Iab information texts

Branch-wide information textsPractical tools so that your organisation can comply with the legal information obligation in accordance with the Cookie Provision in the Dutch Telecommunication Act as well (art. 11.7a DTA)

Table of contents

1. Introduction 3

2. Support: uniform information texts 3

3. Branch-wide use 3

4. Model of the information texts 3

5. Use of the information texts by your organisation 5

6. Consent requirement under own responsibility 6

7. On the authors 6

8. Application information texts 7

APPENDIX 1 FAQ 8

APPENDIX 2 Work Instruction Cookie Information Texts 10

iab. Cookie Compliance. Branch-wide information texts | 3

1. IntroductionLast 5 June the amended Dutch Telecommunication Act including the ‘Cookie Provision’ came into effect. What did the Cookie Provision encompass again? In short, according to the Cookie Provision (Art. 11.7a Dutch Telecommunication Act), website owners must clearly and fully inform their visitors on the use of cookies, including for which purposes cookies are being used. Apart from the information obligation, for the placing of cookies consent will have to be obtained from the website visitor, unless a legal exception applies for this.The new legislation creates a lot of (legal) uncertainty and new challenges for the members of the IAB. In order to help the online branch to be compliant, IAB has immediately after the introduction of the legislation published the Cookie Compliance Guide. After the Cookie Compliance Guide, IAB now publishes a Guide with which the information obligation can be complied with. The Guide provides practical tools for a transparent internet, and is freely available for everyone. IAB believes that uniformity contributes to transparency and acceptance.

2. Support: uniform information textsIn order to be able to comply in a uniform and understandable manner with one of the legal obligations of the Cookie Provision, namely the information obligation, since last 5 June a number of large internet operators and the Security & Privacy Team of Deloitte have intensely collaborated under the supervision of IAB Nederland in the formulation of standard information texts. These texts materialised in close consultations with supervisor OPTA. During the materialisation, OPTA has looked on and provided its recommendations with regard to the contents. IAB The Netherlands would like to thank OPTA for the constructive manner of collaboration at the materialisation of these information texts.

3. Branch-wide useThe more websites will use these texts, the broader the uniform message of these texts will be introduced and the more recognisable things will become for the consumer. This is the reason that the parties involved in the process are happy to make the information texts that materialised available to the whole online branch. Internet users will start recognising the texts and become accustomed to them, both because of the uniformity in the explanation on cookies and the use thereof, and the uniform layout as used by parties. This also contributes to the uniform information obligation as desired by OPTA. The information texts have therefore been formulated in such a model that the use of these texts can be easily implemented by the whole online branch.

1 The new Cookie Provision applies in case of the placing of or obtaining access to data on auxiliary equipment of the user. Thereby no difference is made between the nature of the data. For reasons of readability we will refer to cookies in this document, but this encompasses all technology that is used in order to store data in the auxiliary equipment of a user. Besides various types of cookies, this therefore also concerns installed apps and/or plug-ins, information stored in the Web Storage, screen size, OS, browser type, device fingerprinting, etc.


4. Model of the information textsIn order to see to it that the information texts can also be used branch-wide by all different parties, a three-tiered pyramid model was selected, where a cafeteria model was included in the last tier.

The pyramid model consists of:

1) an unequivocal pop-up bar;2) a short, general explanation ‘why cookies’;3) an explanation specific for the website.

An unequivocal pop-up bar (1) and the short, general explanation ‘why cookies’ (2) are general standard texts and should be adopted unaltered by the website owners who want to make use of this initiative. The explanation specific for the website (3) will subsequently be formulated based on a cafeteria model. Various informative boxes were formulated, consisting of fixed standard boxes and selection boxes. The fixed standard boxes should be adopted unaltered by the website owner. Furthermore, a selection should be made by the website owner of those selection boxes that specifically apply to his website(s).

THE BOXES CONTAIN THE FOLLOWING ISSUES:

1. GENERAL INTRODUCTION TEXT (FIXED STANDARD BOX);2. FUNCTIONAL COOKIES (SELECTION BOX);3. COOKIES TO MAINTAIN STATISTICS (SELECTION BOX);4. SOCIAL MEDIA COOKIES (SELECTION BOX);5. COOKIES IN ORDER TO BE ABLE TO DISPLAY ADVERTISEMENTS (SELECTION BOX);6. COOKIES FOR THE BENEFIT OF BEHAVIOUR-DEPENDENT CONTENTS OF A WEBPAGE (SELECTION BOX);7. OTHER/UNFORESEEN COOKIES (FIXED STANDARD BOX);8. BROWSER SETTINGS (FIXED STANDARD BOX);9. FINAL REMARKS (FIXED STANDARD BOX).

The selection boxes can therefore, depending on whether or not they apply for the visitors, be displayed. In the selection boxes that do indeed apply, subsequently various options are included from which the website owner needs to make a selection, for example the applicable purposes per cookie category. In Appendix 2 Work Instruction, a more comprehensive user instruction on the information texts is included, and print screens of the final result are displayed as well.

“By communicating

in a uniform, recognisable manner with

consumers on the use of cookies,

the online branch shows that it

takes the privacy of the individual

seriously. We hope that these

texts will be adopted by the whole market.”

Lauren van der Heijden,

Director IAB The Netherlands


Example. The short, general statement on ‘why cookies’


“The Cookie Act means enormous

challenges for the online

branch, but challenges

are there to be faced.

Transparency and uniformity

will contribute to the consumer’s

confidence.” Annika

Sponselee, Senior Manager

Security & Privacy, Deloitte

Risk Services

5. Use of the information texts by your organisationYour organisation can start using these information texts discussed with OPTA as well, in order to thus comply with the information obligation under the Cookie Provision, and also profit from the uniformly distributed message and the recognisability. The extended multi-tiered explanation contributes to informing your visitors as completely and understandably as possible on cookies, both generally (2) and specifically (3). The idea behind this is that therewith possible uncertainty and therefore unrest with internet users can be avoided if these uniform texts are used branch-wide. Because of the improved knowledge on cookies and the recognition of ever returning information texts – whereby OPTA was involved as well – your visitors will be able to give their consent in a more balanced manner for the placing of cookies. The model in which the uniform information texts are used simplifies the inclusion thereof on your website(s) as well, espe-cially since you can also inform specifically on your website(s) based on this model. If you have any questions on this, we are happy to refer to Appendix 1 FAQ and/or Appendix 2 Work Instruction, or to the example below. You can also contact IAB The Netherlands. In order to be able to make use of the texts, you will indeed have to know which cookie categories are placed by and via your website(s). For the mapping thereof we are happy to refer to Appendix 3 Cookie Compliance Practical Guide. A step-by-step explanation is included there.

6. Consent requirement under own responsibilityApart from the information obligation, parties that place cookies – including website owners – should also obtain consent prior to the placing.The uniform information texts as they are currently formulated in collaboration with aforementioned parties do not provide for this so-called consent requirement.The texts do provide for the first part of the legal obligation under the Cookie Provision, namely a clear and complete provision of information. Based on this, consent should finally be obtained. Websites will under their own responsibility have to see to obtaining prior consent from the user.


7. On the authorsThe information texts were formulated by Deloitte on the assignment of IAB The Netherlands and in close collaboration with the large internet providers. OPTA was closely involved in the project.

LAUREN VAN DER HEIJDENDirector IAB

Lauren van der Heijden is Director at IAB The Netherlands and was previously employed as Operational Director at Digital Out of Home market leader Librium. In this position he was responsible for the commercial and operational policy of the organisation. Besides he was vice-chairman of the International Advertising Association (IAA).

EMAIL: [email protected] / TEL: +31 854 010 802

AUKE VAN DEN HOUT Member of the Board IAB

Within the management of IAB, Auke van den Hout is responsible for the privacy portfolio. He is co-founder of Adatus, the European market place for audience targeting, and Consentu, supplier of Online Privacy Solutions. Auke has over 15 years’ experience in data-driven advertising in Europe.


ANNIKA SPONSELEESenior Manager Deloitte

Annika Sponselee is Senior Manager at Deloitte and has over 7 years’ experience in consulting to, among other things, media and technology companies in the field ofprivacy. Previously Annika was employed as a lawyer at Baker & McKenzie in the field of privacy legislation. As a project manager, Annika has counselled the group of internet providers at the materialisation of the texts, and has maintained the contact with OPTA during this process.


“Companies that take the privacy of the individual

seriously by communicating

transparently on cookies obtain a

competitive advantage in the long term while doing so” says Auke van den

Hout, Member of the Board IAB The

Netherlands.


8. Application information texts

If you also want to adopt the information texts on your website(s) we kindly ask you to send an e-mail to [email protected]. You will then receive the information texts from us per e-mail file. You will also receive information on the way in which the layout can be included. The ‘Cookie Information Texts’ have been developed with the utmost care, whereby the legal regulations from or by virtue of the Dutch Telecommunication Act were observed as good as possible. Despite that, this document can contain inaccuracies or deficiencies and no rights can be derived from the Cookie Information Texts. Neither the IAB nor the makers of the Cookie Information Texts are liable for possible inaccuracies and/or deficiencies. Since apart from this the exact meaning of these regulations always depends on the circumstances of the case which during the development of these Cookie Information Texts could not be taken into account, the use of these Cookie Information Texts is always fully at the risk of the user.

The ‘Cookie Information Texts’ have been developed with the utmost care, whereby the legal regulations from or by virtue of the Dutch Telecommunication Act were observed as good as possible. Despite that, this document can contain inaccuracies or deficiencies and no rights can be derived from the Cookie Information Texts. Neither the IAB nor the makers of the Cookie Information Texts are liable for possible inaccuracies and/or deficiencies. Since apart from this the exact meaning of these regulations always depends on the circumstances of the case which during the development of these Cookie Information Texts could not be taken into account, the use of these Cookie Information Texts is always fully at the risk of the user.


Q. What does the initiative exactly encompass?A. IAB has taken the initiative to work together with a number of market parties on standard information texts with which the information obligation of the new telecommunication legislation - better know as the cookie legislation – can be complied with. OPTA has looked on and provided feedback on the texts that materialised.

Q. What does IAB want to achieve with this initiative?A. Both in the interest of the consumer and in the interest of the branch, IAB is an advocate of uniformity in communication towards consumers by internet providers.

Q. What will visitors notice in practice when they visit websites?A. On the various websites visitors will be informed in a uniform manner on the use of cookies on that site.

Q. What was the role of OPTA at the materialisation of the texts?A. OPTA has looked on and provided feedback on the texts that materialised.

Q. Do websites that make use of this information materials fully comply with the Dutch Cookie Act? A. No, with the texts only the information obligation of the legislation is complied with. Websites must furthermore also ask consent for the placing of cookies.

Q. May all websites make use of these texts without asking?A. Websites that want to make use of the texts can indicate this to IAB. They will then receive a tool kit with all necessary files via e-mail.

Q. Why would websites have to adopt these texts, what is the ad vantage thereof?A. By using these texts they comply with the information obligation of the new legislation and transparently communicate with the user/visitor.

Q. May websites apply modifications by themselves in the text? A. No, the intention is not that the texts are modified. After all, that would harm the uniformity that was pursued.

Q. Can foreign websites also make use of the information material?A. Yes, the texts are available both in English and in Dutch.

Q. How are visitors addressed: with the informal or formal “you”? A. The texts are available in both forms.

Q. On which location on the webpage should the pop-up banner be placed?A. On top or at the bottom of the page.

APPENDIX 1: FAQ


Work Instruction Cookie Information Texts Below you can find instruction on the way in which the information texts should be used by a website manager. First we will explain how the various parts of the cookie information texts are related to each other; use is namely made of a pyramid model and a cafeteria model.

1. Pyramid model and cafeteria model:In consultation with the large internet providers we chose to inform the website visitors via a pyramid model. By means of this model, the visitor will first be shown a (1) pop-up bar, from which the visitor can click on to a (2) short, simple, and general explanation on ‘why cookies’. Subsequently, the visitor can click on from the short, simple explanation to the (3) more detailed information text regarding the specific website. These detailed information texts are in turn construed via a cafeteria model. This means that the information texts are subdivided into various selection boxes from which the website manager has to make a selection.

WITH REGARD TO THE (1) POP-UP BAR THE FOLLOWING:We chose for a fixed pop-up bar in a tranquil layout that can be placed both on top and at the bottom of the website page. The way this pop-up bar should look like is shown in the example below.

Example 1. Fixed box: Pop-up bar

WITH REGARD TO THE (2) SIMPLE, SHORT, GENERAL EXPLANATION ON THE ‘WHY’ OF COOKIES THE FOLLOWING:We chose for this fixed intermediate step in order to provide a simple, general explanation on the ‘why’ of cookies, because of which the average visitor (young or old, higher or lower educated) can understand better what cookies exactly are. This box is therefore not specifically focussed on your own website(s) but on websites that make use of cookies in general. Apart from complying with a clear information obligation towards everyone, this can also function in a distinguishing manner on the market, since these parties choose to inform everyone in general on cookies, and not only specifically on the use of cookies on the own website. In the example below you can see in which way this text can be displayed on your website.

APPENDIX 2:Work Instruction Cookie Information Texts

This website makes use of cookies. Why? Please click here for more information. Close


THE CAFETERIA MODEL WITH REGARD TO THE (3) MORE DETAILED INFORMATION ON THE OWN WEBSITE:As mentioned before, this part consists of various compulsory boxes and selection boxes. For instance, there are general introductory and closing boxes that apply for everyone. Besides boxes were created that describe (the purposes of) the various types of cookies, and that can be switched on/off in as far as they apply to the website. Per box, you will then also have to make a selection once again from the various purposes. These are in turn also construed via a cafeteria model again. In the example below you can see how these boxes can look like on your website.

Example 2. Fixed box: Why cookies?


Example 3A. Selection box: website-specific explanation on cookies


Example 3B: Selection box: website-specific explanation on cookies


2. Instructions with regard to the selection that has to be made in the (3) detailed website-specific text

GENERAL

• The long text (3) indicates which boxes are general (in short: those that apply for everyone and must be used unaltered) and which boxes are optional and can be selected specifically. This is always indicated at the start of the box.

• At all text between <<>> you have to fill in something or make a selection between two texts, depending on your preferences as website manager. These selections in principle speak for themselves. A number of selections need explanation however, which follows directly below.

• You will for instance have to indicate with regard to each cookie category what the name of the cookie is (for example: cookie 1), who has placed it, with which purpose the cookie was placed, and how long the cookie will be stored. You will also have to indicate on page 3 (cookie type ‘statistics’) whether you make use of software of a third party for the measurements or not. On page 4 (cookie type ‘social media’) you will have to indicate which type of social media cookie u are using: does the party place a cookie

directly after the social media, or only at the time the visitor clicks on the social media button?

• All texts in front of which there is a tick box (namely the purposes) are optional, since they depend on the website. Upon implementation on your

own website(s) you must therefore tick/display the purpose(s) that apply to the respective website, and therefore switch off the purpose(s) that does/do not apply.

For an inventory of the cookies that are used on/via your website,

we refer to our Cookie Compliance Guide.

HOW LONG THE DATA IS STORED (LIFESPAN):• In this box you should indicate how long the cookies are stored. You can select the following storage terms here:o [X] minutes;o [X] days;o [X] weeks;o [X] months;o [X] years;o “Session cookie” (these are temporary cookies that are only used during the visit of your website visitor).

MODIFICATIONS TO THE VERSIONIn the final box, the final remarks, it is indicated that the contents of the statementsand the cookies included may always and without prior warning be modified. Within this framework, it is important to pay attention to two issues:

• See to it that you always keep records on the date and at which time you modify a version, and always save all older versions at an easily accessible location.

• By the time you ask your visitors for their consent, the following appliesforthat matter. Substantial modifications in the contents of the statement or the cookies that you use might have consequences for the consent provided if you have obtained this from a website user. After all, this means that the consent obtained is based on substantially different grounds, and therefore in principle you would have to obtain consent from your website user once again. Substantial modifications are for example concerned if you start using new cookie categories on your website that you did not use before.


IAB The NetherlandsPrins Hendriklaan 291075 AZ AmsterdamT: +31 85 401 08 02

Documents

Iab information texts