How New EU Privacy Laws Will Change Your Marketing

Transcription

1 How New EU Privacy Laws Will Change Your Marketing A M A R K E T O W H I T E P A P E R Contributors: Josh Aberant, Director of Privacy, Marketo & Duncan Smith, CEO, icompli

2

3 Contents The Basics... 4 Scope of the Law... 5 The Changes... 6 Obtaining Consent... 7 The Process... 8 Browsing Experience... 9 Privacy & Marketing Automation Privacy Tracking Software... 11

4 The Basics Many companies track website visitors in order to personalize content and offer web services. Recently, you may have heard about changes to how companies worldwide are allowed to collect or use information from web page visitors from Europe. This is because the European e-privacy directive has been amended, requiring European Member States to change their laws by May This Directive (2009/136/EC), legally mandates that websites which track users must ask those users whether they consent to any recording or retrieval of data on their browsers. In Europe, when cookies are used for tracking, websites will need to obtain the website visitor s permission. When asking for permission, the website must be clear about what data is being tracked and how it will be used. A record of the permission confirmation action (e.g. clicking an agreement link) must be retained. Cookie: A cookie is a very small piece of software code that websites use to track visitors. 4

5 Scope of the Law The regulations apply to all EU businesses that are tracking individuals on their websites. Do they apply to non-eu entities? Viviane Reding, the EU s commissioner for justice has spoken on this matter. Privacy standards for European citizens should apply independently of the area of the world in which their data is being processed, she said. To enforce the EU law, national privacy watchdogs shall be endowed with powers to investigate and engage in legal proceedings against non-eu data controllers whose services target EU customers. Although we are some way from full international agreement, American businesses too should consider how they might meet the EU prior consent requirements and perhaps identify European website visitors, even though similar constraints do not yet apply in the US. The amended European e-privacy directive is EU law, but it is not yet national law for all EU members. With EU directives, member states are required to enact national laws implementing the directive. Most member states have not yet implemented national laws requiring explicit consent for cookies or other similar technologies. The national legislatures don t always move at the schedule ordered by the EU directives. This process could very well take many years to cover all of Europe. Britain has implemented the directive into National law as the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations The Department for Culture, Media and Sport (DCMS), in consultation with the Information Commissioner, is tasked with developing the regulatory specifics of the law. They have jointly agreed that they will not begin enforcing the law until May Some news sites that are helpful for keeping up with changing Internet laws in Europe are: Out-Law.com, eweekeurope.co.uk and 5

6 The Changes It is a stated goal of the EU to harmonize privacy regulations and this is a major step forward in EU privacy harmonization. Compliance with these changes, and the ability to demonstrate privacy protection plus a robust online trust mechanism will enhance a company s reputation. Businesses will need to start competing on how much they are trusted by their web users/visitors. Marketo believes initiatives that encourage trust will benefit the online marketing ecosystem over time. 6

7 Obtaining Consent The key to compliance is obtaining consent. Before the law changes, websites using cookie technology could do so by offering site visitors a privacy policy with clear and comprehensive information about the use of the technology and how to opt-out. The new legal regime requires the same clear and comprehensive information, only this time it has to be before the cookie is created or read. A positive, affirmative action (e.g. clicking) where the subscribers acknowledges their consent to marketing and tracking is required. It s important that you don t mix up consent wording with more general wording within your business policies. If you integrate consent wording into your general wording, then be sure to highlight the consent language, and record the click making consent. You can decide where to collect consent but it must be before the cookie is set or read. Many websites will allow visitors to browse some pages or sections before popping the question. The objective in these cases is to enable the website visitor to see the value of the web content or services before asking them for tracking permission. For example, you might want to pop the question after a visitor has viewed a certain number of pages, spent a given amount of time on the site or visited specific webpages. How New EU Privacy Laws Will Change Your Marketing 1 There is much debate in Europe about the timing of consent acquisition. The EU advisory body, the Article 29 Working Party, is clear however that consent should precede any setting or reading of cookies 2 The wording of Recital /136/EC, reflected in the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 Regulation 6 (3)A, does allow for consent to be indicated by browser settings inter alia. 7

8 The Process EU regulators have suggested many ways for organizations to comply including: Placing a pop-up window or widget asking for permission when someone first visits the website Placing a pop-up window or widget AFTER a few pages of viewing content Placing a pop-up window or widget when accessing a feature like a video or web service Placing forms asking for consent Adding clear information and a consent action to Terms & Conditions pages of web services Popping the question on Settings or Subscriber Options pages Use highlighted headers or footers on specific webpages or turn on scrolling text asking for permission No longer using cookies or similar technology e.g. browser fingerprinting Demonstrating that cookies are strictly necessary to provide a service requested by the user e.g. placing items in a shopping cart. Note: Marketo advises all marketers to test all methods employed to obtain consent. Some early deployments have shown web surfers can confuse pop the question messages with virus or malware attacks resulting in high website abandonment rates. Careful attention, testing and optimization must be applied to consent methods in order to avoid negatively impacting web traffic. 8

9 Browsing Experience Visiting other websites? If you are in the US, these new rules probably won t affect you on most websites you visit. Europeans, on the other hand, are likely to be asked for permission quite often. Europeans will consequently get better at factoring privacy protection into their business and purchase decisions. These new rules may fundamentally change the browsing experience for European web visitors. There are many unanswered questions about how the new EU laws will affect how consumers interact with websites and web services: How New EU Privacy Laws Will Change Your Marketing Will consumers find constant pop-ups asking for consent frustrating in much the same way many found Windows Vista s User Account Control constant pop-ups frustrating? Will non-opted in consumers spend less time on websites that can t offer relevant advertising? Will consumers start to demand some kind of automation of consent giving like the privacy headers proposed by browser vendors? The leading edge marketers out there will be paying attention to these questions and striving to improve the Internet experience of European web surfers. 9

10 Privacy & Marketing Automation Pros: Businesses that can compete on privacy protections and easily implement marketing automation processes, will do better and make more money, in a world where more buyers will factor privacy into their buying decisions. Cons: The EU laws will compromise companies that don t have marketing automation solutions to easily implement compliance. The EU regulations will also hurt organizations that don t or can t protect subscriber privacy. When it comes to targeted advertising, users will see fewer or no targeted adverts depending on whether they have opted out (the preferred solution in the US), or not opted in, as is the requirement across Europe. Personal blogs and webpages The EU focus is currently on business compliance. It will be interesting to see how Europe approaches tracking and consent for personal web properties. 10

11 Privacy Tracking Software This does not mean marketing automation or companies like Doubleclick, Omniture, and Quantcast will go out of business. The EU privacy regulations create more need for marketing automation and web analytics companies. As businesses need to implement more sophisticated privacy protocols and compete on trust, they ll turn to their marketing automation solutions to make it happen. Web analytics will work in the EU because businesses will need web analytics for the EU subscribers they cookie. They ll also need web analytics on subscribers they don t cookie for things like testing different action flows to obtain consent. Web analytics solutions are good at analyzing both known subscribers and unknown visitors. It s unlikely that EU courts will excuse lack of technical capabilities. So if your marketing automation, web analytics, or other software doesn t currently help you comply, good marketing automation solutions could be the edge you need to give your European customers the privacy options they require. 11

12

13 About Marketo Marketo is the fastest growing provider in Revenue Performance Management. Marketo s powerful yet easy-to-use marketing automation and sales effectiveness solutions transform how marketing and sales teams of all sizes work and work together to drive dramatically increased revenue performance and fuel business growth. The company s proven technology, comprehensive services and expert guidance are helping enterprise and mid-market companies around the world to turn marketing from a cost center to a business-building revenue driver. Marketo also offers Spark by Marketo, a new brand of marketing automation tailored specifically for small businesses the fastest-growing and largest segment of today s economy. Marketo, Inc. 901 Mariners Island Blvd, Suite 200 San Mateo, CA Tel: Fax: Marketo EMEA Ltd. Cairn House South County Business Park Leopardstown Dublin 18 Ireland Phone: