Almost all websites are running on cookies, but if you want to move your business to the world wide web, chances are that you are required to become cookie compliant due to the General Data Protection Regulation (GDPR). Read on for a short introduction to cookies and the GDPR.

Cookies run the internet

Cookies are small text files that contain bits of information about website visitors. The technology behind cookies were invented some time in the early 90’s. Cookies are named after fortune cookies because, like the pastry, cookies are structures containing a message within.

Upon first visiting a website, the website will place cookies on the user’s browser. The cookies will then enable the website to remember the user, their preferences, prior activity etc. You have probably tried visiting a website and put some items in the cart. You then closed the browser, and upon your next visit to the same website, your items are still in the cart. This feature is possible due to cookies.

There are four types of cookies: Necessary cookies, preference cookies, statistics cookies, and marketing cookies. While the first two types of cookies help improve the user’s experience on the website, the latter two are used for tracking, reporting, and advertising purposes.

Though many consider cookies an evil technology, cookies are in themselves not a bad technology, as all they do is collect and contain data. It is, however, the ethical implications of being in possession of potentially sensitive information and the severe damages that a data breach can do that are concerning.

GDPR: A new era for data privacy

On May 25^th, 2018, the GDPR came into effect. The GDPR is the most significant data privacy initiative in 20 years. It sets strict regulations for how organizations handle data processing activities and gives individuals control over how their data is used.

In other words, websites that serve individuals from inside the EU are required to provide transparency regarding which kind of personal information is processed, why it is processed, and who has access to this processed data. Website owners are also required to gain consent before any kind of data processing can begin in addition to providing clear instructions on how data subjects can change or revoke their consent.

Having a privacy policy on your website is no longer enough. Instead, the website owner must either expand the privacy policy with a declaration of all active cookies on the site or provide a separate cookie policy.

Moreover, if you fall under the legislation of the GDPR, not only are you responsible to ensure that your own organization is compliant. But you must also make sure that service partners, i.e., third service providers, are following the regulations of the GDPR.

The GDPR was a major gamechanger for data privacy as businesses and organizations are now being held accountable for how they handle personal data. Non-compliance can result in hefty fines of up to €20 million or 4% of the global yearly turnover, whichever is higher.