First-party cookies: 'Get legal help to avoid fines'

New interpretations of privacy within the cookie law and GDPR will cause a wave of stricter supervision regarding how newsrooms analyse editorial data. European authorities already require media outlets to ask for consent before tracking website visitors. Here is what you need to do to be compliant if you have readers in Europe.

During the summer, the government in Sweden clarified its interpretation of the guidelines of the General Data Protection Regulation (GDPR) and cookie statements.

"For years it was a bit muddy about what we could track without the consent of visitors”, Magnus Wahlberg, head of data analytics at VK Media, says.

"As long as we collected data to improve our product, the authorities weren’t very strict. But now we need to implement a cookie statement asking for permission to even know that someone is on our website. But in order to improve our journalism, it is essential that we know how our audience behaves. The new interpretations hinder our ability to do just that."

This development will affect all online media outlets within the European Union, Rob van Eijk warns. As managing director for Europe at the Future of Privacy Forum, he oversees where government and businesses are heading regarding data processing. "If it’s not strictly necessary for the functioning of the website, then you’ll need consent from users. Whether it’s personal data or not," he says.

What is first-party data?

"The definitions sometimes get mixed up, but generally first-party data is the information that a website collects for its own purposes and via its own channels," explains Erik van Heeswijk, CEO of the European editorial analytics tool smartocto.

"Third-party data is information that websites share with third parties for their benefit, for example, advertising networks. That was already controversial for the media, but stricter legal interpretations about first-party data are now a primary concern for our clients. It is important for media to ensure the privacy of their visitors is safeguarded and at the same time focus and make clear what collecting data is about: maximising product relevance."

Van Eijk thinks media companies are right to be worried about the issues surrounding first-party data because civil rights organisations like NOYB (The European Center for Digital Rights) are having success with enforcement requests all over Europe. A key reason is that the Court of Justice considers exporting data to companies in the United States problematic, as they deem the data processed by many companies to be less protected.

"Civil rights organisations may use that as a crowbar to file a complaint in addition to the European cookie restrictions. The data protection authorities united in the European Data Protection Board formed a task force to coordinate handling enforcement requests. They went from a waiting modus to a coordinated enforcement modus and we even see slowly that fines are being handed out."

For VK in Sweden, a newspaper with 50,000 subscribers (online and offline), this warning is their alarm bell to act fast. This autumn, they are going to implement stricter cookie pop-ups.

"We have to follow the law," Wahlberg says.

"But it will be a challenge to make sure we still improve our website for our visitors. We can’t and don’t want to use dark patterns to let our audience manipulatively say yes to tracking them on our website. But we also know that most visitors just click 'no' if you ask them permission on anything. We need to make clear that it is in their interest to click yes, in order to create relevant content for them. Without proper tracking, we can’t segment visitors into age groups and give younger people a product that better fits their needs for example."

Luckily, there are more things to do than just trying to tempt visitors to click 'yes'. Here are four steps to take:

• Ask a lawyer to help you formulate your goals if you want to avoid fines, Rob van Eijk advises. "Don’t use common terms like 'first-party tracking' but explain what data you need for which purpose. In some cases, you may not need to ask for consent. You only need to inform, for example, with a banner at the bottom of the web page. A lawyer should clarify to what extent collecting the data is strictly necessary and has a low impact on the website visitor’s privacy." Here is an example (in Dutch).
• Be alert and aware of GDPR data processing agreements. "Most websites don’t collect their data. They use third parties like Google Analytics or smartocto to process their data. You need to put in the agreement that those companies only process the data on your behalf and don’t use it for their purpose." Here is a template.
• Be aware of the legal obligations when working with processors outside the EU. "The United States is a prominent technology supplier, but the required level of data protection has a complex history." Media outlets may also focus on collaboration with local parties, Van Eijk recommends.
• Explore contextual advertising. "The Dutch public broadcaster NPO switched to contextual advertising instead of targeted advertising. With machine learning, they can now sell advertisements that are very well connected to the subject of their editorial content. For the NPO it’s even more lucrative than using targeted advertising."

Media outlets sometimes consider consent part of the contract for premium members. But that could be risky business, Van Eijk concludes. "You still need to ask for consent to use personal information for advertising. Let’s not forget that privacy is a fundamental right within the EU. But if you have the right intentions, it’s possible to collaborate with lawyers to make the contract with premium members so that it could be used to improve the journalistic product."

Stefan ten Teije is a journalist and formerly editor of AD.nl and NU.nl, two major news websites in The Netherlands. He specialised in the housing market. Recently he switched jobs and became smartocto's first senior content editor. He writes about the challenges (and solutions) of news media around the world.

Free daily newsletter

If you like our news and feature articles, you can sign up to receive our free daily (Mon-Fri) email newsletter (mobile friendly).