who may or may not, and a number of them, they are promoting that maybe they're not tracking as much as the Google search, but that's probably the biggest engine out there. So most surveys, I think, automatically by default will go there. But then they use all of our information to be so successful with their Google ads.
Esther
Yeah, well, that's true. I mean, I have a number of devices in my house. I won't say her name because there's one beside me and she'll turn on. But literally, she's listening to everything that I say and then I get ads coming through. So at least.
Melanie
Alexa... Alexa
Esther
We speak in a different voice and in a different language. So she doesn't pick up everything. But when do we have to comply by, Michelle? Is there a date? Is that just ongoing or is there a deadline?
Michelle
Well, the actual cookies regulation came in Ireland in 2011, but the guidance notes now have issued effectively a six month warning. So, therefore, 5th of October, if everything is not compliant by then, Regulator after that may start taking enforcement actions. A big deadline looming five October 2020. But again, businesses probably ASAP probably would be the better guidance to give.
Esther
OK, and as a Web design agency ourselves our clients will obviously be coming to us looking for this. But we don't make the cookie policies. Where can they find a good cookie policy? Who should they go to?
Michelle
There are a number of software developers out there designing all of the systems for you. So there's a number of operators out there. When you're looking at them, hopefully they'll take the automated software that they would be able to do a run of the entire software, your systems, and pick up all of the cookies that you want to have to run on your device. And it's automated. So there's a number of different softwares out there that can be purchased. Again, what I'd say to businesses probably will be liaising with somebody like yourself, Esther. What's the most suitable one that will work for their business? And also, there's going to be a cost factor as well here. Affordability.
Esther
Of course, yeah.
Michelle
What can they afford? Some of them are offering a fixed sum for a 12 month. Others are offering as a per month subscription. But again, I'm afraid that will be coming back to you because they will be saying, is this working, is this compliance, you are the web person you tell me what's on here behind the scenes.
Esther
Yeah
Michelle
And then and then the issue then is if they're doing some things themselves, if they're adding code to the back end of it. Do they know what that code is doing? Yeah. And I think the other thing for you and for everybody is how do we get them set that they're automatically by default turned off and then how do they turn on for some users and then for the users who don't click the accept, how do they stay off? So, again, possibly a challenge for everybody involved.
Esther
Yeah,
Melanie
Sorry. I keep on interjecting here. I'm really ballsing this up aren't it.
Michelle
It's ok
Esther
Laughs
Melanie
Now you're your solicitor. OK, now we've got a fair idea of what Esther needs to do as her past as a web developer. When you get in trouble, we speak to you in this respect. What can you do to help a business owner to get out of this problem, this situation? And is it the business owner's fault or the web developer's?
Michelle
Again, I suppose the lawyer's question there was in the contract between the web developer and their customers - who was in charge of this area?. Is it within the scope of services that the web developer is or is not providing? Many web developers say, no, this is your business, you give us your privacy policy if you're collating personal data, and all of the other documents you need to comply with here is a separate cookie policy. So there are two documents and I think most Web developers to say it's up to the business to provide those to them or if they're going to use a third service software system that auto runs that. Again, most Web developers, I think, would go back to the business and say, "this is your responsibility". And for GDPR purposes, the data controller who's the person who's collecting the data is the person responsible. So that would be the business owner of the website. And then for some of these cookies, particularly what I call the third party ones like example, there would be the Google Analytics or maybe the Facebook pixel, because you're placing those on your website and that information is going to a third party, you're a joint controller with those bigger players for that information as well. So I'm not sure if that's helpful or not for you there. But the business owner ultimately has to take responsibility. They're collecting the information and they own it so.
Melanie
Well, thank you for that. I didn't mean to be controversial there, but
Michelle
That's OK.
Melanie
I just wanted to know.
Esther
Yeah, no, I think it's good that we know that, you know, and there will there could be a passing of the buck when it comes down to it. It's like yeah, no, it's the web designer's fault. No, it's the business owner's fault. No, it's the solicitors' fault for not writing it. No, it's, you know, blame everybody, you know, as long as you don't get to blame yourself.
Michelle
Absolutely. But I think that's one of the ones when you were taking on new jobs, it's having that conversation at the start who has taken responsibility for it. Because quite clearly there's a cost attaching to that, to write a privacy policy. We all have to be customised for every individual business. Also, every cookie policy is going to be unique to every device as well, because all different businesses will have all different ones on it. So somebody's going to have to do it.
Esther
Yeah. And on the scary part, then, what is the enforcement action that they could take? We're talking Ireland here, but obviously there's... We have listeners from all over the world. What if they have people from Ireland going on to their website? So they also...
Michelle
In relation. For GDPR purposes, the GDPR rules, and this would be in relation to the consents threshold, particularly here, if it's tracking personal data, anything that can identify an individual, GDPR rules would apply. So, yes, if you're encouraging or want customers from Ireland to be on your site, you comply with the GDPR thresholds. And we know they're scarify finds there if you get things wrong. But in particular, in relation to cookies, this is the E-privacy legislation. There are fines for that as well under unfortunately, Irish legislation. It's scary and there is criminal stuff as well. And it's also offences and stuff. But yeah, we won't even go there today.
Esther
No, no. that we'll save that one for another day. Thank you very much for joining us today, Michelle. I don't know about all of you, but I'm hungry now, after all that talk about cookies.
Michelle
Absolutely. Chocolate chip all the way, I think. Yeah.
Esther
Yeah, definitely. Definitely.
Melanie
Well, thanks so much for speaking to us today. Absolutely fascinating. I'm so glad that you came along and imparted your knowledge today. Some excellent questions posed by Esther, and I didn't think they weren't too bad from me. And hopefully, you can come back to us next week and hear our next podcast and do try and find us on our social media, we're pretty much everywhere. And you do visit the website
Esther
Thanks very much, guys. Talk to you again. Bye-bye.
Melanie
Bye