CPRA Cookie Consent: What You Need to Know

The California Privacy Rights Act (CPRA) is an extension of an existing law, the California Consumer Privacy Act (CCPA). It gives California residents even more rights and control over their personal information.  

 

The CPRA also gives businesses additional responsibility for handling end user information. This is important, because as a business owner, you’ll need to understand and comply with these laws to maintain credibility and avoid fines.  

 

Some sites say that CCPA and CPRA do not have explicit cookie consent laws. That’s not true. While they may not use the terms “cookie” and “consent,” it’s all wrapped up in the same package. Cookie consent means that you gain consent from your users before sharing their information with other vendors.  

 

It also means that you, as a business, adhere to the laws and practices regarding the handling of that information. These data points should be readily available to users upon request, able to be deleted or modified, and stored in a way that auditors or lawmakers can easily access in the event of an audit.  

 

Cookie Laws and Practices  

 

The CPRA states that users have the right to “opt out.” What does this mean?  

 

It’s a little more complicated than saying “No, thanks!” In fact, opt out means that end users are allowed to:  

 

• Restrict the movement of personal information (limitation)  

• Only use strictly necessary cookies when browsing your site (without hindrance to site functionality)  

• Never allow their information to be shared with other parties (decline all cookies)  

 

This is something that every business should have written in their cookie banner. CPRA explicitly states that each user must be able to opt out as easily as they can opt in. Having “accept all” or “okay” on your cookie banner is not enough to satisfy lawmakers. It goes even further than that.  

 

In order to stay compliant, your decline and accept buttons must be of equal size and accessibility. It’s a bonus if the cookie banner is customized to your brand. Your customers should be able to easily recognize that this is yours and they are making an agreement with you and your business. In the age of scams and hacks, it’s especially important to put your personal touch, voice, and tone into your cookie banner. No, you can’t copy and paste it from the Internet. Your policy should be something you believe, and that you can adhere to.  

 

Interestingly, the General Data Protection Regulation (GDPR) has an opt-in clause. That means all cookies (except strictly necessary) are blocked unless an end user says they consent to having information shared. While it sounds similar to opt-out, do not be fooled – they are not the same.  

 

 

Opt-in VS Opt-out  

 

The GDPR defines “opt-in” as information that is a choice and freely given from the end user with automatic restrictions in place.  

 

On the other hand, CPRA assumes consent (to a degree) and asks users to opt out. This does not apply to minors. We are only talking about people over 18 here today.  

 

How can end users possibly know the difference? Opt-in or opt-out, it always feels like consumers get the short end of the stick when it comes to legalese. In short, both of these terms are a puzzle for business and lawmakers. Whether or not you comply is up to you – and your cookie consent banner.  

 

Now, businesses that do not operate in California have to follow these rules if they have end users or receive web/app traffic from California. Every data privacy law has a workflow. For CCPA, your banner should give a “Do not sell my data” option every time someone comes from California. It’s just one of many amendments businesses need to comply with.  

 

 

Geolocation and Cookie Consent  

 

Now that we’ve gone over the nuances in laws like CPRA and GDPR, you can see how difficult it would be to manually tailor a cookie banner based on your best guess. Actually, that would be impossible.  

 

A cookie banner that uses geolocation can solve this issue. Geolocation means that your cookie banner will automatically identify where your end user is accessing the site and make the necessary adjustments in order to comply with the law. How neat! You may have the same cookie banner for California and for EU residents, but the wording and the calls to action may be slightly different.  

 

A cookie banner like this will come in handy, especially as data privacy laws expand around the world. Countries like Canada, Brazil and Saudi Arabia have their own laws; states like Utah, Colorado, Virginia, Indiana, Connecticut and more are all writing their own laws. How can you keep up? Good news. You don’t have to. We want to make things easy.    

   

Adzapier Does the Work for You   

 

At Adzapier, we have the tools you need to succeed. Our cookie consent banner comes with geolocation – which is super important. We also offer Data Subject Access Request (DSAR) management, session recording and more. But you don’t have to get into all of that right now.  

 

What’s important is that your business stays protected, and you don’t have to deal with a headache down the road. We’ve all seen big business get millions of dollars in fines. Will that happen to your small business? Probably not right now – but if you’re looking to grow and expand in the future, having this protection could save you.

Facebook got fined years after their original mistakes happened. Lawmakers waited until the company made enough money to cough up the cash. Are you prepared to take that chance on your business? Get in compliance now, and you’ll have a worry-free route to success. Well, when it comes to data privacy. We can’t guarantee the rest.  

 

Talk to one of our data privacy experts, and they’ll get you set up within just a few minutes. Later on, they’ll answer any questions you may have and help you keep going. We’re not into frills. We’re into skills.  

 

 

Schedule a Demo