The French Data Protection Authority, CNIL (Commission Nationale Informatique & Libertés) published a very interesting guide on the alternatives to third-party cookies and their consequences in terms of consent.
As the CNIL notes, for several years, certain digital players have been developing alternatives to “third-party” cookies for advertising targeting. The CNIL, attentive to these innovations, reminds us that these devices must always respect the rules relating to data protection and, above all, consent.
The use of “third-party” cookies is now being called into question by certain browsers who seek to limit the tracking possibilities of advertising players. The precursor in this area was Apple’s Safari browser which, with the launch in 2017 of its ITP program (” Intelligent Tracking Prevention” in French), developed browser features specifically designed to limit certain practices of advertising networks. The proposed system seeks to identify cookies linked to tracking practices and to limit the possibilities offered by APIs to websites, for example in terms of the retention period of cookies.
As the CNIL notes, the end of the use of third-party cookies does not mean that individuals will no longer be tracked on the web , particularly for advertising purposes. Indeed, players in the advertising ecosystem will always be able to use alternative technologies allowing them to track the navigation and behavior of users to target them for advertising purposes, in particular.
In recent years, the CNIL has noted the development of several alternatives to the use of third-party cookies which can be classified into four categories:
- “ Internal” cookies and browser fingerprinting
- Single sign- on
- Unique identifiers
- Advertising targeting by cohort
The CNIL underlines that the need to ensure that the use of these technologies respects the privacy of users remains. To this extent, it is essential to integrate, from the design stage, means allowing users to maintain control over their personal data and at the same time it is necessary to enable and facilitate the exercise of all individual rights, through user-friendly interfaces, which is an essential component of the data protection by design approach imposed by the GDPR.
See more at cnil.fr
