I’m sure we’ve all seen a notification for cookie preferences pop up on a website while browsing. They’re everywhere! But what is cookie tracking, and why do you need a cookie policy for your website? 

Let’s start with the basics.  

What is a cookie?

Cookies aren’t just pre-dinner temptations! 

They’re small data files that work silently in the background as users browse. Even though they’re on every website, most cookies don’t pose a threat. Most have important functions for websites that add to the overall user experience. Companies rely on cookies for features such as cart abandonment, comment sections, and embedded videos to ensure their site is a customer-friendly experience. 

Cookies are stored within your web browser and contain large amounts of data. Some of that data could be used to identify site visitors without their knowledge. Because of this, cookie data must be easily viewed or removed, depending on their type.

Not only that, websites are required by law to let visitors know what information they’re collecting via cookies. They’re also required to give visitors control over how much information is shared. 

The United States doesn’t have a federal law regarding cookie policies, but that doesn’t mean companies get to slide by without regulation. If your site can receive visitors from the United Kingdom, Europe, or states like California (that have cookie laws already in place), it needs to comply with regulations from those areas. Otherwise, you could face heavy fines and other penalties according to the law of the visitor’s state or country. 

What are the different types of cookies on a webpage?

Cookies can be put into different categories based on their ingredients. Kidding–they’re classified by their purpose, duration, and origin. 

To write an accurate cookie policy, you’ll need to know all three. It’s also good to note that cookies can sometimes have multiple classifications in one. For example, third-party cookies can also be marketing cookies. 

Their purpose

While these cookie categories aren’t a set standard, they are a useful tool to understand the different functionalities. While some may interact a certain way on one website, they could be used for something else on another. 

• Strictly necessary cookies are essential to a website’s functionality. They do not collect any personal information. Instead, they allow you to log in and manage your account, or recall what items you’ve placed in your cart while online shopping.

  Even though it’s not required to obtain consent for strictly necessary cookies, what they do and why they’re on a website should be explained in simple terms in your website’s privacy policy. 

• Preference cookies, or ‘functionality cookies,’ let a website keep information about a visitor’s past choices. This can apply to preferred languages, specific regions for accurate weather and time reporting, or a username and password for automatic log-ins. 

These cookies are similar to preferred settings on a laptop or mobile device. They exist within functions like Password Keychain or location settings. They make browsing the web convenient, especially when you can’t remember which password you’ve used to log in! 

• Statistics cookies, also known as ‘performance cookies,’ collect information about how visitors are interacting with a website. They analyze which pages are visited and which links are clicked. The data from these cookies is aggregated and anonymized, and therefore cannot be used to identify any individual website visitor.

Performance cookies exist with the sole intention of improving website functions. Third-party cookies used for analytics purposes by the site owner also fall under this category. 

• Marketing cookies track online activity to help advertisers serve more relevant ads to end users. They can be used to limit how many times someone sees a specific ad while browsing. Marketing cookies that come from third-party providers are considered persistent cookies. 

Let’s say someone is shopping for a food processor. They land on the KitchenAid website to browse but don’t complete a purchase. With marketing cookies, the business can target that specific user later with an ad on Facebook or Instagram to guide them to purchase. 

Like in the image below, your cookie policy should disclose the use of marketing cookies.

• Social media cookies enable you to share content with your friends and networks. They can track browsing behavior across different sites to build a profile of interests. 

These cookies are responsible for a social media platform’s ability to create a highly specific algorithm for an individual’s browsing. Anyone can deny these cookies within a social platform’s privacy settings. Sometimes that Instagram feed gets a little too specific, right? 

Their duration

• Session cookies have a limited time frame and expire once a user closes the browser or when their session ends.  
• Persistent cookies include all cookies that remain on a user’s hard drive until they are permanently deleted either by expiration date or manual erasure. 

All persistent cookies have an expiration date baked into their code, but their lifespan can vary. According to the ePrivacy Directive, they should expire before 12 months, but sometimes they could remain on devices much longer if users don’t take direct action. 

Their origin

• First-party cookies are put on a device directly by a website. 
• Third-party cookies are placed on a device by a third party, like an advertiser or analytics provider, and not by the website itself. 

Now that we’ve gone over the types of cookies, you’ll need to know about cookie regulations. 

Related Reading: Data and Your User Experience

Cookie Policies and Regulations

Though there are no federal cookie laws in the US, website owners need to know the different types of regulations that are actively being enforced by other states, regions, and countries. 

One of the most notable cookie laws is the ePrivacy Directive (ePD). 

The ePD was passed in Europe in 2002 and is considered to be the all-encompassing ‘cookie law’. After it was passed, the ePD’s most significant impact was the addition of cookie consent pop-ups. This regulation required site owners to permit visitors the ability to accept or deny the website’s cookies. 

While the General Data Protection Regulation, also known as the GDPR, is the more famous of the two cookie laws, the ePD is the ultimate ruling body over cookie regulations. This is due to its predecessor status and its highly specific laws regarding personal data and web traffic. 

What is a cookie policy?

A cookie policy lists all active cookies on a website and detailed information about how each is used. This policy provides website visitors with specific information on how their data is processed while browsing.

Related Reading: Preparing for the GDPR: How Will It Affect My U.S. Organization?

Why do you need a cookie policy for your website?

Privacy laws require you to let your users know what personal data is collected and how it’s used. If you use cookies, you need a cookie policy–it’s as simple as that! This applies to all types of cookies. Don’t forget! If website visitors from the UK, EU, or states such as California or Wisconsin visit your site, regulations protecting them require your site to have a standard cookie policy. 

How do you write a cookie policy for your website?

To comply with the GDPR (General Data Protection Regulation), these are the five things you need to include in your cookie policy: 

• Receive visitors’ consent before you use any cookies (except for strictly necessary cookies).
• Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
• Document and store consent received from users.
• Allow visitors to access your service even if they refuse to allow the use of certain cookies.
• Make it as easy for visitors to remove their consent as it was to give their consent in the first place.

What’s happening to third-party cookies?

With user demands for greater privacy and security on the rise, browsers are responding by limiting third-party cookies. Safari and Firefox removed third-party cookies, while Google Chrome has orchestrated a more phased approach. In their 2022 announcement, Google stated changes to third-party cookies will be made gradually to ensure the stability of the online advertising business. 

This means shifting strategies for marketers who thrive on using third-party cookies, but this won’t affect all types of cookie tracking. First-party cookies are considered vital, as they are used to improve site functionality. 

If you want to better understand your site’s data and user experience, contact our team!