The consent exemption allows you not to collect consent from Internet users to collect your audience measurement data.
This allows you to regain visibility on non-consented traffic.
Legal reminder
According to the principles established by the European ePrivacy Directive and the various guidelines issued by the various data protection authorities in Europe, the conditions for implementing consent exemption are as follows:
- Trackers exempt from consent must exclusively collect data strictly necessary for the provision of the service requested by the user (see below).
- The purpose of these trackers must be strictly limited to measuring the audience on the platforms (site, applications, etc.) and for the exclusive account of the publisher.
- These cookies must not be used to track the overall browsing habits of persons using different applications or browsing different websites.
- Trackers may only be used to produce anonymous statistical data.
- The personal data collected may not be cross-referenced with other processing operations, nor passed on to third parties.
Reminder: in addition to the configuration and tagging actions listed above, it is necessary to sign the specific exemption appendix to our Data Processing Agreement (DPA), in order to benefit from the ePrivacy exemption and collect audience measurement data without consent.
Strictly necessary
Consent exemption implies collecting only what is "strictly necessary" to provide the service requested by the user.
For example, the CNIL considers the following information to be "strictly necessary" for the collection of audience measurement data: "performance measurement, detection of navigation problems, optimization of technical performance or ergonomics, estimation of server power requirements, analysis of content consulted, etc.".
As a data controller, you will need to document, and justify in the event of an audit, the collection and use of data for purposes that are "strictly necessary" to your business.
Configuration
In order to benefit the consent exemption with the Piano Analytics solution, the following configuration must be carried out.
Ask Piano to:
- Hide the visitor ID property (visitor_id) by default within your Data Model.
This means that the property will no longer be accessible in the interfaces, and the data will be aggregated there (linked metrics are still usable).
- Activate the data deletion after 25 rolling months (see personal data history customization ).
- Activate the IP address anonymization (see IP address anonymization ).
Note: these three activations will apply to an entire organization.
On the perimeters/platforms/sites on which you wish to benefit from the exemption, make sure to:
-
Configure your data model to hide properties that should not be used (linked metrics are still usable):
- ISP: connection_isp
- Converted visit?: visit_converted
- Carry out your audience measurement exclusively on your own domain or application: off-site measurements such as banner impressions, deported videos, emailing openings or iframes are not possible without prior consent. If you wish to track a user on different perimeters linked to the same publisher, you will need to justify that this measurement is strictly necessary for your business.
- Collect and use data within the Analytics Suite in such a way as not to allow recognition of a visitor/user: the data collected must be used exclusively for anonymous statistics or cohorts that do not involve personal data.
- Do not use imported or exported data for cross-referencing purposes (e.g.: CRM import, API calls feeding partners, API or Data Flow export for CRM feed).
- In your privacy policy (website, app, etc.), inform your users of the presence of this exempted tracker and set up an Opt-Out mechanism.
Implémentation
To set up consent exemption, you can use the dedicated tagging methods . Simply specify the "exempt" mode.
Add strictly necessary information.
By default, "Exempt" mode sends only those properties considered "strictly necessary" by Piano Analytics. If you wish to add customized properties, you'll need to modify the "Exempt" mode and add the property_key for the properties in question.
Deleting information not strictly necessary
You can use the personal data flags to remove data from certain properties automatically in "Exempt" mode.