How to... find out who's tracking your website

The ePrivacy Directive has prompted an explosion of tracking audit services. Companies are now pushing for clarity on how sites are using tags and cookies to collect consumer data. Last month, we covered how iMedia used Evidon Encompass for a complete breakdown of tracking activity on this website, as a first step in the path to compliance. Of course, tracking reports are strictly an internal step, and they don't address the legal requirement for consent by themselves. In this piece, we review the iMedia plan for obtaining a consumer consent to be tracked, using information from its tracking audit.

Step 1: How intrusive is the tracking?

The iMedia tracking audit included results that were surprising, including a total of 18 companies that were tracking consumers, in addition to iMedia itself. Thirteen of those companies were ad-related and all of those companies performed functions that fall outside of the ‘strictly necessary’ exemption of the directive. Fortunately, none of the companies found on the iMedia site are involved in any particularly sensitive practices, including the targeting of ads to individual children or based on medical conditions. The most sensitive business models were online behavioral advertising, which have become mainstream for any ad-supported site or major brand site with retargeting capabilities.

The technical assets used by these trackers were also typical, including a range of tags and session and permanent cookies. For a complete list of attributes that you should expect from a tracking audit, see our detailed piece on minimum requirements.

The bottom line: on the sliding scale of relative intrusiveness, the iMedia site was squarely in the middle of the typical range for ad-supported sites. Consent would be required, but not because of any tracking that is overly intrusive to the user.

Step 2: Where am I based?

The standard for consent has not been finalised in many European markets -- regulators in each jurisdiction are currently split on whether they require explicit consent (similar to opt-in), or if they are open to implied consent. The two considerations are:

a) where are you incorporated?
b) where is your target audience?

iMedia is incorporated in the US, and its iMedia UK property is obviously built for folks in the UK. As it happens, this is good news, as iMedia will be held to the standard set where the user is based.. The UK regulator has been one of the most active in providing guidance to the market, and they are clearly open to implied consent solutions. This means that iMedia has the flexibility to explore the full range of implied and explicit options.

Step 3: Final Decision

iMedia has two options -- explicit or implied consent. Each has pros and cons. Explicit consent is safest option to take from a compliance perspective, but carries with it substantial commercial cost. In the explicit consent model, the consumer must take an action to accept tracking after having been first provided with clear and specific information about tracking activities on the site, including which companies will be collecting and using its information. Until the consumer provides consent, all non-essential tracking must be disabled. This can have a seriously negative impact on site traffic and revenues.

Fortunately, iMedia can rely on Implied consent. Under this model, all tracking can be enabled by default provided that iMedia can argue that consumers understand how they’re being tracked, and that they’re navigating the website based on that understanding. Note that this is different from a traditional opt-out model seen in the US, whereby the presentation of a link on the footer of the page, including information and an opt-out option, would suffice. Implied consent requires dedicated real estate on the page and more specific information about tracking on the site...

When the user clicks on the Cookie Consent Tool, they will see a complete inventory of the tracking companies present on iMedia, along with a description of what they do and a means to withdraw consent.

Zedo ad server On/Off With this approach, iMedia has a plan to inform consumers fully about how they're being tracked on the iMedia site. It enables them to obtain users' consent with minimal impact to the user experience, to make sure the company is using data responsibly and generate more ad revenue.

>>>Next up: How to overcome common pitfalls in deployment.

Colin O'Malley is the chief strategy officer at Evidon