Legal Requirements – Compliance Solutions for Websites, Apps and Organizations | iubenda https://www.iubenda.com/en/ Thu, 19 Mar 2026 09:58:21 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 Using these 6 alt text best practices helps support real accessibility https://www.iubenda.com/en/help/184273-alt-text-examples-3/ Tue, 01 Jul 2025 14:44:14 +0000 https://help.iubenda.com/?p=184273 Alt text is one of the most overlooked, but most impactful, elements of digital accessibility. Whether you’re designing a website, writing a blog, or scheduling a social post, adding thoughtful, descriptive alt text makes a real difference to people who rely on screen readers or other assistive tech.  But writing effective alt text isn’t always […]

The post Using these 6 alt text best practices helps support real accessibility appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Alt text is one of the most overlooked, but most impactful, elements of digital accessibility.

Whether you’re designing a website, writing a blog, or scheduling a social post, adding thoughtful, descriptive alt text makes a real difference to people who rely on screen readers or other assistive tech. 

But writing effective alt text isn’t always straightforward. What do you say about a chart? Do product images need detail? When is it better to leave alt text blank?

In this guide, we’ll cover everything you need to know about alt text best practices – with real alt text examples. In just a few moments, you’ll be better placed to write image descriptions that improve accessibility, boost SEO, and meet key compliance standards.

What is alt text, and why is it important?

Alt text, short for “alternative text”,  is a written description of an image. It usually appears in the HTML code as a visible line of text next to the image, or as a longer description on a separate page accessed through a link. 

Alt text is incredibly important for people who live with visual impairment – it provides essential context that would otherwise be lost to them. It turns visuals into words, making content more inclusive and easier to navigate.

How alt text improves accessibility and SEO

Alt text was originally created to improve digital accessibility, and that remains its most important role today. For blind and low-vision users, screen readers use alt text to describe images aloud, helping them navigate and understand visual content.

But alt text doesn’t only serve assistive technology. When written well, it also contributes to better SEO.

That’s because search engines can’t “see” images. They depend on alt text, alongside file names, to interpret what an image shows. This means relevant alt text, which uses keywords naturally, can improve how your pages rank in image search results.

6 best practices for writing effective alt text

The best alt text is specific, concise, and relevant to the image’s purpose. Here are a few practical tips to guide your writing:

  1. Keep it short, but meaningful – Aim for a maximum of one or two clear sentences. You don’t need to include every visual detail, just the elements that matter most.
  2. Describe the image in context – Why is this image here? What information is it adding? Your alt text should reflect the role the image plays on the page.
  3. Avoid phrases like “image of” or “picture of” – Screen readers already announce that it’s an image, so these intros only create clutter.
  4. Use keywords naturally – Never stuff your alt text with keywords. If the image supports your SEO goals, include relevant terms.
  5. Don’t add alt text to decorative images – If an image on your page is just there for decorative purposes, it should have a null alt attribute (alt=””), so that screen readers skip it altogether.
  6. Add a full stop – Adding a full stop to the end of the alt text helps differentiate it from the rest of the page’s text. It also improves the reading experience for those using screen readers, adding a natural pause.  

By following these best practices, you’ll create alt text that is genuinely helpful for users. To see these principles in action, take a look at the alt text examples below. 

Alt text examples for different types of images

What might surprise you is that not all alt text should be written the same way.

Why? Because different types of images call for different approaches. 

But whether you’re working with graphs, social media content, or product photos, the goal is always the same: describe what matters, in a way that is connected to the context of the image and to support user experience.

Let’s examine how to approach alt copy for each type of image: 

Alt text for informative images

As the name suggests, informative images convey key information that isn’t written elsewhere on the page.

Example:

[Image:] A laptop screen showing a user’s privacy settings dashboard.

Alt text: Privacy settings dashboard showing toggles for location tracking, marketing preferences, and data sharing.

This description focuses on what’s visible and relevant to the context of the image, without overexplaining.

Alt text for decorative images

Decorative images don’t add meaningful content. They’re there purely for aesthetics and should be skipped by screen readers and other assistive technology. 

Example:

[Image:] A background pattern of blue waves.

Alt text: alt=”” (empty)

Use a null alt attribute, like in the example above, so assistive technology can ignore the image and move on.

Alt text for charts and graphs

Charts and graphs convey complex data, which can seem difficult to condense into alt text. 

The answer? Your alt text should simply summarize the key takeaway from the chart or graph.

Example:

[Image:] A bar chart showing cookie banner engagement rates by design.

Alt text: Bar chart showing that banners with fewer choices have higher consent rates than banners with granular options.

If there’s more detail, you might want to consider providing a longer description in text nearby or linking to a text alternative.

Alt text for product images

Product images should be described with key visual details that help users understand what’s being sold.

Example:

[Image:] A pair of wireless headphones on a white background.

Alt text: Black over-ear wireless headphones with cushioned ear pads and adjustable headband.

This is especially important for e-commerce accessibility and usability.

Alt text for social media images

Social media is no exception when it comes to writing alt text. When sharing visual content on social channels, include concise but descriptive alt text that describes the image in a way that’s related to the post’s context. 

Example:

[Image:] A team gathered around a whiteboard during a meeting.

Alt text: Marketing team brainstorming campaign ideas around a whiteboard covered in sticky notes.

Most platforms, like X, LinkedIn, and Instagram, now support alt text, so there’s no excuse to skip it – ensuring everyone in the community can access your content. 

Common mistakes to avoid when writing alt text

Even with the best intentions, it’s easy to get alt text wrong. Here are some of the most common pitfalls – and how to avoid them:

1. Writing overly vague descriptions

Alt text like “Image of a graph” or “Photo of a product” offers no useful context. Be specific. What does the graph show? What kind of product is it?

2. Making descriptions too long

Alt text isn’t the place for full-blown essays. Overly detailed descriptions can overwhelm screen reader users and can interrupt flow. Keep it short and sweet – just a few words will work, or two clear, focused sentences at most.

3. Stuffing in keywords

Alt text that’s crammed with keywords and has no real description doesn’t help users or search engines. Remember to focus on clarity first – when the alt text is genuinely useful, you can rest assured that the SEO benefits will follow soon enough. 

4. Repeating surrounding content

If the image caption or nearby text already says the same thing, there’s no need to repeat it in the alt text. Just focus on what the image itself adds.

5. Ignoring functional images

Buttons, icons, and links with images should have descriptive alt text that explains their function, such as “Submit form” or “Download PDF”,  not just “arrow” or “icon.”

6. Forgetting about mobile and social

If you’re managing content across different platforms, make sure the alt text works consistently across the board, including on mobiles and social posts. Accessibility shouldn’t stop at your website.

By avoiding these common mistakes and using the right tools, you’ll get closer to building a more accessible, user-friendly experience.

How to test and optimize alt text for accessibility

Once you’ve written alt text, how do you know it’s working? 

It’s important to test how well your alt text works in practice, both for screen readers and for overall user experience. 

Here’s how to test and improve your image descriptions:

1. Use a screen reader

Try navigating your site with a screen reader like NVDA (Windows) or VoiceOver (macOS). This gives you direct insight into how your alt text is read aloud and whether it makes sense in context.

2. Turn off images in your browser

Disabling images in your browser is a quick way to preview the alt text that appears in place of each visual. It can be a good way to discover descriptions that feel confusing or redundant and need editing.

3. Check for accessibility errors

Use automated tools to help uncover any errors that may affect screen readers, along with other accessibility issues.  

4. Ask real users for feedback

If you have access to testers who use assistive technology, their feedback is the best thing you can get. Ask whether your alt text feels helpful, concise, and consistent – and adjust based on their suggestions. 

5. Review your SEO performance

Once you’ve optimized your alt text, monitor image-related search traffic in Google Search Console. If your images start showing up in relevant results, you’ll know your descriptions are working for search engines too.

Optimizing alt text is an ongoing process, but following these steps will help you stay on track and build a more inclusive digital experience.

Alt text and WCAG compliance guidelines

If you’re aiming to meet accessibility standards, alt text isn’t optional. The Web Content Accessibility Guidelines (WCAG) lay out clear expectations for how images should be handled to support users with visual impairments, including:

  • All non-text content must have a text alternative – This is a Level A requirement under WCAG 2.1 (Success Criterion 1.1.1). If an image conveys information, it must include a meaningful text alternative.
  • Decorative images should be ignored by assistive tech If an image doesn’t convey content (such as borders, patterns, or visual embellishments), it should include an empty alt attribute: alt=”” so screen readers skip it entirely, reducing noise.

Meeting these standards helps you create a more inclusive site. And it also could help reduce legal risk, especially for organizations operating in areas where accessibility laws, like the European Accessibility Act, are enforced. 

Small details, big impact

Alt text might be a small detail – but it has a big impact.

It makes your content more inclusive. It helps you meet accessibility standards. It boosts SEO. 

But most importantly, it improves the experience for real people who rely on assistive technology every day. 

By following best practices and avoiding the common mistakes outlined above, you can start making accessibility a natural part of your content process.

Want help fixing accessibility gaps on your website?

Learn more about Take a look at our Accessibility Widget and help more people access your site.

The post Using these 6 alt text best practices helps support real accessibility appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Best fonts and text layouts for ADHD https://www.iubenda.com/en/help/184233-adhd-font-2/ Tue, 01 Jul 2025 11:38:19 +0000 https://help.iubenda.com/?p=184233 Font might seem like a small design choice – but for people with ADHD, it can make a big difference. Readers with ADHD often face challenges when processing dense text, navigating cluttered layouts, or maintaining focus on long-form content. And while many accessibility conversations focus on visual or mobility impairments, cognitive accessibility is just as […]

The post Best fonts and text layouts for ADHD appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Font might seem like a small design choice – but for people with ADHD, it can make a big difference.

Readers with ADHD often face challenges when processing dense text, navigating cluttered layouts, or maintaining focus on long-form content. And while many accessibility conversations focus on visual or mobility impairments, cognitive accessibility is just as essential – and often overlooked.

ADHD-friendly fonts are designed (or selected) with these challenges in mind. They prioritize clarity, reduce visual noise, and help readers stay oriented on the page. The right font won’t “fix” ADHD, of course – but it can support attention, lower cognitive load, and make reading a more comfortable experience.

In this guide, we’ll explore what makes a font ADHD-friendly, the key features to look for, and how to apply best practices in your digital content and designs. Whether you’re a UX designer, developer, educator, or content creator, you’ll learn how to make more inclusive choices that benefit everyone.

How typography affects people with ADHD

Typography plays a surprisingly powerful role in how we absorb and interact with information. For individuals with ADHD, certain typographic choices can either support focus and comprehension or make reading a frustrating experience.

Common reading challenges for people with ADHD

  • Difficulty focusing for extended periods: Dense blocks of text, small fonts, or inconsistent layouts can increase mental fatigue.
  • Visual crowding: Overly stylized or compact text can blur together and overwhelm the reader, especially in long paragraphs.
  • Frequent distraction: If the text lacks clear visual structure, readers with ADHD may struggle to track their place or stay engaged.
  • Slower processing: Certain typefaces require more effort to decode, which can increase cognitive load and reduce reading fluency.

Design impacts

  • Poor font and layout choices may result in more time spent re-reading, losing a place, or abandoning the content entirely.
  • Well-designed typography, on the other hand, can make content easier to scan, follow, and retain – benefiting all users.

In short, typography is about more than style – it’s a functional tool. And when chosen thoughtfully, it can serve as a subtle but powerful ally for cognitive accessibility.

Key features of fonts designed for ADHD

While no single font can solve the challenges of ADHD, certain typographic traits can significantly improve readability, reduce distraction, and support sustained attention. 

ADHD-friendly fonts typically share a few important features:

1. Simplicity

Clean, minimal letterforms are easier to process. Avoid overly decorative fonts, which can create unnecessary visual noise.

Helpful fonts: Helvetica, Arial, Calibri
Avoid: Script, cursive, novelty fonts (e.g., Comic Sans, Papyrus)

2. Consistent letter shapes

Fonts that clearly differentiate similar characters (like “I”, “l”, and “1” or “O” and “0”) reduce confusion and help with faster word recognition.

3. Even spacing

Generous letter, word, and line spacing improves clarity and reduces the chance of text appearing too crowded – something that can quickly overwhelm a reader with ADHD.

TIP: Aim for line spacing (leading) of 1.5 or greater for paragraphs of body text.

4. Medium weight

Fonts that are too thin or too heavy can strain the eyes. A medium-weight font – neither too light nor too bold – will offer the best readability.

5. Left-aligned layout

Justified text creates irregular spacing between words, making it harder for the eye to track lines. Left-aligned text maintains consistent spacing and a predictable rhythm.

6. Readable at various sizes

Fonts should be legible even at smaller sizes or when zoomed in – this is important for users who increase text size as a reading aid.

By keeping these features in mind, designers and content creators can begin to create a reading environment that feels calmer, more inviting, and far less cognitively demanding.

Best fonts for ADHD: Top recommendations

Preferences can vary from person to person, but some fonts consistently perform better for readers with ADHD thanks to their clarity, spacing, and simplicity. 

Let’s look at several tried-and-tested options that combine legibility with cognitive friendliness:

1. Verdana

  • Designed for on-screen readability.
  • Wide spacing and tall lowercase letters improve line tracking.
  • Great for body copy and interfaces.

2. Arial

  • A clean, sans-serif classic.
  • Familiar to most users, with a neutral design.
  • Consistent stroke widths reduce visual distraction.

3. Calibri

  • The default font used in many digital workspaces.
  • Rounded corners and soft curves make it easy on the eyes.
  • A good choice for emails, documents, and online reading.

4. Helvetica

  • Highly legible, even at smaller sizes.
  • Used widely in interface and digital product design.
  • Offers clarity without being overly stark.

5. Open Dyslexic

  • Designed specifically for people with dyslexia, but helpful for some with ADHD.
  • Heavier bottoms on letters reduce flipping and skipping.
  • Opinions are mixed, so user testing is important.

6. Lexend

  • Scientifically developed to reduce visual stress and improve reading performance.
  • Custom spacing and wider letterforms benefit people with ADHD and dyslexia.
  • Free to use and available via Google Fonts.

Bonus tip: Use Google Fonts or System Fonts

Stick with web-friendly fonts or those available via Google Fonts. These will ensure consistent rendering across devices and browsers.

Sans-Serif vs. Serif Fonts: Which is better for ADHD?

One of the most common typography questions when designing for cognitive accessibility is whether to use serif or sans-serif fonts. 

While both have their uses, there’s a clear frontrunner when it comes to ADHD-friendly design.

Sans-Serif fonts: the ADHD-Friendly Favorite

Sans-serif fonts – like Arial, Calibri, and Helvetica – tend to be more suitable for people with ADHD. 

Here’s why:

  • Cleaner, simpler shapes: Sans-serif fonts lack decorative strokes at the ends of letters, making them less visually complex and easier to process quickly.
  • Less visual clutter: The minimalist letterforms reduce distractions on the page.
  • Better on screens: Sans-serif fonts typically render more clearly on digital displays, especially at smaller sizes.
  • Improved letter recognition: Their straightforward design helps prevent letters from blending together.

Serif Fonts: best used sparingly

Serif fonts – such as Times New Roman or Georgia – include small embellishments or “tails” on the ends of strokes. While they can be elegant and readable in print, they present a few challenges for ADHD readers:

  • Increased visual noise: Serifs can add unnecessary complexity, especially in dense paragraphs.
  • More difficult tracking: The additional ornamentation can make it harder to follow lines or distinguish similar characters.
  • Screen readability issues: On low-resolution screens, serifs can appear blurry or pixelated.

The verdict

For most ADHD-friendly digital design contexts, sans-serif is the safer bet – especially for body copy, forms, interfaces, and educational content. Serif fonts may still have a place in headings or print materials, but they should be used thoughtfully and tested with real users whenever possible.

How font size, spacing, and line height impact readability for ADHD

Even the most ADHD-friendly font can fall short if the text layout isn’t thoughtfully designed. Typography isn’t just about which font you choose; it’s also about how you present it. 

For readers with ADHD, spacing and sizing choices can dramatically affect focus, comprehension, and comfort.

Font size: bigger is often better

Small fonts require more concentration and visual effort. For readers with ADHD, this added strain can lead to faster fatigue and frustration.

  • Aim for a minimum of 16px for body text on web content.
  • Larger fonts (18–20px) are often more readable and reduce cognitive load.
  • For headings, use consistent scaling to create clear content hierarchy.

Line height: give the eyes room to breathe

Also known as “leading,” line height determines the vertical space between lines of text. Tight line spacing can make reading feel claustrophobic, while overly wide spacing breaks visual flow.

  • Use 1.4 to 1.6x the font size for optimal readability.
  • Avoid cramming too many lines into small content areas.

Letter spacing: the unsung hero

Adjusting the space between characters can help with letter recognition and reduce the chance of letters visually merging – especially in readers who are easily distracted or prone to skipping.

  • A slight increase in letter spacing (e.g., 0.5px) can improve clarity.
  • Avoid fonts with extremely tight or inconsistent kerning.

Paragraph spacing and chunking

Dense blocks of text are overwhelming for many readers, but especially for those with ADHD. Breaking content into smaller, scannable units helps maintain engagement.

  • Use clear paragraph breaks to segment information.
  • Incorporate bulleted lists, subheadings, and whitespace to support scanning.

TL;DR?

Make it large. Make it spacious. Make it easy to scan. The more mental breathing room your text provides, the easier it will be for ADHD readers to stay focused and absorb your content.

Custom ADHD Fonts: do they really help?

In recent years, several typefaces have been designed specifically to support readers with dyslexia and ADHD. These fonts often feature unique shapes, spacing, and weights meant to improve readability and focus. But do they actually make a difference?

What are ADHD fonts?

ADHD-specific or ADHD-friendly fonts are designed with neurodivergent readers in mind. While there’s more research supporting fonts for dyslexia, many of the same principles (like generous spacing and simplified letterforms) can benefit people with ADHD as well.

Popular examples include:

  • OpenDyslexic: Features heavy-weighted bottoms to help prevent letter flipping or confusion.
  • Lexend: A font family scientifically designed to reduce visual stress and improve reading performance.
  • Read Regular: Designed to improve readability for those with reading challenges, including ADHD.

Do they actually work?

The evidence is mixed. Some studies and user reports suggest that these fonts may reduce reading errors or increase comfort for neurodivergent readers – but others show little measurable impact compared to standard readable fonts like Arial or Verdana.

However, user preference matters. If someone finds a custom ADHD font easier to read, that’s a valid and valuable reason to use it.

Things to consider

  • Custom fonts may not always be supported across all devices or browsers.
  • Excessive stylization can sometimes create more distractions, not fewer.
  • Test custom fonts in real-world settings before committing to them across the site.

Bottom line

Custom ADHD fonts can be helpful, especially when paired with thoughtful formatting and clean design. But they’re not a magic bullet – the key is offering flexibility and using them as part of a broader accessibility strategy.

Best practices for designing ADHD-friendly text

Typography is about the overall reading experience (not just fonts). For people with ADHD, small design decisions can make a big difference in how easily they process and engage with content.

Here are some practical tips to improve readability and reduce cognitive overload:

1. Choose simple, clean fonts

  • Use readable sans-serif fonts like Arial, Verdana, or Lexend.
  • Avoid ornate or decorative typefaces – they can be distracting and hard to scan.
  • Stick to one or two font families throughout your site or document.

2. Use adequate font size

  • Aim for a minimum of 16px body text.
  • Increase font size for headings and calls to action to create clear visual hierarchy.

3. Adjust line height and spacing

  • Set line height (line spacing) to around 1.5x the font size.
  • Use generous paragraph spacing to avoid visual clutter.
  • Ensure adequate letter and word spacing (tracking) to aid focus.

4. Break Up Text

  • Use short paragraphs, bullet points, and subheadings.
  • Incorporate white space to give the eyes room to rest.
  • Include visual cues (icons, highlights) to guide readers through content.

5. Minimize distractions

  • Avoid flashing content, auto-play videos, or fast-moving carousels.
  • Use consistent layouts and navigation patterns.
  • Reduce clutter and remove non-essential elements from the page.

6. Give users control

  • Allow users to adjust font size, contrast, or line spacing if possible.
  • Consider offering a “reading mode” or simplified content view.

7. Test with real users

  • Whenever possible, test your designs with neurodivergent individuals.
  • Collect feedback to refine your content and improve usability.

Conclusion: Designing with ADHD in mind benefits everyone

Typography can be a powerful ally in making content more accessible for people with ADHD. When you prioritize clarity, simplicity, and flexibility, you reduce barriers, not just for neurodivergent users, but for all your readers. 

From font choice and spacing to layout and readability, every design decision can support better focus and comprehension.

By following the guidance in this article, you’ll be one step closer to creating more inclusive, user-friendly digital experiences.

Want to make accessibility a seamless part of your workflow?

Learn more about iubenda’s Accessibility Widget and how we can help you meet user needs while staying compliant.

The post Best fonts and text layouts for ADHD appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Best font for dyslexia: How to choose fonts that empower every reader https://www.iubenda.com/en/help/184227-best-font-for-dyslexia-3/ Tue, 01 Jul 2025 09:46:09 +0000 https://help.iubenda.com/?p=184227 Reading is something many of us take for granted.  But for people with dyslexia, it can feel like navigating a maze. The letters and words are difficult to decipher, and memory, coordination, and organization are affected, too. Dyslexia affects up to 10% of the population and often makes reading slow, exhausting, and frustrating. Yet one […]

The post Best font for dyslexia: How to choose fonts that empower every reader appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Reading is something many of us take for granted. 

But for people with dyslexia, it can feel like navigating a maze. The letters and words are difficult to decipher, and memory, coordination, and organization are affected, too.

Dyslexia affects up to 10% of the population and often makes reading slow, exhausting, and frustrating. Yet one of the simplest ways to support dyslexic readers is often overlooked: 

Font choice.

Typography affects how easily text can be decoded and understood. By choosing dyslexia-friendly fonts and applying thoughtful design practices, you can significantly improve reading experiences for people with dyslexia. 

In a moment, you’ll know why font selection matters, what formatting choices are easier to read, and what the best font for dyslexia is – so your digital content is more accessible. 

What is dyslexia, and how does it affect reading?

Dyslexia is a common neurological difference that affects the way the brain processes written and spoken language. It makes it difficult to recognize, decode, and accurately process words. This means reading, writing, and sometimes speaking can be a struggle.

Dyslexia appears differently in different people. For some, letters and words can appear jumbled, distorted, or upside down. But in general, dyslexics find it difficult to track lines of text and distinguish between similar-looking letters (like b/d or p/q). These obstacles not only reduce comprehension but also make reading mentally draining and frustrating.

Why font choice matters for people with dyslexia

Font choice can be a game-changer for dyslexic readers – making a massive difference to their reading experience. Fonts and typography with certain characteristics can reduce cognitive load, improve readability, and make it easier to distinguish between letters.

By using more accessible fonts, designers, educators, and content creators can remove unnecessary barriers and make their content more accessible.

Key features of dyslexia-friendly fonts

Not all fonts are created equal – especially when it comes to supporting dyslexic readers. Dyslexia-friendly fonts share several key features that minimize confusion and improve readability:

  • More spacing – Characters like b/d, p/q, and i/l are easily confused in many fonts. Consistent, even, generous spacing in between letters reduces visual crowding and can help make it easier for dyslexic readers to tell them apart.
  • Unique sticks and tails – Because some letters are difficult for dyslexic readers to tell apart, ensuring letters have unique sticks and tails that vary in length helps with recognition.
  • Larger size – A larger font size makes letters and words clearer, aiding comprehension.
  • Simple, open shapes – Avoiding ornate strokes and unnecessary embellishments prevents letters from blending together or becoming visually overwhelming.
  • Weighted bottoms – Adding heavier bottoms to letters helps anchor them on the line.
  • Asymmetry – Fonts with asymmetrical letters make it easier to distinguish between commonly confused characters.
  • Longer extenders – Extenders are the parts of a letter that extend above or below the line that letters sit on (e.g., p or b). Lengthening them makes each letter more distinct for easier recognition. 

Sans-serif vs. serif fonts: which is better for dyslexia?

When it comes to dyslexia-friendly typography, sans-serif fonts are generally the better choice. Sans-serif fonts –  like Arial, Verdana, and Open Sans – have clean, straightforward lines without the small decorative strokes (serifs) found in serif fonts. This minimalist design helps letters stand out more clearly from one another.

Serif fonts, on the other hand, can make reading harder for dyslexic individuals. The extra details in serifs often cause letters to blur together, increasing the likelihood of confusion and fatigue. 

How font size, spacing, and line height impact readability

Beyond font choice, how you format your text can make a big difference for dyslexic readers. Proper font size, spacing, and line height all help reduce visual stress,  making text easier to process:

  • Font size – Larger text, typically 12 to 14 point,  improves readability by making letters more distinguishable.
  • Letter spacing (tracking). Increasing the space between letters helps dyslexic readers avoid the crowding effect, where letters seem to run together. Aim for 35% of the average letter width, but be careful not to overdo it, as this can make text less easy to read.
  • Word spacing. Slightly increasing the distance between words helps separate them visually, improving comprehension.
  • Line height (leading). Increasing line spacing helps readers keep track more easily.
  • Paragraph spacing. Adding space between paragraphs breaks text into manageable sections, improving comprehension and navigation through longer content.

Thoughtful adjustments to size and spacing don’t just benefit dyslexic readers; they improve readability and accessibility for everyone, creating a more inclusive and user-friendly experience.

Best fonts for dyslexia: top recommendations

So, what are the best fonts for dyslexia? Dyslexia manifests differently depending on the person, which means no one font will be perfect for everyone. 

That being said, some fonts are more likely to make the reading experience just that little bit easier for them. 

 Below you’ll find a list of recommended options:

  • Arial – A clean, widely available sans-serif font with simple letterforms and generous spacing, making it easier to read than many serif fonts.
  • Helvetica – A classic sans-serif font with clean, uniform strokes and minimal ornamentation, which can improve legibility for dyslexic readers. However, some find its tight spacing less ideal for longer pieces of text.
  • Open Sans – Designed to be legible across different screen resolutions and sizes, Open Sans features clear letterforms and balanced spacing, making it easier for dyslexic readers to distinguish similar characters.
  • Verdana – Like Open Sans, Verdana was designed for screen readability, especially for smaller screen resolutions and sizes. Its distinct letters and loose spacing are well-suited to dyslexic readers.
  • Tahoma – Similar to Verdana but slightly narrower, Tahoma offers distinct letter shapes that improve character recognition, and is especially suited to formats where a lot of words need to fit into a smaller space.
  • Calibri – With rounded, clear letters and generous spacing that can aid legibility, Calibri was designed to make longer pieces of text more readable.
  • Century Gothic – A rounded sans-serif font with slightly larger aspects of lettering, it reduces the chances of letter confusion.
  • Comic Sans – While often criticized for its informal appearance, Comic Sans’ irregular, clear letter shapes can actually benefit some dyslexic readers.
  • Trebuchet – Also designed for easy screen readability, Trebuchet has strong, wide, distinct letterforms and clean lines for greater clarity. 

Custom dyslexia fonts: Do they really help?

Custom fonts designed specifically for dyslexia,  like OpenDyslexic and Dyslexie, aim to make the reading experience easier for those with the condition. 

These fonts use weighted bottoms to stabilize letters, exaggerated character shapes to enhance differentiation, and wider spacing to reduce visual crowding. 

But research on custom dyslexia fonts suggests they might not be effective, with some studies concluding that they offer no significant advantage over well-chosen, standard sans-serif fonts like Arial or Verdana. 

However, because of the highly subjective nature of dyslexia, individual preferences do seem to play a key role: what works well for one dyslexic reader might not help another.

The best approach is to provide readers with standard sans-serif fonts, like those listed above. Using these, in combination with best practices like appropriate spacing and clear layouts, will make your content more accessible.

Best practices for designing dyslexia-friendly text

As well as picking a legible font, there are some best practices to keep in mind which can help make text more dyslexia-friendly:

  • Avoid all caps – Blocks of uppercase letters are harder to read and can slow comprehension for dyslexic readers.
  • Limit italics and underlining – These styles distort letter shapes and can blur words, making them harder to decode.
  • Choose high-contrast color schemes – Avoid low-contrast color combinations or busy backgrounds.
  • Use left-aligned text – Avoid justified text, which creates uneven spacing that can disrupt reading flow.
  • Keep structure clean and clear – Make sure your layouts are clean and uncluttered, avoiding columns, using consistent headings, adding plenty of white space, and including a table of contents for clear navigation.
  • Use bullet points and short paragraphs – Breaking information into small, digestible chunks helps readers process and retain content.
  • Write for clarity – Use simple language with shorter sentences in the active voice, and avoid double negatives. 
  • Provide adjustable text – Where possible, allow users to customize font size, spacing, and color schemes to suit their individual needs. You can do this with our Accessibility Widget.

Applying these best practices improves the experience not only for people with dyslexia but for everyone who reads your content, helping them absorb information more quickly and with less effort.

How to test and optimize fonts for dyslexic readers

When it comes to dyslexia, typography isn’t one-size-fits-all. The best approach is to test different fonts to ensure your design supports the needs of dyslexic users. 

Here’s how to approach testing:

  • Gather feedback from dyslexic users – The most valuable insights come directly from people with dyslexia. Share prototypes or sample pages and ask about their reading comfort, speed, and comprehension.
  • Run readability tests – Readability testing tools can help you assess overall text complexity, but remember that these don’t evaluate font choice. Pair them with user testing for a complete picture.
  • Use screen readers and assistive technology – Test your design with popular assistive tools to ensure compatibility and a smooth experience for all users.
  • Continuously improve – Apply feedback and test results to refine your typography and layouts, balancing accessibility with your brand’s style.

By actively testing and optimizing your content, you demonstrate a genuine commitment to accessibility, giving dyslexic readers the support they need to engage confidently with your content.

From frustration to comfort

The right typography can make the difference between a frustrating reading experience and a comfortable one. By understanding how dyslexia affects reading, choosing supportive fonts, and applying best practices when setting out your content, you can create an experience that’s inclusive, accessible, and more enjoyable for your audience.

Designing with dyslexic users in mind is a commitment to cognitive accessibility, benefiting millions of people worldwide. And, given that it will widen your audience reach,  it’ll benefit your business too. 

Ready to make your website or app more accessible?

Find out more about our Accessibility Widget and give your content that wider reach. 

The post Best font for dyslexia: How to choose fonts that empower every reader appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Assistive technology examples: Tools that empower access https://www.iubenda.com/en/help/184201-assistive-technology-examples-3/ Tue, 01 Jul 2025 08:09:19 +0000 https://help.iubenda.com/?p=184201 In a digital world, access is everything.  But millions of people still face barriers when interacting with digital tools due to physical, sensory, or cognitive impairments. This is where assistive technology comes in – a powerful category of tools and devices designed to bridge the gap and empower users of all abilities to engage with […]

The post Assistive technology examples: Tools that empower access appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
In a digital world, access is everything. 

But millions of people still face barriers when interacting with digital tools due to physical, sensory, or cognitive impairments. This is where assistive technology comes in – a powerful category of tools and devices designed to bridge the gap and empower users of all abilities to engage with content, communicate, and participate fully in digital spaces.

From screen readers and braille displays to speech recognition software and ergonomic keyboards, assistive technologies come in many forms. Some support users with permanent disabilities, while others assist people with temporary or situational limitations, like recovering from surgery or navigating a noisy environment.

As global awareness of digital inclusion grows, so does the importance of understanding how assistive technology works and how it can be integrated into websites, classrooms, workplaces (and beyond). 

In this article, we’ll break down:

  • What assistive technology is and how it benefits users
  • Real-world examples across a range of disabilities
  • Use cases in education and employment
  • Emerging trends to watch
  • How to choose the right tools for your audience or organization

Let’s dive in – and explore how technology can be a force for inclusion.

How assistive technology helps people with disabilities

Assistive technology (AT) is about independence, dignity, and equal opportunity. These tools enable people with disabilities to perform functions that might otherwise be difficult or impossible, improving quality of life and opening access to education, employment, and online services.

Empowering independence

Whether it’s a blind person using a screen reader to shop online, or someone with mobility limitations navigating a website via voice control, assistive technology enables users to complete tasks on their own – often without needing additional help.

Enhancing communication

Tools like speech-generating devices (SGDs), real-time captioning, and hearing aids allow people with communication barriers to engage in conversations, both in person and online. This is crucial in educational and workplace settings where clear communication is make or break.

Leveling the playing field

In both education and employment, AT helps make sure that people with disabilities can compete and collaborate on equal footing. For example, students with dyslexia may benefit from text-to-speech software, while an employee with limited dexterity may rely on adaptive keyboards or eye-tracking technology.

Supporting digital access

As more services move online, it’s vital that digital environments accommodate assistive tech – from compatibility with screen readers to customizable text sizes and keyboard-friendly navigation. AT can only be effective if web content and digital tools are designed with inclusion in mind.

Adapting to changing needs

Assistive technology can also support people with temporary injuries, age-related impairments, or situational challenges – such as using captions in a noisy space. In this way, AT benefits a much broader population than many realize.

Examples of assistive technology for visual impairments

People with visual impairments – from low vision to complete blindness – rely on a wide range of tools to interact with digital content. These technologies translate visual information into formats that can be heard, touched, or enlarged.

Screen readers

Screen readers convert on-screen text into synthetic speech or braille output. Popular options include:

Note

Content must be structured with semantic HTML and alt text to work well with screen readers. Basically, poor coding = poor experience.

Braille displays

These devices render text as tactile braille characters. Dynamic refreshable displays allow users to “read” digital content line by line, often working alongside screen readers.

Magnification software

For users with low vision, screen magnifiers (like ZoomText or native tools like Windows Magnifier) enlarge parts of the screen. 

Features often include:

  • Adjustable zoom levels
  • Enhanced contrast settings
  • Cursor enhancements

Text-to-speech tools

While often grouped with screen readers, standalone TTS tools like NaturalReader or Read Aloud browser extensions help users with partial vision or fatigue listen to content at their own pace.

High-contrast and inversion modes

Operating systems and browsers frequently offer display enhancements, such as dark mode or high-contrast color schemes, making text easier to read for users with light sensitivity or reduced contrast perception.

For your digital content to be truly accessible, it must be compatible with these technologies – from ensuring correct label markup to avoiding text baked into images.

Examples of assistive technology for hearing impairments

For individuals who are deaf or hard of hearing, assistive technology means better access to auditory content – from conversations to multimedia – through visual and tactile alternatives.

Real-time captioning tools

Live captioning converts speech to text on the fly. It’s especially valuable for:

  • Video conferencing (e.g., Google Meet, Zoom, Microsoft Teams all offer built-in captions)
  • Live events (via CART services: Communication Access Real-Time Translation)
  • Streaming platforms (like YouTube’s auto-captions or third-party services)

Best practice: Always provide captions for pre-recorded and live content – not just for compliance, but for clarity.

Subtitling and transcription software

Transcripts and subtitles make audio and video content accessible. Tools like Otter.ai, Rev, and Descript help create readable versions of spoken content, useful in both educational and professional settings.

Visual alert systems

Devices like flashing doorbells, visual fire alarms, and vibrating pagers offer non-auditory notifications. On websites, visual cues for sounds (like “ding” when a message is sent) improve the user experience for everyone.

Sign language interpretation technology

Video relay services (VRS) and interpretation apps like InterpreterNow and SignLive connect users with interpreters via video, helping bridge communication gaps in real-time settings.

Hearing aid-compatible technology

Modern hearing aids now integrate with:

  • Bluetooth for direct audio streaming
  • Telecoils for improved sound in public venues
  • Smartphone apps for sound filtering and environmental control

TIP: Audio content on websites should always be accompanied by transcripts or alternative formats. Not all users benefit from amplification – many need a visual version.

Examples of assistive technology for mobility challenges

People with mobility impairments may experience difficulty using standard input devices like keyboards, mice, or touchscreens. Assistive technology helps them interact with digital content in ways that suit their physical abilities.

Alternative input devices

These tools replace or supplement traditional hardware:

  • Mouth sticks and head wands allow users to press keys or touchscreen elements with head or mouth movements.
  • Foot switches and sip-and-puff systems enable interaction using air pressure or foot motion.
  • Joystick mice offer greater control for users with limited dexterity.

These tools are often customized to individual needs, improving both autonomy and speed.

Voice control and speech recognition

Software like Dragon NaturallySpeaking, Apple Voice Control, and Google Assistant lets users navigate, dictate, and interact with devices entirely hands-free. This technology is especially helpful for users with limited or no use of their arms and hands.

TIP: Make sure your website or app is compatible with voice commands and doesn’t require complex gestures to operate.

On-screen keyboards

These allow typing using:

  • A mouse
  • Eye tracking
  • Switch controls

Available on most operating systems, on-screen keyboards are especially useful when paired with pointer tools or gaze tracking.

Switch-access systems

Switches offer simplified interaction by mapping multiple commands to a single button or sequence. 

They can be activated with:

  • Head movements
  • Shoulder taps
  • Blinking (via sensors)

These systems are often used alongside screen readers or scanning software that cycles through options.

Ergonomic and adaptive hardware

Custom setups include:

  • Split keyboards, trackballs, and vertical mice
  • Adjustable desks and mounts for optimal device positioning
  • Touch-free access options using eye gaze technology (like Tobii Dynavox)

Developer tip: Make sure all interactive components (e.g., form fields, buttons) are keyboard-accessible and support focus indicators.

Examples of Text-to-Speech (TTS) tools

Tools like NaturalReader, Kurzweil 3000, and Read&Write by Texthelp convert written content into audio, helping users with dyslexia or reading difficulties absorb information more easily. These tools often include synchronized highlighting, improving word recognition, and focus.

Screen masking and focus tools

These help reduce on-screen distractions by dimming irrelevant areas or guiding the eye line. 

Examples include:

Useful for: users with ADHD, visual processing disorders, and executive function challenges.

Mind mapping and visual organizers

For users who struggle with linear note-taking or abstract planning, visual mapping tools can help structure information:

These tools are great at offering support for joining the dots for complex auditory information

Assistive technology in education

Inclusive education means empowering every student, regardless of ability, to participate fully in the learning process. Assistive technology is a critical enabler, especially for students with disabilities. When integrated thoughtfully, it enhances learning outcomes, independence, and engagement.

Key use cases across disability types

For students with visual impairments:

  • Screen readers (JAWS, NVDA) provide spoken descriptions of digital content.
  • Braille displays allow reading and writing through tactile input.
  • Accessible e-textbooks offer reflowable, alt-text-equipped formats.

For students with hearing impairments:

  • Captioning services (e.g., Otter.ai, Google Meet captions) ensure access to spoken content.
  • Visual learning tools support comprehension through imagery and text-based resources.

For students with motor disabilities:

  • Alternative input devices like adaptive keyboards or switch controls support writing and navigation.
  • Voice dictation tools (Dragon Naturally Speaking and Google Voice Typing) enable speech-based interaction.

For students with cognitive disabilities:

  • Text simplification tools (Rewordify, SMMRY) and TTS tools support literacy and comprehension.
  • Scheduling apps and visual organizers help with time management and executive function.

Accessibility features in learning platforms

Most major learning management systems (LMS) like Moodle, Blackboard, and Canvas now include built-in accessibility tools such as:

  • Adjustable font sizes and contrast
  • Keyboard navigation support
  • Captioning and transcript tools

Educators can enhance accessibility by providing:

  • Multiple content formats (e.g., video + transcript)
  • Structured documents with headings
  • Alt text for all visual materials

TIP: When designing digital learning materials, apply Universal Design for Learning (UDL) principles – offering multiple means of representation, engagement, and expression.

Assistive technology in the workplace

Workplaces that embrace assistive technology not only support employees with disabilities – they also unlock productivity, inclusivity and innovation. With the right tools and culture, everyone can contribute meaningfully.

Key use cases by disability type

Visual impairments:

  • Screen readers (JAWS, VoiceOver, NVDA) allow employees to interact with software, emails, and documents.
  • Screen magnifiers (ZoomText, Windows Magnifier) assist with reading and on-screen navigation.
  • Accessible email clients and intranet tools with keyboard navigation and alt-text support ensure inclusive communication.

Hearing impairments:

  • Real-time transcription tools (Otter.ai, Microsoft Teams captions) improve meeting accessibility.
  • Video conferencing with live captions or interpreters ensures equal participation.
  • Visual notifications replace audio alerts in workplace systems.

Motor disabilities:

  • Speech recognition software (e.g., Dragon, Windows Speech Recognition) for hands-free computing.
  • Adaptive input devices like ergonomic keyboards, head pointers, and eye-tracking systems.
  • Customizable workstations for physical comfort and accessibility.

Cognitive disabilities:

  • Task automation and reminder tools (e.g., Trello, Asana) for executive function support.
  • Distraction-reducing apps (like Focus@Will or Freedom) to enhance concentration.
  • Simplified interfaces and consistent layouts reduce cognitive load.

Employer responsibilities and best practices

  • Conduct accessibility audits for internal systems and tools.
  • Offer accommodations proactively – through HR processes or inclusive design from the outset.
  • Train teams on digital accessibility, including how to create accessible documents, presentations, and emails.
  • Integrate assistive technologies as standard options – not exceptions.
Note

In many regions (e.g., under the European Accessibility Act), employers and service providers are legally required to ensure workplace accessibility.

How to choose the right assistive technology

With so many tools available, selecting the right assistive technology can feel overwhelming. The key is to align the solution with the individual’s unique needs, context, and preferences – not just the disability category.

1. Start with the user’s goals

  • What tasks or environments are most challenging?
  • Is the goal communication, navigation, education, employment, or daily independence?
  • Consider both short-term needs (e.g., exams, work apps) and long-term adaptability.

2. Assess needs and try solutions

  • Needs assessments (conducted by AT specialists or therapists) help match tools to abilities and context.
  • Trial periods or demos let users test tools before committing.
  • Involving the user in the decision-making process is critical for long-term success.

3. Think about these key elements

  • Compatibility: Will it work with the user’s current devices, browsers, or platforms?
  • Ease of use: Is the interface intuitive and customizable?
  • Support and training: Are tutorials, help guides, or community support available?
  • Cost and funding: Are grants or employer/educational reimbursements available?

Pro tip: Remember that needs evolve. The right solution today may need adjusting tomorrow. Flexibility is key.

Learn more

Want to make your digital content work better with assistive tech?

The post Assistive technology examples: Tools that empower access appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Creating content for everyone: A guide to Text-to-Speech assistive technology https://www.iubenda.com/en/help/183765-text-to-speech-assistive-technology/ Fri, 20 Jun 2025 12:24:36 +0000 https://help.iubenda.com/?p=183765 Text-to-speech (TTS) assistive technology is more than just a convenience; it’s a lifeline to information for millions of users.  From helping visually impaired individuals navigate websites to supporting neurodivergent learners in educational settings, TTS plays a vital role in building an inclusive digital world. As digital content continues to multiply across platforms and devices, making […]

The post Creating content for everyone: A guide to Text-to-Speech assistive technology appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Text-to-speech (TTS) assistive technology is more than just a convenience; it’s a lifeline to information for millions of users. 

From helping visually impaired individuals navigate websites to supporting neurodivergent learners in educational settings, TTS plays a vital role in building an inclusive digital world.

As digital content continues to multiply across platforms and devices, making sure that information is accessible to all users is no longer optional. Assistive technologies like TTS are essential components of accessibility compliance under global standards such as the Web Content Accessibility Guidelines (WCAG) and the European Accessibility Act (EAA). But despite this importance, many organizations still don’t fully understand how TTS works, or how to optimize their content so that it’s truly accessible when read aloud by machines.

This article breaks down what TTS technology is, how it supports users with different abilities, and what you can do to keep your digital content working effectively. You’ll find implementation tips, real-world examples, and practical guidance that helps you build better, more inclusive experiences for every user.

Want a quick win for TTS accessibility?

Start with semantic HTML and a clear heading structure.

What is Text-to-Speech (TTS) assistive technology?

TTS assistive technology is software that converts digital text into spoken words. It reads content aloud from screens, whether it’s a paragraph on a website, an email, or a menu in an app, allowing users to consume information audibly instead of visually.

Unlike screen readers, which provide complex navigation and interaction capabilities for blind users, TTS tools focus on voice output alone. 

They’re used by a broad range of people: not just those with disabilities, but also anyone who benefits from auditory learning, multitasking, or reduced screen time.

TTS systems can be built into devices (like iOS VoiceOver or Android’s Select to Speak), embedded in websites and apps, or installed as standalone software or browser extensions. 

High-quality TTS software often includes:

  • Natural-sounding synthetic voices
  • Multi-language and dialect support
  • Speed and pitch controls
  • Word and sentence highlighting while reading
  • Compatibility with different content types (e.g., PDFs, HTML, eBooks)

TTS has become more sophisticated thanks to advances in AI and natural language processing, allowing voices to sound more human and less robotic, enhancing both comprehension and user experience.

How Text-to-Speech technology works

TTS technology follows a relatively straightforward process, but under the hood, it relies on sophisticated linguistic, computational, and audio processing techniques to deliver a natural listening experience.

1. Text analysis

The software begins by analyzing the raw text input. It breaks sentences into smaller units, identifies punctuation and grammatical structure, and prepares the content for speech conversion. This stage also includes normalization – for instance, turning “€10” into “ten euros” or “Dr.” into “doctor.”

2. Linguistic processing

Next, the TTS engine applies phonetic rules and natural language processing (NLP) to determine how each word should be pronounced. 

This step is essential for:

  • Handling homographs (e.g., “lead” as in “to guide” vs. “a metal”)
  • Adjusting intonation based on sentence type (statement vs. question)
  • Focusing on correct stress and rhythm in multi-syllable words

3. Speech synthesis

Once the text is linguistically parsed, the engine generates speech using one of two main approaches:

  • Concatenative synthesis: Strings together pre-recorded fragments of human speech.
  • Neural or parametric synthesis: Uses deep learning to generate speech from scratch (e.g., Google’s WaveNet, Amazon Polly). This approach produces more natural and expressive voices.

4. Audio output

The final output is a spoken voice rendered through speakers or headphones. Advanced tools also include highlighting, allowing users to follow along visually as the text is read aloud – an important feature for improving literacy, attention, and comprehension.

Modern TTS engines are increasingly integrated into platforms, browsers, and operating systems, making the technology more accessible than ever. As capabilities expand, understanding these mechanics helps content creators and developers design experiences that support – rather than hinder – spoken interaction.

Who benefits from TTS assistive technology?

TTS isn’t just a tool for people with permanent disabilities. Its versatility makes it valuable across a wide range of user needs, contexts, and industries. 

Here’s a breakdown of who benefits most:

1. Individuals with visual impairments

For blind and low-vision users, TTS provides vital access to digital content. It allows them to consume information on websites, documents, and applications without needing to rely on visual cues.

  • Example: A screen reader using TTS can read out webpage content, including headings, buttons, and links, enabling independent web navigation.

2. People with dyslexia or other reading disabilities

TTS helps decode complex or unfamiliar words, easing cognitive load and improving reading comprehension.

  • Example: A student with dyslexia may use TTS to follow along with assigned readings, improving retention through dual auditory and visual input.

3. Individuals with ADHD or memory challenges

TTS can help users maintain focus and reinforce understanding by presenting content in a different sensory format.

  • Example: Hearing a passage read aloud can support working memory and reduce distractions for people with attention difficulties.

4. Non-native language speakers

TTS offers clear pronunciation and pacing, aiding language learners and multilingual users.

  • Example: A website visitor unfamiliar with written English may prefer listening to content rather than reading it.

5. People with motor disabilities

For users with limited mobility or dexterity, TTS allows for hands-free content consumption – especially useful when used with voice control or keyboard navigation.

  • Example: A user with a tremor may find it easier to navigate using a screen reader and listen to content rather than scroll and click.

6. Mobile and situational users

Even users without any disability can benefit from TTS in specific contexts, such as multitasking, driving, or exercising.

  • Example: A commuter may use TTS to listen to an article during a train ride instead of reading on a small screen.

The bottom line is that TTS technology makes digital content more inclusive, usable, and versatile for everyone, not just those with diagnosed disabilities.

Key features of effective TTS software

Not all TTS tools are created equal. While basic versions can read text aloud, the most effective TTS software includes a range of features designed to improve clarity, control, and user experience – especially for individuals who rely on it daily.

1. Natural-sounding voices

Modern TTS engines use neural networks and deep learning to simulate human speech patterns. 

You need to look for tools that offer:

  • Expressive intonation
  • Appropriate pacing and rhythm
  • Regional accents or multilingual support

Example: Google’s WaveNet and Amazon Polly generate high-quality synthetic voices that are almost indistinguishable from human speech.

2. Customizable playback settings

Different users need different speeds, tones, and reading styles. 

Quality TTS tools allow users to:

  • Adjust reading speed (slower for comprehension, faster for skimming)
  • Modify pitch or emphasis
  • Choose between male/female or child/adult voices

3. Highlighting and word tracking

Highlighting text as it’s read helps users follow along visually. 

This is especially helpful for:

  • Users with dyslexia or reading difficulties
  • Language learners building reading fluency

4. Pronunciation control

Advanced TTS software allows for customization of tricky words, acronyms, or brand names – especially important for:

  • Medical or technical content
  • Multilingual websites
  • Company or industry-specific terms

5. Compatibility with assistive technologies

Effective TTS tools integrate well with:

  • Screen readers (like NVDA, JAWS, VoiceOver)
  • Browsers and mobile apps
  • Learning management systems (LMS)

6. Offline or cross-platform use

Some users need TTS access on the go, in low-bandwidth settings, or across different devices. 

You need to look for tools that support:

  • Offline playback
  • Cloud syncing of preferences and settings
  • Browser extensions and mobile apps

Best TTS tools and software

Whether you’re designing a website, building educational tools, or crafting inclusive workplace policies, selecting the right TTS technology is essential. 

We’ve curated a list of the top-performing TTS tools, ranging from enterprise-level platforms to consumer-friendly apps.

1. Screen reader TTS engines

These tools are integrated with screen readers used by millions of people with visual and cognitive disabilities.

  • JAWS (Job Access With Speech)
    – Industry standard for Windows users with vision loss
    – Highly customizable voice profiles and shortcut commands
    – Common in government and enterprise settings
  • NVDA (NonVisual Desktop Access)
    – Open-source, free for Windows
    – Uses eSpeak or can integrate with premium voices like Vocalizer
  • VoiceOver (macOS/iOS)
    – Built into all Apple devices
    – Includes high-quality voices with natural cadence
    – Syncs user settings across devices via iCloud
  • TalkBack (Android)
    – Android’s native screen reader
    – Supported by Google’s speech services
    – Works well with Braille displays and other ATs

2. Standalone TTS applications

These tools are used for reading websites, documents, or books aloud, even by users without disabilities.

  • NaturalReader
    – Supports PDFs, Docs, emails, and web pages
    – Offers offline mode and AI voices
    – Suitable for education and general productivity
  • Read Aloud (Chrome/Edge Extension)
    – Free browser extension for reading web content
    – Supports multiple languages and speech engines
    – Popular with casual users and students
  • Speech Central
    – Cross-platform TTS for Windows, macOS, iOS
    – Can read RSS feeds, websites, and books
    – Useful for professionals and language learners

3. Cloud-based and developer APIs

These are ideal for integrating TTS into apps, platforms, and digital products.

  • Google Cloud Text-to-Speech
    – Over 220 voices in 40+ languages
    –  Offers WaveNet natural voice synthesis
    – Widely used in education, telehealth, and IoT devices
  • Amazon Polly
    – Real-time and batch TTS support
    – Neural TTS (NTTS) options for lifelike speech
    – Integrates with Alexa, learning apps, and accessibility tools
  • IBM Watson Text to Speech
    – Enterprise-grade security and scalability
    – Supports SSML (Speech Synthesis Markup Language) for custom pronunciation
    – Suitable for healthcare and enterprise solutions

No matter your use case – education, compliance, UX, or inclusion – there’s a TTS solution to support your goals. The key is choosing tools that match your audience’s needs and your technical environment.

TTS for web accessibility and inclusion

When integrated thoughtfully, TTS can dramatically enhance how users interact with websites, apps, and digital platforms.

Why TTS matters for accessibility

TTS plays a vital role in ensuring compliance with accessibility laws such as the Web Content Accessibility Guidelines (WCAG) and the European Accessibility Act (EAA). Specifically, it supports:

  • Perceivability: Helps users perceive content regardless of visual or cognitive ability.
  • Operability: Offers alternative methods of accessing content for those who struggle with manual input or screen reading.
  • Inclusivity: Makes digital services more usable for individuals with literacy challenges, second-language users, and aging populations.

Globally, over 2.2 billion people have some form of visual impairment (WHO, 2023). TTS makes information accessible to many of them.

Common applications of TTS in web accessibility

  • Screen readers: These tools convert everything on a web page – text, buttons, menus – into spoken content.
  • Accessible document readers: PDFs or Word docs with accessible formatting are read aloud using TTS tools.
  • Audio guidance for forms: Well-structured labels and instructions read via TTS can improve form usability.
  • Dynamic content alerts: ARIA live regions allow updates (like error messages) to be announced in real-time.

Best practices for TTS-friendly websites

  • Use semantic HTML: Structure your site with clear headings (<h1>–<h6>), paragraphs (<p>), and landmarks (<nav>, <main>, <footer>) to help TTS parse the content.
  • Label everything: Buttons, form fields, and links should all have proper aria-label, alt, or visible text.
  • Avoid auto-playing audio: It can interfere with screen readers and confuse users relying on TTS.
  • Ensure keyboard navigation: TTS users often rely on keyboard shortcuts – your site should support smooth tabbing and focus.

Tip: Use tools like Lighthouse or axe DevTools to test how TTS interacts with your site.

Applications of TTS in education and the workplace

TTS technology has moved far beyond its original use cases and now plays a pivotal role in enabling access to information in both educational and professional settings. Its flexible, multimodal delivery of content can boost inclusion, productivity, and learning outcomes for a broad range of users.

Education: Leveling the learning field

In classrooms and remote learning environments, TTS can:

  • Support learners with reading or visual impairments by reading assignments, textbooks, and test instructions aloud.
  • Help with comprehension for students who struggle with decoding written text – especially useful for learners with dyslexia, ADHD, or ESL (English as a second language) backgrounds.
  • Encourage independent study by allowing students to listen to notes, handouts, and digital materials at their own pace.
  • Reinforce auditory learning styles, helping students who absorb information better when it’s spoken rather than read.

Example: A student with dyslexia may use TTS to review homework instructions while following along with the text visually, increasing understanding and retention.

The workplace: supporting focus and productivity

TTS tools have also found their place in the modern workplace, especially as organizations move toward more inclusive digital environments. 

In this context, TTS can:

  • Enable accessibility compliance in internal communications, training modules, and HR systems.
  • Assist neurodivergent employees who may find spoken instructions easier to follow than dense documentation.
  • Reduce cognitive load by allowing employees to “read” long reports or policy documents while multitasking.
  • Facilitate productivity on the go, making it easier to absorb content during commutes or while completing manual tasks.

TTS is particularly valuable in hybrid or remote work settings, where digital content needs to be as inclusive and flexible as possible.

By integrating TTS features into their learning platforms and workplace tools, organizations create more equitable experiences and help people thrive – regardless of ability or preferred learning mode.

The challenges and limitations of TTS technology

While TTS technology offers immense benefits for accessibility and inclusion, it’s not without limitations. Understanding these challenges is essential for optimizing content and setting realistic expectations for users and implementers.

1. Lack of human-like nuance

Even the most advanced TTS engines can struggle to replicate the intonation, emotion, and rhythm of human speech. This can make the output sound robotic or monotonous, especially in long-form content or emotionally charged material.

  • Impact: May reduce engagement or make it harder for users to interpret tone or emphasis.
  • Mitigation: Choose TTS tools with natural-sounding voices and support for SSML (Speech Synthesis Markup Language) to control pitch, pauses, and pronunciation.

2. Contextual misinterpretation

TTS systems may mispronounce homographs (e.g., “lead” the verb vs. “lead” the metal), acronyms, or unusual proper nouns, especially without context clues or phonetic guidance.

  • Impact: Could lead to confusion or misinformation.
  • Mitigation: Use SSML or pronunciation guides in structured content when needed, and test outputs before publishing.

3. Language and dialect limitations

Although TTS supports an increasing number of languages and accents, coverage can still be limited for:

  • Minority or regional languages
  • Non-standard dialects
  • Multilingual documents or websites
  • Impact: May exclude users who speak less-common languages or rely on mixed-language content.
  • Mitigation: Choose multilingual TTS providers and make sure fallback content or translations are available.

4. Compatibility and integration gaps

Not all websites, apps, or documents are designed with TTS users in mind. Poor semantic structure, missing alt text, or inaccessible navigation can reduce the effectiveness of TTS tools, even if the tools themselves are robust.

  • Impact: Frustrating user experience, particularly for screen reader users.
  • Mitigation: Apply accessible development practices, use semantic HTML, and test TTS compatibility across platforms.

5. Privacy and data security concerns

Some cloud-based TTS tools may require sending user input or personal data to third-party servers for processing.

  • Impact: May raise compliance concerns under privacy regulations like GDPR.
  • Mitigation: Select TTS solutions with transparent privacy policies and on-device processing options where necessary.

Creating TTS-friendly content is not just about choosing the right tool – it’s about understanding the experience from the user’s perspective and minimizing friction at every touchpoint.

Final thoughts

Text-to-speech assistive technology is a powerful tool for promoting accessibility, inclusion, and digital equality. But it only works when paired with thoughtful content and accessible design practices. Whether you’re a developer, content creator, educator, or product leader, taking steps to make your content TTS-friendly can open digital doors for countless users.

By adopting inclusive content strategies, testing with real users, and selecting TTS-compatible platforms, you help make sure that everyone – regardless of ability – can engage with your content fully and independently.

The post Creating content for everyone: A guide to Text-to-Speech assistive technology appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Color contrast accessibility: What it is and how to get it right https://www.iubenda.com/en/help/183562-color-contrast-accessibility/ Thu, 19 Jun 2025 15:33:09 +0000 https://help.iubenda.com/?p=183562 Ever squinted at light gray text on a white background? Or struggled to read a button in bright sunlight?  That’s the problem of poor color contrast in action.  Color is a beautiful thing, with a whole spectrum to pick from – but for millions of people with visual impairments, that same rainbow can be a […]

The post Color contrast accessibility: What it is and how to get it right appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Ever squinted at light gray text on a white background? Or struggled to read a button in bright sunlight? 

That’s the problem of poor color contrast in action. 

Color is a beautiful thing, with a whole spectrum to pick from – but for millions of people with visual impairments, that same rainbow can be a daily barrier. 

Think of color contrast like the volume dial on your content’s clarity. Turn it down too low, and your message gets lost, especially for those with visual impairments. 

And yet, many websites still fall short, using color combos that make content hard to read or interact with.

In this guide, we’ll break down exactly what color contrast accessibility means, why it matters, and what changes you can make to your site to get it right. 

What is color contrast accessibility? 

Color contrast accessibility refers to using color combinations that provide sufficient contrast between text (or other foreground elements) and the background. 

It plays a big role in making digital content readable and accessible for everyone, especially those with visual impairments such as color blindness and low vision. Without having the right contrast, important content can become difficult, or even impossible in some cases, to read. 

Why does color contrast matter for accessibility?

Poor color contrast is one of the most common and overlooked accessibility issues in digital design.

When contrast isn’t balanced properly:

  • Users with color vision impairments may not be able to distinguish text or interface elements
  • People with low vision may struggle to read small or light text
  • Mobile users in bright environments may have trouble seeing content 

By addressing color contrast issues, designers can make a big difference and significantly improve the usability and inclusiveness of websites and applications. 

Who benefits from proper color contrast?

Improving color contrast isn’t just a simple matter of meeting legal requirements, although that is important. It’s also about being able to improve the user experience for a wide range of people, including:

  • Users with visual impairments (color blindness, cataracts, glaucoma, etc.) 
  • Older users with age-related vision changes
  • Mobile users viewing content in sunlight
  • Anyone experiencing fatigue or distraction 

Accessible color contrasts benefit everyone. They make content clear, easier to engage with, help widen your audience, but also, things just look better, and what’s not to like about that?

WCAG guidelines for color contrast

 The Web Content Accessibility Guidelines (WCAG) provide clear guidelines for color contrast accessibility. 

They state:

  • Minimum contrast ratio: Text and background color combinations must have a contrast ratio of at least 4.5:1
  • Large text: For 18pt or 14pt bold, the minimum contrast ratio is 3:1
  • UI elements and graphical objects: These should have a contrast ratio of 3:1 against adjacent colors 

By following this criteria, you can make sure all of your site users can see content clearly, no matter their visual ability. 

Common color contrast issues and their impact

Even when teams are fully clued into contrast issues and have good intentions, issues can still slip through the cracks – especially during the rush of product development or visual branding. 

Understanding the most common pitfalls can help you catch them early and build more inclusive designs from the ground up. 

Typical issues can include:

  • Light gray text on white backgrounds
  • Low contrast buttons and links
  • Using color alone to convey information (e.g., red for errors)

These common, yet avoidable mistakes can lead to things such as:

  • Increased user frustration
  • Higher bounce rates
  • Legal compliance risks 

Best practices for designing with accessible color contrast

Good design is about aesthetics, of course. But it’s also about function and inclusion.

When it comes to color contrast, a few intentional choices can go a long way toward making your content readable for everyone. 

Here’s how to build accessibility into your design right from the start: 

  • Use high-contrast color combinations: Dark text on a light background or vice versa
  • Avoid relying solely on color to communicate: Use icons, labels, or underlines for clarity
  • Test your palette early: Check contrast ratios before finalizing your design elements
  • Be mindful of branding colors: Adjust shades if necessary to meet contrast requirements 

Top color contrast checkers and testing tools

Designing with accessibility in mind should never be about guesswork.

There are a number of different tools that take any mystery out of contrast compliance, giving you clear feedback and actionable suggestions.

Here are a few helpful tools you can use to test and improve your color contrast: 

How to fix poor color contrast in websites and apps

Spotted a contrast issue? Not to worry, they’re usually a quick fix. 

Whether you’re updating a single button or reworking your entire color scheme, these steps will help you bring your contrast up to standard. 

If your audit reveals issues:

  • Adjust foreground or background colors to meet the required ratio
  • Use semi-transparent overlays or shading to improve contrast
  • Reconsider font size and weight for better legibility
  • Use automated tools to retest and validate changes

Beyond usability, color contrast has legal weight. As accessibility regulations tighten worldwide, making sure you have compliant contrast ratios is essential, not optional.

Several global laws and standards emphasize color contrast as a key part of accessibility:

  • ADA (US): Enforced under Title III for public digital spaces
  • WCAG: Internationally recognized technical standard
  • EAA (EU): Requires accessibility for many digital services by 2025

Non-compliance may lead to lawsuits, fines, or reputational damage. 

Color contrast makes or breaks accessibility

Color contrast accessibility plays a huge role in shaping an inclusive and legally sound experience of an inclusive and legally compliant digital experience. 

By understanding the rules, testing your content, and applying thoughtful design practices, you can make your site more readable, more user-friendly, and more future-proof.

Need help getting started?

Explore Accessibility Widget to help you detect and resolve contrast issues across your site.

Frequently asked questions

1. What is a good color contrast ratio?

According to WCAG guidelines, a contrast ratio of 4.5:1 is required for normal text, and 3:1 for large text (18pt or 14pt bold).

2. How do I check if my color contrast is accessible?

Use tools like the WebAIM Contrast Checker to test contrast ratios between text and background colors.

3. What are common color contrast mistakes?

Using light grey text on white backgrounds, low-contrast buttons, or relying only on color to convey meaning.

4. Do I need to meet color contrast requirements to be WCAG compliant?

Yes. Meeting minimum contrast ratios is a core requirement for WCAG 2.1 compliance.

5. Does color contrast affect users who aren’t visually impaired?

Yes. Poor contrast can affect readability in bright light, on mobile devices, or for users with temporary vision issues.

6. Can branding colors be used and still be accessible?

Yes, but you may need to adjust shades or pair them with high-contrast elements to meet accessibility standards.

7. What’s the difference between AA and AAA contrast requirements?

AA is the standard level required by most laws, while AAA is more stringent, requiring a 7:1 ratio for normal text.

8. Are contrast issues only about text?

No. Icons, buttons, and interactive elements also need adequate contrast against their backgrounds.

9. What happens if my site fails a color contrast check?

You may face usability issues, increased bounce rates, or legal risks depending on your jurisdiction.

The post Color contrast accessibility: What it is and how to get it right appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Most accessible fonts: How to choose typography that supports inclusion https://www.iubenda.com/en/help/182497-most-accessible-fonts/ Thu, 05 Jun 2025 16:01:00 +0000 https://help.iubenda.com/?p=182497 Fonts are just fonts. Sure, they look nice, but there’s nothing all that special or important about them, right? Think again.  There is far more behind fonts than a simple matter of typography.  They have the power to make content fun or serious, playful or straight-laced; they give hints as to what the reader can […]

The post Most accessible fonts: How to choose typography that supports inclusion appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

]]>
Fonts are just fonts.

Sure, they look nice, but there’s nothing all that special or important about them, right?

Think again. 

There is far more behind fonts than a simple matter of typography. 

They have the power to make content fun or serious, playful or straight-laced; they give hints as to what the reader can expect next, like a helpful guidebook, a friendly voice, or a clearly marked path. 

But they can also do the opposite. 

For users with visual impairments, dyslexia, or cognitive challenges, the wrong typeface can turn simple letters and numbers into impenetrable barriers. 

In this guide, we’ll take a look at why fonts matter, how to choose the most accessible fonts, and how to implement them effectively in your digital content. 

Why font choice matters for accessibility

Choosing the right font isn’t just a matter of aesthetics; it’s also about being inclusive. 

Fonts can influence how easily content is perceived, understood, and navigated – and when chosen thoughtfully, typography supports accessibility for people with diverse needs. 

Typography affects legibility, comprehension, and fatigue. So when you choose an inaccessible font, you can create significant barriers to understanding – even when the content itself is well written and accessible. 

Here’s why it matters: 

  • Legibility and comprehension: The right font reduces eye strain and supports faster reading.
  • Neurodiverse needs: Font style can help or hinder users with low vision, dyslexia, ADHD, and other neurodivergent conditions.
  • Legal alignment: Typography plays a role in meeting WCAG’s readability and perceivability standards. 

💡 But remember, accessibility isn’t just about contrast ratios. Learn how to design for everyone with iubenda’s Accessibility Widget

    Key characteristics of an accessible font

    So what actually makes a font accessible?

    While aesthetic preferences vary, certain characteristics consistently enhance the readability for all users. These traits reduce cognitive strain and help prevent misreading:

    • Simple, open letterforms: Avoid overly ornate styles that make characters hard to distinguish. 
    • Large x-height: Taller lowercase letters improve legibility, especially at smaller sizes. 
    • Generous character spacing: This helps prevent letters from blending into one another, especially in longer passages. 
    • Clear distinction between similar shapes: Characters like “l, I, and 1” or “o, O, and 0” should look noticeably different. 
    • Minimal decoration or compression: Fonts that are too stylized or condensed reduce readability, especially when being viewed on a mobile device like a phone or iPad. 

    Sans-serif vs. serif fonts: which is more accessible?

    There’s an ongoing debate in the design world about serif vs. sans-serif fonts. But when it comes to accessibility, one type generally comes out on top.

    Sans-serif fonts like Arial or Helvetica are generally easier to read on screens.

    Serif fonts can work in print or headings, but may reduce legibility for users with dyslexia or low vision.

    So the verdict? 

    Sans-serif is the best choice for body text. You can still use serif, but sparingly – and make sure you test thoroughly.

    Most accessible fonts for readability

    Certain fonts are widely recognized for their clarity and readability. They’re frequently used in inclusive design because they work well across devices and are familiar to users.

    • Arial: Clean and common
    • Verdana: Wider spacing, large x-height
    • Tahoma: Legible on screens
    • Trebuchet MS: Open, rounded characters
    • Helvetica: Widely used, but tighter spacing may require adjustments
    • Roboto: Modern sans-serif with good readability

    A good tip is to test font rendering across devices, as some system fonts vary in performance. 

    Best fonts for dyslexia and cognitive accessibility

    For users with dyslexia and other cognitive conditions, specially designed fonts can make a big difference. They can improve comprehension and reduce frustration, vastly improving their experience with your site. 

    These typefaces use unique visual cues to make each letter more distinct.

    • OpenDyslexic: Specially designed to reduce letter confusion
    • Lexend: Reduces visual stress and improves reading speed
    • Atkinson Hyperlegible: Designed by Braille Institute with clear differentiation
    • Read Regular: Tailored to dyslexic readers

    These fonts use visual strategies like heavier bottoms, wider spacing, and unique shapes to reduce people’s cognitive load and make everything much easier to understand. 

    Font size, spacing, and line height: How they affect accessibility

    Typography is also about how you present your typefaces – with key aspects like size, spacing, and formatting all influencing readability. 

    Here’s how to get it right:

    • Minimum font size for accessibility: WCAG recommends at least 16px for body text.
    • Line height: Use 1.5x line spacing for body text (as per WCAG 1.4.8).
    • Letter spacing: Aim for at least 0.12x the font size.
    • Word spacing: Target 0.16x the font size.

    It’s also a good idea to use relative units (em/rem) for flexibility and avoid fixed pixel sizes on responsive layouts.

    Fonts to avoid for accessibility

    Let’s be honest, some fonts just look great. Whether that’s in a brand deck, on a presentation, or across your site. 

    But the issue is that these can also seriously hinder readability online. 

    When accessibility is the goal, steer clear of these common culprits:

    • Cursive or script fonts: Hard to parse quickly
    • Condensed fonts: Reduce spacing and character distinction
    • Decorative/stylized fonts: Especially problematic for neurodivergent users
    • Comic Sans: Although sometimes recommended for dyslexia, it’s divisive, and it can be argued that it lacks professionalism
    ✅ How to test font accessibility on websites

    Not sure if your font choices are up to scratch? 

    Here’s how to assess them in a practical, user-focused way:

  • Automated tools: Use browser extensions like Accessibility Insights, WAVE, or axe DevTools to flag common issues quickly.
  • Responsive testing: Check how fonts render at different screen sizes and zoom levels to ensure consistency.
  • Visual evaluation: Combine font tests with contrast and scalability evaluations to check for readability and clarity.
  • User testing: Whenever possible, test with real users to uncover problems that tools might miss.
    • WCAG guidelines for typography and readability

      The Web Content Accessibility Guidelines (WCAG) include several checkpoints that relate directly to typography. 

      These help you make sure your content remains clear and readable in diverse contexts.

      • WCAG 2.2 Success Criterion 1.4.12 (Text Spacing)
      • 1.4.3 (Contrast), 1.4.4 (Resize Text), and 1.4.8 (Visual Presentation)
      • Emphasize: “No loss of content or functionality” when resized or reformatted

      You can take a look at the WCAG guidelines and the specific clauses above by visiting their website here

      Need help applying WCAG to your site?

      Discover how iubenda simplifies accessibility right here.

      Make accessible font choices part of your design DNA

      Even though it may not be the first thing to spring to mind, typography really does shape the reading experience. 

      By making smart, accessible choices – from font selection to spacing and formatting – you can create content that works for more people, more of the time.

      And when your content and site are more accessible, this doesn’t just benefit those with additional needs – it creates a more rounded, streamlined experience for everyone who visits your site. 

      Frequently asked questions about accessible fonts

      1. What makes a font accessible?

      An accessible font is designed to improve readability through clear letterforms, ample spacing, and high legibility across digital and print formats.

      2. Are sans-serif fonts better for accessibility?

      Generally speaking, yes. Sans-serif fonts are easier to read on screens due to their clean, simple shapes.

      3. What’s the best font for dyslexia?

      Fonts like OpenDyslexic, Lexend, and Atkinson Hyperlegible are specifically designed to support dyslexic readers.

      4. What is the WCAG minimum font size for accessibility?

      At least 16px for body text is recommended to meet accessibility guidelines.

      5. How can I test if a font is accessible?

      Use tools like WAVE or axe DevTools and perform user testing with people who have diverse needs.

      6. Is Comic Sans really good for dyslexia?

      Some say yes due to its uneven shapes, but it’s also polarizing and often considered unprofessional.

      7. What fonts should I avoid if I want to be accessible?

      Avoid cursive, decorative, and condensed fonts that reduce legibility.

      8. Can font choice affect cognitive load?

      Absolutely. Clear, consistent fonts reduce cognitive strain and make reading easier.

      9. Do accessible fonts work across all browsers and devices?

      Most web-safe fonts do. Be sure to test font rendering across different platforms.

      10. How can iubenda help with font accessibility?

      iubenda’s Accessibility Widget can help you fix the most common accessibility issues in just minutes.

      The post Most accessible fonts: How to choose typography that supports inclusion appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      A guide to digital inclusion: Breaking barriers in the digital age https://www.iubenda.com/en/help/182488-digital-inclusion/ Thu, 05 Jun 2025 14:43:35 +0000 https://help.iubenda.com/?p=182488 Being digitally connected isn’t a luxury; it’s a lifeline. Everything from education to healthcare, banking, shopping, and government services is online, but millions of people are still being left behind. Digital inclusion means making sure that everyone, regardless of income, location, age, ability, or literacy, can access and use digital technologies effectively.  It’s about equity. […]

      The post A guide to digital inclusion: Breaking barriers in the digital age appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Being digitally connected isn’t a luxury; it’s a lifeline.

      Everything from education to healthcare, banking, shopping, and government services is online, but millions of people are still being left behind.

      Digital inclusion means making sure that everyone, regardless of income, location, age, ability, or literacy, can access and use digital technologies effectively. 

      It’s about equity. It’s about empowerment. And in 2025, it’s more urgent than ever.

      According to the World Bank, nearly 3 billion people still don’t use the internet. Even among those who do, many face barriers due to inaccessible interfaces, lack of digital skills, or unreliable infrastructure. 

      The result? A growing digital divide that mirrors – and often magnifies – existing social and economic inequalities.

      Digital exclusion doesn’t just affect individuals. It limits participation in democracy, reduces workforce potential, and creates reputational and legal risks for organizations. As businesses and institutions digitize rapidly, they must make sure that progress doesn’t leave people behind.

      Fortunately, digital inclusion isn’t an abstract ideal – it’s something we can build through thoughtful design, policy, and technology. And web accessibility plays a foundational role in making it possible.

      This article will explore the key pillars of digital inclusion, the barriers people face, and what governments, businesses, and digital teams can do to promote a truly inclusive digital future.

      The key barriers to digital inclusion

      Despite growing awareness, digital inclusion remains out of reach for many. That’s because the barriers to full participation are not just technical – they’re social, economic, physical, and cultural. 

      Let’s take a look at some of the most common and persistent obstacles:

      1. Infrastructure and affordability

      • In many regions, broadband access is limited or prohibitively expensive.
      • Even in urban centers, some households can’t afford data plans, devices, or consistent electricity.
      • Rural and low-income communities are disproportionately affected by infrastructure gaps.

      2. Lack of digital skills

      • Access doesn’t guarantee capability. Millions struggle with basic tasks like creating passwords, navigating websites, or sending emails.
      • The digital skills gap is especially pronounced among older adults, people with lower literacy, and those with limited education.

      3. Accessibility barriers

      4. Language and literacy challenges

      • Digital content that is overly complex or not available in users’ native language can exclude large groups.
      • This particularly affects migrants, multilingual communities, and people with learning differences such as dyslexia.

      5. Cultural and motivational factors

      • Distrust in digital platforms, fear of online scams, or cultural stigma around technology can discourage participation.
      • Some people simply don’t see digital tools as relevant or safe.

      Solving digital inclusion requires addressing these barriers holistically, not just with tech, but through policy, education, design, and empathy.

      The role of accessibility in digital inclusion

      Digital inclusion and accessibility are deeply interconnected, but they’re not interchangeable.

      While digital inclusion is the broader concept of ensuring equitable participation in the digital world, accessibility focuses specifically on removing barriers for people with disabilities. It’s a crucial pillar of digital inclusion – and often the first step toward achieving it.

      ⚠ Why accessibility matters

      According to the World Health Organization, over 1.3 billion people worldwide live with a disability. That’s nearly 1 in 6 of us.

      If digital platforms aren’t accessible, vast segments of the population are immediately excluded from essential services and opportunities.

      Inaccessible websites, mobile apps, and documents can prevent users from:

    • Navigating interfaces using a keyboard
    • Understanding content due to poor color contrast or small fonts
    • Hearing audio content without captions or transcripts
    • Filling out forms that aren’t compatible with screen readers
    • WCAG: The accessibility foundation

      The Web Content Accessibility Guidelines (WCAG) provide a framework for designing inclusive digital experiences. 

      Their principles – Perceivable, Operable, Understandable, and Robust (POUR) – are used globally as a benchmark for accessibility compliance.

      Accessibility is the gateway

      By addressing accessibility, organizations automatically improve usability for all. Clear navigation, descriptive links, flexible layouts, and readable fonts benefit everyone – not just disabled users.

      In other words, you can’t have digital inclusion without accessibility. It’s the baseline for building digital experiences that respect and reflect human diversity.

      How governments and organizations promote digital inclusion

      Tackling digital exclusion is not the responsibility of one group alone. It takes collaboration between governments, non-profits, businesses, educators, and technologists to create an inclusive digital society.

      Here’s how different sectors are making progress:

      Government-led initiatives

      Many countries have launched national digital inclusion strategies focused on expanding access, improving digital skills, and ensuring accessibility. For example:

      • The European Union mandates accessibility through the European Accessibility Act (EAA), which requires many digital services to be accessible by 2025.
      • Local councils and municipalities often fund digital literacy training, especially for older adults and job seekers.

      Private sector contributions

      Forward-thinking companies are embedding digital inclusion into their products and services by:

      • Investing in accessible design from the ground up
      • Offering free or subsidized access to digital tools and connectivity (e.g., Google’s Chromebooks for Education or Microsoft’s Airband Initiative)
      • Partnering with non-profits to fund training programs for marginalized communities
      • Building internal diversity and inclusion teams to shape digital equity strategies

      Non-profits and community groups

      Organizations like the Digital Equity Foundation, AbilityNet, and Good Things Foundation play a key role in:

      • Delivering community-based tech support
      • Running inclusion-focused awareness campaigns
      • Advocating for inclusive policies and funding

      Ultimately, digital inclusion is a shared responsibility. Governments can create the regulatory foundation, but lasting change requires public-private cooperation and user-centered design.

      Best practices for improving digital inclusion

      Digital inclusion is not a one-time initiative; it’s a mindset embedded in design, delivery, and communication. The following best practices help ensure that your digital products and services are usable and beneficial to everyone.

      1. Design with accessibility from the start

      Embed accessibility and inclusive design principles into your development lifecycle rather than retrofitting later. Use semantic HTML, provide alt text, ensure keyboard navigability, and maintain strong color contrast.

      2. Simplify language and navigation

      Use plain language, intuitive layouts, and clear CTAs. Avoid jargon. A well-structured interface helps everyone, especially users with cognitive disabilities, low literacy, or language barriers.

      3. Test with diverse users

      Involve people from different backgrounds, age groups, and ability levels in user testing. Their feedback reveals friction points that homogenous testing often misses.

      4. Provide multiple ways to access content

      Offer alternatives: text transcripts for audio, video captions, and downloadable documents in accessible formats. This makes sure users can engage in the way that works best for them.

      5. Offer digital skills support

      Consider how you can provide or link to training and onboarding materials, especially for tools that may be new to your audience. A friendly FAQ or step-by-step guide can make a big difference.

      6. Regularly audit and update

      Use accessibility testing tools and perform regular reviews to make sure your content stays inclusive as your product evolves.

      By embracing these best practices, you build trust, loyalty, and compliance.

      The impact of assistive technology on digital inclusion

      Assistive technology (AT) plays a vital role in closing the digital divide for people with disabilities. By enabling access to digital content and services, these tools make inclusion not just possible, but practical.

      What is assistive technology?

      Assistive technology includes devices, software, and tools that help people with disabilities perform tasks they might otherwise find difficult or impossible. In the digital world, this can range from simple screen magnifiers to advanced speech-to-text systems.

      Common examples of digital assistive tech

      • Screen readers: Convert on-screen text into speech or braille for users with visual impairments.
      • Text-to-speech tools: Help users with dyslexia, ADHD, or low literacy access written content more easily.
      • Voice recognition software: Allows users to navigate and input text via speech instead of a keyboard.
      • Alternative input devices: Such as eye-tracking tools or adaptive switches for users with limited mobility.
      • Customizable interfaces: Options for resizing text, adjusting color contrast, or selecting dyslexia-friendly fonts.

      Why assistive tech matters

      Assistive technology empowers independence and participation in:

      • Education: Helping students access digital learning platforms
      • Employment: Enabling remote work and professional development
      • Healthcare: Supporting patients in managing telehealth or booking appointments
      • Civic life: Allowing individuals to vote, access government services, and connect with their communities

      When websites and digital tools are designed to work with assistive technology, everyone benefits.

      Digital inclusion in education and the workplace

      Access to digital tools and content is essential for learning, professional development, and career participation. However, digital exclusion continues to create inequality in both education and employment.

      Education: Learning without limits

      Digital education platforms are now standard in all settings, from K-12 classrooms to higher education and remote learning environments. But without inclusive design, these tools can unintentionally exclude students with disabilities or those from disadvantaged backgrounds.

      Common barriers include:

      • Learning portals that don’t work with screen readers
      • Videos without captions
      • Text-heavy content that isn’t readable for dyslexic learners

      Solutions:

      • Use accessible learning management systems (LMS)
      • Provide multi-format content (e.g., audio, video, transcripts)
      • Offer digital literacy training for students and educators alike

      Inclusion in education correlates with long-term academic success and employment outcomes, so it goes beyond ethics.

      The workplace: Inclusion as a competitive advantage

      Many jobs now rely on digital platforms, from recruitment and onboarding to daily collaboration and upskilling. Yet employees with disabilities often encounter inaccessible systems that hinder productivity and advancement.

      Examples:

      • Job applications incompatible with keyboard navigation
      • Training videos without subtitles
      • Intranet tools that lack accessibility controls

      Best practices:

      • Make sure HR platforms and digital tools meet WCAG standards
      • Provide assistive technology support and personalized accommodations
      • Make inclusive design a part of company culture and DEI strategy

      Digital inclusion in the workplace is about unlocking the full potential of a diverse workforce and attracting talent from all backgrounds.

      How businesses can support digital inclusion

      Businesses have a powerful role to play in shaping a digital world that works for everyone. Beyond compliance, digital inclusion is a strategic advantage – it opens access to broader markets, improves user experience, and strengthens brand trust.

      Here are key ways your organization can contribute:

      1. Audit your digital products

      Conduct a comprehensive accessibility audit across your websites, apps, and internal platforms. Identify barriers that could exclude users with disabilities, older adults, or individuals with limited digital literacy.

      2. Embed inclusive design in your development process

      Make inclusive design principles a default. Involve users with diverse needs during product research and usability testing. Use accessible fonts, meaningful link text, flexible layouts, and semantic code from the start.

      3. Educate your teams

      Invest in ongoing training for developers, content creators, and marketers on accessibility best practices and the importance of inclusive UX. Make this part of your DEI (diversity, equity, and inclusion) strategy.

      4. Support assistive technology compatibility

      Ensure your services work smoothly with screen readers, voice navigation tools, and keyboard-only browsing. Test with multiple devices and software types.

      5. Partner with purpose

      Work with organizations that promote digital inclusion – whether through sponsorships, open-source contributions, or employee volunteering. Use your reach to amplify awareness and action.

      6. Leverage compliance as a baseline, not a finish line

      Laws like the European Accessibility Act and ADA offer clear benchmarks, but true inclusion goes beyond checklists – so aim to meet user needs, not just legal minimums.

      Conclusion: Building a digitally inclusive future, together

      Digital inclusion is more than a policy or best practice; it’s a reflection of how we value equity, participation, and human potential in an increasingly digital world.

      By removing barriers, embracing inclusive design, supporting assistive technologies, and widening access to digital tools, we unlock opportunities for millions of people. It’s good for society, good for business, and essential for long-term growth.

      Whether you’re designing a website, building a platform, shaping policy, or leading a team, your role matters. Inclusion isn’t the responsibility of one department or one decision, it’s a commitment embedded across every touchpoint of the digital experience.

      Ready to take action?

      Explore how iubenda’s Accessibility Widget can support your digital inclusion goals by helping you meet key accessibility standards and deliver more inclusive experiences from the start.

      Together, we can close the digital divide – and create a more open, connected, and equitable world for all.

      The post A guide to digital inclusion: Breaking barriers in the digital age appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      How to make your website screen reader-friendly (and why it matters) https://www.iubenda.com/en/help/182473-screen-readers/ Wed, 04 Jun 2025 16:21:00 +0000 https://help.iubenda.com/?p=182473 Picture this.  You land on a website only to find that it all makes zero sense.   The content is unreadable, key functions are hidden, and you can’t make head nor tail of how to find what you’re looking for.  For millions of people who rely on screen readers, this isn’t a hypothetical situation – it’s […]

      The post How to make your website screen reader-friendly (and why it matters) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Picture this. 

      You land on a website only to find that it all makes zero sense.  

      The content is unreadable, key functions are hidden, and you can’t make head nor tail of how to find what you’re looking for. 

      For millions of people who rely on screen readers, this isn’t a hypothetical situation – it’s a daily digital experience.

      Screen readers are essential tools for digital accessibility. They convert on-screen content into synthesized speech or Braille, allowing people with visual impairments to navigate websites and applications with ease. 

      But in reality, many developers and designers lack a clear understanding of how these tools work and what makes a digital experience accessible

      It’s a knowledge gap that can unintentionally exclude people who rely on screen readers every day. 

      In this article, we break down what screen readers are, how they function, who uses them, and how sites can be designed inclusively – with a few technical tips and practical examples thrown in. 

      What are screen readers?

      First things first, what exactly are screen readers?

      Essentially, they’re assistive technologies that read digital content aloud or translate it into Braille. 

      They help users navigate content using a keyboard or input methods other than a typical mouse. Screen readers rely on the structure and semantics of HTML code to make sense of web content. 

      How do screen readers work?

      Screen readers work by building an “accessibility tree,” which is a simplified version of the webpage’s underlying structure (called the DOM, or Document Object Model). 

      This “tree” picks up on meaningful elements in the code, like headings, labels, and ARIA (Accessible Rich Internet Applications) attributes – all of which help users make sense of the content. 

      Here’s an example.

      If the code for a button was written as:

      <button aria-label=“Submit form”>Submit</button>

      A screen reader will announce it as “Submit form button.” 

      It’ll also give navigation shortcuts to move through headings, landmarks, links, and form fields. That’s why proper markup and labeling are crucial for easy navigation. 

      Who uses screen readers?

      Screen readers are mostly used by people with:

      • Full visual impairment
      • Low vision
      • Cognitive or learning disabilities
      • Temporary visual impairment (e.g., recovering from eye surgery)

      Users often pair screen readers with keyboard navigation, screen magnifiers, or Braille displays. 

      With several screen readers available across different platforms, it helps to understand which ones are the most commonly used and how they differ. 

      Here are some of the most widely used screen readers: 

      Screen reader Platform Cost Notes
      JAWS Windows Paid Feature-rich, enterprise-friendly
      NVDA Windows Free Open-source, developer-friendly
      VoiceOver macOS/iOS Built-in Default on Apple devices
      TalkBack Android Built-in Default on Android devices

      Screen readers by platform

      Screen readers are built to work across different operating systems, and each platform comes with its own set of tools, features, and user expectations. 

      If you’re designing for inclusivity, it’s important to know what screen readers are available on each system and how they differ from each other. 

      • Windows: JAWS and NVDA dominate this space. NVDA is often favored by developers thanks to its open-source nature. 
      • macOS/iOS: VoiceOver is built in and fully integrated with Apple hardware, so it’s the go-to option. 
      • Android: TalkBack offers accessibility support across Android apps and devices, so again, it’s the go-to option for Android users. 

      Each system has its own keyboard shortcuts and navigation paradigms, so testing across platforms is always a good idea. 

      How screen readers improve digital accessibility

      Screen readers are a bridge between visual interfaces and non-visual experiences. 

      They support accessibility in several key ways: 

      • Access to information: They give millions of users access to web content they wouldn’t otherwise be able to enjoy
      • Better code structure: They encourage better semantic markup, which benefits SEO
      • Legal compliance: They help websites meet accessibility laws like the ADA and the European Accessibility Act

      💡 Compliance and usability go hand-in-hand. See how iubenda’s Accessibility Widget can help.

      Common challenges screen reader users face

      Despite all the best intentions, many digital experiences still fall short when it comes to accessibility. 

      Screen reader users often face a range of barriers that make navigation frustrating, or in some extreme cases, impossible. 

      Some common challenges include:

      • Poor heading structure: Skipping heading levels or not using them properly
      • Missing alt text: Non-descriptive or absent alt attributes on images
      • Inaccessible forms: Forms that don’t include visible labels or instructions can confuse screen reader users who rely on auditory cues to complete fields
      • Dynamic content: When content updates (like notifications or form results) aren’t announced, users may miss important information
      • Misused ARIA roles: Applying ARIA roles incorrectly can interfere with how content is interpreted, leading to disorientation or errors

      Best practices for screen reader-friendly websites

      Designing for screen reader accessibility doesn’t have to be complicated – but it does require intentional choices. 

      Here are some practical ways to make your website more usable for screen reader users:

      • Use semantic HTML (e.g., <nav>, <main>, <button>, <label>)
      • Write descriptive alt attributes for images
      • Label all form inputs with <label> or aria-label
      • Use heading tags in a logical order
      • Provide keyboard navigation and focus styles
      • Avoid using visual cues alone (e.g., “Click the red button”)
      • Use meaningful link text (e.g., avoid “Click here”)
      Here’s an example of what an accessible form markup might look like:

      <label for=”email”>Email address</label>

      <input type=”email” id=”email” name=”email” />

      How to test your website for screen reader compatibility

      Testing is always an important step in any accessibility effort. 

      Luckily, there are a number of different tools and techniques you can use to help you evaluate how well your site works with screen readers. 

      • Stress-test with screen readers: Use popular readers like VoiceOver, NVDA, or TalkBack as a good barometer to test your interface
      • Browser tools: Use tools like Lighthouse to audit your site’s accessibility directly in the browser, giving you quick, actionable feedback
      • Extensions: Add-ons like axe DevTools and WAVE can help pinpoint specific code-level issues affecting screen reader compatibility
      • Real user testing: The most accurate and meaningful way to test your accessibility is by observing real users interacting with your site using their preferred screen readers

      Screen reader accessibility matters

      As with any accessibility improvements, creating screen reader-friendly experiences isn’t just a box-ticking exercise. 

      Not only does it help with your site’s SEO and keep your site compliant with evolving laws and expectations, it makes the web a more inclusive and welcoming place for everyone. 

      By understanding how screen readers work and taking simple, thoughtful steps in your design and development process, you can help remove barriers that stand in the way of equal access. 

      So start with small improvements, keep testing, and make accessibility a standard part of your workflow.

      Frequently Asked Questions

      1. What is a screen reader?

      A screen reader is software that reads digital text aloud or converts it to Braille, enabling non-visual access to content

      2. Who benefits from screen readers?

      People with full visual impairment or low vision, individuals with cognitive impairments, and those with temporary visual issues.

      3. Are screen readers only for websites?

      No. They are also used in mobile apps, documents, software interfaces, and operating systems.

      4. Do all websites work with screen readers

      Not by default. Websites must be designed and coded with accessibility in mind.

      5. How do I make my site compatible with screen readers?

      Use semantic HTML, label elements properly, provide alt text, and follow accessibility guidelines. Tools like iubenda’s Accessibility Widget can help you get started with most of these improvements.

      6. What are ARIA roles?

      ARIA (Accessible Rich Internet Applications) roles enhance accessibility by providing additional context, especially for dynamic content.

      7. How can I test for screen reader compatibility?

      Try screen readers like NVDA or VoiceOver, use browser audit tools, and run real user testing.

      8. What is the most popular screen reader

      According to WebAIM, JAWS, NVDA, and VoiceOver are the most commonly used.

      9. Can I use automated tools to fix accessibility issues?

      They can help detect issues, but manual testing and proper coding practices are essential.

      10. Where can I learn more?

      Visit iubenda’s Accessibility Widget for more resources and tools.

      The post How to make your website screen reader-friendly (and why it matters) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      What are the Web Content Accessibility Guidelines – and how do you meet them? https://www.iubenda.com/en/help/182466-web-content-accessibility-guidelines/ Wed, 04 Jun 2025 14:50:29 +0000 https://help.iubenda.com/?p=182466 Making your digital content accessible to everyone isn’t just good UX, it’s a legal and ethical imperative.  For organizations looking to improve digital inclusion, the Web Content Accessibility Guidelines (WCAG) are the global standard. But despite their importance, many teams find WCAG intimidating and hard to apply in real-world projects. WCAG provides the framework used […]

      The post What are the Web Content Accessibility Guidelines – and how do you meet them? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Making your digital content accessible to everyone isn’t just good UX, it’s a legal and ethical imperative. 

      For organizations looking to improve digital inclusion, the Web Content Accessibility Guidelines (WCAG) are the global standard. But despite their importance, many teams find WCAG intimidating and hard to apply in real-world projects.

      WCAG provides the framework used by most digital accessibility laws worldwide, including the Americans with Disabilities Act (ADA) and the European Accessibility Act (EAA). Whether you’re building a new site or auditing existing content, WCAG is likely the compliance benchmark you’ll need to meet.

      Don’t worry, we’ve got you covered – this article will walk you through the essentials:

      • What WCAG is and why it matters
      • How it’s structured (versions, levels, and principles)
      • Common challenges and how to overcome them
      • Practical steps and tools to help you get started

      This guide will help you make sense of WCAG and begin implementing it with confidence.

      What are the Web Content Accessibility Guidelines (WCAG)?

      The Web Content Accessibility Guidelines are internationally recognized standards for making digital content accessible to people with disabilities. Developed by the World Wide Web Consortium (W3C) through its Web Accessibility Initiative (WAI), WCAG provides a comprehensive set of guidelines that apply to websites, mobile apps, digital documents, and other online services.

      The goal of WCAG is simple: to make content perceivable, operable, understandable, and robust for all users. Especially those with visual, auditory, motor, or cognitive impairments. 

      These guidelines are not just best practices, they’re the foundation for most global digital accessibility laws.

      If your organization is subject to regulations like the ADA (in the U.S.), Section 508, or the European Accessibility Act (EAA), WCAG is likely the standard you need to follow. Most laws specifically reference WCAG 2.1 Level AA as the minimum threshold for compliance.

      Importantly, WCAG is technology-neutral. It doesn’t tell you how to code, it tells you what the outcome should be. So, it can be applied across platforms, devices, and development frameworks.

      Why WCAG matters for web accessibility

      The WCAG matters because it helps make the internet usable by everyone. For the 1.3+ billion people worldwide who live with a disability (WHO, 2023), WCAG compliance can mean the difference between accessing services, or being excluded from them entirely.

      But WCAG doesn’t just benefit users. It also helps businesses:

      Get on the road to compliance

      Most digital accessibility laws, including the ADA (U.S.), Section 508 (U.S. federal agencies), and the European Accessibility Act, use WCAG as their technical benchmark. Failing to comply can lead to lawsuits, fines, or being excluded from public-sector contracts.

      Improve user experience for all

      Clear navigation, descriptive links, readable text, and alternative formats aren’t just useful for users with disabilities; they benefit everyone. Inclusive UX often leads to fewer errors, longer sessions, and better conversions.

      Boost SEO and discoverability

      WCAG-aligned content tends to follow best practices like semantic HTML, alt text for images, and clean heading structures – all of which are also favored by search engines.

      Build trust and brand reputation

      Meeting WCAG shows that your organization cares about equity, ethics, and user well-being – values that increasingly influence customer decisions.

      WCAG versions: Understanding 2.0, 2.1, and 2.2

      The WCAG has evolved over time to keep pace with how we use technology. While the core principles have remained the same, each version of WCAG introduces new success criteria to address emerging accessibility needs – especially for mobile, cognitive, and low-vision users.

      WCAG 2.0 (Published 2008)

      This foundational version introduced the POUR framework and the concept of three conformance levels (A, AA, AAA). It remains the legal standard in some regions, but is now largely superseded.

      WCAG 2.1 (Published 2018)

      WCAG 2.1 added 17 new success criteria to better address mobile accessibility, touch interactions, zooming/scaling, and additional support for people with cognitive and vision-related disabilities.

      Most accessibility laws – including the EAA and ADA – now refer to WCAG 2.1 Level AA as the compliance benchmark.

      WCAG 2.2 (Published 2023)

      The latest version builds on 2.1 with nine new success criteria focused on navigation, input help, and cognitive support (e.g., clear focus indicators, accessible authentication).

      What about WCAG 3.0?

      WCAG 3.0 is under development and will represent a major shift – but it’s not a current requirement. Stick with 2.1 Level AA for now unless your jurisdiction mandates 2.2.

      The four principles of WCAG (POUR)

      At the heart of the WCAG are four foundational principles. These principles – Perceivable, Operable, Understandable, and Robust (POUR) – ensure that content is accessible across a wide spectrum of user needs and technologies.

      Perceivable

      Users must be able to detect and interpret content using one or more senses.

      Examples:

      • Provide alt text for images so screen readers can describe them
      • Use captions and transcripts for video and audio content
      • Ensure sufficient color contrast between text and backgrounds
      • Avoid relying solely on color to convey meaning

      Operable

      Users must be able to navigate and interact with all interface elements.

      Examples:

      • Enable full keyboard navigation for users who don’t use a mouse
      • Use visible focus indicators to show where the cursor is
      • Avoid keyboard traps (i.e., where a user gets stuck on an element)
      • Give users enough time to complete actions

      Understandable

      Users must be able to comprehend the information and how to interact with the interface.

      Examples:

      Robust

      Content must be compatible with a range of devices and assistive technologies.

      Examples:

      • Use semantic HTML and ARIA roles correctly
      • Ensure content works across browsers, devices, and screen readers
      • Validate code for accessibility and responsiveness

      POUR gives teams a structured way to think about accessibility – and a flexible framework to guide implementation.

      POUR gives teams a structured way to think about accessibility – and a flexible framework to guide implementation.

      WCAG conformance levels: A, AA, and AAA explained

      WCAG defines three levels of conformance – A, AA, and AAA – which represent increasing levels of accessibility. These levels help organizations prioritize and plan their accessibility efforts.

      Level A – Minimum accessibility

      This is the baseline. Meeting Level A means your content avoids major blockers that would completely prevent some users from accessing it.

      Examples:

      • Alt text on images
      • Keyboard navigation
      • Avoiding flashing content that could trigger seizures

      Level A is essential, but it doesn’t ensure a usable experience for many users.

      Level AA – Legal and practical standard

      Level AA includes all Level A requirements, plus additional criteria that address color contrast, form errors, navigation consistency, and more.

      Examples:

      • Minimum 4.5:1 color contrast for text
      • Descriptive link text
      • Visible focus states for interactive elements
      • Error suggestions for form inputs

      Most accessibility laws, including the ADA and EAA, require WCAG 2.1 Level AA as the minimum compliance level.

      Level AAA – Maximum accessibility

      Level AAA includes the most advanced criteria, such as:

      • Live sign language interpretation for media
      • 7:1 contrast for all text
      • Context-sensitive help throughout

      It’s not always practical to meet every AAA guideline, but teams can adopt specific AAA techniques where feasible – especially for critical content.

      Key WCAG guidelines every website should follow

      While WCAG includes dozens of success criteria, some guidelines consistently have the most immediate impact on accessibility and user experience. If you’re working toward WCAG 2.1 Level AA compliance, these are the areas to prioritize:

      Provide alt text for images

      Every meaningful image should include a descriptive alt attribute so screen readers can convey the content to users who are blind or have low vision. Decorative images should use empty alt text to avoid cluttering the user experience.

      Ensure sufficient color contrast

      Text must have a contrast ratio of at least 4.5:1 against its background. This ensures readability for users with visual impairments or color blindness.

      Support full keyboard navigation

      All interactive elements – like menus, buttons, and forms – must be accessible using only a keyboard. Avoid traps and make sure focus indicators are clearly visible.

      Make links and buttons descriptive

      Avoid vague link text like “click here.” Instead, describe the destination or action – e.g., “Download the report.”

      Provide clear form instructions and error messages

      Forms must include labels, input instructions, and accessible feedback for errors or required fields.

      Common barriers to WCAG compliance

      Implementing WCAG can feel overwhelming – especially for teams juggling multiple priorities, legacy systems, and tight timelines. Here are some of the most common obstacles organizations face and how to navigate them:

      Legacy code and outdated CMS templates

      Older websites often lack semantic HTML or keyboard-friendly components, making retrofitting for accessibility difficult.

      Solution: Start by auditing high-impact pages (e.g., homepage, checkout, forms) and incrementally refactor components using WCAG-aligned design patterns.

      Lack of in-house expertise

      Not every team has an accessibility specialist or frontend developer familiar with WCAG.

      Solution: Use trusted tools, training materials, and accessibility libraries. Consider engaging accessibility consultants or using tools like iubenda’s Accessibility Widget for a fast start.

      Misinterpreting WCAG language

      WCAG documentation can be technical and dense, especially for non-developers.

      Solution: Focus on user impact over legal wording. Many success criteria boil down to good UX: clarity, consistency, and flexibility.

      Siloed ownership across teams

      Design, content, and development often work in isolation – making accessibility harder to coordinate.

      Solution: Make accessibility a shared responsibility. Bake it into your design systems, QA processes, and product KPIs.

      The path to compliance doesn’t have to be perfect, just proactive and ongoing.

      How to make your website WCAG compliant

      WCAG compliance doesn’t have to happen all at once. The most effective way to meet the guidelines is to take a phased, practical approach – starting with high-impact improvements and building toward long-term sustainability.

      Here’s a step-by-step strategy to help you get started:

      1. Run an accessibility audit

      Use a combination of automated tools (like WAVE, axe, or Lighthouse) and manual testing (keyboard navigation, screen reader checks, zoom/resizing) to identify barriers on your site.

      2. Prioritize what to fix

      Focus first on:

      • High-traffic or conversion-critical pages (e.g., forms, checkout, login)
      • Issues affecting core WCAG 2.1 Level AA criteria
      • Quick wins with high usability impact (e.g., contrast, alt text, link clarity)

      3. Implement accessibility enhancements

      Fix content and design issues directly where feasible. For broader support, consider using iubenda’s Accessibility Widget to implement scalable, standards-aligned improvements.

      4. Build accessibility into your workflow

      Make sure that new content, pages, and features are reviewed for accessibility as part of your design and dev process. Use inclusive design components, accessible patterns, and checklists in your design system.

      5. Review regularly

      Accessibility isn’t a one-time fix. Schedule periodic audits and stay updated as WCAG evolves – make it a recurring part of QA and governance.

      WCAG compliance is an ongoing journey – but each improvement brings you closer to a more inclusive and resilient product.

      Best tools for WCAG accessibility testing

      Testing is a crucial step in achieving and maintaining WCAG compliance. While no tool can catch every issue, the right combination of automated and manual methods can significantly reduce accessibility gaps.

      Here are some of the most trusted tools to help your team:

      Automated testing tools

      • WAVE (WebAIM) – Browser-based tool for checking contrast, structure, and ARIA issues
      • axe DevTools – Chrome/Firefox extension that flags WCAG violations and suggests fixes
      • Google Lighthouse – Built into Chrome DevTools; scores accessibility and performance
      • Siteimprove / Deque / Tenon – Enterprise-level automated testing and monitoring solutions

      Manual and assistive tech testing

      • NVDA (Windows) / VoiceOver (Mac) – Free screen readers for real-world interaction testing
      • Keyboard-only navigation – Tab through your site to test focus order and usability
      • Zoom and scaling – Ensure layout remains usable at 200% magnification or more
      • Color contrast checkers – Test color pairings for WCAG ratios (e.g., WebAIM, TPGi)

      Even small testing efforts can surface issues that make a major difference in usability, especially for people relying on assistive technologies.

      Make WCAG compliance part of your digital strategy

      WCAG is more than a set of technical requirements. It’s a roadmap to creating digital experiences that are inclusive, legally compliant, and genuinely user-friendly. Whether you’re building new products or auditing existing ones, aligning with WCAG 2.1 Level AA is a powerful way to reduce risk and improve reach.

      You don’t have to do it all at once. Focus on high-impact fixes, build accessibility into your workflows, and use the right tools to track your progress.

      The post What are the Web Content Accessibility Guidelines – and how do you meet them? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Inclusive design principles: How to build digital experiences that work for everyone https://www.iubenda.com/en/help/181591-inclusive-design/ Thu, 22 May 2025 15:59:11 +0000 https://help.iubenda.com/?p=181591 Digital products are often designed with a narrow definition of the “typical” user in mind – someone who is able-bodied, tech-savvy, and operates under ideal conditions.  But in the real world, users are far more diverse. They may have visual impairments, limited mobility, temporary injuries, low-bandwidth connections, aging-related challenges, or cognitive differences. When digital experiences […]

      The post Inclusive design principles: How to build digital experiences that work for everyone appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Digital products are often designed with a narrow definition of the “typical” user in mind – someone who is able-bodied, tech-savvy, and operates under ideal conditions. 

      But in the real world, users are far more diverse. They may have visual impairments, limited mobility, temporary injuries, low-bandwidth connections, aging-related challenges, or cognitive differences.

      When digital experiences aren’t built to reflect this diversity, the result is frustration, exclusion, and, of course, lost opportunity.

      Inclusive design is a methodology that challenges this status quo. It focuses on building products and services that are usable by the widest possible range of people, regardless of ability, context, or circumstance. 

      Essentially, inclusive design is proactive, not reactive. It goes beyond basic accessibility by embracing human variety as a core design driver.

      In this guide, we’ll explore what inclusive design really means, how it differs from accessibility, and how your organization can start putting it into practice, using proven principles, real-world examples, and actionable steps.

      What is inclusive design?

      Inclusive design is a design methodology that creates products and experiences that can be used by as many people as possible, regardless of circumstance, ability, background, or environment.

      It recognizes that human diversity is the norm – not the exception – and that good design must accommodate that diversity

      Rather than treating inclusion as an afterthought or a checkbox, inclusive design starts by identifying and addressing barriers that might exclude users. It’s about designing with a deep understanding of the full spectrum of human needs, from permanent disabilities to temporary limitations (like a broken arm or noisy environment) and situational constraints (like bright sunlight or using a device with one hand).

      Importantly, inclusive design isn’t just for people with disabilities; it benefits everyone. For example, captions help people with hearing impairments, but they’re also useful for watching videos in public spaces. And voice input aids users with mobility impairments, but is now mainstream in mobile UX.

      Why inclusive design matters

      Inclusive design isn’t just a feel-good initiative; it’s a critical strategy for building better digital products. When done well, it leads to improved usability, stronger brand trust, and broader market reach.

      It promotes equity and digital inclusion

      At a societal level, inclusive design helps make sure that people aren’t left behind due to disability, age, language, or context. It’s a way to reduce digital inequality, uphold human rights, and create fairer experiences for everyone.

      It expands your audience and customer base

      Globally, over 1.3 billion people live with some form of disability (WHO, 2023). Add to that users with temporary limitations, older adults, or low-tech environments – and the number of people who benefit from inclusive design grows exponentially.

      Designing for inclusivity doesn’t narrow your scope; it actually opens your product to more people, more use cases, and more markets.

      It improves UX for everyone

      When you reduce cognitive load, simplify interfaces, or clarify instructions, you’re not just helping edge-case users, you’re improving the experience for all. Inclusive products tend to be cleaner, more intuitive, and easier to use.

      It supports compliance and reduces legal risk

      Inclusive design principles often overlap with accessibility standards like WCAG, which are the foundation for laws like the European Accessibility Act and the ADA. Embedding inclusion into your design process can help you stay compliant and reduce risk.

      Inclusive design vs. accessibility: What’s the difference?

      Inclusive design and accessibility are closely related, but they’re not interchangeable.

      • Accessibility refers to technical standards and legal requirements that make sure people with disabilities can access digital content and services. These are often codified in frameworks like the Web Content Accessibility Guidelines (WCAG) and are essential for compliance with regulations such as the ADA or the European Accessibility Act.
      • Inclusive design, on the other hand, is a broader design philosophy. It starts earlier in the process and focuses on creating experiences that are usable by a wide range of people. It includes considerations like:
        • Language simplicity
        • Device and environmental constraints
        • Cultural context
        • Situational challenges (e.g., using one hand while holding a child)

      They work best together. Accessibility is a baseline. Inclusive design takes things further, ensuring your digital products are flexible, welcoming, and effective for the widest possible audience.

      Key principles of inclusive design

      Inclusive design is guided by a set of core principles that help teams build products that serve the full range of human diversity. These principles can be used as both a design lens and a decision-making framework, no matter the size of your team or product.

      Let’s take a look at the most widely recognized principles:

      1. Recognize exclusion

      Start by identifying who might be left out of your experience. Exclusion happens when we assume all users are the same, able-bodied, fluent in the product language, using modern hardware, or always online. Use empathy interviews, analytics, and testing to uncover pain points and edge cases.

      Example: Designing a sign-up form that assumes every user has a last name, excluding users from cultures where that’s not the norm.

      2. Solve for one, extend to many

      Designing for individuals with specific needs often benefits everyone. This principle flips the idea of “edge case” on its head by treating these cases as innovation drivers.

      Example: Voice input helps users with limited mobility, but also benefits users cooking, commuting, or multitasking.

      3. Learn from diversity

      Inclusive design teams actively seek input from people of different backgrounds, abilities, languages, and contexts. Feedback from diverse users results in better-informed, more effective design decisions.

      Example: When YouTube redesigned its mobile app, it included users with ADHD and dyslexia in testing. Their feedback highlighted how cluttered comment sections made it hard to focus.

      As a result, YouTube introduced a collapsible comment section and simplified the layout – changes that improved the experience for everyone, not just users with cognitive differences.

      4. Provide equivalent experience

      Users might interact with your product differently, but they should get the same core value.

      Example: A video should offer both captions and transcripts so users with hearing loss or slower internet can still access the content.

      5. Offer choice and control

      Give users options to personalize or adapt their experience based on preference or need.

      Example: Letting users adjust text size, toggle animation, or select dark mode.

      6. Prioritize clarity

      Use simple language, consistent layouts, and familiar interaction patterns to reduce cognitive load.

      Example: Clear error messages that explain what went wrong and how to fix it.

      Real-world examples of inclusive design in action

      Inclusive design isn’t theoretical, it’s already improving experiences for millions of people across industries. Here are a few standout examples of how organizations have embraced inclusive design in the real world:

      GOV.UK

      The UK government’s digital services platform is a model of clarity and accessibility:

      • Uses plain language that’s understandable by all reading levels
      • Consistent, keyboard-navigable layouts
      • Focus indicators and screen reader compatibility are built in
      • Content designed for mobile and low-bandwidth users

      This approach benefits not only users with disabilities but also non-native English speakers, older adults, and people with slow connections.

      Microsoft’s inclusive product development

      Microsoft’s inclusive design toolkit has shaped products like the Xbox Adaptive Controller, which was created with direct input from gamers with limited mobility.

      • Flexible inputs and accessible packaging
      • Usable by players with a range of physical abilities
      • Became a UX benchmark and brand differentiator

      Apple’s customizable UX

      Apple integrates inclusive features into the core of its products:

      • Dynamic text sizing and screen magnification
      • VoiceOver screen reader is built into every device
      • Background sounds and audio descriptions for better focus and comprehension

      These tools are beneficial to users with disabilities, and also useful to people who simply prefer different interaction styles.

      Airbnb’s inclusive onboarding

      • Image descriptions for listings
      • Language-localized support for a global user base
      • Inclusive filters for finding accessible accommodation

      These examples show that inclusive design isn’t just about compliance – it’s about creating products people love to use, regardless of their needs.

      How inclusive design improves user experience (UX)

      Inclusive design doesn’t just make digital products more usable for people with disabilities – it leads to better experiences for all users.

      Why? Because inclusive design principles focus on clarity, flexibility, and removing friction – goals that align perfectly with great UX.

      Such as:

      Reduced cognitive load

      Simpler interfaces, consistent navigation, and clear language help users complete tasks faster and with less confusion. That’s especially important for users with cognitive or learning differences – but it benefits everyone, especially under pressure or on mobile.

      Improved usability across devices and contexts

      Designs that adapt to different screen sizes, input methods, and internet speeds are essential for people with limited access, and also crucial for global audiences, mobile-first users, and multitaskers.

      Fewer errors, higher satisfaction

      Clear error messages, flexible interactions (e.g., voice, keyboard, mouse), and intuitive layouts reduce user frustration and dropout rates, improving satisfaction and conversion.

      Broader engagement

      When products are inclusive by default, they reach more people – across abilities, languages, and cultures – leading to increased trust and market growth.

      In short, inclusive design is great UX, scaled to real-world diversity.

      Steps to implement inclusive design in websites and apps

      Inclusive design isn’t a one-time project, it’s a mindset that should be woven into every stage of your product development lifecycle. Here’s how your organization can start building more inclusive digital experiences, step by step:

      1. Audit your current experience for exclusion risks

      Begin by identifying friction points in your existing website or app. Use both automated tools and manual testing to assess:

      • Accessibility gaps (e.g., contrast, alt text, keyboard nav)
      • Language complexity
      • Navigation barriers
      • Form usability

      2. Involve diverse users in research and testing

      Don’t rely on assumptions. Engage users with a range of abilities, backgrounds, languages, and devices in your UX research, user interviews, and us 

      Their feedback will highlight problems – and reveal better design solutions you may not have considered.

      3. Train your team on inclusive design principles

      Help your designers, developers, and content creators understand what inclusive design looks like in practice. Build internal guidelines, share resources, and encourage team-wide ownership.

      4. Bake inclusivity into your design system

      Update your component library to include accessible UI patterns, alt text conventions, contrast rules, and responsive behavior. The more baked-in it is, the easier it is to scale.

      5. Test early, test often

      Use real devices and assistive technologies to evaluate inclusivity throughout the development process, not just at launch.

      Common barriers to inclusive design (and how to overcome them)

      Despite its clear benefits, inclusive design can feel challenging to implement, especially for small teams or organizations without in-house accessibility expertise. 

      Here are some of the most common barriers and how to move past them:

      “It’s too expensive or time-consuming.”

      Reality: Inclusive design becomes costly when it’s an afterthought. But when it’s embedded from the start – during research, design, and development – it saves time and prevents expensive retrofits.

      Solution: Adopt a “design for inclusion by default” mindset. Use inclusive templates and test early to avoid costly changes later.

      “We don’t have the right team or tools.”

      Reality: You don’t need to be an expert in usability to get started.

      Solution: Use publicly available resources, tools like contrast checkers or screen reader emulators, and consult toolkits like Microsoft’s Inclusive Design Guide. When in doubt, start small and iterate.

      “We’re afraid of getting it wrong.”

      Reality: The only real mistake is not trying. Inclusive design is a process of learning, testing, and improving.

      Solution: Get feedback from diverse users, document your decisions, and be transparent about your intent. Progress is better than perfection.

      Best practices for creating inclusive content and interfaces

      Inclusive design extends beyond layout and color contrast, it’s just as much about the language, structure, and interaction patterns you use. 

      Here are some key practices to apply across your digital content and user interfaces:

      Use plain, inclusive language

      • Write for clarity – avoid jargon, idioms, and cultural references that may not translate
      • Use gender-neutral language unless context requires otherwise
      • Break up complex ideas into short, scannable sentences and paragraphs

      Go for visual clarity and flexibility

      • Maintain a minimum color contrast ratio of 4.5:1 for text and background
      • Use scalable fonts and support text resizing without layout breaks
      • Choose accessible typefaces (e.g., sans-serif, dyslexia-friendly fonts)

      Design for different interaction styles

      • Don’t rely on color alone to convey meaning (e.g., red = error)
      • Make all controls accessible via keyboard and screen readers
      • Use clear, descriptive link text (avoid “click here”)

      Tools and resources for inclusive design

      Whether you’re just starting out or scaling inclusive practices across your team, the right tools can help you move faster and smarter. Here’s a selection of practical resources to guide your journey:

      Testing and simulation tools

      • WAVE – Web accessibility evaluation tool for spotting common issues
      • axe DevTools – Chrome extension for automated WCAG checks
      • VoiceOver / NVDA – Screen readers for manual testing
      • Color Oracle – Simulates color blindness for design reviews

      Design and content resources

      • WebAIM Contrast Checker – Test color combinations for readability
      • Microsoft Inclusive Design Toolkit – Practical exercises and personas
      • Google Fonts accessibility collection – Readable and scalable typefaces
      • Plainlanguage.gov – Guide to clear, inclusive writing

      Design that includes is design that works

      Inclusive design isn’t just about checking accessibility boxes, it’s about building better, more usable products for everyone. By intentionally designing for a wider range of needs and contexts, your team can deliver experiences that are more effective, more empathetic, and more aligned with how people actually live and work.

      It starts with a shift in mindset – and continues through research, collaboration, and iteration.

      Ready to take the first step?

      Discover more about our Accessibility Widget

      The post Inclusive design principles: How to build digital experiences that work for everyone appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      A complete guide to EAA compliance for digital services https://www.iubenda.com/en/help/181586-european-accessibility-act-compliance/ Thu, 22 May 2025 13:35:04 +0000 https://help.iubenda.com/?p=181586 What the European Accessibility Act means for your digital operations Digital accessibility has moved beyond an add-on; it’s a legal obligation for many businesses operating in Europe.  The European Accessibility Act (EAA), which came into full force on June 28, 2025, introduces a unified set of accessibility requirements for websites, mobile apps, and other digital […]

      The post A complete guide to EAA compliance for digital services appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      What the European Accessibility Act means for your digital operations

      Digital accessibility has moved beyond an add-on; it’s a legal obligation for many businesses operating in Europe. 

      The European Accessibility Act (EAA), which came into full force on June 28, 2025, introduces a unified set of accessibility requirements for websites, mobile apps, and other digital products and services.

      The goal? To make sure that people with disabilities can access and use digital services as easily as everyone else. But for many businesses – especially those without in-house accessibility experts – the path to accessibility can feel unclear and overwhelming:

      • Who needs to comply?
      • What are the specific accessibility requirements?
      • How do you assess your current level of compliance?
      • And what practical steps can you take to meet the standard?

      This guide provides those answers. Whether you’re in legal, product, design, or development, we’ll break down the EAA’s key requirements, show how they affect your digital properties, and offer a clear framework for achieving accessibility.

      Who needs to comply with the European Accessibility Act?

      The EAA applies to a wide range of businesses operating in or serving consumers within the European Union. 

      But which businesses does it actually affect?

      The short answer: most B2C digital service providers.

      You may be required to comply if you:

      • Operate an e-commerce platform or sell products online
      • Offer banking or financial services
      • Provide transport booking systems (bus, rail, air, etc.)
      • Run a media platform, including video, audio, or streaming
      • Publish eBooks or digital reading tools
      • Deliver telecommunications services
      • Offer public-facing websites or mobile apps
      • Serve EU consumers, even if you’re based outside the EU

      Some common myths about compliance

      You might have had these thoughts in the past, but they’re (probably) not accurate:

      • “We’re too small.” → Size is usually not a determining factor for accessibility compliance (with minor exceptions).
      • “We’re not in the EU.” → If your service targets or reaches EU consumers, you’re likely in scope.
      • “We only sell physical goods.” → Your digital interfaces (website, checkout, app) still need to comply – as do some physical goods!
      So, here’s a quick check: are you in scope?
      • Do you sell or market to EU consumers?
      • Do you provide services digitally (website, app, content)?
      • Would inaccessible features prevent any user from completing a key task?

      If the answer is yes, compliance is likely required, so you need to act.

      Key requirements for EAA compliance

      The EAA doesn’t just recommend better digital experiences – it mandates them. Businesses affected by the EAA must make sure that their digital products and services are accessible to people with disabilities, based on a consistent set of requirements across EU member states.

      What must be accessible?

      The EAA applies to a range of digital assets, including:

      • Websites and web applications
      • Mobile apps
      • e-commerce platforms and online stores
      • Self-service terminals (e.g., ticketing machines, ATMs)
      • eBooks and reading software
      • Audio-visual media players
      • Digital customer service interfaces

      Basically, any interface a user interacts with to access or manage a service is likely covered.

      What does accessible mean under the EAA?

      To comply with the EAA, digital services must follow technical accessibility standards, namely:

      • Conformance with the following:
        • Alt text for non-text content
        • Keyboard navigability
        • Screen reader compatibility
        • Text resize options without loss of functionality
        • Sufficient color contrast
        • Consistent navigation patterns
        • Descriptive form labels and error messages
        • Captions and transcripts for video/audio content
      ⏰ Key deadline: June 28, 2025

      This is when enforcement begins. After this date, non-compliant products and services could be subject to fines, removal from market, or other legal action by national authorities.

      How the EAA affects digital services and websites

      The EAA applies to more than just how information is presented; it also affects how digital services are designed, built, and maintained. This includes user flows, interface components, media content, and even the technologies used to build your site or app.

      If your business relies on digital channels to deliver services – whether it’s an online shop, customer portal, mobile app, or media platform – EAA compliance must be part of your strategy.

      E-commerce platforms

      Online stores must allow all users to:

      • Browse, select, and purchase products
      • Read product descriptions via screen readers
      • Navigate the checkout using only a keyboard
      • View accessible error messages for failed form inputs

      Banking and financial services

      Secure portals and apps must:

      • Be navigable without a mouse
      • Provide accessible 2FA interfaces and forms
      • Offer downloadable documents (e.g., PDFs) in accessible formats

      Streaming platforms and digital media

      Audio-visual content must include:

      • Captions for spoken content
      • Transcripts for audio-only files
      • Interfaces that work with assistive technology

      Design systems and navigation patterns

      All services must make sure there are:

      • Consistent layouts across pages
      • Clear focus indicators for interactive elements
      • Semantic HTML and proper heading structure for screen readers

      In short, digital accessibility affects nearly every layer of the user experience. So getting on the road to compliance means designing for inclusion from the start.

      Steps to achieve EAA compliance

      Meeting the EAA’s requirements doesn’t have to mean a complete overhaul from day one. With a structured, phased approach, organizations can start making meaningful improvements right away – then scale toward heightened compliance.

      Here’s a practical framework to guide your team.

      1. Audit your digital assets

      Start by assessing your website, apps, and digital products to understand where you stand. Combine:

      • Automated tools like WAVE, axe DevTools, or Google Lighthouse
      • Manual testing using screen readers (NVDA, VoiceOver)
      • Keyboard-only navigation testing
      • User testing, where possible, with real users who use assistive tech

      2. Prioritize issues by impact and visibility

      Identify the key areas of focus:

      • High-traffic pages (home, product, checkout, login)
      • Critical forms and user journeys
      • Non-compliant media (videos, PDFs, interactive content)

      NOTE: Make sure that you use WCAG 2.1 Level AA and the EAA annexes as your technical benchmark; it’s important.

      3. Fix the most common accessibility barriers

      Start with achievable fixes that make a big difference:

      • Add alt text to all meaningful images
      • Ensure form fields have labels and accessible error messaging
      • Adjust color contrast and allow text resizing
      • Fix heading structures for semantic HTML
      • Add captions and transcripts to media content

      4. Use iubenda’s Accessibility Widget for fast impact

      The iubenda Accessibility Widget allows teams to make progress quickly:

      • Adds essential accessibility enhancements
      • Helps meet WCAG 2.1 Level AA criteria
      • Offers a simple path to demonstrate proactive accessibility

      5. Educate and enable your teams

      Make sure that product, design, marketing, and dev teams:

      • Understand the principles of accessible design
      • Integrate accessibility checks into QA
      • Know where to find standards and reference docs

      6. Monitor, iterate, and maintain

      Accessibility isn’t a one-off project. Make sure you build in:

      • Periodic re-audits
      • Feedback channels for users
      • Governance processes for continuous compliance

      The common challenges in meeting EAA standards

      Many organizations recognize the need for accessibility, but run into roadblocks when they begin implementation. Understanding the most common challenges can help you avoid delays and keep your compliance roadmap on track.

      1. Lack of internal expertise

      Many teams – especially SMBs – lack in-house accessibility specialists. As a result, compliance can feel overly technical or overwhelming.

      The solution: Start small. Use automated testing tools, free learning resources, and accessible design libraries. And when needed, consult external accessibility partners.

      2. Legacy systems and outdated tech

      Older websites or content management systems may not support semantic HTML, ARIA roles, or screen reader compatibility.

      The solution: Prioritize critical pages and work accessibility into scheduled redesigns or updates. Tools like iubenda’s Accessibility Widget can help you start working towards an accessible path.

      3. Fragmented responsibility

      Accessibility often falls between teams – design, development, marketing, and legal – without a clear owner.

      The solution: Assign ownership. Establish an internal lead or working group and include accessibility in your QA and content processes.

      4. Misunderstanding legal obligations

      Some teams assume the EAA doesn’t apply to them – or they underestimate what’s required to meet WCAG standards.

      The solution: Use self-assessment checklists, review the EAA’s scope, and consult legal if needed. Remember: if you serve EU consumers, compliance is likely required.

      By addressing these challenges early, your organization can make measurable progress – without getting stuck in the weeds.

      Tools and resources for compliance

      Whether you’re just starting your accessibility journey or looking to streamline ongoing improvements, the right tools can make all the difference. 

      Here’s a selection of reliable resources to help your team achieve and maintain EAA compliance.

      Accessibility testing tools

      Start with automated scans to catch the most common accessibility issues:

      • WAVE – Highlights contrast errors, missing alt text, and semantic structure flaws
      • axe DevTools – Chrome extension for developers with actionable WCAG guidance
      • Google Lighthouse – Built into Chrome DevTools, includes accessibility scoring

      Manual testing support

      Automated tools only catch 30–40% of issues. Pair them with:

      • Screen readers: NVDA (Windows), VoiceOver (Mac)
      • Keyboard navigation tests: Use Tab, Shift+Tab, and Enter to navigate your site
      • Zoom/resizing tests: Make sure layout and content remain usable at 200% scale

      Design and content resources

      • Contrast checkers (e.g. WebAIM, Stark)
      • Inclusive design principles from W3C and open design systems
      • Alt text and media accessibility guides

      iubenda’s Accessibility Widget

      For businesses seeking an immediate step toward accessibility, iubenda’s Accessibility Widget:

      • Adds key WCAG 2.1 Level AA enhancements
      • Requires no redesign or replatforming
      • Supports your ongoing accessibility strategy

      Make accessibility a priority

      Digital accessibility is no longer optional. With the European Accessibility Act’s enforcement deadline having passed on June 28, 2025, businesses across Europe – and beyond – must make sure their websites, apps, and digital services are accessible to all users.

      The good news? You don’t need to do everything at once.

      By understanding your legal obligations, identifying accessibility gaps, and making continuous improvements using WCAG 2.1 Level AA as your guide, your organization can reduce risk, expand its audience, and deliver a better digital experience for everyone.

      Start now with a simple, scalable solution

      The iubenda Accessibility Widget makes it easy to begin addressing requirements right away, without the need for a full rebuild.

      Whether you’re in product, compliance, UX, or leadership, taking the first step today can save time, cost, and complexity tomorrow.

      The post A complete guide to EAA compliance for digital services appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      European Accessibility Act B2B guide: Are B2B companies affected? Here’s what the law says https://www.iubenda.com/en/help/181280-european-accessibility-act-b2b-guide-3/ Fri, 16 May 2025 14:53:18 +0000 https://help.iubenda.com/?p=181280 The European Accessibility Act (EAA) is raising questions across the business world – especially in B2B circles. Many companies are wondering how the European Accessibility Act applies to B2B businesses like theirs. In most cases, B2B companies can breathe easy.  If you run a purely B2B company, the chances are that the EAA does not […]

      The post European Accessibility Act B2B guide: Are B2B companies affected? Here’s what the law says appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      The European Accessibility Act (EAA) is raising questions across the business world – especially in B2B circles. Many companies are wondering how the European Accessibility Act applies to B2B businesses like theirs.

      In most cases, B2B companies can breathe easy. 

      If you run a purely B2B company, the chances are that the EAA does not really apply to your operations.

      However, there are key exceptions worth knowing so you don’t get caught out.

      In this article, we’ll clarify exactly when B2B companies need to comply with the EAA, walk through common scenarios, and offer some practical steps to reduce risk and improve accessibility where it counts.

      Need to make your website more accessible? Learn how iubenda can help.

      The European Accessibility Act: Focused on consumer-facing services

      The goal of the EAA (Directive 2019/882) is to make sure that any products and services across the EU are accessible to people with disabilities. 

      It introduces accessibility requirements for:

      • E-commerce websites: Platforms where users can browse and buy goods or services online.
      • Banking and financial services: Apps and websites that let consumers manage their finances or make transactions.
      • Transport services: Digital booking tools for trains, buses, taxis, and other transport modes.
      • E-books and digital reading platforms: Services that offer downloadable or streamable reading materials.
      • Communication services like messaging or VoIP: Tools that help users communicate digitally, including video calls and online chats.

      Under the law, consumers are defined as “any natural person who purchases the relevant product or is a recipient of the relevant service for purposes which are outside his trade, business, craft or profession” as per Directive 2019/882, Article 2.

      This definition is key because it clearly indicates that the law targets B2C operations, not B2B interactions between companies. 

      But that doesn’t mean you can stop reading if you run a B2B business. 

      💡 For a deeper look at the general scope of the law, see our main article on EAA compliance and why it matters.

      When B2B businesses fall outside the EAA’s scope

      If your company sells exclusively to other businesses – and doesn’t engage with individual consumers – your digital properties are generally outside the scope of the EAA.

      Think of tools like:

      • Internal sales systems: Used only by your team to manage deals with other companies, not consumers.
      • Password-protected client dashboards: Secure, login-only areas built for business customers.
      • Procurement tools or vendor portals: Systems designed solely for managing supplier relationships and purchasing workflows.
      • Closed B2B SaaS platforms: Software products that require account access and don’t have a public-facing component.
      • Intranets or internal employee tools: Platforms only used by employees, like HR systems or internal knowledge bases.

      Essentially, the rule of thumb is that as long as your interfaces are exclusively used by people acting within their trade or profession, the EAA doesn’t apply.

      The operative word here is ‘exclusively’. 

      So, how can you be sure you’re truly out of scope?

      When B2B companies need to comply

      Now here’s where it gets a little trickier. If your company offers any public-facing elements that can be used by individual consumers, they are within the EAA’s scope.

      Common examples include things like:

      • Marketing websites with pricing or product pages: These public pages are often visited by individual consumers researching products or services.
      • Public contact or support forms: Open communication channels allow anyone to get in touch – not just businesses.
      • Blogs or educational content aimed at individual users: If content is accessible to consumers and meant to inform or attract them, it’s in scope.
      • Free tools or demo sign-ups without business verification: If individuals can use or trial your service without identifying as a business, accessibility requirements apply.

      Even if your core offering is purely B2B, if someone can stumble across your site and interact with it as an individual, that interaction needs to meet accessibility requirements.

      Mixed B2B/B2C business models: Compliance by component

      Many companies operate in a hybrid model – offering B2B software or products but maintaining consumer-facing digital assets.

      In these cases, compliance needs to be assessed on a section-by-section basis.

      Here are some examples where this might apply: 

      Asset Is compliance required?
      B2C user portal ✅
      Internal CRM ❌
      Marketing website with pricing ✅
      Sales documentation download portal (public) ✅
      Support intranet ❌

      It’s important to remember that the 2019/882 directive does not contain an explicit list of examples being in or out of scope. 

      Instead, the determination hinges on whether or not the recipient qualifies as a “consumer” based on the legal definition we mentioned earlier. 

      Because of this, it’s always a good idea to conduct an accessibility audit that clearly separates consumer-facing areas from internal B2B tools – so you can make sure you’re never caught off guard.

      Why accessibility still matters for B2B companies

      Even if your risk of legal exposure under the European Accessibility Act as a B2B company is low, accessibility is still a smart business move – no matter what kind of business you run. 

      It gives you:

      • Better UX for all users: Accessibility best practices make digital experiences clearer and easier for everyone – not just people with disabilities. 
      • SEO and performance gains: Search engines reward accessible websites with better indexing and faster load times – so you’re more discoverable, and can offer a better experience. 
      • Stronger reputation: Demonstrating inclusion supports employer branding and helps to build customer trust.
      • Procurement advantage: Accessibility is increasingly a requirement in vendor selection for large enterprises.

      What to do next: Steps for B2B companies

      Before diving into any accessibility updates, it’s worth identifying which parts of your digital presence are actually in scope. 

      While many B2B platforms are exempt, anything that can be accessed by an individual consumer needs to meet accessibility standards, such as your homepage, contact form, or pricing page.

      Here’s a simple approach to get started:

      • Step 1: Audit your digital presence. Look for any publicly available pages, tools, or forms that consumers might have access to.
      • Step 2: Fix what’s public. Apply WCAG 2.1 standards to components like landing pages, blog posts, and contact forms.
      • Step 3: Use accessibility tools wisely. Tools like iubenda’s Accessibility Widget can help with overlays and UI tweaks, but back-end fixes are still essential.
      • Step 4: Publish an accessibility statement. Clarify your approach, even if only part of your site needs to comply – it shows transparency and commitment.
      Want a quick way to start improving accessibility?

      Learn about iubenda’s Accessibility Widget

      Getting ahead of the curve

      Even if you’re not strictly required to comply with the EAA, taking proactive steps toward accessibility is good business sense. It improves usability, supports your brand’s reputation, and may even help you win contracts.

      In short, it’s about making sure you’re as ready as you can possibly be. 

      But remember, tools like iubenda’s Accessibility Widget are just the start. You can’t guarantee full accessibility with just one tool alone, so it’s important to make sure you’re also doing manual checks and utilizing other accessibility tools.  

      More and more industries now expect a baseline level of digital accessibility – and B2B is no exception. Forward-thinking B2B companies that embed inclusive design into their workflows will be better placed to compete, adapt, and grow.

      And remember, an accessible site is a user-friendly site. 

      FAQs on EAA and B2B

      1. Does the EAA apply to B2B-only companies?

      The EAA specifically targets consumer-facing interactions. B2B-only companies are therefore out of scope.

      2. What if I have a mixed audience?

      You’ll need to assess each digital asset. Consumer-facing elements must comply, even if the product is B2B.

      3. Are free tools or demos considered consumer-facing?

      Yes – if individuals can access them without acting on behalf of a business, they fall under the EAA.

      4. Is compliance mandatory for my blog?

      If your blog is publicly accessible and aimed at individual users (even educational), it’s likely in scope.

      5. Do accessibility overlays make me compliant?

      Not on their own. Overlays improve usability, but full compliance requires fixing underlying code-level issues.

      6. Are accessibility statements required for B2B companies?

      Only for the consumer-facing elements. But publishing one is recommended for transparency.

      7. What if I only sell to enterprises but have a public website?

      The public website still needs to meet accessibility requirements, regardless of who your customers are.

      8. What happens if I don’t comply?

      Each EU Member State defines its own enforcement measures. This can include corrective actions, sanctions, or other consequences – depending on how the EAA has been implemented at the national level.

      The post European Accessibility Act B2B guide: Are B2B companies affected? Here’s what the law says appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      European Accessibility Act fines: What you need to know https://www.iubenda.com/en/help/181203-european-accessibility-act-fines-3/ Fri, 16 May 2025 10:25:42 +0000 https://help.iubenda.com/?p=181203 The European Accessibility Act (EAA) is a landmark directive that aims to improve digital accessibility across the European Union. It covers a wide range of products and services – from e-commerce platforms and mobile apps to ATMs and e-readers.  But while some businesses are starting to take note of the EAA, many aren’t aware of […]

      The post European Accessibility Act fines: What you need to know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      The European Accessibility Act (EAA) is a landmark directive that aims to improve digital accessibility across the European Union. It covers a wide range of products and services – from e-commerce platforms and mobile apps to ATMs and e-readers. 

      But while some businesses are starting to take note of the EAA, many aren’t aware of the consequences of non-compliance, which can be severe. 

      In this blog post, we’ll demystify the European Accessibility Act fines, so you have a thorough understanding of the stakes – and what steps you can take to help steer clear of the penalties.  

      What happens if you don’t comply with the European Accessibility Act?

      The European Accessibility Act (EAA) is a directive, not a regulation – this distinction is important. Both are binding legislative acts under EU law, but they function differently:

      • A regulation (like GDPR) has a direct effect. It automatically becomes law in all EU Member States without needing to be implemented through national legislation.
      • A directive, like the EAA, must be transposed into national law by each Member State. This means countries have some flexibility in how they implement it – particularly in areas like enforcement and penalties.

      💡 So, what happens if your business doesn’t comply?


      That depends on the specific laws enacted by each Member State in response to the EAA. But here’s what you can generally expect:

      • Fines and penalties: While each country can decide the specifics, they are required to establish sanctions that are effective, proportionate, and dissuasive.
      • Legal action: You may be subject to enforcement proceedings brought by regulatory bodies or affected individuals.
      • Injunctions or forced product withdrawals: In severe cases, authorities could block or pull non-compliant products and services from the market.
      • Reputational damage: Failure to comply may also hurt your brand image – especially in sectors where accessibility is a public expectation.

      To stay compliant, businesses need to track how each relevant Member State is transposing the EAA and what specific obligations and penalties apply in their jurisdictions.

      Who enforces the EAA?

      Each Member State is required to designate one or more authorities responsible for monitoring and enforcing the EAA. These could be existing consumer protection agencies, or entirely new regulatory bodies.

      Enforcement mechanisms might include audits and inspections, ongoing monitoring of digital platforms, responding to user complaints, and collaboration with EU-wide networks to share best practices. Some authorities may also carry out proactive checks, especially in high-risk sectors like finance and e-commerce.

      How Member States determine fines and penalties

      One of the EAA’s key features is that it sets the framework but leaves the application to individual Member States. This means that each country must create its own laws, including specific enforcement procedures and fine structures.

      Although European Accessibility Act fines and penalty systems will vary, most Member States are expected to assess factors like the severity and duration of the violation, how cooperative the business is with regulators, how many users were affected, and whether there’s a history of previous violations.

      Below are some examples of European Accessibility Act fines and penalties. Please note that these are subject to change as each country finalizes its implementation:

      Austria 🇦🇹

      • Fines: Up to €200,000
      • Additional Penalties: Repeated violations can lead to higher fines and possible suspension of services.​

      Belgium 🇧🇪

      • Fines: €1,000 to €50,000
      • Additional Penalties: Continuous non-compliance may lead to suspension of business operations.

      Denmark 🇩🇰

      • Fines: €10,000 for initial non-compliance
      • Additional Penalties: Fines increase with repeated offenses.

      France 🇫🇷

      • Fines: €5,000 to €250,000
      • Additional Penalties: €25,000 for any additional, related offenses as well as potential public exposure of non-compliant businesses.​

      Germany 🇩🇪

      • Fines: Up to €500,000
      • Additional Penalties: Businesses may need to take corrective action and face potential suspension of services.

      Ireland 🇮🇪

      • Fines: €5,000 to €60,000
      • Additional Penalties: Potential imprisonment for directors, managers, administration staff and other officers for up to 6 months or 18 months once indicted.

      Italy 🇮🇹

      • Fines: €40,000 or 5% of annual turnover
      • Additional Penalties: Potential suspension of services. 

      Netherlands 🇳🇱

      • Fines: Up to €250,000
      • Additional Penalties: Potential suspension of services.

      Spain 🇪🇸

      • Fines: €30,000 to €600,000
      • Additional Penalties: Potential suspension of services.

      Sweden 🇸🇪

      • Fines: Up to €200,000.​
      • Additional Penalties: Businesses will have to take corrective action and face mandatory accessibility audits to ensure compliance. 

      Examples of accessibility violations and anticipated enforcement approaches

      To help you better understand what might trigger enforcement action, here are a few hypothetical but plausible scenarios:

      • An e-commerce website fails to provide alt text for product images, making it unusable for visually impaired users.
      • A banking app is not navigable by keyboard alone, violating accessibility principles for users with motor disabilities.
      • A customer support chatbot doesn’t offer an accessible fallback option like a human agent, creating a barrier for those who use assistive technologies.
      • A transport-booking website provides a CAPTCHA with no accessible alternative, making it difficult for screen reader users to complete a purchase.
      • A mobile app used for public services doesn’t have strong contrast and doesn’t support text resizing, excluding users with low vision.
      • A video tutorial platform doesn’t provide captions or transcripts, effectively shutting out users who are hearing impaired.
      • A travel company’s booking platform uses complicated, multi-step forms with no progress indicators or error messages compatible with screen readers.

      In these cases, authorities could issue warnings, fines, require remedial action, or all three. The severity of the enforcement could be linked to how essential the service is and how much harm the inaccessibility causes.

      Legal and financial consequences of non-compliance

      Beyond the potential European Accessibility Act fines, there are broader risks to consider. 

      If you’re sued for non-compliance, legal fees can mount up quickly. You might also lose contracts, particularly with government or enterprise clients that require accessibility compliance

      What’s more, inaccessible platforms can drive customers away. Over 100 million people in the EU alone live with disability, which means your business could be missing out on a large customer base by not being accessible. 

      There’s also the risk of class-action lawsuits or coordinated complaints from consumer rights organizations. Non-compliance can lead to operational setbacks, delays in product launches, and resource-draining remediation efforts that could have been avoided through early planning.

      There’s no denying that the consequences of non-compliance can be severe – not just financially, but legally and reputationally as well. This means it’s all the more important to prioritize accessibility efforts now so you can avoid any unfortunate consequences once the EAA fully comes into force. 

      How to avoid European Accessibility Act fines and get closer to compliance

      To ensure greater compliance with the EAA, it helps to be familiar with the accessibility principles outlined by the Web Content Accessibility Guidelines (WCAG). These guidelines set the WCAG 2.1 Level AA standard.

      The WCAG is based on four principles, commonly referred to as the POUR principles:

      • Perceivable: Users must be able to perceive the content presented. This includes using text alternatives for non-text content, ensuring sufficient contrast, and providing captions for audio and video.
      • Operable: Interfaces and navigation must be operable by all users, including those who rely on keyboards or assistive devices. Avoid content that flashes excessively, and ensure all interactive elements are usable without a mouse.
      • Understandable: Content must be presented in a clear and predictable way. This includes using legible fonts, straightforward language, and consistent navigation across pages.
      • Robust: Content must be compatible with a variety of current and future user agents, including assistive technologies. This means using clean, semantic HTML and following web standards for long-term compatibility.

      If your business’s digital services align with these principles, you’ll increase your chances of improving your website’s accessibility and usability – and reduce the risk of receiving European Accessibility Act fines.  

      Steps to help make your website and services more accessible 

      Whether you’re a startup or a multinational, these practical steps can help you get closer to aligning with the EAA:

      • Start with an accessibility audit. This can help you find the areas where you’re not compliant. To carry out an audit, you can use tools to carry out automated scans, as well as manual user testing. This combined approach will help you uncover both obvious and more nuanced accessibility issues – such as code-level problems that affect screen readers or usability issues that automated tools can’t detect.
      • Fix high-impact issues first. In general, it’s important to focus on issues that directly affect user access to your services. For example, missing alt text, poor contrast, and inaccessible navigation – these can often be fixed quickly. Develop a roadmap for more complex fixes and make sure accessibility improvements are included in your product backlog.
      • Offer multiple communication channels for users. Ensure that users can access customer support in accessible formats.
      • Use semantic HTML. This helps screen readers interpret content correctly.
      • Implement ARIA landmarks and roles. These can significantly improve navigation for assistive technology users.
      • Ensure all forms have proper labels and instructions. This allows users with assistive tech to complete them without barriers.
      • Provide text alternatives for multimedia content. This can include captions for videos, transcripts for podcasts, and audio descriptions where appropriate.
      • Check color contrast and font across all pages. Make sure all text is legible in different conditions.
      • Ensure your navigation is consistent and intuitive. Menus should be logically ordered and links clearly described.
      • Promote keyboard accessibility. Users should be able to navigate your entire website using only their keyboard.
      • Set up a regular review process. Accessibility isn’t one-and-done – it’s a continuous commitment. Build in quarterly or biannual reviews to assess progress, tackle regressions, and stay ahead of legal updates.
      • Document everything. This includes audit results, internal discussions, timelines for fixes, and user feedback. Keeping detailed records helps your team stay accountable and serves as valuable proof of your efforts if authorities investigate.
      • Educate your team. Make sure everyone on your team – from designers and developers to product managers and marketers – understands accessibility principles. Host regular training sessions and make accessibility a shared responsibility across departments.

      Embedding accessibility into your strategy and daily workflows by using the right tools means you can reduce the risk of violations and provide a more inclusive experience for everyone.

      Don’t underestimate the risks of non-compliance

      The European Accessibility Act is an opportunity to make your digital experiences more inclusive, resilient, and user-friendly. 

      But make no mistake: the risks of non-compliance are real. With enforcement deadlines approaching and national implementations underway, businesses must act now to prepare.

      The good news is that you don’t have to go it alone. When used in combination with manual user testing and some of the other steps outlined in this blog, our Accessibility Widget makes it easier to improve your website’s accessibility and usability in terms of EAA standards. 

      The post European Accessibility Act fines: What you need to know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Examples of accessibility done right: real websites you can learn from https://www.iubenda.com/en/help/181073-examples-of-accessibility-3/ Tue, 13 May 2025 07:58:07 +0000 https://help.iubenda.com/?p=181073 Website accessibility shouldn’t be an afterthought – it’s a key part of the digital experience design.  More and more services are shifting online, and as a result, businesses are expected to make their digital spaces inclusive for everyone, including people with disabilities.  However, while many teams understand the need for accessibility, implementing it can feel […]

      The post Examples of accessibility done right: real websites you can learn from appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Website accessibility shouldn’t be an afterthought – it’s a key part of the digital experience design. 

      More and more services are shifting online, and as a result, businesses are expected to make their digital spaces inclusive for everyone, including people with disabilities. 

      However, while many teams understand the need for accessibility, implementing it can feel overwhelming. 

      What does a truly accessible website look like in practice?

      Which features matter most? 

      And how can your team replicate them effectively?

      Don’t worry – we’re giving you the answers through concrete, real-world examples of accessibility done well. We’ll highlight websites that demonstrate key accessibility principles, from keyboard navigation and screen reader compatibility to proper alt text, captions, and readable typography. 

      Whether you’re a designer, developer, marketer, or product lead, this guide will help you understand what great accessibility looks like – and how to bring it to your own site.

      What is website accessibility?

      Website accessibility is the practice of designing and developing digital content so it can be used and understood by everyone, including people with permanent, temporary, or situational disabilities. 

      This includes users who rely on screen readers, navigate with keyboard-only input, or need adjustable text sizes, color contrast, or transcripts for audio content.

      Accessible websites make sure that no user is excluded, and support users in low-bandwidth environments, older adults, and those using non-standard devices.

      The primary framework used to define and evaluate accessibility is the Web Content Accessibility Guidelines (WCAG). These internationally recognized standards are built around four key principles: content must be Perceivable, Operable, Understandable, and Robust (POUR).

      Accessible websites aren’t just more inclusive – they’re also easier to navigate, more SEO-friendly, and often more usable for everyone. That’s why accessibility is now considered a cornerstone of good digital experience design.

      Why website accessibility matters

      Accessibility matters because the web is a critical part of everyday life – and it should be usable by everyone. 

      Excluding users with disabilities from digital services can create real-world barriers to banking, healthcare, education, and employment.

      For many people with disabilities, the internet offers independence and access, but only if digital experiences are built to be inclusive. Whether it’s a lack of alt text, unreadable font sizes, or navigation that doesn’t work with a keyboard, even oversights that seem minor can have a significant impact.

      Beyond the human case, accessibility also brings clear business benefits. Inclusive websites offer a better user experience, reduce bounce rates, and improve SEO performance. Accessible code and content often align with search engine best practices, making your site easier to find and navigate.

      And then there’s compliance: regulatory frameworks like the Americans with Disabilities Act (ADA) and the European Accessibility Act (EAA) impose legal obligations – and potential penalties – for inaccessible digital platforms. It’s important to remember that accessibility isn’t a niche concern. It’s a legal, ethical, and strategic priority for any business building digital products today.

      The key principles of an accessible website

      Truly accessible websites follow well-established principles that support users with a wide range of needs. Let’s take a look at some of the most critical accessibility features, with practical notes on implementation (of course).

      1. Keyboard navigation support

      Not all users rely on a mouse – some navigate using a keyboard, switch device, or assistive tech. Ensure that all interactive elements (buttons, forms, links) can be accessed via the Tab key and that focus indicators are clearly visible.

      2. Alternative text for images

      Alt text provides screen reader users with image descriptions. It’s essential for conveying information visually and supporting users with vision loss.

      3. Captions and transcripts for multimedia

      Videos should have closed captions for users who are deaf or hard of hearing, and transcripts should be available for audio content.

      4. Color contrast and readable text

      Make sure foreground and background colors have sufficient contrast – aim for a minimum contrast ratio of 4.5:1 for body text.

      5. Resizable text and adjustable fonts

      Text should scale without breaking the layout. Make sure you’re supporting user-adjustable fonts or offer toggle settings to improve readability.

      6. Screen reader compatibility

      Use semantic HTML, proper ARIA labels, and structured heading hierarchies so screen readers can interpret the content logically.

      7. Accessible forms and error messages

      Label fields properly, provide clear instructions, and surface error messages that are both visible and announced via assistive tech.

      8. Descriptive links and semantic navigation

      Avoid vague labels like “click here.” Use meaningful, descriptive link text that explains the action or destination.

      Real-world examples of accessible websites

      Understanding accessibility in theory is one thing, but seeing it in action is another. Here are five standout examples of accessible websites, each demonstrating best practices you can adapt to your own projects.

      1. GOV.UK

      The UK government’s digital services site is a global benchmark for clarity, simplicity, and accessibility.

      Here are the highlights:

      • Fully keyboard navigable with visible focus states
      • Clear, hierarchical heading structure
      • Descriptive link text and logical page flow
      • No reliance on color to convey meaning
      💡 Why it works:

      Simply, it’s designed with a “user-first” mindset, prioritizing legibility and universal access.

      2. Apple.com

      Everyone loves the Apple brand – but the Apple site demonstrates how sleek design and accessibility can coexist.

      Highlights:

      • Semantic HTML with screen reader-friendly ARIA labels
      • High color contrast and readable type across all devices
      • Accessible product tours with keyboard navigation
      💡 Why it works:

      Apple integrates accessibility from the start, rather than treating it as an add-on.

      3. BBC.co.uk

      Whatever your thoughts are on the BBC, it’s long been committed to digital inclusion, especially in multimedia content.

      Highlights:

      • Closed captions and audio descriptions for video content
      • High-contrast text with adjustable font sizes
      • Responsive design for screen magnification
      💡 Why it works:

      The BBC serves a diverse audience and ensures everyone can access its content equally.

      4. The New York Times

      The NY Times combines rich media with thoughtful accessibility – in short, it’s hit the nail on the head.

      Highlights:

      • Text versions of multimedia features
      • Structured headlines and skip links for faster screen reader navigation
      • Subtle animations that don’t interfere with usability
      💡 Why it works:

      The design is smart, making sure that accessibility is balanced with editorial storytelling.

      5. Target.com

      Target became a poster child for accessibility after settling a landmark ADA lawsuit – and responded with real change.

      Highlights:

      • Improved alt text across product imagery
      • Logical tab ordering and clearly labeled forms
      • Support for screen readers and keyboard navigation
      💡 Why it works:

      Target’s proactive redesign proved that accessibility can be scalable in e-commerce.

      How to test and improve your own website accessibility

      Knowing what to fix is the first step, but it can feel like the biggest block. 

      Here’s how to identify accessibility gaps on your website and start addressing them – without needing to be an expert.

      1. Run an automated accessibility scan

      You can start with tools like:

      • WAVE (Web Accessibility Evaluation Tool)
      • axe DevTools (browser extension)
      • Google Lighthouse (built into Chrome DevTools)

      These tools highlight common issues like missing alt text, poor contrast, or form labeling errors.

      2. Perform basic manual testing

      Automated scans catch a lot, but not everything. Supplement with simple manual checks:

      • Keyboard-only navigation: Can you tab through all elements? Are focus indicators visible?
      • Screen reader testing: Use free tools like NVDA (Windows) or VoiceOver (Mac) to test reading order, heading structure, and ARIA labels.
      • Zoom in and adjust text size: Does the layout stay usable when text is enlarged?

      3. Prioritize critical fixes

      Focus on user-impacting areas first: navigation, forms, interactive elements, and key content pages. Remember, you should aim to resolve blockers before refining enhancements.

      4. Make accessibility part of your workflow

      Build accessibility checks into your design, content, and dev processes. Create reusable components, document standards, and test early and often.

      Accessibility isn’t just a best practice; it’s a legal requirement in many parts of the world. Regulatory frameworks are evolving quickly, and failure to comply can result in lawsuits, fines, or reputational damage.

      🇺🇸 In the United States: ADA

      Under the Americans with Disabilities Act (ADA), websites are increasingly considered “places of public accommodation.” This means businesses – especially in retail, hospitality, and services – must make sure that their websites are accessible. Numerous high-profile lawsuits (e.g., against Domino’s, Target) have set strong legal precedents.

      🇪🇺 In the European Union: EAA

      The European Accessibility Act (EAA) requires many B2C companies to make their digital products and services accessible. This includes e-commerce sites, mobile apps, banking platforms, and more.

      🌍 WCAG: The global standard

      Most laws reference the Web Content Accessibility Guidelines (WCAG) – specifically Level AA – as the benchmark for compliance. These guidelines provide a clear roadmap for improving accessibility across content, navigation, media, and interaction.

      NOTE: Making your site WCAG-compliant minimizes legal risk and strengthens your commitment to inclusive, user-centered design.

      Conclusion: Bring accessibility from intention to implementation

      Website accessibility isn’t only a checklist; it’s a commitment to creating digital spaces that work for everyone. As the examples above show, inclusive design can be elegant, user-friendly, and scalable, no matter your industry or audience.

      By following accessibility principles, learning from real-world models, and using the right testing tools, your team can go beyond compliance and deliver better experiences for all. 

      You might want to improve an existing site or build something new – whatever you’re starting from, accessibility is a wise investment in usability, trust, and long-term success.

      The post Examples of accessibility done right: real websites you can learn from appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Which web accessibility tools do you really need? A practical guide https://www.iubenda.com/en/help/180990-accessibility-tools-3/ Mon, 12 May 2025 15:27:57 +0000 https://help.iubenda.com/?p=180990 When it comes to creating an inclusive digital experience, web accessibility tools can be your best friend.  However, many businesses still struggle with selecting the right tools, using them effectively, or even using them at all.  This creates a gap that can increase risks, lead to missed opportunities, and even open you up to legal […]

      The post Which web accessibility tools do you really need? A practical guide appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      When it comes to creating an inclusive digital experience, web accessibility tools can be your best friend. 

      However, many businesses still struggle with selecting the right tools, using them effectively, or even using them at all. 

      This creates a gap that can increase risks, lead to missed opportunities, and even open you up to legal exposure. 

      In this guide, we’ll take a look at everything you need to know. From what web accessibility tools are, to how they support compliance with standards like WCAG, ADA, and the EAA. 

      We’ll also offer practical tips and advice on implementing these tools efficiently into your workflows. 

      What are web accessibility tools?

      Let’s get started with the basics.

      Web accessibility tools are technologies and software that help to evaluate, optimize, and monitor websites to make them more usable. This is especially true for people with disabilities or impairments. 

      These tools help assist developers, designers, and compliance officers in spotting and fixing issues such as poor keyboard navigation, missing alternative text, or low color contrast. 

      They contribute to aligning websites with standards like WCAG 2.1 and help businesses meet obligations under laws like the Americans with Disabilities Act (ADA) and the European Accessibility Act (EAA)

      Key features to look for in accessibility tools

      Choosing the right accessibility tool is all about making sure your website is truly usable for all users.

      Because an accessible site is good for everyone, not just those with disabilities. 

      A good tool will not only help you detect issues but also fit naturally into your development workflow, support different types of accessibility testing, and guide you toward making meaningful improvements to your site. 

      When evaluating your options, it’s a good idea to prioritize tools that offer:

      • Automated and manual testing capabilities: Automated scans can help you catch common issues quickly, while manual testing captures more complex usability barriers. 
      • Screen reader simulation options: Helps you experience your website the way visually impaired users would. 
      • Keyboard navigation support checking: Allows users who rely on a keyboard alone to move through your site easily. 
      • Color contrast analysis: Verifies that text and visual elements meet the minimum contrast ratios for readability. 
      • Actionable, easy-to-understand reports: Reports that provide clear guidance on whatever issues are found and how to fix them, which reduces any guesswork. 
      • Compliance checking: Helps to align your site with the major accessibility standards and legal frameworks such as WCAG 2.1, ADA, and EAA. 
      • Integration with development workflows: Allows accessibility testing to be a part of your build and deployment processes automatically. 

      Best web accessibility tools for testing and compliance

      There’s no one-size-fits-all tool that will work for everyone. 

      Different types of accessibility tools serve different needs; more often than not, a combination of tools works best. 

      Automated web accessibility testing tools

      Automated testing tools are great for catching many common accessibility issues quickly, consistently, and easily. 

      • axe DevTools: A popular browser extension that finds accessibility issues right inside your development environment. 
      • WAVE Evaluation Tool: A free, easy-to-use browser extension that highlights accessibility errors visually on your webpage. 
      • Accessibility Insights: A Microsoft tool that offers both fast automated checks and guided manual assessments. 

      Manual web accessibility evaluation tools

      Manual testing complements automation by identifying more complex or subjective issues, like confusing navigation or poor focus order. 

      • Screen reader testing: Use tools like NVDA or VoiceOver to experience your site from a non-visual perspective and manually spot gaps.
      • Manual review of semantic structure: Check headings, landmarks, ARIA roles, and logical tab order directly in the HTML or using browser dev tools.
      • Manual keyboard testing: Navigate your site using only the Tab, Enter, and Arrow keys to check keyboard accessibility. 

      Color contrast checkers

      Color contrast tools help make sure your text and visual elements are readable by users with low vision or color blindness.

      Screen readers and simulators

      Testing with real screen readers helps you to validate how accessible your site’s structure and content really are. 

      • JAWS: One of the most widely used screen readers globally, often considered to be the industry standard. 
      • NVDA: A free and powerful screen reader for Windows that lets you experience your website as a visually impaired user would. 
      • VoiceOver: Apple’s built-in screen reader, perfect for testing how your site performs on MacOS and iOS devices. 

      Keyboard navigation testing tools

      Since many users depend on keyboards instead of mice, good keyboard navigation is important. 

      • axe DevTools’ keyboard focus tests: Identify missing focus indicators or keyboard traps that can disrupt navigation.
      • Manual testing with tab/shift-tab navigation: Manually simulate a complete user journey using only keyboard controls.

      How to use web accessibility tools effectively

      Accessibility should always be baked into your processes, not treated as an afterthought. 

      Tools are at their most powerful when they’re used proactively during the development stage. Here are a few ways you can maximize their impact and make your site as accessible as possible: 

      • Integrate automated checks into CI/CD pipelines: Catch issues early by running accessibility tests automatically during the build and deployment stages.
      • Schedule regular manual audits: Manually test critical workflows and pages at key stages of development. 
      • Prioritize fixes based on impact: Focus first on issues that affect usability the most, like keyboard traps or unreadable text. 
      • Train your team on accessibility-first principles: Make sure your designers and developers know how to avoid introducing accessibility barriers right from the start. 

      For a tool that helps you boost your accessibility, try iubenda’s Accessibility Widget

      Free vs. paid web accessibility tools: Which should you choose?

      Getting the right solution for you depends on a number of factors, including your budget, site complexity, and compliance exposure. 

      So let’s take a look at the pros and cons of both free and paid web accessibility tools: 

      Free accessibility tools Paid accessibility tools
      Pros No cost to use Full-site scanning and detailed reports
      Great for small websites or early-stage testing Continuous monitoring and alerts
      Many tools cover basic WCAG 2.1 checks Integration with CI/CD pipelines
      Cons Limited depth of testing Higher upfront or subscription costs
      No continuous monitoring May require training to use fully
      May miss complex or nuanced accessibility issues Sometimes they are bundles with extra features you might not need

      How web accessibility tools help with WCAG, ADA, and EAA compliance

      Accessibility tools are still essential for identifying and fixing barriers that can prevent compliance with:

      • WCAG 2.1: The gold standard for web accessibility guidelines worldwide. 
      • ADA (Americans with Disabilities Act): Requires reasonable accommodation for people with disabilities, including digital accessibility. 
      • EAA (European Accessibility Act): Mandates accessible websites and services for companies offering to EU consumers. 

      However, if there’s one thing you should remember, it’s that web accessibility tools alone cannot make your site compliant. So these should never be seen as a catch-all solution. 

      True compliance requires a broader strategy, including design, coding best practices, and ongoing monitoring.

      Take the next step on your journey to accessibility

      Choosing and implementing the right web accessibility tools is a key part of creating a digital experience that works for everyone – as well as staying ahead of legal requirements like WCAG, ADA, and EAA.

      No single tool can ever guarantee full compliance. But by combining automated testing, manual evaluation, and accessibility enhancements, you’ll be well on your way to building a more inclusive, user-friendly, and legally safer website.

      Because accessibility isn’t a box-ticking exercise. It’s about improving the experience of all your users. 

      Web accessibility tools FAQs

      Web accessibility tools are technologies and software that help evaluate, optimize, and monitor websites to make them more usable for people with disabilities. They support compliance with standards like WCAG 2.1, ADA, and the European Accessibility Act (EAA).
      Accessibility tools help identify barriers that can prevent users with disabilities from accessing your website – and they support legal compliance, usability improvements, and better SEO performance.
      Free tools are great for basic testing, but often have limitations. Full compliance usually requires a combination of free tools, paid solutions, manual evaluations, and ongoing accessibility improvements.
      Automated testing quickly finds common issues using software scans. Manual testing catches more complex problems, like poor navigation or confusing content, by mimicking real-world user interactions. Both are essential for a thorough accessibility evaluation.
      No, tools alone cannot guarantee compliance. They are valuable aids, but achieving full compliance requires a broader strategy that includes accessible design, development best practices, and continuous monitoring.
      Ideally, you should integrate automated accessibility checks into your development pipeline and run manual accessibility audits at key stages – such as after major updates, feature launches, or design changes.
      Companies offering products or services to EU consumers must comply with the European Accessibility Act by June 28, 2025. This includes making websites, apps, and digital services accessible to people with disabilities.
      iubenda’s Accessibility Widget offers an easy-to-install widget that allows users to adjust accessibility settings like font size and contrast. It can also automatically optimize key accessibility features, helping you move closer to compliance.

      The post Which web accessibility tools do you really need? A practical guide appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      How to identify and fix the most common accessibility issues https://www.iubenda.com/en/help/180984-accessibility-issues-4/ Mon, 12 May 2025 13:07:38 +0000 https://help.iubenda.com/?p=180984 Accessibility issues are among the biggest – and often most overlooked – barriers to creating inclusive digital experiences.  From unreadable text to uncaptioned videos, many websites and digital products unintentionally exclude users with disabilities.  Although not intended, these issues have serious repercussions. They can frustrate, alienate, or completely block access for people who rely on […]

      The post How to identify and fix the most common accessibility issues appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Accessibility issues are among the biggest – and often most overlooked – barriers to creating inclusive digital experiences. 

      From unreadable text to uncaptioned videos, many websites and digital products unintentionally exclude users with disabilities. 

      Although not intended, these issues have serious repercussions. They can frustrate, alienate, or completely block access for people who rely on assistive technologies, or have specific cognitive, visual, auditory, or motor needs.

      The problem is, for teams without dedicated accessibility specialists, identifying and resolving these issues can feel overwhelming. The guidelines are extensive, the tools varied, and the consequences – ranging from user drop-off to legal risk – can be serious.

      That’s why it’s critical to understand not only what accessibility issues are, but also how to find and fix them. 

      Whether you’re a web developer, UX designer, content strategist, or product manager, this guide will walk you through the most common accessibility problems and provide actionable strategies to solve them.

      Addressing these barriers is more than just compliance: it’s a commitment to digital equity and better user experiences for everyone.

      But, what are accessibility issues?

      Accessibility issues refer to digital design and development problems that make websites, applications, or content difficult – or even impossible – for people living with disabilities to use. These barriers affect how users perceive, navigate, and interact with digital products, often excluding individuals who rely on assistive tools or alternative input methods.

      Let’s take a look at some examples: 

      A user with vision loss may not be able to understand content without alternative text on images. A person with motor disabilities may be unable to complete a form that isn’t keyboard-navigable. And someone with hearing loss may miss essential information in a video that lacks captions or transcripts.

      Accessibility issues are typically defined and assessed according to the Web Content Accessibility Guidelines (WCAG), a global standard that outlines success criteria across four key principles: perceivable, operable, understandable, and robust (POUR). These principles help make sure that digital content works for the widest possible range of users.

      Importantly, accessibility isn’t just about screen readers or visual impairments – it covers a wide spectrum of physical, sensory, and cognitive needs. That includes neurodivergent users, aging populations, and users in temporary situations (like navigating with one hand or reading in bright sunlight).

      Why fixing accessibility issues matters

      Accessibility issues don’t just affect code: they affect people. 

      Every barrier in your digital product can result in a user being unable to access vital information or complete a task. For the more than 1 billion people worldwide who live with some form of disability, these issues represent a significant obstacle to independence and inclusion, and, ultimately, opportunity.

      But accessibility issues impact businesses, too. Exclusionary design leads to lost customers, reputational damage, and increased legal risk. In the U.S., lawsuits under the ADA continue to rise. In the EU, the European Accessibility Act is set to make digital accessibility a legal requirement for many B2C businesses in 2025.

      The good news is, many accessibility best practices – like semantic HTML, descriptive alt text, and structured content – are also SEO best practices. So, fixing accessibility issues can actually improve your site’s search visibility and organic reach.

      Think of it this way: accessibility isn’t just a legal or ethical checkbox. It’s a pathway to a better user experience, wider audience engagement, and long-term digital success.

      Common accessibility issues in websites and digital content

      Accessibility issues can appear in many forms – some are visual, others structural or interactive. Understanding the most common ones is key to building inclusive digital experiences. 

      Let’s explore the top barriers users face and how they can be addressed.

      Issue ❌ Details 🔎 Solution ✅
      Lack of alt text Alt text is fundamental for users who rely on screen readers to interpret visual content. Without it, blind or low-vision users may miss important information, especially if the image is getting across a call to action or critical context. Always add concise, descriptive alt text to informative images. Just remember, failing to comply can lead to expensive lawsuits.
      Poor color contrast Low contrast between text and background makes it hard to read, especially for users with color vision deficiencies or older adults. Use tools like the WAVE Accessibility Tool or axe DevTools to test color contrast ratios. Aim for a minimum ratio of 4.5:1 for normal text.
      Inaccessible forms and input fields Forms are a common point of failure for accessibility. Issues include missing or improperly associated labels, unclear error messages, and broken tabbing behavior. Always use label tags correctly, make sure there’s a logical tab order, and provide clear, text-based error messages that are programmatically linked to input fields.
      Missing or incorrect header structure Screen readers rely on heading hierarchies (like <h1> to <h6>) to navigate pages. If headings are skipped or misused (e.g., using <div>s styled like headers), users lose context. Use headings to reflect the logical structure of content. Only one <h1> per page, followed by nested subheadings in order (e.g., <h2>, <h3>).
      Keyboard navigation issues Many users can’t use a mouse and rely on keyboard navigation (e.g., the Tab key) to move through content. Common issues include missing focus indicators or getting “stuck” in navigation traps. Make sure all interactive elements (links, buttons, inputs) are accessible via keyboard and that visible focus styles are preserved.
      Videos with transcripts or captions Deaf or hard-of-hearing users can’t access video content without captions. Without transcripts, users also lose the ability to scan or reference audio-based content. Provide accurate closed captions for all spoken content and transcripts for audio or multimedia assets.
      Inconsistent or confusing navigation Navigation that’s inconsistent across pages – or overloaded with poorly grouped content – can disorient users, especially those with cognitive or learning disabilities. Use consistent layouts, clear menu structures, and predictable interactive behaviors across all screens and breakpoints.
      Auto-playing media without controls Media that auto-plays with sound can disrupt screen reader users and trigger sensory overload, especially for neurodivergent individuals or users with ADHD. Avoid auto-play where possible. But if used, make sure users have accessible options to pause, stop, or mute the media immediately.

      How accessibility issues affect people with disabilities

      Behind every accessibility issue is a person being excluded. 

      These aren’t abstract usability flaws – they’re barriers that can deny access to essential services, opportunities, and participation in digital life.

      Imagine a blind user relying on a screen reader to shop online. If product images lack meaningful alt text, or navigation menus don’t follow a logical heading structure, it becomes nearly impossible to complete a purchase independently.

      A deaf user visiting a government site to access public services may miss critical information if videos lack captions or if no transcripts are available for audio content.

      For someone with ADHD or a cognitive disability, auto-playing media, cluttered layouts, or confusing forms can create sensory overload or cognitive fatigue, forcing them to abandon tasks halfway through.

      Also, a user with mobility impairments who navigates via keyboard or switch device may be unable to fill out forms or interact with content if the tab order is broken or focus indicators are missing.

      These examples illustrate how inclusive digital design isn’t just a technical standard – it’s a human right. 

      How to identify and fix accessibility issues

      Solving accessibility issues starts with awareness and ends with systematic action. Whether you’re improving an existing product or starting from scratch, following a consistent workflow makes accessibility scalable and sustainable.

      1. Start with an audit

      Begin by running an accessibility audit on your website or app. Use automated tools like axe DevTools or WAVE to fix the most common issues – like missing alt text, low contrast, or unlabeled form fields.

      But remember: automation only catches around 30–40% of accessibility problems.

      2. Complement with manual testing

      Manual testing is essential to uncover structural and experiential issues:

      • Use a keyboard to navigate your site – can you reach every interactive element? If not, you need to get fixing.
      • Turn on a screen reader to check the reading order and label clarity.
      • Zoom to 200% or more and see how layouts adapt.
      • Review form validation, error messaging, and interactive feedback.

      3. Fix strategically

      Rather than try and fix everything at once, concentrate on triaging issues based on severity and user impact – starting with high-traffic or pages that are critical for conversion. 

      Tackle foundational issues like:

      • Color contrast and font readability
      • Heading structure
      • Alt text and image roles
      • Keyboard traps and missing focus indicators

      4. Bake accessibility into your workflow

      Make sure you train your team. It sounds obvious, but as we know, it’s not always a focus point until you know how important it is. 

      You should add accessibility checks to your QA process, building and documenting inclusive design patterns from the start.

      Best tools for accessibility testing

      Choosing the right tools can significantly streamline your accessibility work. While no single solution catches everything, combining automated checks with manual testing will help uncover most major issues.

      1. WAVE (Web Accessibility Evaluation Tool)

      WAVE is a free browser extension that visually highlights accessibility problems on your webpage, like missing alt text, low color contrast, and structural errors. It’s beginner-friendly and great for quick audits.

      2. axe DevTools

      axe by Deque Systems is a powerful developer tool that integrates with browser DevTools. It provides detailed diagnostics and code-level suggestions, making it ideal for developers embedding accessibility in their workflow.

      3. Google Lighthouse

      Built into Chrome DevTools, Lighthouse runs automated audits for performance, SEO, and accessibility. It assigns an accessibility score and surfaces common issues like missing ARIA labels or small tap targets.

      4. Other helpful tools

      • Color contrast analyzers (e.g., TPGi or Stark)
      • HTML validators to ensure semantic structure
      • Browser zoom and keyboard-only testing for manual checks

      Remember, no tool is a silver bullet – but together, they help create a clear path to digital inclusion.

      Conclusion: Remove barriers, unlock inclusion

      Accessibility issues are more than just technical bugs – they’re barriers that prevent millions of people from fully participating in the digital world. 

      From missing alt text to poor color contrast and broken keyboard navigation, these problems can affect user experience, SEO performance, and legal compliance.

      But with the right knowledge and tools, your team can tackle these issues effectively, one fix at a time. Start with a thorough audit, prioritize critical pages, and embed accessibility into your design and development process moving forward.

      You’ll not only create a better experience for users with disabilities, you’ll build more resilient, inclusive, and future-proof digital products for everyone.

      The post How to identify and fix the most common accessibility issues appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      A complete guide to accessibility compliance for digital platforms https://www.iubenda.com/en/help/180938-accessibility-compliance-3/ Mon, 12 May 2025 10:01:51 +0000 https://help.iubenda.com/?p=180938 Digital accessibility is no longer a “nice-to-have” – it’s a legal, ethical, and commercial necessity.  As more services and content migrate online, businesses must make sure that all users –  including those with disabilities – can access and interact with digital platforms without barriers.  This is where accessibility compliance comes into play. At its core, […]

      The post A complete guide to accessibility compliance for digital platforms appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Digital accessibility is no longer a “nice-to-have” – it’s a legal, ethical, and commercial necessity. 

      As more services and content migrate online, businesses must make sure that all users –  including those with disabilities – can access and interact with digital platforms without barriers. 

      This is where accessibility compliance comes into play.

      At its core, accessibility compliance means adhering to standards and legal frameworks designed to make digital content usable for everyone, regardless of ability. 

      These standards support individuals who rely on assistive technologies like screen readers or keyboard navigation, but they also enhance the overall user experience and prioritize inclusivity.

      The problem is that, for many organizations, navigating the complexities of accessibility laws and implementing practical compliance strategies can feel overwhelming. There is a world of acronyms to contend with (WCAG, ADA, and EAA, anyone?), and with the list of requirements growing, it’s easy to get lost.

      In this article, we’re going to break it all down: what accessibility compliance means, why it matters, and how your organization can achieve and maintain it – while minimizing risk and creating a better web for all.

      First up, what is accessibility compliance?

      Accessibility compliance means that you’re making sure that digital products – such as websites, mobile apps, and online documents – are usable by everyone, including people with disabilities. Specifically, it means aligning your digital assets with established accessibility standards and legal requirements so that no user is excluded due to visual, auditory, motor, cognitive, or other impairments.

      The most widely recognized benchmark for accessibility is the Web Content Accessibility Guidelines (WCAG), developed by the World Wide Web Consortium (W3C). WCAG outlines principles for making web content perceivable, operable, understandable, and robust (the POUR principles). These guidelines help developers and content creators build more inclusive experiences, with levels of compliance ranging from A (basic) to AAA (the highest standard).

      Beyond WCAG, organizations must also consider jurisdiction-specific laws such as the Americans with Disabilities Act (ADA) in the U.S., the European Accessibility Act (EAA) in the EU, and Section 508 for U.S. federal agencies. These regulations may carry legal consequences if not followed.

      Compliance doesn’t just involve code. It includes accessible design choices, like using the best fonts for accessibility and appropriate color contrast, and providing alt text for images and text-to-speech support. 

      Remember, accessibility compliance is a legal requirement and a commitment to inclusive digital experiences.

      Why is accessibility compliance so important?

      Accessibility compliance isn’t just about ticking legal boxes – it’s about guaranteeing equitable digital access for all users, regardless of ability. 

      The internet is a vital space for communication, commerce, education, and civic participation. So when digital platforms exclude people with disabilities, they don’t just limit access, they make space for inequality.

      From an ethical standpoint, accessibility is fundamental to digital inclusion. Making your website or app usable for someone who relies on a screen reader, voice navigation, or a keyboard interface reflects a commitment to inclusive design and equal opportunity.

      The business case is just as compelling. Accessible websites benefit from better user experience, improved navigation, and broader audience reach. They’re also more SEO-friendly, as many accessibility best practices – like semantic HTML and alt text – support search engine indexing. 

      Plus, accessibility compliance can open the door to government contracts and partnerships that require WCAG or Section 508 adherence.

      Then there’s the legal dimension. Non-compliance can lead to lawsuits, fines, and reputational damage. High-profile cases involving companies like Domino’s, Netflix, and Target have shown that courts are increasingly siding with users who face digital barriers.

      For all these reasons, accessibility compliance is a strategic priority – not just a technical requirement.

      Key accessibility laws and regulations (that you need to know)

      Before you can get on the way to accessibility compliance, you need to understand the legal landscape.

      Below is an overview of the most influential laws and frameworks that may apply to your organization.

      Americans with Disabilities Act (ADA)

      The ADA is a civil rights law in the United States that prohibits discrimination against individuals with disabilities. While it doesn’t explicitly reference websites, U.S. courts increasingly interpret digital spaces as “places of public accommodation,” meaning websites and apps must be accessible under ADA Title III.

      Failing to comply can lead to costly lawsuits, particularly if your website serves the public. Businesses of all sizes have faced legal action, from global brands to local restaurants – don’t become one of them!

      Web Content Accessibility Guidelines (WCAG)

      We’ve already dipped into WCAG, but let’s explore it in more detail. 

      Developed by the W3C, WCAG is not a law but serves as the de facto global standard for digital accessibility. 

      Its three compliance levels – A, AA, and AAA – provide increasing levels of accessibility. As a frame of reference, most legal frameworks recommend or require conformance to WCAG 2.1 Level AA.

      European Accessibility Act (EAA)

      The European Accessibility Act is a landmark directive that standardizes accessibility rules across the EU. It applies to websites, mobile apps, e-commerce platforms, ticketing services, ATMs, and more – but importantly, only B2C businesses, who had to comply by June 28, 2025, and are now required to ensure ongoing compliance.

      Section 508 (U.S.)

      This federal law mandates that all U.S. government agencies – and any organizations doing business with them – make sure their electronic and information technology is accessible. 

      NOTE: Section 508 explicitly references WCAG compliance, so keep that in mind.

      Who needs to comply with accessibility standards?

      Accessibility compliance isn’t limited to public institutions or tech giants. A wide range of organizations – across sectors and sizes – may be legally or ethically required to meet accessibility standards.

      Public sector obligations

      In many jurisdictions, public bodies must follow strict accessibility laws. For example, Section 508 mandates compliance for U.S. federal agencies, while the EU Web Accessibility Directive enforces similar requirements for public sector websites and mobile apps in Europe.

      Private sector responsibilities

      Private companies are increasingly held accountable, too. In the U.S., businesses that offer “places of public accommodation” online – like e-commerce stores, banking platforms, and streaming services – are expected to meet ADA accessibility requirements. 

      In the EU, the upcoming European Accessibility Act extends those obligations to B2C businesses offering digital services across member states.

      But even if you’re not legally required to comply today, market forces and ethical expectations are driving widespread adoption. Enterprise partners, government contracts, and savvy consumers now expect inclusive digital experiences.

      Whether you’re a startup, a SaaS provider, a digital agency, or a municipality, if your platform serves the public – it should be accessible.

      Common barriers to accessibility compliance

      Despite the clear benefits and legal mandates, many organizations still struggle to achieve accessibility compliance. These challenges often stem from a combination of technical complexity, resource constraints, and a lack of internal awareness.

      Let’s take a closer look at each of the barriers. 

      1. Limited awareness and expertise

      Many teams are simply unaware of their accessibility obligations or assume that they are only relevant to public-sector entities. 

      Others may recognize the need but lack the in-house expertise to implement standards like WCAG effectively.

      2. Perceived cost and time investment

      Accessibility improvements are sometimes viewed as expensive or disruptive – especially when retrofitting legacy systems. But postponing compliance can be even more costly in the long run due to legal exposure and rework.

      3. Technical debt and outdated systems

      Older websites and applications often rely on inaccessible design patterns, non-semantic code, or proprietary platforms that make compliance difficult. Fixing these issues may require a phased approach, starting with quick wins and having a long-term strategic plan.

      4. Inconsistent processes

      Without clear workflows for testing, maintaining, and updating accessibility features, compliance efforts can be patchy or unsustainable over time.

      Understanding these common barriers is the first step toward overcoming them – and building a roadmap to sustainable, inclusive design.

      How to get on the road to accessibility compliance

      Achieving accessibility compliance isn’t a one-time fix – it’s an ongoing process that blends design, development, content strategy, and legal awareness. 

      Here’s a step-by-step framework to help your organization get started and stay compliant.

      1. Conduct an accessibility audit

      Start by evaluating your current digital assets – websites, mobile apps, PDFs, and customer portals. 

      Use both automated tools and manual testing to identify issues related to (not an exhaustive list):

      • Color contrast
      • Missing or improper alt text
      • Non-semantic HTML
      • Keyboard navigation
      • Labeling and form field issues

      2. Identify applicable standards and laws

      It’s important that you determine which legal frameworks apply to your organization. 

      For example:

      • ADA or Section 508 (U.S.)
      • European Accessibility Act (EU)
      • WCAG 2.1 AA (industry best practice globally)

      Though it can seem daunting, the earlier you identify this, the better, so you can get started.

      3. Prioritize remediation

      Remember, not all issues carry the same weight. 

      Prioritize critical barriers first – especially those that prevent access to core services or information. Implement low-hanging fixes immediately while developing a longer-term remediation roadmap.

      4. Embed Inclusive Design Principles

      You can easily bake accessibility into your design and development processes by:

      5. Maintain ongoing compliance

      Accessibility isn’t static. Create internal documentation, assign ownership, and revisit compliance regularly – especially when launching new features or redesigns.

      You can try an array of automated and manual testing techniques, such as:

      Automated accessibility testing tools

      These tools can quickly identify many common WCAG violations:

      • WAVE (Web Accessibility Evaluation Tool): Chrome extension that highlights contrast issues, missing alt text, and ARIA errors.
      • axe DevTools: A browser plugin that provides actionable diagnostics during development.
      • Google Lighthouse: Built into Chrome DevTools, this audit tool scores your site for accessibility and suggests fixes.

      Manual testing techniques

      You may want to try out some manual testing techniques, just to see how your accessibility fares in real life. 

      You can try:

      • Navigating your site using only a keyboard
      • Browsing with a screen reader like NVDA (Windows) or VoiceOver (macOS)
      • Zooming in to 200% to test layout responsiveness
      • Reviewing content for clear headings, labels, and focus order

      Assistive technology simulation

      Go beyond checklists and experience your platform like a real user would. 

      Simulating or using actual text-to-speech tools, alternative input devices, or speech recognition software can reveal usability gaps that others miss.

      Failing to meet accessibility compliance standards can result in serious legal and financial consequences – especially as global enforcement tightens.

      In the United States, lawsuits under the Americans with Disabilities Act (ADA) have surged in recent years. 

      These cases often target websites and mobile apps that are inaccessible to users with disabilities. Courts have consistently ruled in favor of plaintiffs, even when businesses claimed they weren’t aware of their obligations. Settlements and court rulings can cost companies tens or even hundreds of thousands of dollars, not to mention reputational harm.

      In the European Union, the European Accessibility Act (EAA) introduces structured enforcement mechanisms. Non-compliance can result in regulatory investigations, market withdrawal of non-conforming products, and substantial fines.

      With the compliance deadline set for June 2025, regulators are preparing to clamp down on any businesses who aren’t ready.

      Countries like Canada, Australia, and the UK also have strict accessibility mandates, and penalties vary depending on jurisdiction and sector.

      Inaction is not a neutral choice – it poses clear legal and commercial risks. Proactive compliance is a shield against litigation and a path to a more inclusive brand experience.

      Conclusion: compliance that drives inclusion – and growth

      Accessibility compliance is no longer optional – it’s essential. Whether you’re driven by ethical responsibility, legal risk, or business opportunity, building accessible digital experiences is the right move for your organization and your users.

      From understanding global regulations like the ADA, WCAG, and EAA, to embedding inclusive design and adopting the right testing tools, compliance can seem complex. But it doesn’t have to be.

      With the right strategy, partners, and mindset, accessibility becomes a powerful driver of innovation, trust, and brand reputation.

      The post A complete guide to accessibility compliance for digital platforms appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Designing for everyone: Why digital access is now a must-have https://www.iubenda.com/en/help/180711-digital-access-2/ Fri, 02 May 2025 08:37:00 +0000 https://help.iubenda.com/?p=180711 There’s a great divide. And it’s one that’s often overlooked; unnoticed in the frantic flurry of everyday life.  While technology keeps advancing at a rapid pace, we might not always think of those left behind: not everyone can access or use technology equally.  This is the digital divide.  With the digital world being woven into […]

      The post Designing for everyone: Why digital access is now a must-have appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      There’s a great divide.

      And it’s one that’s often overlooked; unnoticed in the frantic flurry of everyday life. 

      While technology keeps advancing at a rapid pace, we might not always think of those left behind: not everyone can access or use technology equally. 

      This is the digital divide. 

      With the digital world being woven into nearly every part of modern life – from education and healthcare to banking, shopping, and government services – it’s a divide that can accelerate the growth of other forms of inequality.  

      That’s where digital access comes in.

      Digital access means ensuring everyone, regardless of ability or circumstance, has equal opportunity to use digital tools, websites, and services. It’s about removing barriers that prevent people from participating in online life – whether it’s because of disability, age, device limitations, or other reasons.

      Digital access is something that many organizations overlook. But those that embrace it only stand to benefit, especially with governments around the world encouraging its adoption.

      By the end of this post, you’ll know the ins and outs of digital access, how you can get your business closer to compliance, and how you can help contribute to closing the digital divide.

      Why digital access matters in today’s world

      So much of everyday life relies on the digital world. We register for healthcare appointments, apply for jobs, pay bills, study, shop and connect with others – all through digital platforms. 

      But not everyone can do these things easily. When websites or apps aren’t designed with digital access in mind, they effectively shut out billions of people.

      It’s true: 2.6 billion people around the world don’t have digital access. That means they don’t enjoy the same opportunities and conveniences as the rest of the population.  

      That’s why digital access is so important. It ensures no one, regardless of circumstance or disability, is left behind. 

      Key barriers to digital access

      Even with the best intentions, many digital experiences still leave people behind. Here are some of the most common barriers:

      • Design that doesn’t consider diverse needs: Complex layouts, low-contrast colors, missing alt text, and inaccessible forms make it hard – or impossible – for users with visual, cognitive, or motor impairments to navigate content.
      • Lack of assistive technology support: Some websites and apps aren’t compatible with screen readers, keyboard navigation, or other assistive tools that many users rely on every day.
      • Language and literacy challenges: Complicated language, lack of translations and inaccessible documentation can alienate users who speak different languages or have lower literacy levels.
      • Device and connectivity limitations: Many people rely on mobile devices or slower internet connections. If a site is slow to load or not mobile-responsive, it instantly becomes unusable for a significant number of users.
      • Unclear or inconsistent UX: Confusing navigation, missing labels, and inconsistent layouts can create frustrating experiences – especially for users with cognitive or neurological conditions.

      The role of web accessibility in digital access

      Web accessibility is a cornerstone of digital access. It ensures that websites, apps, and digital tools are designed in a way so that everyone can perceive, navigate, and interact with them effectively.

      At its core, web accessibility is built around four key principles: content should be perceivable, operable, understandable, and robust – often referred to as the POUR principles. These are the foundation of the Web Content Accessibility Guidelines (WCAG) and the EU’s accessibility standards.

      Accessible design is about creating digital spaces that work for different needs, contexts, and abilities. That means:

      • Providing text alternatives for images and multimedia
      • Ensuring keyboard-only navigation is possible
      • Using sufficient contrast and readable font sizes
      • Structuring content clearly with headings and labels
      • Making sure interactive elements (like buttons and forms) are compatible with assistive technology

      When done right, web accessibility enhances digital experiences for all users, not just those with permanent disabilities. It supports aging populations, users in noisy environments, or people dealing with temporary impairments – ensuring everyone has equal digital access, no matter their ability or circumstance.  

      Digital access and inclusive technology

      Inclusive technology is a powerful enabler of digital access. It ensures people can independently access information, complete tasks and participate in digital spaces without needing help or workarounds – the essence of digital access.

      Inclusive technology involves tools, platforms, and systems that adapt to people, such as:

      • Screen readers and text-to-speech software for people with vision impairments
      • Speech recognition tools for those who can’t use a keyboard or mouse
      • Keyboard-only navigation and voice assistants for users with motor disabilities
      • Transcripts, captions, and sign language interpretation for users who are deaf and hard-of-hearing
      • Simplified, distraction-free interfaces for people with cognitive or neurological conditions
      • Customizable visual settings (like text size, color contrast, or dark mode) for better readability
      • Responsive, lightweight design that supports low-bandwidth connections or mobile-only users

      By embracing inclusive technology, organizations can reduce friction, reach more users, and create digital experiences that welcome everyone.

      How governments and organizations promote digital access

      Around the world, governments and organizations are stepping up with legislation  and strategic initiatives to close the digital divide:

      Americans with Disabilities Act

      In the US, the Americans with Disabilities Act (ADA) has long recognized accessibility as a civil right – and that increasingly includes digital spaces. 

      While the ADA was originally written with physical accessibility in mind, courts have repeatedly interpreted its provisions to apply to websites, mobile apps, and other digital services. This has led to a growing number of lawsuits and settlements involving organizations whose digital platforms failed to accommodate users with disabilities. 

      UK Accessibility legislation

      In the UK, the Equality Act 2010 legally requires organizations to make reasonable adjustments for people with disabilities – including in digital contexts. But the Public Sector Bodies (Websites and Mobile Applications) (No.2) Accessibility Regulations 2018 go a step further, mandating that all UK public sector websites and apps meet the WCAG 2.1 Level A and AA standards, publish an accessibility statement, and maintain accessibility as they update their content.

      The European Accessibility Act

      In the EU, the European Accessibility Act (EAA) is a major milestone. It’s an EU directive that aims to improve access to key products and services for people with disabilities. It came into force on June 28th 2025 and applies to businesses offering digital services or products to EU consumers.

      The EAA requires these products and services to follow core accessibility principles and to be compatible with assistive technology. Businesses must also provide an accessibility statement explaining how their services meet the requirements.

      While microenterprises are exempt, they’re encouraged to comply. Exemptions also apply to legacy systems, third-party content, and archived materials.

      Beyond legislation, many organizations are weaving digital access into broader diversity, equity, and inclusion (DEI) strategies. This includes building inclusive design into any digital products they develop, ensuring their websites and apps meet accessibility guidelines, and training staff in accessibility best practices. 

      And you can see, ensuring digital access is quickly becoming the norm across the world. Businesses that commit to improving accessibility by adhering to best practice will spare themselves the legal repercussions and penalties that come from non-compliance. 

      Best practices for improving digital access

      Improving digital access doesn’t have to be difficult. Small changes can make a big difference. Here are some best practices to build more inclusive digital experiences:

      • Start with accessibility in mind: Building digital access into your design and development processes from day one makes things easier – and it can be more affordable in the long run. 
      • Follow established standards: Use frameworks like the Web Content Accessibility Guidelines (WCAG 2.1 or higher) or, if applicable, the standards set in legislation such as the European Accessibility Act. These provide clear technical benchmarks for making content more accessible.
      • Make your content inclusive: Use clear, plain language. Structure pages with headings. Include alt text for images, captions for videos, and labels for form fields. Provide alternatives to flashing or moving content that can be distracting or harmful to certain users. 
      • Ensure keyboard navigation works: Many users rely on keyboards or assistive technologies to navigate. Make sure every interactive element can be accessed without a mouse.
      • Test with real users: Include users with disabilities in your testing processes to uncover barriers that tools might miss.
      • Be transparent: Publish an accessibility statement that outlines what you’re doing well and where you’re improving. 
      • Train your teams: Educate your designers, developers, content creators and marketers on accessibility principles and how they apply to their work.
      • Maintain accessibility over time: Accessibility isn’t a one-off task. As you add or update content, audit your platform regularly to ensure you’re not introducing new barriers.

      As well as following these best practices, there are simple tools that can help you improve digital access with minimal setup

      Digital access in education and the workplace

      Digital access has become a non-negotiable in both classrooms and offices. As more learning and work shift online, ensuring inclusive access to tools and content is essential for legal compliance and equal opportunity.

      In education

      From online classes to digital textbooks, students now rely heavily on digital platforms. But when those platforms aren’t accessible, entire groups of learners are left at a disadvantage.

      For example:

      • Course materials that don’t work with screen readers can prevent students from learning
      • Videos without captions exclude deaf or hard-of-hearing learners
      • Timed online tests without accommodations can be impossible for students with processing difficulties

      Accessible digital education empowers all students to participate fully. By adopting inclusive platforms, training educators in accessibility best practices, and providing accessible materials, schools can ensure greater digital access for their students. 

      In the workplace

      Digital systems are now the foundation of today’s work environments – from onboarding processes to internal communications and productivity tools. 

      If digital tools in the workplace aren’t accessible, they create barriers to productivity, inclusion and even hiring.

      An inaccessible intranet, for example, can prevent employees from accessing HR resources. A virtual meeting platform without captions can exclude deaf and hard-of-hearing team members. Even inaccessible job application forms can filter out qualified candidates before they get a chance.

      Accessible workplace tech supports diversity, equity, and inclusion and helps attract and retain talent from all backgrounds. It also improves collaboration, since accessible design often results in clearer communication and more user-friendly interfaces for everyone.

      A win-win for people and business

      Digital access is no longer optional. As more services, interactions, and systems move online, ensuring everyone can use them is both a legal obligation and a practical necessity.

      Addressing the barriers to digital access in your products and services isn’t just the right thing to do. It reduces legal risk, improves user experience, and extends your reach to a wider customer base. 

      Ensuring digital access is a win-win – and with our Accessibility Widget, you can start with just a couple of clicks. 

      The post Designing for everyone: Why digital access is now a must-have appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Breaking barriers: The ultimate guide to accessibility testing https://www.iubenda.com/en/help/179430-accessibility-testing-3/ Thu, 24 Apr 2025 12:51:42 +0000 https://help.iubenda.com/?p=179430 Accessibility isn’t just a nice-to-have – it’s a must.  You need to make sure your digital content is accessible. And that means you have to break down barriers that prevent people with disabilities from fully using your products.  Whether it’s a website, mobile app, or software platform, prioritizing accessibility improves user experience and helps you […]

      The post Breaking barriers: The ultimate guide to accessibility testing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Accessibility isn’t just a nice-to-have – it’s a must. 

      You need to make sure your digital content is accessible. And that means you have to break down barriers that prevent people with disabilities from fully using your products. 

      Whether it’s a website, mobile app, or software platform, prioritizing accessibility improves user experience and helps you stay on the right side of the law.

      With the rise of global standards like the Web Content Accessibility Guidelines (WCAG) and regulations like the European Accessibility Act 2025, more and more businesses are getting serious about accessibility testing. 

      However, despite its importance, many teams still struggle to test for accessibility effectively, leaving issues unresolved and users frustrated.

      In this guide, we’ll break down everything you need to know about accessibility testing – from the basics to advanced techniques.

      You’ll learn about manual and automated testing approaches, get practical tips for carrying out audits, and discover how to make your digital products more inclusive. 

      Let’s dive in!

      First, why accessibility testing matters

      Accessibility testing guarantees that everyone – including people with disabilities – can access and enjoy your digital content. 

      It’s not just about ticking boxes for compliance, it’s about making sure no one is left out.

      What are the risks of ignoring accessibility?

      Simply, skipping accessibility testing can cause big problems. 

      The most obvious one? Legal issues. With the European Accessibility Act 2025 having come into effect on June 28, 2025, companies are under pressure to make their digital content accessible. Ignoring it could mean lawsuits and damage to your brand’s reputation.

      There is also the user experience factor. Imagine a visually impaired person trying to navigate your website that lacks alt text or uses poor color contrast. Not only do they struggle, but they’re also highly likely to leave your site and never come back.

      Making user experience more inclusive

      Accessibility is about more than just avoiding lawsuits. It’s about putting users first. Incorporating human-centered design and testing with assistive technologies, like screen readers or the Android Accessibility Suite, makes your content usable for everyone.

      Plus, making your site more accessible benefits everyone, not just those with disabilities.

      Think keyboard navigation and clear text contrast. These are good for users with slow internet, mobile users, and anyone who appreciates a streamlined experience.

      Stay ahead of the curve

      Taking accessibility seriously sets your brand apart. It shows you’re proactive, responsible, and committed to inclusion. 

      It’s also a competitive advantage – customers appreciate brands that prioritize their needs.

      Key standards and guidelines

      Let’s talk about standards. 

      Accessibility testing is rooted in established standards and guidelines that define how digital products and services should be made accessible. Understanding these standards is crucial for effective testing and compliance. 

      Let’s look at the most widely recognized frameworks and regulations that guide accessibility practices.

      Web Content Accessibility Guidelines (WCAG)

      The Web Content Accessibility Guidelines (WCAG) are the most widely adopted set of guidelines for web accessibility. Managed by the World Wide Web Consortium (W3C), WCAG provides a comprehensive framework organized into four key principles: Perceivable, Operable, Understandable, and Robust (often abbreviated as POUR).

      WCAG is structured into three conformance levels:

      • A (Minimum accessibility): Basic web accessibility features.
      • AA (Mid-range accessibility): Deals with the most common accessibility barriers.
      • AAA (Highest accessibility): Offers enhanced accessibility, which is often difficult to achieve across all content.

      Adhering to WCAG 2.1 AA is typically considered the industry standard for web accessibility.

      Americans with Disabilities Act (ADA)

      The ADA is a U.S. civil rights law that prohibits discrimination based on disability. While it initially targeted physical spaces, it has since been interpreted to cover digital environments, especially websites.

      Guaranteeing compliance with ADA standards is vital for U.S.-based businesses to avoid legal challenges and public backlash.

      Section 508 of the Rehabilitation Act

      This regulation mandates that all federal agencies’ electronic and information technology be accessible to people with disabilities. Section 508 compliance is essential for government websites and any businesses that contract with federal agencies.

      European Accessibility Act (2025)

      The European Accessibility Act (EAA) sets out comprehensive requirements for products and services to be accessible to people with disabilities. It covers websites, mobile apps, e-commerce, and more, making it essential for businesses operating within the EU.

      Other international standards

      Remember, different countries have their own accessibility requirements, so it’s important to check that you’re covered everywhere you operate.

      Here are a few examples:

      • Canada: Accessibility for Ontarians with Disabilities Act (AODA)
      • Australia: Disability Discrimination Act (DDA)
      • United Kingdom: Equality Act 2010

      By aligning your testing practices with these standards, you ensure that your digital content meets legal requirements and provides an inclusive user experience. 

      Types of Accessibility Testing

      Accessibility testing can be conducted through various methods, each serving a unique purpose in identifying and addressing accessibility barriers. 

      The most effective approach often involves combining multiple testing methods to cover both technical and user-centered aspects. 

      Let’s take a look:

      Manual accessibility testing

      Manual testing involves human evaluators interacting directly with the website or application to identify accessibility barriers. While it can be time-consuming, it offers nuanced insights that automated tools may miss, such as contextual issues or nuanced usability challenges.

      Techniques for manual accessibility testing

      1. Screen reader testing: Using tools like NVDA, JAWS, or mobile options like TalkBack to ensure compatibility.
      2. Keyboard navigation: Checking whether users can fully navigate the site using only a keyboard.
      3. Color contrast analysis: Verifying that text and background combinations meet minimum contrast ratios (e.g., using a color contrast analyzer).
      4. Alt text verification: Making sure that alt text for images is meaningful and accurate.
      5. ARIA Roles and Labels: Verifying the correct use of ARIA roles to provide semantic meaning and screen reader support.

      Automated accessibility testing

      Automated testing tools quickly scan digital content to identify common accessibility issues. While they are efficient at detecting technical problems, they cannot replace the thoroughness of manual testing. 

      As a result, automation should complement manual efforts rather than replace them.

      Popular automated testing tools

      • Axe Accessibility Checker: Integrates into browser developer tools to find WCAG violations.
      • WAVE (Web Accessibility Evaluation Tool): Analyzes entire web pages and highlights errors.
      • Pa11y: An open-source tool for testing web accessibility.
      • Lighthouse (by Google): Provides accessibility scores and suggestions for improvement.

      User testing with people with disabilities

      Testing with actual users who have disabilities is a critical component of a comprehensive accessibility strategy. 

      Automated and manual methods often miss real-world challenges that users face, such as navigating complex forms or interpreting content with screen readers.

      Key considerations

      • Diverse user base: Involve users with various disabilities, including visual impairments, hearing impairments, and cognitive disabilities.
      • Assistive technology testing: Evaluate how digital products work with tools like Android Accessibility Suite and screen readers.
      • Cognitive load considerations: Make sure that content is presented clearly to reduce cognitive strain, especially for users with conditions like dyslexia.

      Practical tips

      • Task-based testing: Give users real tasks to complete, such as filling out a form or navigating to specific content.
      • Feedback gathering: Collect insights about usability challenges directly from users.
      • Accessibility iconography: Use standard icons and symbols that users with cognitive or visual impairments recognize.

      Why combining methods is essential

      Relying on just one method of testing can leave significant gaps. By combining manual, automated, and user testing, organizations can achieve more comprehensive and accurate results. This multi-faceted approach ensures that both technical compliance and real-world usability are addressed, delivering a fully inclusive digital experience.

      Next, we’ll dive into some of the most common accessibility barriers that are uncovered during testing and how to address them effectively.

      Common accessibility barriers

      Let’s take a look at some of the most common issues you’ll run into during accessibility testing:

      • Missing alt text: Screen readers can’t describe images without it.
      • Poor color contrast: Makes text hard to read, especially for visually impaired users.
      • Inaccessible navigation: If users can’t navigate via a keyboard, that’s a problem.
      • Cognitive load issues: Overly complex content can overwhelm users with cognitive disabilities.
      • Wrong ARIA Labels: Incorrect roles confuse screen readers and users alike.

      Fixing these issues not only makes your content accessible but also improves the overall user experience.

      How to perform an accessibility audit on your website

      Conducting an accessibility audit is a systematic way to find and fix accessibility issues. You need to follow these steps to make sure your digital product meets current standards:

      1. Plan your audit: First, you need to identify the pages and components to test.
      2. Use automated tools first: Make sure you run automated scans to detect common issues.
      3. Conduct manual checks: Test for things that automation might miss, like keyboard navigation and screen reader compatibility.
      4. User testing: Remember to involve real users with disabilities to get genuine feedback on usability; otherwise, you’re basing your findings on assumptions.
      5. Document findings: Create a report outlining detected issues and their severity so you always have a point of reference.

      Steps to fix accessibility issues after testing

      Once you’ve identified issues during your audit, it’s time to fix them.

      1. Prioritize issues: Focus on high-impact problems first, like navigation barriers and missing alt text.
      2. Implement fixes: Adjust code, design elements, and content based on findings. Our Accessibility Widget aims to make websites more accessible by using AI to scan for issues and automatically adjust code to improve accessibility for users with disabilities.
      3. Test fixes: Re-run automated tools and manual checks to confirm fixes are effective.
      4. Gather feedback: Engage users to test improvements and ensure better usability.
      5. Maintain accessibility: Make ongoing testing part of your workflow to keep your site accessible.

      What are the best tools for accessibility testing?

      As we know, a workperson is only as good as their tools. Make sure you’re working out what’s best for you and your users.

      You can try:

      • Axe Accessibility Checker: A browser extension that finds WCAG violations and helps you correct them.
      • WAVE: A tool that visually highlights accessibility errors on web pages.
      • Lighthouse (by Google): Evaluates accessibility alongside performance and SEO.
      • Pa11y: Open-source tool for automated accessibility testing.
      • Color Contrast Analyzer: Ensures text and background contrast meet guidelines.

      Making digital spaces accessible for everyone

      Accessibility testing isn’t just about compliance – it’s about making your digital spaces welcoming and usable for everyone. By combining manual testing, automated tools, and user feedback, you can make sure your content is accessible to all.

      Take action now to make your site more inclusive. Start testing today and make your digital products better for everyone!

      The post Breaking barriers: The ultimate guide to accessibility testing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Your guide to the European Accessibility Act: Scope, requirements, and next steps https://www.iubenda.com/en/help/179096-eaa-compliance-2/ Mon, 14 Apr 2025 14:26:17 +0000 https://help.iubenda.com/?p=179096 On a good day, a website just works. Everything is easy to navigate. The content makes sense. You don’t have to wrestle with weird buttons or unreadable text. For millions of people with disabilities, that’s unfortunately rarely the case.  But new legislation aims to change that. The European Accessibility Act (EAA) is a sweeping piece […]

      The post Your guide to the European Accessibility Act: Scope, requirements, and next steps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      On a good day, a website just works.

      Everything is easy to navigate. The content makes sense. You don’t have to wrestle with weird buttons or unreadable text.

      For millions of people with disabilities, that’s unfortunately rarely the case. 

      But new legislation aims to change that.

      The European Accessibility Act (EAA) is a sweeping piece of EU legislation that took effect on June 28, 2025. It applies to businesses that sell digital products or services in the EU, including many SMBs and international companies.

      However, with this act set to hit, businesses across Europe are left wondering whether they’re about to be in breach of the law.

      So, what are you supposed to do?

      In this guide, we’ll break down what the EAA is, who it applies to, and how you can get your business ready.

      What is the European Accessibility Act (EAA)?

      The European Accessibility Act (Directive 2019/882) is an EU directive that aims to improve access to digital and physical products and services for people with disabilities.

      It applies to a wide range of services and sectors, from e-commerce and banking to media, telephony, and transport, including the websites and mobile apps that power them.

      This law builds on the earlier Web Accessibility Directive, which focused on public sector websites. The EAA takes things a few steps further by extending accessibility obligations to private businesses.

      Who must comply with the European Accessibility Act?

      The EAA applies to EU-based and non-EU businesses offering products or services within the European Union.

      In general, you need to comply if:

      • You sell digital products or services in the EU: This includes anything from physical goods sold through a website to services like video streaming, online banking, or transport booking – if it’s available to EU consumers, it counts. 
      • You employ 10+ people or have over €2 million in annual turnover or balance sheet: These are the official thresholds, and you need to exceed at least one of them to fall under the EAA. If you’re under both, you may qualify for the microenterprise exemption. 
      • Your website or app serves consumers (B2C): If your platform is meant for everyday users, it’s considered customer-facing. That means it’s subject to the EAA.

      Even if you’re based outside the EU – whether in the UK, the US, or elsewhere – you’re still on the hook if your offering reaches EU consumers.

      Microenterprises (under 10 employees and under €2M in turnover or balance sheet total) are exempt, but they’re still strongly encouraged to comply voluntarily. 

      It’s important to remember that an accessible website is a user-friendly website. So, even if your business doesn’t fall under the remit of EAA compliance, making your website compliant allows you to:

      • Reach more users (including the 27% of the EU population with a disability)
      • Improve SEO and performance
      • Enhance brand reputation
      • Support legal compliance across multiple regions to meet standards such as the US (ADA) and UK accessibility laws

      🤔 Not sure where you fall?

      Take our 1-minute quiz

      Key requirements of the European Accessibility Act

      Under the EAA, covered businesses must design products and services that are accessible to people with disabilities – including websites and apps.

      This means meeting criteria such as:

      • Offering information through multiple sensory channels: For example, combining visual text with audio or tactile outputs.
      • Making content perceivable and understandable: So users can find and interpret information clearly and easily.
      • Using readable fonts, sufficient contrast, and adjustable spacing: To improve legibility and adapt to different visual needs.
      • Supplementing visual elements with text or audio alternatives: Like alt text for images or transcripts for video and audio.
      • Supporting screen readers and keyboard navigation: To allow people to access and move through content without a mouse. 
      • Following the POUR principles: Perceivable, Operable, Understandable, Robust

      How the EAA affects websites and digital services

      If your site or app helps users buy something, book something, watch something, or communicate, chances are it’s covered.

      Some examples of affected services include:

      • E-commerce websites and digital marketplaces
      • Online banking and financial apps
      • Video streaming platforms
      • Public transport booking systems
      • E-books and digital reading platforms
      • Customer communication services (e.g., VoIP or messaging)

      And remember: it’s not just about what’s visible. The entire user journey – forms, buttons, pop-ups, error messages – needs to be accessible.

      European Accessibility Act vs. Other accessibility laws

      While the EAA is the EU’s biggest step toward digital accessibility, it’s part of a larger global trend. Countries across the world are introducing their own accessibility rules to try to make life easier for people with disabilities. 

      Here’s how the laws compare:

      Region Law Who it applies to
      EU European Accessibility Act (EAA) and relevant national transposition legislation Private businesses with digital offerings to EU consumers
      EU (public sector) Web Accessibility Directive Public sector websites and apps
      US Americans with Disabilities Act (ADA) Public-facing websites and apps, mostly Title III
      UK Equality Act 2010 & Accessibility Regulations Public sector, with some private obligations
      Italy Legge Stanca Law 4/2004 Public sector and very large private entities

      Deadlines and compliance timeline

      Here’s what you need to know about the EAA compliance deadlines:

      • June 28, 2025 This is the main compliance deadline under the EAA
      • For products – Only those placed on the market after June 28, 2025, must comply
      • For services – All services provided to consumers after June 28, 2025 must comply, even if the service was originally launched before that date

      This means that if you continue to offer a service (like a website or an app) beyond the deadline, it has to meet EAA accessibility requirements, no matter when it was created. 

      The EAA also allows for transitional periods. For example, services that rely on older products that were already in use before the deadline can continue operating under certain conditions until June 28, 2030. 

      Penalties for non-compliance

      Because the EAA is a directive, enforcement varies by country. But in all EU member states, authorities will:

      • Investigate complaints: Member States must establish procedures to investigate and address reported accessibility issues.
      • Respond to identified accessibility issues: Action can be taken if a complaint or report reveals that services fail to meet EAA requirements
      • Issue fines or other penalties: If you’re found to be non-compliant, you can face sanctions. Member States define their own penalties, which may include corrective actions, sanctions, or other consequences.

      Penalties must be effective, proportionate, and dissuasive – but the exact measures are determined by each Member State. That could mean anything from corrective actions, sanctions, or other consequences, depending on national law. 

      Ignoring the EAA doesn’t just hurt your users. It could hurt your business, too.

      How to make your business EAA-compliant

      Getting ready for EAA compliance shouldn’t just be a box-checking exercise. It’s about improving your business and giving it a more inclusive digital presence, benefiting all customers, not just those with disabilities. 

      Here’s how to start:

      Step 1: Audit your site or app

      Use automated tools like WAVE, axe, or Lighthouse to identify any key issues.

      Step 2: Fix the major barriers

      Once you’ve identified your site’s accessibility issues, start by resolving the most common and high-impact problems. This can include things like:

      • Adding missing alt text to images: So screen readers can describe visual content to users with visual impairments
      • Increasing color contrast between text and background: To improve readability for users with low vision or color blindness
      • Enabling keyboard navigation for all interactive elements: So users can browse your site without using a mouse
      • Updating form labels and error messages for clarity: To help assistive technologies interpret and communicate input fields
      • Making pop-ups and modals accessible to screen readers: So important content isn’t missed or blocked

      Step 3: Add accessibility tools

      You can support your efforts by adding a few front-end accessibility widgets. This allows users to personalize their browsing experience so that it fits their needs. For example:

      • Text resizing options: So users can increase font size without breaking layout
      • Color contrast toggles (e.g., dark mode, high contrast): To support different visual preferences or needs
      • Keyboard focus enhancements: To make sure users can see where they are on the page
      • Options to pause animations or flashing elements: To reduce distractions and support users with epilepsy or cognitive sensitivities

      Tools like iubenda’s Accessibility Widget offer an easy way to introduce these kinds of real-time adjustments with just one line of code – helping you to improve your accessibility without a full site rebuild. 

      However, it’s important to note that while these tools improve the accessibility and usability of websites, they’re not a complete solution on their own – full compliance still requires addressing issues at the source.

      Step 4: Publish an accessibility statement

      Annex V of the EAA requires you to describe your accessibility efforts. This shows transparency and supports compliance.

      Step 5: Make accessibility part of your workflow

      From new content to design updates – build accessibility into your process. That way, you can stay ahead of the game and not spend time playing catch-up.

      Start improving your site’s accessibility today with iubenda’s Accessibility Widget

      One line of code. Real-time adjustments. No overhaul needed.

      FAQs on the European Accessibility Act (EAA)

      It’s an EU directive that requires many businesses to make their products, services, websites, and apps accessible to people with disabilities by June 28, 2025.
      If you sell products or services in the EU, have at least 10 employees, or make over €2 million annually – yes.
      E-commerce, banking, media, telephony, transport booking, and more. If your site helps consumers transact or access services, it’s likely covered.
      Not by themselves. Accessibility overlays – including tools like iubenda’s – can help improve usability, but true compliance requires fixing accessibility issues at the source as well.
      Yes – microenterprises, legacy systems, third-party content, and more. However, even exempt businesses are encouraged to comply voluntarily.
      Each EU Member State defines its own enforcement measures. This can include corrective actions, sanctions, or other consequences – depending on how the EAA has been implemented at the national level.
      The EAA is similar in spirit to the ADA but applies across the EU and includes detailed digital accessibility obligations.

      The post Your guide to the European Accessibility Act: Scope, requirements, and next steps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      ADA compliance for websites: Legal risks, guidelines, and how to get started https://www.iubenda.com/en/help/179091-ada-compliance-2/ Mon, 14 Apr 2025 13:54:57 +0000 https://help.iubenda.com/?p=179091 Don’t you just love it when you open up a website and it’s instantly accessible?  Everything is in the right place, there’s a logical flow, and you can navigate it without thinking twice.  For millions of people, especially those with disabilities, website accessibility is the be-all and end-all for their online experience.  The Americans with […]

      The post ADA compliance for websites: Legal risks, guidelines, and how to get started appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Don’t you just love it when you open up a website and it’s instantly accessible? 

      Everything is in the right place, there’s a logical flow, and you can navigate it without thinking twice. 

      For millions of people, especially those with disabilities, website accessibility is the be-all and end-all for their online experience. 

      The Americans with Disabilities Act (ADA) is one of the most important pieces of legislation protecting the rights of people with disabilities in the US. 

      While it was originally written to make physical spaces more accessible, the law has increasingly been interpreted to apply to online spaces like websites and digital services.

      But what does all of this mean for you? 

      Well, the short answer is that your business could face legal and financial consequences if your website creates any barriers for users with disabilities. 

      In this guide, we’ll take a look at what ADA compliance means in the digital world, who needs to comply, and how to get your site on the road to compliance – while also improving user experience, SEO, and your brand’s reputation. 

      What is ADA compliance?

      ADA compliance is – as the name suggests – compliance with the requirements of the ADA, shorthand for the Americans with Disabilities Act. 

      The original law prohibits discrimination against individuals with disabilities in all areas of public life, including employment, education, transportation, and access to goods and services. 

      The act was originally enacted by the 101st United States Congress on July 26th, 1990. 

      But a lot has changed since then, with the digital world taking off and becoming a much larger part of our day-to-day lives and society. 

      So, while the original ADA text doesn’t specifically mention websites, US courts and the Department of Justice have made it clear that websites can be considered places of public accommodation under Title III of the ADA – especially for businesses open to the public. 

      Why ADA compliance matters for websites and businesses

      Failing to make your website accessible has several downsides, not just in a legal sense. 

      It also means:

      • Excluding millions of potential customers with disabilities.
      • Missing out on SEO and traffic benefits from a well-structured, user-friendly website. 
      • Damaging your brand reputation. 

      The simple truth is that accessible websites perform better, serve more users, and show a commitment to inclusivity – which today’s customers increasingly expect. 

      So, making your website ADA-compliant is a real win-win situation.

      Who needs to comply with the ADA?

      In general, ADA compliance applies to:

      • Businesses that operate in the public sphere: Businesses in retail, hospitality, healthcare, finance, education, and more are expected to provide equal access in both physical and online spaces.  
      • State and local government entities: Public sector organizations are covered under Title II of the ADA and must make their websites and digital services accessible. 
      • Private businesses with 15 or more employees: While ADA lawsuits have mainly targeted public-facing businesses, private employers of a certain size are also subject to ADA rules. 
      • Any website or app that offers goods or services to the public: If your digital presence functions as a storefront or service portal, courts may view it as a place of public accommodation – regardless of your business size. 

      In practice, this means that if you run a business website that allows users to browse products, book appointments, make purchases, or access information, your digital presence is expected to be accessible – especially under Title III of the ADA.

      Even if you’re not based in the US, if your website targets or serves US users, you could still be at risk. 

      ADA compliance and WCAG: What’s the connection?

      Unfortunately, there’s no single checklist published by the US government that guarantees ADA compliance. However, the DOJ has repeatedly pointed to the Web Content Accessibility Guidelines (WCAG) as the standard businesses should aim to meet. 

      The WCAG, currently in version 2.1 (with 2.2 recently published), outlines best practices for making digital content accessible to people with various disabilities – including visual, auditory, motor, and cognitive impairments.

      Some of the key principles include:

      • Text alternatives: For images, videos, and other non-text content
      • Keyboard accessibility: Everything must be usable without a mouse
      • Readable and structured content: With logical heading levels
      • Sufficient contrast: Between text and background
      • Resizing and zooming support: Without loss of content or functionality
      • Clear labels and instructions: For forms and inputs
      • Error messages and validation: With easy-to-understand text
      • No time limits or content that triggers seizures: Without having full user control

      That means that making your website WCAG-compliant is the best step you can take to reduce your legal risk and support users with disabilities.

      And remember, meeting these requirements improves usability for everyone – not just people with disabilities. 

      Common barriers to ADA compliance

      Sometimes, even the best-designed websites can accidentally fall short on accessibility. 

      Here are some of the more common issues to look out for: 

      • Missing image alt text: No descriptions for images or visual elements
      • Low contrast text: Hard to read for users with visual impairments
      • Unclear button or link labels: When readers can’t interpret the action of a button
      • No keyboard navigation: Users can’t navigate without a mouse
      • Poor form labels or error messages: Forms become confusing or unusable
      • No captions or transcripts: Videos aren’t accessible to deaf users
      • Inaccessible pop-ups and banners: Messages that trap focus or block screen readers

      Some of these might seem like small, even insignificant details, but they can make a huge difference in whether or not someone can actually use your site – so they’re worth your consideration. 

      How to make your website ADA-compliant

      Here are a few key steps that could bring you closer to ADA requirements:

      Step 1: Audit your current website

      The first step is to run an accessibility audit on your website. You can do this by using tools such as: 

      • WAVE (Web Accessibility Evaluation Tool)
      • axe DevTools
      • Google Lighthouse

      These tools can help you pick out common issues. But remember that automated tools don’t catch everything, so a manual review is still needed. 

      Step 2: Fix key issues

      After you have your list of issues, you can start fixing the most urgent accessibility problems. Things you should focus on first include:

      • Adding alt text to images: So screen readers can describe visual content
      • Improving text contrast: To help users with low vision read more easily
      • Enabling keyboard navigation: So users can move through your site without a mouse
      • Updating form labels and error messages: To make forms and messages usable and understandable for assistive tech users

      If your site uses pre-built themes or components, make sure they follow accessibility best practices.

      Step 3: Add an accessibility interface

      Tools like the iubenda Accessibility Widget can help improve your website’s usability through real-time adjustments, such as resizing text, enabling keyboard navigation, or changing contrast.

      Just remember, overlays and widgets can support accessibility, but they don’t replace a fully accessible website. The DOJ has made it clear that compliance requires addressing accessibility at the source.

      Step 4: Create an accessibility statement

      An accessibility statement is a page or document that outlines your accessibility goals, what you’ve done to meet them, and how users can contact you if they face difficulties. 

      It shows transparency and helps fulfill requirements under the ADA and the European Accessibility Act (EAA).

      Step 5: Build accessibility into your workflow

      ADA compliance isn’t a one-time fix. Every time you update your site – whether it’s a new blog post or a redesign – accessibility needs to be part of the process.

      Tools to help with ADA compliance

      As we just mentioned, there are some tools out there that can help support your efforts to make your website more accessible. 

      Here are a few:

      • Accessibility testing tools: WAVE, axe, Lighthouse
      • Screen readers: NVDA (free), JAWS (paid), VoiceOver (Mac)
      • Keyboard-only navigation testing
      • iubenda Accessibility Widget: Helps address common accessibility challenges through AI-powered adjustments – and offers an easier path to more inclusive design

      Legal risks and penalties for non-compliance

      When you ignore accessibility, you create a bad user experience for people who visit your website – but you can also land yourself in legal trouble.

      In recent years, ADA website lawsuits have skyrocketed in the US. In fact, according to an ADA website accessibility annual report, 2024 saw over 3,000 lawsuits filed in state and federal courts

      Businesses in all industries, from retail and finance to hospitality and healthcare, have been targeted for failing to provide accessible websites.

      The penalties for non-compliance can include:

      • Legal fees and settlement costs
      • Court-mandated accessibility fixes
      • Reputational damage
      • Loss of customers and trust

      To put it simply, the cost of non-compliance can far exceed the cost of doing it right in the first place.

      What is the European equivalent of the ADA?

      There isn’t a direct one-to-one equivalent of the ADA in Europe. Instead, the responsibilities are split across two key pieces of legislation:

      • The Web Accessibility Directive (WAD): This applies to public sector websites and mobile apps.
      • The European Accessibility Act (EAA): Came into effect on June 28, 2025, this applies to certain private businesses offering digital services and products within the EU

      Together, these laws cover many of the same areas as the ADA, although they apply differently across sectors. 

      Read our guide on the EAA and international accessibility laws here to learn more. 

      Accessibility is good for business

      ADA is about so much more than just avoiding lawsuits and fines. 

      When you make your website more accessible, you’re creating a space that allows everyone to interact with your brand – regardless of their capabilities. 

      That means fewer barriers, better experiences, and more loyal customers. 

      Remember, an accessible website:

      It also sends a clear message that your business values inclusion, usability, and doing the right thing. 

      And with the right tools and mindset, accessibility doesn’t have to be overwhelming.

      iubenda’s Accessibility Widget offers a simple, cost-effective way to start improving your website’s accessibility today.

      FAQs on ADA compliance

      It means making your website accessible for people with disabilities, following standards like WCAG to remove barriers and improve accessibility.
      As stated by the ADA.gov website, any business or organization that serves the public, commercial facilities, transportation providers, and telecommunication companies, especially those with 15+ employees operating in the US.
      Accessibility features include alt text, keyboard navigation, high-contrast text, readable fonts, captions for videos, and screen reader compatibility.
      Use tools like WAVE or Lighthouse, or explore accessibility solutions like iubenda’s widget for real-time support. You can also follow this up with a manual audit of your website.
      You could face legal complaints, lawsuits, and reputational damage.
      No – WCAG is a set of guidelines, whereas ADA is the law. However, courts and the DOJ often refer to WCAG as the standard for ADA compliance, even though it’s not an official legal requirement.
      In Europe, the closest equivalent is the European Accessibility Act (EAA), which began enforcement on June 28, 2025.

      The post ADA compliance for websites: Legal risks, guidelines, and how to get started appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      Accessibility 101: Here’s what you need to know about web accessibility https://www.iubenda.com/en/help/178117-accessibility-101-5/ Thu, 10 Apr 2025 13:54:19 +0000 https://help.iubenda.com/?p=178117 When Tim Berners-Lee created the internet, he didn’t think it would turn out like this. He envisioned it as a force for good – one that would level the playing field and bring equality to all. But 36 years later, that vision is still far from reality. The internet remains inaccessible to many. Only now, […]

      The post Accessibility 101: Here’s what you need to know about web accessibility appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

      ]]>
      When Tim Berners-Lee created the internet, he didn’t think it would turn out like this.

      He envisioned it as a force for good – one that would level the playing field and bring equality to all. But 36 years later, that vision is still far from reality.

      The internet remains inaccessible to many. Only now, with legislation like the European Accessibility Act (EAA) coming into force in 2025, are we seeing a real push to change that.

      So, how can you be part of this change? 

      By the end of this post, you’ll have discovered everything you need to know about accessibility – what it is, some of the legal requirements, and how it benefits both people and businesses alike. 

      What is accessibility?

      Making your website or mobile app accessible means ensuring that all users, including those with disabilities, can navigate, understand, and interact with your digital content.

      Accessibility isn’t just about compliance. It’s about creating a better experience for everyone, strengthening your brand, and ensuring you reach the widest possible audience.

      💡 Find out more about accessibility

      If you’d like to discover more about accessibility and its importance, take a look at digital access and digital inclusion.

      Types of accessibility

      So, what does accessibility look like in practice? It spans multiple areas:

      • Web accessibility: Ensuring websites are navigable with screen readers, keyboard shortcuts, and alternative text for images.
      • Mobile accessibility: Designing apps and interfaces to be accessible across different devices. This means supporting features such as voice commands, gesture controls, and adaptive screen layouts.
      • Software accessibility: Making software more inclusive with customizable settings, voice-to-text capabilities, and adjustable fonts.
      • Content Accessibility: Ensuring that all digital content – text, images, and videos – is structured for easy understanding and navigation, including captions for videos and descriptive alt text for images.
      💡 Find out more about the different types of accessibility

      Get a clearer picture of the subject by taking a look at our examples of accessibility.

      Why accessibility matters in the digital world

      Accessibility ensures that people with disabilities – including those with visual, auditory, cognitive, and motor impairments – can fully participate in the digital world. 

      Technology plays an integral role in everyday life. Without accessibility, barriers prevent people from accessing education, employment, shopping, and even essential services. 

      It ends up excluding a large number of people in our society. 

      Besides the ethical considerations, accessibility is also important for business. 

      Websites and apps designed with accessibility in mind often see increased engagement and conversion rates – as they offer a smoother, more intuitive experience for everyone. 

      Accessibility features such as voice navigation, legible fonts, and high-contrast designs also improve usability for individuals without disabilities, making digital products more user-friendly overall.

      Common barriers to accessibility

      What is it about most websites and digital platforms that make them inaccessible? 

      Many websites remain inaccessible due to common issues like:

      • Lack of alternative text for images: Screen readers rely on alt text to describe images to visually impaired users.
      • Poor color contrast: Low contrast between text and background makes reading difficult for users with visual impairments.
      • Inaccessible forms: Forms that lack proper labels and instructions can be difficult to complete using assistive technology.
      • Inconsistent or complex navigation: Poorly structured menus and unclear headings make it hard for users to find the information they need.
      • Lack of keyboard accessibility: Some users rely on keyboards instead of mice or touchscreens. Inaccessible designs make navigation difficult.
      • Uncaptioned audio and video content: Hearing-impaired users need captions to understand multimedia content.
      💡 Find out more about common barriers to accessibility

      To develop a deeper understanding of these common barriers, see accessibility issues.

      WCAG guidelines

      The Web Content Accessibility Guidelines (WCAG), developed by the World Wide Web Consortium (W3C) and founded by Tim Berners-Lee, set the international standard for digital accessibility.

      Adhering to WCAG helps businesses and organizations create a more inclusive digital space while ensuring compliance with various accessibility laws worldwide. Following these guidelines not only reduces legal risks but also improves user engagement, SEO performance, and overall user satisfaction.

      WCAG is continuously updated to reflect technological advancements and the changing needs of users with disabilities. Staying informed on the latest updates ensures that your website remains accessible and compliant with evolving standards.

      💡 Find out more about the web content accessibility guidelines

      You can dive deeper into the WCAG by reading web content accessibility guidelines.

      Key principles of accessibility

      The WCAG are built on four key principles, commonly referred to as POUR. This stands for Perceivable, Operable, Understandable, and Robust. 

      Ensuring your website or app and its content align with these key principles means you’re on the right track when it comes to accessibility.

      Perceivable

      Content must be presented in ways that users can perceive. This means providing text alternatives for images, ensuring there’s enough color contrast so text is easy to read, and offering captions for multimedia content.

      Operable

      Users must be able to navigate and interact with the content using different input methods, including keyboards and screen readers. Important things to keep in mind include avoiding flashing elements that could trigger seizures and ensuring buttons and links are accessible.

      Understandable

      Information and navigation must be clear so people don’t get confused. This involves having a structure that makes information easy to find, legible fonts, and clear instructions for interactive elements.

      Robust

      Content must also be compatible with current assistive technology and future developments. Using standardized coding practices and adhering to accessibility guidelines ensures that websites, apps, and their content will be accessible long into the future.

      How you can improve accessibility

      The great news is that improving accessibility doesn’t have to be complicated. Here’s where you can start:

      • Conduct regular accessibility audits: Use automated tools and manual testing to identify and fix accessibility issues.
      • Use accessible design principles from the start: Designing with accessibility in mind prevents costly fixes in the future. 
      • Provide text alternatives for multimedia content: Include captions, transcripts, and audio descriptions.
      • Ensure keyboard and screen reader compatibility: Test websites and apps to confirm usability without a mouse.
      • Offer clear and simple navigation: Use descriptive links, consistent menus, and logical content structure.
      • Implement proper color contrast and legible fonts: Ensure text is legible in all viewing conditions.
      • Test with real users, including those with disabilities: Getting feedback from actual users ensures your content is genuinely accessible. 

      Making your website accessible

      What does accessibility look like on a website? Below you’ll find some examples. Although it isn’t an exhaustive list, ensuring your website has these features will help make it more accessible:

      • Screen-reader compatible code
      • Adaptable contrast settings
      • Text resizing options
      • Keyboard navigation
      • Cursor enhancements for people with motor impairments
      • Adjustable controls for animations and dynamic content for people with epilepsy
      • Proper labels on all interactive elements on your site, so they’re compatible with assistive technology

      Using inclusive design principles from the very beginning when creating your website is the easiest way to ensure accessibility. Making changes after the fact can involve some complex alterations to your code – but the right tools can make it easier

      iubenda Accessibility Widget

      You can improve your website’s accessibility using our Accessibility Widget, which adapts your site to a user’s accessibility needs. 

      Whether a person requires screen reader compatibility, keyboard navigation, content adjustments, color enhancements, or orientation tools, you’ll get closer to providing them with what they need on your site through the Accessibility Widget. 

      It uses AI to scan and fix any code on your site that isn’t accessible. And you can easily set it up in just a couple of minutes. 

      💡 Find out more about how you can improve accessibility

    • To get an overarching picture of how to improve accessibility from the ground up, see inclusive design.
    • Or, to discover how you can improve your website’s visual display for greater accessibility, take a glance at color contrast accessibility.
    • If you’d like some more info on alt text and what to aim for, see our alt text examples.
    • Go into greater depth around making your content readable for a wider audience by visiting the following resources:
        • Countries worldwide are putting stringent laws and regulations in place to ensure greater accessibility. 

          After all, with many essential services now digital, it’s more important than ever for governments to ensure everyone can access the services they need. 

          Here are some of the laws and regulations around the world that mandate digital accessibility:

          🇺🇸 Americans with Disabilities Act (ADA)

          The ADA requires businesses operating in the United States to provide equal access to their digital services. While the law doesn’t explicitly outline web accessibility requirements, courts often interpret it to include websites and mobile applications. 

          ADA compliance usually follows WCAG 2.1 Level AA standards, ensuring usability for individuals with disabilities.

          🇺🇸 Section 508 (U.S.)

          Section 508 of the Rehabilitation Act mandates that U.S. federal agencies and organizations receiving government funding must ensure their digital content is accessible.

          It explicitly references WCAG 2.0 Level AA as the required standard. Government contractors and vendors must also meet these requirements when providing digital services to federal entities.

          🇪🇺 European Accessibility Act (EAA)

          The EAA establishes accessibility requirements across the European Union for digital products and services, including websites, apps, and e-commerce platforms. By June 2025, businesses providing digital services in the EU – regardless of where they’re based – must comply with these requirements to avoid penalties and ensure accessibility for all users. 

          While the requirements draw from the WCAG, they differ slightly. This means it’s all the more important to make the EAA’s requirements the standard to adhere to in order to ensure compliance.

          ❓ Frequently Asked Questions about the European Accessibility Act


          You need to comply with the European Accessibility Act (EAA) if you meet BOTH of these conditions:

          • Sell products or services to consumers in the EU
          • Meet at least ONE of the following criteria:
            • Have 10 or more employees
            • Have an annual turnover exceeding €2 million OR a balance sheet total exceeding €2 million

          June 28, 2025. The EAA makes an important distinction:

          • For products: Only those placed on the market after June 28, 2025 must comply
          • For services: ALL services provided to consumers after June 28, 2025 must comply

          If your website is offering products and services covered by the EAA, it falls under the EAA. However, certain website content may be exempt, provided that it is not updated after the EAA’s entry into force. This includes:

          • Pre-recorded time-based media published before June 28, 2025
          • Office file formats published before June 28, 2025
          • Online maps and mapping services, provided you offer essential navigational information in an accessible alternative format
          • Content qualifying as archives (not updated after June 28, 2025)
          • Third-party content not under your control

          Yes, the EAA provides for transitional periods for services:

          • Service providers may continue to provide services using products that were lawfully used before the compliance date until June 28, 2030
          • Service contracts agreed before June 28, 2025, may continue without alteration until they expire, but no longer than five years from that date (until June 28, 2030)

          The EAA leaves it to individual EU Member States to establish penalties. Each country will determine its own enforcement mechanisms and penalties under national laws, which may differ between Member States. The EAA only requires that these penalties be “effective, proportionate, and dissuasive.”

          Purely informational websites that don’t offer any products or services covered by the EAA to consumers typically fall outside the directive’s scope. However, if your website includes contact forms for leads or calls-to-action for services that target consumers, it likely falls under the EAA’s scope.

          The EAA covers specific products and services including:

          For products:

          • Computers and operating systems
          • Self-service terminals (ATMs, ticketing machines, check-in machines)
          • Smartphones, tablets, and TV equipment
          • E-readers
          • Other consumer electronic devices for accessing audiovisual media services

          For services:

          • E-commerce platforms
          • Banking services
          • Electronic communications
          • Services providing access to audiovisual media
          • E-books and dedicated software
          • Transportation-related websites and apps

          The EAA focuses on products or services offered to consumers. The EAA defines consumers as “any natural person who purchases the relevant product or is a recipient of the relevant service for purposes which are outside his trade, business, craft or profession.” B2B websites, intranets, and learning management systems that are not intended for consumers generally fall outside the scope of the EAA.

          B2B sites typically do not fall under the EAA’s scope as the act specifically targets consumer-facing services. However, if these B2B sites offer services directly to consumers, those consumer-facing portions would need to comply with accessibility requirements.

          Yes, payment gateways integrated into consumer-facing websites must be accessible. Under the EAA, the entire purchasing process, including form fields, payment gateways, and confirmation messages, must be fully accessible.

          The EAA explicitly exempts third-party content that you didn’t fund, develop, or control. However, for content that you do control (including PDFs, videos, and embedded software), the compliance requirements depend on timing:

          • Content published before June 28, 2025, that remains unchanged after this date is exempt
          • Content published before June 28, 2025, that gets updated after this date must comply
          • Content published after June 28, 2025, must comply with accessibility requirements

          The EAA focuses on products and services offered to “consumers,” defined as natural persons using products or services for purposes outside their trade, business, craft, or profession. If your website offers goods or services to consumers, including through contact forms or CTAs, it generally falls under the EAA’s scope.

          The EAA does not provide different rules specifically for non-profits. If a non-profit organization meets the criteria for compliance (over 10 employees or exceeding financial thresholds) and provides services to consumers, it should typically comply with the EAA requirements.

          The EAA itself does not address specific funding mechanisms. However, it does note that if economic operators receive funding from outside sources specifically for improving accessibility, they cannot claim exemption under the “disproportionate burden” provision. Check with your local business support organizations or EU programs for potential funding opportunities.

          While the EAA does not explicitly reference the Web Content Accessibility Guidelines (WCAG), the requirements are closely aligned with these standards. The EU is developing specific accessibility guidelines for private entities, building on existing standards like EN 301 549 (already established for public bodies).

          According to Annex I, Section III of the EAA, general accessibility requirements include making information available through multiple sensory channels, presenting content in understandable formats, providing text alternatives to non-textual content, and ensuring websites are perceivable, operable, understandable, and robust.

          Generally, following WCAG 2.1 guidelines is considered a good approach toward EAA compliance, though the EAA includes additional requirements beyond WCAG.

          Yes, exemptions include:

          • Microenterprises (fewer than 10 employees AND annual turnover not exceeding €2 million OR annual balance sheet total not exceeding €2 million)
          • Cases where compliance would require a “fundamental alteration” to a product or service
          • Situations where compliance would impose a “disproportionate burden” on the economic operators concerned
          • Specific types of pre-existing content on websites and mobile applications

          The EAA includes a “disproportionate burden” exemption. To qualify, you must conduct and document a formal assessment demonstrating why the cost of compliance would be excessive relative to the potential benefits for persons with disabilities. However, if you receive funding from other sources specifically for improving accessibility, you cannot claim this exemption.

          The EAA does not explicitly provide for such a declaration. However, service providers are required to provide information on how their service meets accessibility requirements, commonly referred to as an accessibility statement. According to Annex V of the EAA, this should include a general description of the service in accessible formats, explanations necessary to understand its operation, and a description of how the relevant accessibility requirements are met.

          If your service is not compliant, you are obligated to take corrective measures and inform the competent national authorities about the non-compliance and the corrective measures taken.

          Yes, the EAA requires service providers to include information about how their service meets accessibility requirements. This typically takes the form of an accessibility statement that includes a description of the service, how it operates, and how it meets relevant accessibility requirements.

          With our solution, you can see accessibility improvements in real-time. Our AI continuously scans your site against accessibility guidelines and applies necessary adjustments. Additionally, we recommend periodic manual testing with different assistive technologies.

          🌎 Other International Regulations

          Many countries have enacted their own accessibility laws, often aligning with WCAG guidelines:

          • Canada: The Accessible Canada Act (ACA) requires digital accessibility compliance for federally regulated industries.
          • United Kingdom: The Equality Act 2010 includes web accessibility as part of its anti-discrimination mandates.
          • Australia: The Disability Discrimination Act (DDA) enforces digital accessibility requirements.
          💡 Find out more about the legal requirements around accessibility

          Benefits of accessibility for users and businesses

          Besides legal compliance and ethics, accessibility is good for business. By making your website, app, and content accessible, you could reap rewards such as:

          • A strong user experience: Enhancing accessibility leads to greater engagement and user satisfaction, benefiting everyone.
          • More customers: Over 100 million people in the EU live with disabilities, making accessibility a significant market opportunity for your business. 
          • Keeping your customers for longer: Making digital services accessible helps retain users with disabilities as well as an aging population experiencing sensory and cognitive changes.
          • Less legal liability: Meeting accessibility regulations minimizes the risk of lawsuits, penalties, and costly remediation efforts.
          • SEO advantages: Search engines prioritize accessible websites, improving search rankings and online visibility.
          • Boosted brand image: A strong commitment to accessibility enhances your brand’s reputation and aligns with ethical business practices, resulting in more loyal customers.

          Tools and resources for testing accessibility

          Now you know you need to make your website and content accessible. But how do you find out how accessible your website is? Where do you even start?

          The great news is that there are several tools that can help your business evaluate and enhance accessibility:

          • WAVE (Web Accessibility Evaluation Tool): Identifies accessibility issues on web pages.
          • Axe Accessibility Checker: Carries out a full accessibility audit of your website, detecting WCAG violations in digital products.
          • Color contrast analyzer: Ensures text is legible against background colors.
          • Screen readers: Software that converts content into spoken word or braille. It’s useful for simulating how users with visual impairments interact with content.
          • Google Lighthouse: Assesses website performance, including accessibility.
          💡 Find out more about tools and resources for testing accessibility

        • Get an overview of the topic by having a read of accessibility testing.
        • Or, if you’d like to discover more about assistive technology, take a look at:
        • Take a look at our resource on screen readers, if you’d like some more information on the tool.
          • A place for all

            The Internet was meant to be for everyone. Yet, millions of people still face barriers every day.

            The good news is that fixing accessibility issues is easier than you think. And by making your website or app more inclusive, you’re not just avoiding legal risks – you’re expanding your audience, improving user experience, and doing what’s right.

            With accessibility laws tightening and consumer expectations rising, now is the time to act.

            You can easily make a start today with our Accessibility Widget – it only takes a couple of clicks. It’ll only benefit your users and your business. 

            The post Accessibility 101: Here’s what you need to know about web accessibility appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            A guide to CalOPPA, the California Online Privacy Protection Act https://www.iubenda.com/en/help/122078-caloppa/ Thu, 09 Jan 2025 08:58:45 +0000 https://help.iubenda.com/?p=122078 California has one of the most robust privacy legislations in the world. Even though the CCPA may not apply to you, if you own a website or are planning to launch one, it’s important to understand the California Online Privacy Protection Act (CalOPPA). In this guide, we explain what CalOPPA is, its purpose, who needs […]

            The post A guide to CalOPPA, the California Online Privacy Protection Act appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            California has one of the most robust privacy legislations in the world. Even though the CCPA may not apply to you, if you own a website or are planning to launch one, it’s important to understand the California Online Privacy Protection Act (CalOPPA).

            In this guide, we explain what CalOPPA is, its purpose, who needs to comply, and how to do it!

            What is CalOPPA?

            CalOPPA stands for the California Online Privacy Protection Act.

            Effective from July 1, 2004, CalOPPA is designed to help protect the personal information of California residents and ensure that they are informed about how their information is being used by websites and online services. In 2013 the law was amended to also regulate the tracking of users.

            If your website collects personal information from California residents, CalOPPA requires you to post a privacy policy on your website and make it easily accessible to website visitors. The privacy policy should outline how the information is being collected, used, and shared.

            💡
            What is personal information under the California Online Privacy Protection Act?

            Personal information can include anything that can be used to identify an individual, such as:

            • a name;
            • address;
            • email address;
            • phone number;
            • date of birth;
            • social security number; or
            • any other information that can be used to identify a person.

            In addition, personal information can include information that is linked or associated with an individual, such as their browsing history, purchase history, or location data. It’s important to note that even if a piece of information on its own may not allow to identify an individual, it can still be considered personal information if it is linked to other information that can identify a person.

            This means that if your website collects any personal information from California residents, even through a contact form or newsletter subscription, you are required to comply with CalOPPA.

            Did you know? 🤔

            The California Online Privacy Protection Act was the first US state law to make privacy policies mandatory!

            What is the Purpose of CalOPPA?

            The main purpose of CalOPPA is to protect the privacy of California residents who use online services and websites by ensuring that websites and online services provide transparent and clear information about their data collection practices, particularly concerning personal information.

            What is the Difference Between CCPA and CalOPPA?

            The main difference between the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) is the scope of the laws.

            The CCPA is a comprehensive privacy law that regulates the collection, use, sale, and sharing of personal information of California residents by businesses. Under the CCPA, the definition of businesses refers to organizations that meet one of the following thresholds:

            • They generate over $25 million in annual gross revenue;
            • They derive 50% or more of their annual revenues from selling or sharing the personal information of consumers;
            • They buy, sell, or share the personal information of 100,000 or more consumers.

            Moreover, CCPA grants more comprehensive consumer rights over personal data, such as, for example, the ability to access, delete, and opt out of the sale and sharing of their information.

            On the other hand, CalOPPA primarily focuses on transparency and it applies to any business that operates a commercial website or online service that collects personal information from California residents. There is no particular threshold for CalOPPA, you just need to collect personal information from your users. As you can understand, it has a much broader scope.


            Aspect CalOPPA CCPA
            Scope Websites and online services Large for-profit businesses
            Purpose Transparency in privacy policies Consumer rights and control over data
            Requirements Privacy policy disclosure Access, delete, and opt-out rights
            Applicability Broad (any website collecting CA data) Threshold-based (large data handlers)

            Who Has to Comply with CalOPPA?

            Any organization, regardless of location, that operates a website, online service, or mobile app and collects personal information from California residents.

            The California Online Privacy Protection Act may apply to you even if you’re not based in California, but you target California residents.

            How to Comply

            Now let’s take a look at the requirements and what you need to do to comply in practice.

            Post a Privacy Policy

            Having a clear and accessible privacy policy is the first and most important requirement of CalOPPA.

            To comply with CalOPPA, your privacy policy should include at least the following:

            • The categories of personal information you collect.
            • If you share this data with third parties, disclose who are these third parties.
            • How users can review and request changes to their information.
            • Whether you honor “Do Not Track” requests, and how you do it.
            • The effective date of the policy.

            This policy must be easily accessible to your website visitors, such as through a link in your website’s footer.

            Handle “Do Not Track” Requests

            A “Do Not Track” request (DNT) is a request that users send to websites through their browsers to ask them to stop tracking their online activity, for example via cookies. When this feature is activated through the browser’s settings, every website visited receives a Do Not Track request.

            However, most websites don’t support Do Not Track requests, so even though the Do Not Track request is sent, it has no effect.

            Under CalOPPA, it’s not mandatory to honor “Do Not Track” requests, but it is mandatory to disclose whether you honor them or not. If you do, then you should also explain the process.

            👉 You can learn more about “Do Not Track” requests here.

            Consequences of Non-Compliance

            Failure to comply with the California Online Privacy Protection Act can result in fines and legal action. The California Attorney General’s office can enforce CalOPPA and seek penalties of up to $2,500 per violation.

            How iubenda can help

            If you’re looking for an easy way to create your privacy policy for CalOPPA, then iubenda may be the solution for you.

            Our Privacy and Cookie Policy Generator helps you create a customized privacy policy that you can easily add to your website, by simply copying and pasting our code.

            If you don’t know where to start, our Generator comes with a handy Site Scanner, that suggests you the best configuration for your policy.

            Create your privacy policy now

            Start for free

            The post A guide to CalOPPA, the California Online Privacy Protection Act appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            What is COPPA? An In-Depth Guide to the Children’s Online Privacy Protection Act https://www.iubenda.com/en/help/168026-what-is-coppa/ Thu, 28 Nov 2024 11:37:19 +0000 https://help.iubenda.com/?p=168026 What is COPPA? COPPA is an abbreviation for the Children’s Online Privacy Protection Act,enacted by Congress in 1998. The primary goal of COPPA is to protect children’s privacy online. The Act gives parents control over what information websites collect and process about their children. This guide will explain what you need to know about COPPA, […]

            The post What is COPPA? An In-Depth Guide to the Children’s Online Privacy Protection Act appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            What is COPPA? COPPA is an abbreviation for the Children’s Online Privacy Protection Act,enacted by Congress in 1998. The primary goal of COPPA is to protect children’s privacy online. The Act gives parents control over what information websites collect and process about their children.

            This guide will explain what you need to know about COPPA, its main requirements, and how to comply.

            What is COPPA?

            The Children’s Online Privacy Protection Act (COPPA) was enacted in 1998 to safeguard the online privacy of children under 13 years old. The main goal of COPPA is to put parents in control over what information is collected from their children online. Over the years, the Act has undergone several amendments, and a new one has been proposed recently:

            • 1998: COPPA was signed into law on October 21, 1998.
            • 2000: The Federal Trade Commission (FTC) issued the COPPA Rule, effective April 21, 2000, detailing how businesses must comply with the Act.
            • 2013: The FTC updated the COPPA Rule to address technological advancements.
            • 2024: The Children and Teens’ Online Privacy Protection Act, informally known as COPPA 2.0, is being discussed in Congress. If enacted, it would significantly extend COPPA and build on its provisions.

            Businesses that fall under COPPA are not allowed to collect and process the personal information of children under the age of 13 without parental consent.

            Who Must Comply with COPPA?

            According to definitions, COPPA targets operators, generally any person operating a website or online service, directing the website or online service to children, or having actual knowledge that it is collecting or maintaining personal information from a child.

            COPPA applies to a broad group of operators:

            • operators of commercial websites and online services directed to children under 13 that collect, use, or disclose personal information from children.
            • operators of general audience websites or online services knowing they are collecting, using, or disclosing personal information from children under 13.
            • operators of websites or online services that know they are collecting personal information directly from users of another website or online service directed to children.

            In simpler words, you must comply with COPPA both when you are directly targeting children with your website or online service, and when you are not directly targeting children, but you know that children could use your website or online service or that you could be collecting and processing children’s personal data. Please note that COPPA may apply to you even if you’re based outside the United States, but you target children in the US.

            Key Terms and Definitions

            Before diving into the requirements, we need to understand some other key terms and definitions of COPPA. This will also clarify whether you need to comply with the Act.

            • Personal Information: Any data collected online that allows the identification of and can be referred to an individual (‘individually identifiable information about an individual collected online’). The definition was expanded in 2013 to include geolocation, photos, videos, audio files, IP addresses, and persistent identifiers like tracking cookies.
            • Website or online service: The definition includes mobile apps that send or receive information online, internet-enabled gaming platforms, plug-ins, advertising networks, internet-enabled location-based services, voice-over-internet protocol services, connected toys, or other Internet of Things devices.
            • “Directed to children under 13”: A website or online service that is “Directed to children under 13” is one that appeals to a younger audience, based on a variety of factors. These factors include the subject of the website, the use of visual and audio content or animated characters, the presence of celebrities who appeal to kids, the use of child-oriented activities, and more.
            • Collect: To collect personal information is to request, prompt, or encourage the submission of information, even if it’s optional; to let information be made publicly available (for example, through an open chat); or to passively track a child online.

            COPPA’s Requirements for Businesses

            Now that we’ve understood what COPPA is and what its keywords mean, let’s take a look at the main requirements for businesses.

            1. Post a Clear and Comprehensive Privacy Notice

            One of the first requirements that come into the picture is to include a Privacy Policy on your website outlining how you collect and process children’s data. To be COPPA-compliant, your notice must disclose:

            • what personal information you are collecting and processing and why;
            • how you are using this information and whether there are third parties involved in the processing;
            • if third parties are involved, you should name each third-party operator – such as an advertising network or social network plug-in – that collects or processes children’s personal information through your site or service;
            • specify that you won’t require a child to disclose more information than is reasonably necessary to participate in an activity;
            • specify that parents can review their child’s personal information, ask you to delete it, and refuse to allow any further collection or use of the child’s information;
            • specify that parents can agree to the collection and use of their child’s information, but still not allow disclosure to third parties unless that’s part of the service;
            • what the procedures to follow to exercise their rights.

            Remember that you must disclose not only your own data processing activities, but also the ones of third parties that collect children’s personal data through your website. It’s also important to make your privacy policy easy to read and accessible from every page of your website – a good idea is to add it in the footer of your site and make it prominent and hard to miss.

            Find out how iubenda can help!

            iubenda can support you in creating a privacy policy in line with the Children’s Online Privacy Protection Act, in just a few clicks.

            1. Scan your website. We identify the clauses that you may need to add to your document.
            2. Select the COPPA-dedicated clause: “This Service is directed to children under the age of 13”.
            3. Add custom clauses to meet legal transparency and disclosure requirements.
            4. Save your document and add it to your website!
            what is coppa - coppa clause iubenda

            2. Provide Direct Notice to Parents and Obtain Verifiable Parental Consent

            As we said at the beginning, you can’t collect information from children without parental consent. Before collecting children’s personal information, COPPA requires you to show parents a direct notice, which explains:

            • that you collected their online contact information to get their consent;
            • that you want to collect personal information from their child;
            • that their consent is required for the collection, use, and disclosure of the information;
            • the specific personal information you want to collect and how it might be disclosed to others;
            • a link to your online privacy policy;
            • how parents can give their consent; and
            • that, if parents do not consent within a reasonable time, you’ll delete the parents’ online contact information from your records.

            3. Get Parents’ Verifiable Consent

            COPPA allows you to decide which method to use to obtain parental consent. In its Six-Step Compliance Plan, the FTC suggests that you have the parents:

            • sign a consent form and send it back to you via fax, mail, or electronic scan;
            • use a credit card, debit card, or other online payment system that provides notification of each separate transaction to the account holder;
            • call a toll-free number staffed by trained personnel;
            • connect to trained personnel via a video conference;
            • provide a copy of a form of government-issued ID that you check against a database, as long as you delete the identification from your records when you finish the verification process;
            • answer a series of knowledge-based challenge questions that would be difficult for someone other than the parent to answer; or
            • verify a picture of a driver’s license or other photo ID submitted by the parent and then compare that photo to a second photo submitted by the parent, using facial recognition technology.

            If you collect and process personal information only for internal purposes, you can use a method known as “Email plus”. With this method, you send an email to the parent and have them respond with their consent. You must send a confirmation to the parent via email, letter, or phone call. Using “email plus”, you must let the parent know they can revoke their consent anytime.

            4. Honor Parents’ Ongoing Rights

            Even if parents have given you permission to collect information from their children, they have rights that you should respect and allow them to exercise.

            If a parent requests it, you must:

            • Provide them with a way to check the personal data gathered about their kid.
            • Provide them with a way to withdraw their consent and object to the use or collection of additional personal data about their child.
            • Erase their child’s data.

            5. Protect the Kids’ Personal Information

            Finally, you must establish and maintain appropriate safeguards for the privacy, security, and integrity of any personal information you collect from children.

            It’s important to collect as little information as possible and to make sure that any third parties who may collect personal information from your site have the same safeguards in place.

            Keep the information only as long as necessary to fulfill your purposes, and then delete it in a secure manner.

            How To Design a Website or App for Children

            When you design a website or an app for kids, you need to follow specific procedures and guidelines. In fact, besides COPPA, third parties like Apple and Google also have their rules regarding apps for children that you must comply with.

            Apple App Store

            First of all, Apple requires you to comply with applicable law. This means that you must always provide a privacy policy and apply all the standards required by law – be it COPPA, the EU GDPR, or others.

            If your app is specifically designed for kids, you should make it clear by adding terms like “For Kids” and “For Children” in the app metadata. The app will then be assigned to the Kids Category in the App Store.

            Apps in the Kids Category should not include third-party analytics or third-party advertising, to grant children a safer space. Third-party analytics and contextual advertising may be permitted in some cases, but you need to make sure that these services don’t collect any information about children.

            If your app has links that redirect outside the apps, or it offers purchasing opportunities, then you should put these behind a parental gate – which is not the same as the method to get parental consent.

            Parental gates block the app navigation for children and require an adult to perform an action to unblock it. It could look something like this:

            app for children - coppa definition

            Google Play

            Google too requires you to comply with applicable law and provide a privacy policy to your users. Moreover, if your app is designed for children, it must follow the Google Play Family Policies.

            The first thing you need to do is to select your target audience in the Target Audience and Content section of the Google Play console. If your app is designed for children, select “Children” as the intended audience. Google will ask you to provide details about the app’s target age group and content.

            As for Apple, personalized or behavioral advertising is prohibited in apps directed to children and in-app purchases should be designed to avoid the exploitation of children.

            There is no parental gate requirement for Android apps, but Google encourages app developers to add parental control features.

            👉 Learn more about COPPA and Mobile Apps in our dedicated guide.

            Websites

            As mentioned earlier, websites must include a privacy policy that complies with the Children’s Online Privacy Protection Act (COPPA). According to the COPPA Rule, you must provide a clear and prominent link to your privacy policy on your homepage or landing page, and in any areas of your site where you collect personal information from children.

            If your website is aimed at both a general audience and children, you can have a single privacy policy that covers all requirements. However, be sure to include a specific section within the policy that addresses COPPA and children’s privacy. On pages of your site that are designed for children, link directly to this section rather than to the general privacy policy.

            COPPA Compliance Checklist

            Let’s recap how to make your website or app compliant with COPPA:

            Create a clear and comprehensive privacy policy. It should explain what data you’re collecting from children and why, whether there are third parties involved in the processing, and what rights parents have regarding their children’s data.

            Give parents a direct notice to collect their consent, before collecting children’s personal information. The notice should summarize the information contained in the privacy policy and link to the main document.

            Get parents’ verifiable consent. You can use the method you want, as long as it’s effective and allows you to verify that the consent was truly granted by the parents.

            For apps, choose the appropriate category in the app stores (“For Kids”) and implement additional layers of security, as required by Apple and Google guidelines (parental gate or parental control features). Block targeted advertising.

            Honor parents’ rights. Parents have ongoing rights, that they can exercise at any moment.

            Protect the kid’s personal information. Make sure you and the third parties have appropriate security measures in place.

            Penalties and Enforcement

            Since COPPA is a federal law, its enforcement is regulated by the Federal Trade Commission. Civil penalties for COPPA violations can go up to $51,744 per violation, depending on what happened. There have been cases where the fines have reached millions of dollars.

            For example, in 2023 Microsoft agreed to a civil penalty of $20 millions, because they were collecting the personal information of children who signed up for the Xbox gaming system without parental consent.

            You can report COPPA violations from this FTC website.

            Comparison of COPPA with Other U.S. Privacy Laws

            The Children’s Online Privacy Protection Act (COPPA) is part of the complex landscape of privacy laws in the United States. But while laws like the California Consumer Privacy Act (CCPA) or the Virginia Consumer Data Protection Act (VCDPA) generally have a state-wide scope, COPPA is a federal law that applies throughout the United States.

            Another key difference is the target of these laws. COPPA specifically protects children under 13, while State laws safeguard all consumers who are residents of the specific state.

            In the table below, we’ve gathered the main differences, but you can read a complete overview here: US State Privacy Laws Overview.

            Aspect COPPA CCPA/CPRA CalOPPA VCDPA CPA UCPA CTDPA
            Scope Protects children under 13 Protects all California consumers Applies to commercial websites and online services Protects all Virginia consumers Protects all Colorado consumers Protects all Utah consumers Protects all Connecticut consumers
            Applicability Websites/apps directed at children or with actual knowledge of collecting children’s data For-profit entities meeting certain thresholds (e.g., revenue, data processing) Any commercial website or online service collecting personal data from California residents Entities conducting business in Virginia and meeting specific thresholds Entities conducting business in Colorado and meeting specific thresholds Entities conducting business in Utah and meeting specific thresholds Entities conducting business in Connecticut and meeting specific thresholds
            Consumer Rights Parental consent for data collection, access, and deletion Right to know, delete, opt-out of sale/sharing, correct, limit use of sensitive data Right to know categories of data collected and third parties shared with Right to access, correct, delete, and opt-out of data processing Right to access, correct, delete, and opt-out of data processing Right to access, delete, and opt-out of data processing Right to access, correct, delete, and opt-out of data processing
            Enforcement Federal Trade Commission (FTC) California Attorney General and California Privacy Protection Agency California Attorney General Virginia Attorney General Colorado Attorney General Utah Attorney General Connecticut Attorney General
            Data Subject Age Under 13 All ages All ages All ages All ages All ages All ages
            Parental Consent Requirement Yes In limited cases In limited cases In relation to the processing of a known child’s sensitive personal data In relation to the processing of a known child’s personal data In relation to the processing of a known child’s personal data In relation to the processing of a known child’s sensitive personal data

            Frequently Asked Questions

            What is the meaning of COPPA?

            COPPA stands for Children’s Online Privacy Protection Act (COPPA) and refers to the US law that was enacted in 1998, and subsequently integrated and amended, to safeguard the online privacy of children under the age of 13.

            What does COPPA actually do?

            The goal of COPPA is to give parents control over what information is collected from their children online. Websites that target children must meet certain requirements to ensure that they collect as little information as possible and obtain parental consent before collecting that information.

            What is a COPPA violation?

            An example of COPPA violation is collecting and processing children’s personal information without parental consent. Civil penalties for COPPA violations can go up to $51,744 per violation.

            Resources

            Here below you’ll find a list of helpful resources to help you with COPPA compliance.

            Start complying with COPPA today!

            iubenda helps websites and apps of all sizes comply with international regulations, such as the Children’s Online Privacy Protection Act (COPPA).

            With our Privacy and Cookie Policy Generator, you can create your privacy policy and add dedicated COPPA clauses, in just a few minutes.

            Try it yourself!

            Start now for free

            The post What is COPPA? An In-Depth Guide to the Children’s Online Privacy Protection Act appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Opt-In vs Opt-Out: What’s the Difference? https://www.iubenda.com/en/help/6192-opt-in-opt-out/ Fri, 23 Aug 2024 08:52:44 +0000 https://help.iubenda.com/?p=6192 Opt-in and opt-out are key concepts when it comes to complying with online data privacy laws. Many of these laws can either require an opt-in or opt-out approach, so it’s important to understand the difference between opt-in vs opt-out and how to implement them. In short Opt-in vs Opt-out Opt-in meaning Examples of opt-in Opt-out […]

            The post Opt-In vs Opt-Out: What’s the Difference? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Opt-in and opt-out are key concepts when it comes to complying with online data privacy laws. Many of these laws can either require an opt-in or opt-out approach, so it’s important to understand the difference between opt-in vs opt-out and how to implement them.

            opt in vs opt out

            Opt-in vs Opt-out

            The concept itself isn’t too hard to understand.

            Opt-in meaning

            Opt-in” is the process used to describe when an affirmative action is required to subscribe a user to something, such as a newsletter list. In an opt-in system, explicit action is needed from the user to indicate their willingness to be included.

            Examples of opt-in systems are the EU ePrivacy Directive, the General Data Protection Regulation (GDPR), or the Brazilian Lei Geral de Proteção de Dados Pessoais (LGPD).

            Examples of opt-in

            Let’s take the GDPR as a reference. As we said, the GDPR uses an opt-in approach, and – when consent is needed – it must be “freely given, specific, informed and unambiguous”. That’s why the regulation specifically forbids pre-ticked boxes and similar opt-out mechanisms.

            Newsletter and Marketing Emails

            If you have a newsletter or send marketing emails, your users should either enter their email addresses or check a specific box to receive them. Remember not to pre-select the boxes, and have a checkbox for each specific consent you require. For example, you should not combine consent for your Terms and Conditions and your newsletter. You may use two separate boxes.

            opt-in example

            Cookie consent

            The EU ePrivacy Directive also requires explicit opt-in consent to install cookies. This is usually done via a cookie consent banner, which is shown on the user’s first visit to your website. Without explicit consent, you may only use technical cookies.

            basic cookie banner requirements under the gdpr and eprivacy

            Opt-out meaning

            On the other hand, opt-out means that a user can be included in something without prior consent, but you need to provide them with an easy way out. So, users can withdraw their consent at any time.

            Examples of opt-out systems are the California Consumer Privacy Act (CCPA) and the Swiss Federal Act on Data Protection (FADP), even though there are some exceptions when opt-in consent is required.

            Examples of opt-out

            Unsubscribe link

            One common example of opt-out is the Unsubscribe link you can find at the bottom of newsletters.

            Under certain regulations, like the US CAN-Spam Act, you can send your users commercial emails without the need for any action on their part. However, you must always provide them with an Unsubscribe link, so they can easily stop any further communication if they wish to.

            The unsubscribe option should be free, not require a login process, and be honored within 10 days.

            Do Not Sell or Share My Personal Information Link

            Another example of opt-out is the ‘Do Not Sell or Share My Personal Information’ link required under California’s CCPA. Under the CCPA, a “sale” is broadly defined and includes any exchange of personal information for valuable consideration, not just monetary transactions. For example, the use of tracking cookies for advertising can be considered a sale.

            The “Do Not Sell or Share My Personal Information” link should also come with a notice designed to inform consumers of their right to opt out of the sale and sharing of their personal data. It should be placed on your homepage and in your privacy policy.

            What’s the difference between opt-in and opt-out?

            The difference between opt-in and opt-out lies in the initial consent process. Opt-in requires proactive consent from the user, while opt-out assumes consent until the user withdraws it.

            How you sign up your users for direct marketing, and the specific privacy disclosures you must provide, depends on where these individuals reside.

            When are opt-in and opt-out needed?

            As we said in the previous paragraph, the choice between opt-in and opt-out depends on the location of your users.

            If you’re targeting EU-based users, it’s safe to assume that you’ll need to get consent from your users before any marketing activity (direct email marketing, newsletters, use of tracking cookies, etc.).

            ⚠ Exception

            You could bypass the need for prior consent in the case of soft opt-in. Soft opt-in can occur when a user has provided their email address while purchasing a product or service from you. However, you must meet certain conditions:

            • the email address is collected during a sales process on your site;
            • you inform your customer that you use emails in this way (via a notice on the sales page or in your privacy policy);
            • the user has not opted out of being contacted;
            • your future promotional emails are related to products and services similar to those originally purchased; and
            • the products/services you intend to promote are your own (not third-party).

            On the other hand, if your users are based in the US, you can generally rely on opt-out mechanisms, such as the Unsubscribe or ‘Do Not Sell or Share My Personal Information’ links.

            ⚠ Exception

            If you’re targeting children under the age of 13, you’ll always need prior consent from the child’s parents before processing their personal information. This is a requirement of the Children’s Online Privacy Protection Act (COPPA), which applies throughout the United States.

            Of course, these are just a few examples, and we recommend checking your law of reference before choosing between opt in vs opt out.

            How to implement opt-in and opt-out

            Cookie Consent Banner

            The first thing you need to opt your users in is a cookie consent banner. A cookie banner is a notice displayed to users the first time they visit your site. A cookie banner allows users to accept or reject consent for cookies and to manage their preferences. If a user rejects cookies, you need to block them from running.

            Create a cookie banner with iubenda

            iubenda helps you create a customizable cookie banner, that automatically adapts its behavior to the location of your users. So if your users are based in the EU, it will apply an opt-in approach, while if they’re based in the US an opt-out one.

            Here’s how to do it:

            1. Start the configuration and answer a few questions. Our Generator will automatically apply the best configuration for you.
            2. Customize the look of your cookie banner to match your brand.
            3. Add it to your website, and you’re done!

            Make your forms GDPR-compliant

            As previously mentioned, your forms must align with GDPR’s consent requirements: freely given, specific, informed, and unambiguous. Here’s how to do it:

            • Use clear and straightforward language.
            • Avoid pre-ticked checkboxes.
            • Separate different consent requests.
            • Make it easy to withdraw consent.

            Remember that it’s also essential to keep consent records to track all opt-in and opt-out requests.

            Unsubscribe link

            Adding an Unsubscribe link to your newsletter is quite simple because most email marketing platforms provide an automated way to include it.

            If you want to do it manually, you first need to create a page where your users will land once they click on the link. Then you need to add the link to the footer of your emails.

            The link should redirect your users to the landing page and allow them to opt out, without the need to log in again or add any additional information.

            Manage your newsletters with iubenda

            Newsletters and email lists are key elements of a marketing strategy, but they need to be managed correctly. iubenda can help!

            Our Newsletter Opt-in Booster is the perfect tool to make subscribing to your newsletter easy, while keeping your consent and opt-ins up to date.

            Here’s how it works:

            1. Create your customizable form and add it to your website.
            2. Every time a new user signs up, a consent record is automatically created.
            3. Easily keep track of all opt-ins and opt-outs: the solution records any changes to the consent status.

            Do Not Sell or Share My Personal Information Link

            If the CCPA applies to you, you must provide, among others, a “Do Not Sell or Share My Personal Information” link. This link is typically placed in the footer of a website so that your users can opt out at any time.

            Add your DNSOSMPI link with iubenda

            iubenda helps you create your DNSOSMPI disclosure in no time!

            1. Go to the Privacy and Cookie Policy Generator and create a privacy policy that includes CCPA disclosures.
            2. Add your notice at collection through the Privacy Controls and Cookie Solution. Our solution will also help you manage all the opt-out requests you receive.

            Manage opt-in and opt-out with iubenda

            Start for free

            The post Opt-In vs Opt-Out: What’s the Difference? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            A Detailed Look at the EU AI Act https://www.iubenda.com/en/help/145851-a-detailed-look-at-the-eu-ai-act/ Mon, 15 Jan 2024 14:57:25 +0000 https://help.iubenda.com/?p=145851 The EU AI Act has been agreed upon by the European Parliament and the European Council, marking a pivotal moment in the governance of Artificial Intelligence (AI) within Europe.  The EU AI Act serves as a cornerstone in shaping the future of AI, ensuring that its development and deployment align with the core values of […]

            The post A Detailed Look at the EU AI Act appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            The EU AI Act has been agreed upon by the European Parliament and the European Council, marking a pivotal moment in the governance of Artificial Intelligence (AI) within Europe. 

            The EU AI Act serves as a cornerstone in shaping the future of AI, ensuring that its development and deployment align with the core values of safety, ethics, and transparency across the European Union. Learn more about it below 👇

            🚨 Update: Publication in the Official Journal

            On July 12, 2024, the European AI Act was published in the Official Journal of the European Union. The Act will gradually come into force starting from August 1, 2024, and will be fully applicable on August 2, 2026. Key dates to note include:

            February 2, 2025: Ban on AI systems deemed to pose an unacceptable risk (e.g., social scoring systems, biometric categorization, facial recognition databases, emotion recognition systems).

            August 2, 2025: Provisions regulating general-purpose AI systems.

            August 2, 2026: Full applicability to high-risk AI systems designated in Annex III, such as those used in recruiting, managing staff, biometrics, and access to services.

            August 2, 2027: Applicability to high-risk systems categorized under Annex I, including medical devices, machinery, radio equipment, toys, and motor and agricultural vehicles.

            Additionally, the European Commission has established the European AI Office to be the center of AI expertise across the EU. It will play a key role in implementing the AI Act, fostering the development and use of trustworthy AI, and promoting international cooperation.

            Historical Context of the AI Act

            The road to the EU AI Act has been a journey marked by significant milestones in the world of AI. This journey began as AI technologies started permeating every aspect of our lives, from healthcare to transportation. The EU’s response to these advancements was initially in the form of guidelines and recommendations, but the growing influence of AI called for more robust governance. 

            The AI Act is a response to this need, emerging from a background of thoughtful deliberation and previous directives that sought to balance innovation with ethical considerations.

            What is the new AI regulation in the EU?

            The new artificial intelligence (AI) regulation in the EU, known as the AI Act, is a groundbreaking law that sets rules for the use and development of AI across Europe. Its main goal is to ensure AI systems are safe and respect fundamental rights like privacy and non-discrimination. This law is significant because it’s one of the first comprehensive attempts to regulate AI at such a large scale.

            Update

            The European Commission has unveiled the AI Office, established within the Commission. The AI Office aims to enable the future development, deployment, and use of AI in a way that fosters societal and economic benefits and innovation while mitigating risks. The Office will play a key role in the implementation of the AI Act, especially in relation to general-purpose AI models. It will also work to foster research and innovation in trustworthy AI and position the EU as a leader in international discussions.

            What does the EU AI Act apply to?

            The AI Act applies mainly to “high-risk” AI systems. These are AI applications used in critical areas like: healthcare; education; law enforcement; and other public services.

            The Act sets strict rules for these systems, like needing risk-mitigation measures and human oversight. However, it gives a pass to AI uses considered low risk, such as spam filters or AI used in non-critical domains.

            What are the guidelines for artificial intelligence in the EU?

            The guidelines under the EU AI Act focus on transparency, ethical use, and fundamental rights. 

            AI systems must: be transparent, meaning companies must inform people when they’re interacting with AI (like chatbots); label AI-generated content, like deepfakes; and assess how their AI affects people’s rights, especially in essential services like banking and insurance.

            While there is a cohesive effort at the EU level to regulate AI, individual member states have also been formulating their own strategies, reflecting their unique priorities and contexts.

            See how different EU countries have been handling artificial intelligence in the EU here →

            EU AI Act Summary

            The EU AI Act represents a major legislative move, establishing comprehensive guidelines for AI usage across member states. Its primary goal is to secure AI systems, safeguarding fundamental rights and promoting trustworthy AI development.

            🔎 Key Features of the AI Act:

            • Risk-Based Approach: The new categorization of AI systems will be based on their potential societal risk. Under this approach, AI applications in sensitive areas like healthcare and law enforcement will undergo rigorous assessment to ensure they meet high safety and ethical standards.
            • Transparency Requirements: The Act mandates that individuals be informed when they are interacting with AI, particularly in critical sectors such as employment, law enforcement, and finance. This requirement aims to foster an environment of trust and accountability in AI deployment.
            • Bans on Certain AI Practices: Perhaps one of the most striking aspects of the AI Act is its prohibition of certain high-risk AI applications. This includes real-time biometric identification systems in public spaces, reflecting a commitment to protecting individual rights and freedoms.

            Businesses operating in the EU must adhere to these regulationsinvolving rigorous assessment procedures for high-risk AI systems. This includes ensuring data quality, transparency, and oversight mechanisms. See here for more on the European AI strategy

            EU AI Act Unacceptable Risk

            AI systems that are categorized as posing an unacceptable risk will be prohibited under the EU AI Act. These systems are deemed hazardous to individuals and include:

            1. AI mechanisms that manipulate behavior, especially targeting specific groups or vulnerable populations. An example of this would be voice-activated toys designed to encourage unsafe behaviors in children.
            2. Systems that implement social scoring, which involves evaluating individuals based on their behavior, socio-economic background, or personal traits.
            3. Technologies that involve biometric identification and classification, including those that can recognize and categorize people based on their biometric data.
            4. Systems capable of biometric identification in real-time or remotely, like facial recognition technologies, fall under this category as well.

            However, the Act does make provisions for certain exceptions, primarily for law enforcement purposes. Real-time remote biometric identification can be used in a limited scope, specifically for grave cases. Additionally, post-event remote biometric identification, which is used after a delay, is permitted for investigating serious criminal offenses, but only with prior judicial authorization.

            These regulations are part of the EU’s effort to balance the advancement of AI technology with the protection of individual rights and safety. 

            EU AI Act High Risk

            AI systems that are determined to have a potentially negative impact on safety or fundamental human rights are categorized as high risk under the EU AI Act. These high-risk AI systems are subdivided into two distinct groups:

            1. AI systems integrated into products that are subject to the EU’s product safety laws. This category encompasses a broad range of products, including but not limited to toys, aviation-related items, automobiles, medical equipment, and elevators.
            2. AI systems that operate in specific sectors and must be registered in a dedicated EU database. These sectors cover a wide array of critical and sensitive areas, including:
            • The management and functioning of essential infrastructure.
            • The educational sector, encompassing both general education and vocational training.
            • Employment-related areas, including worker management and self-employment opportunities.
            • Access to important private and public services, as well as public benefits.
            • The realm of law enforcement.
            • Systems involved in the management of migration, asylum, and border control.
            • Support in the interpretation and application of legal matters.

            Every AI system classified as high risk will undergo a thorough evaluation process before being allowed on the market. Furthermore, their performance and compliance with regulations will be continually monitored throughout their operational life.

            This structured approach towards high-risk AI systems is part of the EU’s broader strategy to ensure that AI development and deployment are conducted in a manner that is safe and respects the rights and freedoms of individuals. For a more comprehensive understanding of these classifications and regulations, it’s advisable to refer to official EU documentation or legal analyses on the subject.

            👀 See How to Comply for high risk AI Systems under the EU AI Act →

            EU AI Act Limited Risk

            AI systems classified as having limited risk are required to adhere to basic transparency measures. These measures are designed to ensure users can recognize when they are interacting with AI and make informed choices about their continued use of these applications. 

            Particularly, this includes AI-generated or manipulated content like images, audio, or video, such as those created by deepfake technology. The goal is to foster an environment where users are aware of AI involvement, allowing them to make more conscious decisions regarding their engagement with these technologies.

            EU AI Act Minimal Risk

            Applications like spam filters and video games are considered to have minimal risk. Therefore, they are not subjected to additional regulatory oversight.

            Compliance and Transparency Requirements for General Purpose and Generative AI

            In the context of the EU AI Act, both general-purpose and generative AI systems, including platforms like ChatGPT, are subject to specific transparency obligations. These requirements include:

            1. An explicit declaration to users indicating that the content they are interacting with has been generated by an AI system.
            2. The design of these AI models must incorporate measures to prevent the creation of illegal content.
            3. There is a need to provide summaries of copyrighted data that have been utilized in the training of these AI models.

            Moreover, AI models that are more advanced and have a significant impact, such as GPT-4, are required to undergo extensive evaluations. In the case of any serious incidents arising from these systems, it is mandatory to report these incidents to the European Commission. This is part of the broader effort to monitor and regulate AI systems that could potentially pose systemic risks.

            These measures are in place to ensure transparency and accountability in the use of AI, particularly in instances where these technologies have a wide-reaching impact or pose potential risks. For further details on these regulations and their implications, it’s recommended to review the official documentation or authoritative sources on the EU AI Act.

            How to Comply for high risk AI Systems

            The EU AI Act establishes a comprehensive set of compliance measures for AI systems deemed high-risk, covering various stages from design and implementation to post-market introduction. These regulations encompass:

            1. Implementation of a Risk Management System
            2. Requirements for Data Handling and Governance
            3. Preparation and maintenance of Detailed Technical Documentation
            4. Obligations for Record-Keeping
            5. Ensuring Transparency and clear Information Dissemination to users
            6. Guaranteeing Human Oversight
            7. Upholding Standards for Accuracy, Robustness, and Cybersecurity
            8. Establishment of a Quality Management System
            9. Conducting a Fundamental Rights Impact Assessment

            While AI systems identified as having limited risk are not subjected to the same stringent compliance checks, such as conformity assessments or product safety reviews, they are still evaluated based on similar criteria to ensure they meet the necessary transparency and safety standards.

            These regulatory requirements are integral to ensuring that high-risk AI systems operate safely, ethically, and transparently, aligning with the broader objectives of the EU AI Act to safeguard user rights and public safety. For a deeper understanding of these compliance requirements, it’s advisable to consult the official text of the EU AI Act or related legal resources.

            Frequently Asked Questions

            The implementation timeline of the EU AI Act, while not set to a specific date, is expected to be fully operational by 2026. This timeline reflects the need for a gradual but comprehensive adoption process, giving businesses and organizations sufficient time to understand and adapt to the new regulations. 

            It’s important to note that the period leading up to 2026 will likely see a phased implementation, with certain aspects of the Act coming into force at different stages. Businesses, especially those in high-risk sectors, should start assessing their AI systems and processes now to ensure a smooth transition to compliance. Ongoing updates and guidance from EU regulatory bodies are expected to assist in this preparatory phase.

            The EU AI Act’s regulations cast a wide net, encompassing all entities involved in providing AI services within the EU market. This includes not only AI developers and providers based within the EU, but also those situated outside the EU, provided their AI systems are used in the EU market.

            This global reach is significant as it implies that any business, regardless of its location, must comply with the Act if its AI services impact EU citizens or operations in EU countries. For multinational corporations, this means adherence to the Act’s standards even if their headquarters are outside the EU. Startups and smaller companies, particularly those aiming to enter the EU market, must also be mindful of these regulations and integrate compliance into their development and deployment strategies.

            Entities found non-compliant with the EU AI Act regulations will face substantial financial penalties, reflecting the seriousness with which the EU regards AI governance. 

            These fines are structured to be proportionate to the size and turnover of the entity, ensuring that penalties are significant but fair. For minor infringements, fines can be as low as €7.5 million or 1.5% of the annual turnover, which can still represent a significant financial burden for many companies.

            In cases of more serious breaches, the fines can escalate to €35 million or up to 7% of the global annual turnover, underscoring the potential financial risks of non-compliance. Beyond financial penalties, non-compliance could also lead to reputational damage, loss of consumer trust, and potential legal challenges. It’s crucial for entities to understand the full scope of these consequences and establish robust compliance mechanisms.

            For a more detailed understanding of the AI Act and its implications, refer to the EU Commission’s comprehensive Q&A: EU Commission Q&A.

            The EU AI Act is a significant step towards regulating AI in a manner that balances innovation with ethical considerations. Its impact extends beyond Europe, setting a global precedent for how AI can be governed responsibly. As this field continues to evolve, it is crucial to keep the dialogue open and engage various stakeholders in shaping the future of AI governance.

            The post A Detailed Look at the EU AI Act appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            How Technology Helps Businesses Build Effective Whistleblowing Systems https://www.iubenda.com/en/help/144878-how-technology-helps-businesses-build-effective-whistleblowing-systems/ Thu, 04 Jan 2024 10:35:38 +0000 https://help.iubenda.com/?p=144878 In the corporate world, whistleblowing plays a crucial role in maintaining ethical standards and uncovering wrongdoing. Whistleblowers, who may be employees or external stakeholders, report illegal activities, misconduct, or risks to public safety within an organization. In practice, it can be things like fraud, harassment, product or food safety, environmental issues or protection of privacy […]

            The post How Technology Helps Businesses Build Effective Whistleblowing Systems appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            In the corporate world, whistleblowing plays a crucial role in maintaining ethical standards and uncovering wrongdoing. Whistleblowers, who may be employees or external stakeholders, report illegal activities, misconduct, or risks to public safety within an organization. In practice, it can be things like fraud, harassment, product or food safety, environmental issues or protection of privacy and personal data.

            whistleblowing systems

            From December 2023, the EU Whistleblower Directive requires all EU organizations with 50+ employees (including EU branches) to establish a confidential internal whistleblowing channel.

            Implementing a channel that is safe and anonymous is crucial to comply with this regulation. However, there are many technical challenges you can face as a business when implementing whistleblowing procedures. This article explores how technology is empowering companies to build secure, efficient, and user-friendly whistleblowing systems. Let’s dive in!

            Challenges for Businesses to Implement Whistleblowing Systems

            • Technical Challenges: Ensuring seamless integration of the whistleblowing system with existing IT infrastructure can be complex. Additionally, maintaining the system’s security against threats like cyberattacks or breaches requires constant vigilance and updates.
            • Retaliation Concerns: Despite technological safeguards, the fear of retaliation remains a significant deterrent for potential whistleblowers. Creating a culture that supports and protects whistleblowers is paramount.
            • Legal and Compliance Issues: Navigating the various legal requirements, especially for multinational corporations, can be daunting. Ensuring compliance with different countries’ laws while maintaining a standard system is challenging.
            • Training and Adoption: Encouraging employees to use the system effectively requires comprehensive training. Overcoming resistance to new technologies and processes can be a significant hurdle.
            • Ensuring Trust: Have potential whistleblowers trust that the system is truly secure and anonymous is crucial.

            💡 Over time, whistleblowing has been fraught with challenges, including retaliation against the whistleblower or the risk of sensitive information being mishandled. However, with the advent of advanced technology, the landscape is changing.

            How Technology Improves Whistleblowing Systems

            Anonymity and Confidentiality

            One of the biggest fears for potential whistleblowers is the risk of being identified and facing retaliation. This means that commonly-used corporate communication channels like phone, email or instant messaging cannot be used. Luckily, modern digital platforms are available and offer robust encryption and anonymity features.

            Accessibility and Ease of Use

            Technology has made it possible to create user-friendly reporting channels accessible from anywhere, at any time. Mobile apps and online portals allow employees to report concerns discreetly and conveniently, encouraging more individuals to come forward.

            Reports Management and Tracking

            Once a report is filed, it’s crucial to manage it effectively. Technological solutions can help you track the progress of an investigation, maintain records, and ensure timely resolution of reported issues.

            Data Protection

            Protecting sensitive information is paramount in whistleblowing systems. Technology, including firewalls or antivirus software, safeguard the data against unauthorized access and cyber threats.

            Global Reach

            For multinational corporations, ensuring compliance across different legal jurisdictions is challenging. Whistleblowing systems can be adapted for different languages and legal requirements, making them versatile tools for global operations.

            👋 Ready to implement whistleblowing protections in your organization? 🔍 Find out how

            iubenda’s Whistleblowing Management Tool

            🚀 iubenda’s Whistleblowing Management Tool is your powerful ally in providing your employees with a secure platform for internal reporting, in no time!

            It consists of a form and dashboard to simply the process of submitting and managing whistleblowers’ reports through a dedicated channel. Our product aims to streamline management within organizations, protect whistleblowers, and ensure businesses consistently adhere to the law.

            💡 Want more detail on how iubenda can help? Check out our dedicated guide.

            With iubenda, you can harness technology to ensure compliance and support your employees:

            ⭐ Quick and easy-to-use form setup
            ⭐ Smooth integration with your existing processes
            ⭐ Guaranteed anonymity and confidentiality for whistleblowers
            ⭐ Guided and standardized report submission on any device
            ⭐ Role-specific permissions for secure access
            ⭐ Real-time updates to monitor developments and ensure prompt responses
            ⭐ Intuitive all-in-one dashboard to centralize, filter and reports

            Leverage technology with iubenda’s Whistleblowing Management Tool

            Provide whistleblowers with a secure reporting channel, as legally-required

            Try it now

            The post How Technology Helps Businesses Build Effective Whistleblowing Systems appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            How to Implement Whistleblower Protections in Your Organization https://www.iubenda.com/en/help/144294-how-to-implement-whistleblower-protections-in-your-organization/ Wed, 13 Dec 2023 09:25:20 +0000 https://help.iubenda.com/?p=144294 In an era where transparency and corporate responsibility are paramount, regulators are working to establish frameworks for the protection of individuals in the workplace. The Whistleblower Directive serves as a critical tool in order to set robust protections for employees and other stakeholders who step forward to report wrongdoings. As a business, this should matter […]

            The post How to Implement Whistleblower Protections in Your Organization appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            In an era where transparency and corporate responsibility are paramount, regulators are working to establish frameworks for the protection of individuals in the workplace.

            whistleblower directive

            The Whistleblower Directive serves as a critical tool in order to set robust protections for employees and other stakeholders who step forward to report wrongdoings. As a business, this should matter to you for two reasons: complying with legal requirements and maintaining a safe environment with integrity.

            The Whistleblower Directive: At a Glance

            What is the EU Whistleblower Directive?

            The Directive (EU) 2019/1937 on the protection of individuals who report breaches (wrongdoing or misconduct) of Union law, also known as the “Whistleblower Directive”, was adopted on October 23, 2019, and entered into force on December 16, 2019.

            It sets minimum standards for the protection of whistleblowers across the European Union and requires all EU Member States to implement measures, within national legal frameworks.

            Who can be defined as a “whistleblower”?

            Whistleblowers are reporting persons working in the private or public sector who acquired information on breaches (wrongdoing, misconduct or violation of EU law) in a work-related context. It can be, amongst others:

            • Employees;
            • Contractors or subcontractors;
            • Suppliers;
            • Volunteers;
            • Paid/unpaid trainees;
            • Job applicants.

            What type of violation can be reported?

            Whistleblowers can report a wide range of issues in several areas, such as:

            👉 Protection of privacy and personal data
            👉 Consumer protection
            👉 Violations of company policies and procedures
            👉 Financial misconduct
            👉 Money laundering and terrorist financing
            👉 Fraud
            👉 Network and information system security
            👉 Harassment or discrimination
            👉 Safety concerns (product, food, transportation)
            👉 Public health or animal health and welfare concerns
            👉 Environmental issues

            whistleblower protections

            Who has to comply with the Whistleblower Directive?

            The following organizations must comply:

            • Public and private entities with 50 or more employees;
            • All state, regional administrations, and municipal administrations with over 10,000 inhabitants.

            💡 Even if your company is based outside the EU, if you have a presence (i.e. branch) in a Member State of the EU and employ at least 50 employees, you are also subject to the Directive and relevant national legislation.

            How to Implement Robust Whistleblower Protection Measures

            There are a number of protection measures you need to take in order to comply with the Whistleblower Directive and make sure the rights of individuals in this regard are honored. We have listed 4 below.

            💡 Some legal penalties are imposed on companies that are not compliant with the directive. On top of that, there is a potential risk for your reputation and customer trust, which in turn can strongly impact your business. Keep reading to see what you can do!

            📌 Establish an Internal Reporting Channel

            In short, you need a way for employees and other stakeholders to report wrongdoing directly, in a confidential and secure way. You can do that by putting in place a process such as an internal reporting channel. This channel must:

            ✅ Ensure confidentiality of the reporting person’s identity (and that of any third party mentioned in the report);
            ✅ Prevent access from non-authorized staff;
            ✅ Acknowledge receipt within 7 days;
            ✅ Provide feedback in a timely manner, within 3 months;
            ✅ Designate an impartial person/department to handle reports;
            ✅ Allow different means of reporting (writing, orally, in person);
            ✅ Keep records for no longer than necessary to comply with legal requirements.

            💡 🚀 See how you can do this here.

            📌 Provide Training for Reporting Persons

            Another measure you should implement is to properly inform any potential reporting individual, such as employees, of their rights and protections deriving from the directive.

            It goes without saying, you should also give necessary training on how your reporting process works.

            💡 Learn more about this measure here.

            📌 Keep Whistleblowers’ Information Confidential

            Anonymity is key when handling whistleblowers’ reports. This is tightly linked to the next measure on preventing retaliation.

            In a nutshell, the identity of whistleblowers cannot be disclosed without their explicit agreement. This means that you should keep their data confidential. As always, compliance with data protection laws like the GDPR is crucial.

            📌 Prevent Retaliation

            This step requires you to implement robust legal measures to shield whistleblowers from backlash.

            Companies must show that they are proactive on this matter, by putting an anti-retaliation policy in place, conducting internal investigations and supporting whistleblowers who do face retaliation.

            Easily Manage Whistleblower Reports with iubenda

            Leverage technology to implement whistleblowing systems in no time!

            🚀 iubenda’s Whistleblowing Management Tool helps companies set up a reporting channel to comply with the Whistleblower Directive in no time and with low effort! It consists of a form and dashboard to simplify the process of submitting and managing whistleblowers’ reports through a dedicated channel.

            With iubenda’s secure platform for internal reporting, bypass the limitations tied to other traditional reporting channels like phone or email, and easily meet the technical requirements mentioned above:

            ⭐ Quick form setup
            ⭐ Guaranteed anonymity and confidentiality for whistleblowers
            ⭐ All-in-one dashboard to centralize reports and processes
            ⭐ Guided, standardized process for reporting
            ⭐ Instant acknowledgement mechanism upon receipt

            Provide Whistleblowers with a Secure Reporting Channel

            and comply with the EU’s Whistleblower Directive!

            Try it now

            The post How to Implement Whistleblower Protections in Your Organization appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            What is the GDPR? The Ultimate Guide to GDPR Compliance https://www.iubenda.com/en/help/5428-gdpr-guide/ Tue, 12 Dec 2023 16:57:15 +0000 https://help.iubenda.com/?p=5428 The General Data Protection Regulation (GDPR) became fully enforceable on May 25th, 2018. In this comprehensive guide on GDPR compliance, we explain the main requirements of the EU Regulation, how to comply, what are users’ rights, and much more. In this post, we explain: Before getting started: Special definitions used in this GDPR compliance guide […]

            The post What is the GDPR? The Ultimate Guide to GDPR Compliance appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            The General Data Protection Regulation (GDPR) became fully enforceable on May 25th, 2018. In this comprehensive guide on GDPR compliance, we explain the main requirements of the EU Regulation, how to comply, what are users’ rights, and much more.

            Before getting started: Special definitions used in this GDPR compliance guide
            • The term ” user ” here means an individual whose personal data is processed by a controller or processor (also known as the data subject ).
            • The term ” data controller ” means any person or legal entity involved in determining the purpose and ways of processing the personal data.
            • The term ” data processor ” means any person or legal entity involved in processing personal data on behalf of the controller.

            For example, an internet company may collect user information via their website and store it using a 3rd party cloud service. In this scenario, the internet company is the data controller and the organization running the cloud service is the data processor.

             

            What does GDPR stand for

            GDPR stands for General Data Protection Regulation (Regulation (EU) 2016/679) and at its most basic, it specifies how personal data should be lawfully processed (including how it’s collected, used, protected or interacted with in general). The EU GDPR became fully enforceable on May 25th, 2018.

            What is GDPR

            This regulation is intended to strengthen data protection for all people whose personal information fall within its scope of application, putting personal data control back into their hands.

            🔎 Personal data explained

            Personal data within the context of the GDPR text refers to any data that relates to an identified or identifiable living person. This includes pieces of information that, when collected together, can lead to the identification of a person.

            This applies even to data that has been pseudonymized or encrypted as long as the encryption/anonymization is reversible. In terms of meeting data protection obligations under the regulation, it means that decryption keys will need to be kept separately from the pseudonymized data.

            Examples of personal data include:

            • basic identity data such as names, health, genetic & biometric data;
            • web data such as IP addresses, personal email addresses, political opinions;
            • sexual orientation data.

            Examples of non-personal data include:

            • company registration numbers;
            • generic company email addresses such as info@company.com;
            • anonymized data.

            Who does the GDPR apply to

            The GDPR can apply to:

            • An entity that bases its operations in the EU (whether the processing takes place in the EU or not).
            • An entity that is not established in the EU, but offers goods or services (even for free) to people in the EU. The entity can be government agencies, private/public companies, individuals, and non-profits.
            • An entity that is not established in the EU but monitors the behavior of people who are in the EU, provided that such behavior takes place in the EU.

            Where does it apply

            This scope effectively covers almost all companies and, therefore, means that the GDPR can apply to you whether your organization is based in the EU or not. As a matter of fact, this PwC survey showed that GDPR compliance is a top data protection priority for up to 92% of US companies surveyed.

            The GDPR can apply to you whether your organization is based in the EU or not

            A common misconception is that only EU users are covered by the protections of the GDPR. However, the protections of the GDPR also extend to users outside the EU if the data controller is EU-based. Therefore, if you are an EU-based data controller, the GDPR requirements apply to you and you must, by default, apply GDPR standards to ALL your users.

            When does it not apply

            The conditions of applicability of the GDPR are set in GDPR text Articles 2 & 3 from a material and a territorial point of view. To determine, whether a specific processing activity is exempt from its applicability, we have to consider both aspects.

            GDPR compliance: Material point of view

            The EU GDPR applies to the processing of personal data. Therefore, it does not apply to company data, such as a company name and address. Be careful here, however, because normally “natural persons” work in a company, any data referring to them would, therefore, be deemed “personal”, regardless of whether they are processed in a Business to Customer (B2C) or Business to Business (B2B) context.

            Furthermore, personal data would not fall under the scope of applicability of the GDPR whenever:

            • they are processed by Member States in the context of the EU’s common foreign and security policy;
            • they are processed by competent authorities for purposes of prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
            • they are processed by EU institutions, bodies, offices and agencies;
            • they are processed by a natural person in the course of a purely personal or household activity (e.g. if you collect your friends’ personal data for your own personal phone book).

            GDPR compliance: Territorial point of view

            We’ve already mentioned under which conditions the GDPR applies from a territorial point of view.

            Consequently, for a processing activity not to be subjected to the GDPR, the following must apply cumulatively:

            • the controller (or processor) is not based within the EU. Always bear in mind that the controller (or processor) could also be a EU-branch office of a non-EU corporation: in that case, even if the branch office were to have no legal personality, the GDPR would fully apply;
            • the processing does not relate to the offering of goods or services (even for free) to data subjects in the Union or the monitoring of their behavior as far as it takes place within the Union;
            • the controller is not based in an extra-EU place, where EU law applies due to international public law.

            💡 Let’s take a look at some practical examples:

            US-based company, “A”, is selling goods to EU-based consumers (→ GDPR applicable) and hires a US-based company, “B”, for market analytics and statistics purposes. Is company B subject to the GDPR, although it’s neither based in the EU nor does it sell goods or services to EU customers? Probably yes, if the market analytics and statistics activity requires a “monitoring of the behavior” of customers based in the EU.

            Do the employees of the Italian Consulate in New York need to comply with the GDPR? Yes, because the GDPR applies to them by virtue of “international public law”.

            Does a China-based company selling goods over a website only drafted in Chinese need to comply with the GDPR just because it’s possible, from a practical point of view, that some EU-based Chinese persons might purchase something from it? In principle, we’d say no, unless it can be proven that the company is doing relevant business with EU-based customers, or is addressing them expressly (for instance, by informing that “delivery to the EU” or “payment from an EU bank account” are possible, etc.)

            Main requirements for GDPR compliance

            We have listed below the main requirements that organizations should meet in order to comply with the GDPR. It’s not an easy task. That’s why we have crafted GDPR-compliant legal software solutions to help you speed out and simplify the process. Jump to this section to learn more.

            Not sure how to get started with GDPR compliance?

            Use our site scanner for a FREE website compliance audit

            Scan your website now

            1. Legal basis for processing data

            According to GDPR compliance, data can only be processed if there’s at least one legal basis for doing so.

            The legal bases are:

            • The user has given consent for one or more specific purposes.
            • The data processing is necessary for the performance of a contract in which the user is a participant or necessary in order to take steps (requested by the user) prior to entering the contract.
            • The processing is necessary for fulfilling a legal obligation to which the data controller is subject.
            • The processing is necessary for protecting the vital interests of the user or of another person.
            • The processing is necessary for performing a task carried out in the interest of the public or as contained under the official authority given to the data controller.
            • The processing is necessary for the legitimate interests of the data controller or third party, except where overridden by the interests, rights and freedoms of the user, in particular where the user is a child.
            Please note

            Consent is the most common legal basis that an organization can choose to process user data, but it is not the ONLY one. Therefore in some cases, companies can apply other legal bases for a data processing activity (however determining whether or not another legal basis may apply to your processing is best done with a lawyer). With that said, there will always be data processing activities where consent is the only, best or safest option.

            GDPR requirements dictate that if relying on the legal basis of consent, data controllers must get verifiable consent from users.

            In general, when getting consent for data processing, organizations should not use overly complicated terms. This includes legalese and unnecessary jargon. This indicates that terms and privacy policies should be laid out legibly (see ours here) using understandable language and clauses so that users are fully aware of what they’re consenting to and what the consequences of their consent are.

            Organizations must be transparent on the purpose of the data collection and consent must be “explicit and freely given”. This means that the mechanism for acquiring consent must be unambiguous and involve a clear “opt-in” action (the regulation specifically forbids pre-ticked boxes and similar “opt-out” mechanisms).

            The regulation also gives a specific right to withdraw consent; it must, therefore, be as easy to withdraw consent as it is to give it.

            🔎
            Consent for children

            In regards to Consent for children, organizations are required to get verifiable consent from a parent or guardian unless the service being offered is a preventative or counseling service. Organizations must make reasonable efforts (using available technology) to verify that the person giving consent actually holds parental responsibility for the child.

            Consent is such an important issue under the GDPR and it’s mandatory that you’re able to demonstrate that the user has given consent; should problems arise, the burden of proof lies with the data controller, so keeping accurate records is vital.

            To achieve GDPR compliance, your consent records should include:

            • who provided the consent;
            • when and how consent was acquired from the individual user;
            • the consent collection form they were presented with at the time of the collection;
            • which conditions and legal documents were applicable at the time that the consent was acquired.

            💡 Check this out for an example of compliant record-keeping vs non-compliant record-keeping:

            Non-compliant Record Keeping Compliant Record Keeping
            Simply keeping a spreadsheet with customer names and whether or not consent was provided Ensuring that you keep a copy of the customer’s dated form which shows the action taken by the customer to provide their consent to the specific processing.
            Simply keeping the time and date of consent linked to an IP address, with a web link to your current data-capture form and privacy policy. Keeping comprehensive records that include a user ID and the data submitted together with a timestamp. You also keep a copy of the version of the data-capture form and any other relevant documents in use on that date.

            Maintaining valid records, while mandatory, can be a technical challenge. Our Consent Database simplifies this process, making it easy for you to view, manage and export your recorded consents. You can read more about it here.

            Cookies and the GDPR

            Another EU law worth mentioning here is the ePrivacy Directive (also known as the Cookie Law). This law still applies as it has not been repealed by the GDPR. In future, the ePrivacy Directive will be replaced by the ePrivacy Regulation and as such, will work alongside the GDPR; the upcoming regulation is expected to still uphold the same values ​​as the directive.

            The Cookie Law requires users’ informed consent before storing cookies on a user’s device and tracking them.

            💡 Everything you should know in this guide: Cookies and the GDPR: What’s Really Required?

            🌏 Want to learn more about which EU cookie consent rules apply on a per-country basis? Check out our Cookie Consent Cheatsheet.

            3. Users’ rights

            The GDPR text significantly enhances users’ rights over their personal data within the EU. It empowers individuals with greater control and transparency over their information and providing rights such as access, rectification, erasure, and data portability among others. Let’s take a look at each of them.

            📌 The right to be informed

            Organizations must provide users with information about the data processing activities they carry out. Such information should be provided at the time at which personal data is obtained, typically via a privacy notice/policy.

            The information must be concise, transparent, intelligible, easily accessible, written in clear and plain language (especially if addressed to a child), and free of charge.

            If the data is collected from the actual user it relates to, then they must be provided with privacy information at the time the data is obtained. However, if the personal data is obtained from a source other than the individual user it relates to, then the user must be provided with privacy information within a “reasonable period” of the data being obtained. This period can be no later than one month in general. If you use the data to communicate with the user, the disclosure must be at latest, when the first communication occurs.

            📌 The right to access

            Users have the right to access the data and information about how their personal data is being processed. GDPR compliance dictates that should a user request it, data controllers must provide an overview of the categories of data being processed, a copy of the actual data, and details about the processing. The details should include the purpose, how the data was acquired, and with whom it was shared.

            Also, the organization must provide the person making the request with a copy of their personal data free of charge (a reasonable fee can be charged for further copies). The requested data must be provided to the individual without undue delay and at latest, within one month of receiving the request; the exact number of days the organization has to honor a request depends on the month in which the request was made.

            💡 The right to access is closely linked to the right to data portability, but these two rights are different. It is therefore important that in your privacy policy, there is a clear distinction between the two.

            📌 The right to rectification

            Users have the right to have their personal data rectified if it is inaccurate or incomplete.

            This right also implies that rectification must be disclosed to any and all third-party recipients involved in the processing of the data in question – unless doing so is impossible or disproportionately difficult. If requested by the user, the organization must also inform them about these third-party recipients.

            Requests can be extended by a further two months if the request is complex or if numerous requests were received from the individual. The individual must be informed within one month of receipt of the request with an explanation as to why the extension is necessary. Requests must be honored without undue delay and at latest, within one month of receiving the request.

            In most cases, organizations must comply with a request for rectification without charging a fee, however, if a request is found to be “manifestly unfounded or excessive”, a “reasonable fee” can be requested in order to carry out the request or refuse to deal with the request. In both scenarios, the decision will need to be legitimately justified. If a request is refused, the individual must be informed (along with the justification) without unnecessary delay and within one month of receiving the request.

            📌 The right to object

            Under the GDPR text, users have the right to object to certain processing activities in relation to their personal data carried out by the controller.

            The user has to state a motivation for their objection, unless the processing is carried out for direct marketing purposes, in which case no motivation is needed to exercise this right.

            In a nutshell, the user can object to the processing of their data whenever the processing is based on the controller’s legitimate interest, or the performance of a task in the public interest/exercise of official authority, or for purposes of scientific/historical research and statistics.

            In a nutshell, the user can object to the processing of their data whenever the processing is based on the controller’s legitimate interest, or the performance of a task in the public interest/exercise of official authority, or for purposes of scientific/historical research and statistics.

            If an objection to the processing of personal data is received and there is no grounds to refuse, the processing activity must stop. While the processing activity (including storage) must stop for the particular processing activities objected to, erasure may not be appropriate if the data is processed for other purposes (including the fulfillment of legal or contractual obligation) as the data will need to be retained for those purposes.

            Requests must be honored without undue delay and at latest, within one month of receiving the request. Requests can be extended by a further two months if the request is complex or if numerous requests were received from the individual. The individual must be informed within one month of receipt of the request with an explanation as to why the extension is necessary.

            In most cases, organizations must honor an objection (where there are no grounds to refuse) without charging a fee, however, if a request is found to be “manifestly unfounded or excessive”, a “reasonable fee” can be requested in order to carry out the request or the request can be refused. In both scenarios, the decision will need to be legitimately justified. If a request is refused, the individual must be informed (along with the justification) without unnecessary delay and within one month of receiving the request.

            📌 The right to data portability

            Users have the right to obtain (in a machine-readable format) their personal data for the purpose of transferring it from one controller to another, without being prevented from doing so by the data processor.

            This right only applies to personal data and as such does not apply to genuinely anonymous data (data that can’t be linked back to the individual).

            Requests must be honored without undue delay and at latest, within one month of receiving the request. Requests can be extended by a further two months if the request is complex or if numerous requests were received from the individual. The individual must be informed within one month of receipt of the request with an explanation as to why the extension is necessary.

            In most cases, organizations must comply with a request without charging a fee, however, if a request is found to be “manifestly unfounded or excessive”, a “reasonable fee” can be requested in order to carry out the request or the request can be refused. In both scenarios, the decision will need to be legitimately justified. If a request is refused, the individual must be informed (along with the justification) without unnecessary delay and within one month of receiving the request.

            📌 The right to erasure

            When data is no longer relevant to its original purpose, or where users have withdrawn consent, or where the personal data have been unlawfully processed, users have the right to request that their data be erased.

            The right to erasure can be refused:

            • where the personal data is processed for archiving purposes in the public interest (for example, scientific research);
            • where data is necessary for legal defense;
            • to comply with a legal obligation;
            • for the performance of a task carried out in the public interest;
            • in the exercise of official authority vested in the controller;
            • where the data is necessary to exercise the right of freedom of expression;
            • where the data is being processed for health purposes in the public interest.

            The request must be honored without undue delay and at latest, within one month of receiving it.

            Requests can be extended by a further two months if the request is complex or if numerous requests were received from the individual. The individual must be informed within one month of receipt of the request with an explanation as to why the extension is necessary.

            📌 The right to restrict processing

            Users have the right to restrict the processing of their personal data in cases where:

            • they’ve contested its accuracy;
            • the user has objected to the processing and the organization is considering whether it has a legitimate ground which overrides this right;
            • the processing is unlawful but the user requests restriction instead of erasure;
            • the data is no longer needed but the user needs it to establish, exercise or defend a legal claim.

            The restriction must be disclosed to any and all third-party recipients involved in the processing of the data in question – unless doing so is impossible or disproportionately difficult. If requested by the user, the organization must also inform the user about these third-party recipients.

            Requests must be honored without undue delay and at latest, within one month of receiving the request. Requests can be extended by a further two months if the request is complex or if numerous requests were received from the individual. The individual must be informed within one month of receipt of the request with an explanation as to why the extension is necessary.

            In most cases, organizations must comply with a request without charging a fee, however, if a request is found to be “manifestly unfounded or excessive”, a “reasonable fee” can be requested in order to carry out the request or the request can be refused. In both scenarios, the decision will need to be legitimately justified. If a request is refused, the individual must be informed (along with the justification) without unnecessary delay and within one month of receiving the request.

            📌 Rights relating to automated decision-making and profiling

            Users have the right to not be subjected to a decision when it is based on automated processing or profiling, and it produces a legal or a similarly significant effect on the user.

            Organizations can only carry out automated decision-making if it is needed for the performance of a contract; authorized by EU state law applicable to the data controller; does not have a legal or similarly significant effect on the user; or is based on the individual’s explicit consent. You can only make automated decisions based on special category data with the explicit consent of the user or for reasons of substantial public interest.

            4. Cross-border data transfers

            The GDPR allows data transfers of EU resident data outside of the European Economic Area (EEA) only when in compliance with set conditions.

            According to the GDPR text, the country or region the data is being transferred to must have an “adequate” level of personal data protection by EU standards, or where not considered adequate, transfers may still be allowed under the use of standard contractual clauses (SCCs) or binding corporate rules (BCRs).

            💡 Learn more about data transfers between the EU and the US.

            5. Privacy by design & default

            Data protection should be included from the onset of design and development of the business processes and infrastructure. This means that privacy settings should be set to ‘high’ by default and measures put into place to make sure that the processing life cycle of the data falls within the GDPR requirements.

            6. Breach notification

            If the organization is victim of a data breach, the data controller must notify the Supervisory Authority within 72 hours of becoming aware of it. If the processing is carried out by a processor on behalf of the controller, the data processor will have to notify the controller immediately after becoming aware of it.

            Under this rule, users must also be informed of the breach (within the same time frame) unless the data breached was protected by encryption (data rendered unreadable for the intruder), or, in general, the breach is unlikely to result in a risk to individuals’ rights and freedoms.

            In any case, the data controller should keep records of the breaches occurred in order to be able to demonstrate to the supervising authority compliance with these provisions.

            7. Data Protection Officers

            The Data Protection Officer (DPO) is a person with expert knowledge of data protection law whose role includes assisting the controller or processor in monitoring internal compliance with GDPR regulations and overseeing data protection strategy and implementation. The DPO should also be proficient in IT process management, data security and other critical issues surrounding the processing of personal and sensitive data.

            When is the appointment of a DPO required by the GDPR?

            GDPR compliance requires the designation of a DPO specifically in the following cases:

            • Where there is large-scale regular and systematic monitoring of users;
            • Where the processing is carried out by a public authority (except for courts or independent judicial authorities);
            • Where the organization is performing complex operations with user data (in particular sensitive user data).

            The appointment of a DPO is therefore not just based on the actual number of employees but on the essence of the data processing activity. If your organization falls outside of these categories, then it is not mandatory that you appoint a DPO.

            8. Records of processing activities

            The EU GDPR requires that both data controllers and data processors keep and maintain “full and extensive” up-to-date records of the particular data processing activities they are carrying out.

            The records of processing activities must be in writing. While both paper and electronic forms are acceptable, it is best practice to use an electronic method of record-keeping so as to facilitate easy amendments.

            When is record-keeping of processing activities required by the GDPR?

            Under GDPR compliance, full and extensive records of processing are expressly required in cases where the data processing activities:

            • are not occasional; or
            • could result in a risk to the rights and freedoms of others; or
            • involve the handling of “special categories of data”; or
            • is carried out by an organization that has more than 250 employees.

            This effectively covers almost all businesses.

            Note

            Even if your processing activities somehow fall outside of the situations mentioned above, your information duties to users (Articles 13 & 14) make it necessary for you to keep basic records relating to which data you collect, its purpose, all parties involved in its processing and the data retention period — this is mandatory for everyone.

            💡 You may find that it is, in fact, quite useful to do regular information audits on what data your organization holds as not only does this practice help you to readily meet your record-keeping obligations, but it also makes it easier for you to review and optimize your data processing procedures.

            Our Register of Data Processing Activities comes in very handy here as it greatly simplifies the technical process of creating and maintaining records. Read more about how it can help here.

            📝 What records of the data processor should include:

            • The name and contact details of the controller, and where applicable, the controller’s representative and DPO;
            • The purpose of the processing activities;
            • Description of the various categories of users and data;
            • The categories of data recipients including third country (not a member of the EU) recipients or international organizations;
            • Transfers of personal data to a third country and the identification of that third country or international organization, including documentation of suitable safeguards (where applicable);
            • Anticipated time limits for erasure of the various categories of data (where possible);
            • A general description of technical and organizational security measures (where possible).

            📝 What records of the data processor should include:

            • The name and contact details of the controller and the processor acting on their behalf, and where applicable, the processor or controller’s representative and DPO;
            • The categories of processing carried out on behalf of each controller;
            • Transfers of personal data to a third country and the identification of that third country or international organization, including documentation of suitable safeguards (where applicable);
            • Anticipated time limits for erasure of the various categories of data (where possible);
            • A general description of technical and organizational security measures (where possible).

            9. Data Protection Impact Assessment (DPIA)

            A data protection impact assessment (DPIA) is a process used to help organizations comply effectively with the GDPR and ensure that the principles of accountability, privacy by design and privacy by default are put in practice by the organization.

            The DPIA process should be recorded in writing. While publishing the DPIA is not a general legal requirement of the GDPR, it is suggested that data controllers consider publishing all or part of their DPIA as a gesture of transparency and accountability.

            💡 An effective DPIA is useful in meeting the requirement of “Privacy by design” as it makes it possible for organizations to find and fix issues at an early stage, thus mitigating both data security risks for users, and the risk of GDPR fines, sanctions and reputation damage that might otherwise occur to the organization.

            When is a DPIA required by the GDPR?

            The DPIA is only mandatory in cases where data processing activity is likely to result in a high risk for users.

            However, if unsure as to whether or not your processing activity falls within what is considered “high risk”, it is recommended that a DPIA be carried out nonetheless as it is a useful tool for ensuring that the law is complied with.

            🔎 “High-risk” data processing activities include:

            • Large-scale processing of sensitive data;
            • Systematic monitoring of a publicly accessible area (e.g. CCTV);
            • Situations where there are extensive automated evaluations of personal data that is intended to influence decisions that can affect the user’s life significantly.

            Know that DPIAs can also be required in other circumstances (based on a by case evaluation) including but not limited to processing data concerning vulnerable persons (e.g. children, the elderly), data transfer across borders outside the EU and data that is being used in profiling (e.g. credit scores).

            📝 What a DPIA should include:

            • Full descriptions of the data processed;
            • The purpose of the processing activity (and where applicable, information on the legitimate interests of the data controller);
            • An evaluation of the scope and necessity of the processing activity in relation to the purpose;
            • An assessment of the risk posed to users;
            • Measures in place to address that risk.

            GDPR fines: Consequences of non-compliance

            The legal consequences for non-compliance can include fines up to EUR 20 million (€20m) or 4% of the annual worldwide turnover (whichever is greater), but perhaps equally as concerning are the other potential sanctions that may be implemented against organizations found to be in violation. These sanctions include official reprimands (for first-time violations), periodic data protection audits and liability damages.

            The legal consequences for non-compliance can include GDPR fines up to EUR 20 million (€20m) or 4% of the annual worldwide turnover

            The GDPR text also gives the explicit right to file a complaint with a supervisory authority if they feel that any processing of their personal data was done in violation of GDPR regulations and the right to compensation for any damages resulting from an organization’s non-compliance with regulations, hereby leaving violators open to potential litigation.

            If a report is made to the authority about an instance of regulatory violation, the authority may choose to perform an audit of the organization’s data processing operations. If it’s found that some processing activity was done unlawfully, not only is a fine imposed, but the organization may be forbidden from making further use of both the data of the inquiry and data acquired using similar mechanisms. This means that if the improper use was in regards to email address collection, the organization risks being barred from using the entire associated email list.

            GDPR Compliance FAQs

            What does GDPR mean in simple terms?

            In simple terms, GDPR stands for General Data Protection Regulation, which is a comprehensive data protection and privacy law in the European Union (EU). It was introduced to enhance the privacy and protection of personal data of EU citizens and residents. The regulation became enforceable on May 25, 2018, replacing the Data Protection Directive of 1995.

            What are the 7 principles of GDPR?

            The 7 principles of GDPR are lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitations, integrity/confidentiality, and accountability. They guide the processing of personal data and ensure the protection and privacy of individuals’ data. The 7 principles of GDPR are as follows:

            1. Lawfulness, Fairness, and Transparency: The processing of personal data must have a legitimate basis and be conducted in a fair and transparent manner. Data subjects should be informed about the purposes of data processing and any other relevant information regarding their data.
            2. Purpose Limitation: Personal data should be collected for specified, explicit, and legitimate purposes. Organizations must ensure that the data they collect is used only for the purposes for which it was originally collected. If they intend to use the data for additional purposes, they need to obtain explicit consent for this.
            3. Data Minimization: GDPR emphasizes that personal data should be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. This means that organizations should avoid collecting excessive data and should retain only the minimum amount of data required to achieve their stated objectives.
            4. Accuracy: Highlights the importance of keeping personal data accurate and up-to-date. Organizations are responsible for taking reasonable steps to ensure that the data they hold is accurate, and if any inaccuracies are identified, they should be rectified promptly.
            5. Storage Limitations: The data you store should be up-to-date, but you can’t store it forever. The GDPR text requires that you set a time limit – the shortest possible – and that you explain why you need to store your users’ data for that period of time. When the time comes, you must erase or review the data you stored.
            6. Integrity and Confidentiality: Store your users’ data securely, protecting them from unlawful processing or accidental loss, destruction or damage. You should also protect your users’ identity, through anonymization, for instance.
            7. Accountability: Keep records relating to which data you collect, its purpose, all parties involved in its processing and the data retention period. This is mandatory for everyone.

            GDPR compliance: 7 principles of GDPR

            What is a GDPR compliance?

            In short, GDPR compliance refers to adhering to the General Data Protection Regulation (GDPR), a set of data protection laws implemented by the European Union (EU).

            GDPR sets guidelines and regulations on how personal data of individuals within the EU should be collected, processed, stored, and protected by organizations.

            Achieving GDPR compliance involves implementing necessary measures to ensure the privacy and security of personal data, obtaining explicit consent from individuals, providing transparency in data handling practices, appointing data protection officers (DPOs), and promptly addressing data breaches. Non-compliance can result in significant penalties.

            Is GDPR compliance mandatory in USA?

            No, GDPR compliance is not mandatory in the United States by default.

            The General Data Protection Regulation (GDPR) is a regulation implemented by the European Union (EU) and primarily applies to organizations that collect, process, or store personal data of individuals within the EU. However, some US-based companies may need to comply with GDPR if they handle the personal data of EU residents.

            This can occur when offering goods or services to EU individuals or monitoring their behavior. It is advisable for US companies to assess their data processing activities and consult legal experts to determine if GDPR compliance is required for their specific situation. Additionally, the US has its own data protection regulations, such as the California’s CCPA/CPRA, which may apply to businesses operating within that state.

            👋 Which privacy laws apply to you?

            👉 Do this 1-min quiz to find out!

            GDPR overview

            What is GDPR The EU General Data Protection Regulation is one of the most robust privacy laws in the world. It was enforced in May 2018.
            What’s the aim of the GDPR The Regulation wants to strengthen data protection for all people whose personal information fall within its scope of application, putting personal data control back into their hands.
            Who does the GDPR apply to The GDPR applies to both EU and Non-EU companies. Thus, its scope of application can extend outside of EU borders.
            How comply with GDPR GDPR compliance is made of several steps, and each organization should evaluate it carefully. At the very least, you should:
            • Establish a valid legal basis for processing personal data.
            • Clearly describe the types of personal data collected and the purposes behind their collection in your privacy and cookie policy.
            • Enable customers to easily request and receive information about the data you hold on them.
            • Implement robust technologies and procedures to detect, report, and investigate any personal data breach.
            • Maintain detailed records of data storage, usage, and processing activities.

            How to comply with GDPR

            We’ve created a useful checklist on how to comply with GDPR and the Cookie Law, since they go hand in hand for compliance in Europe. Keep reading!

            👋 The GDPR applies to you if you’re based in the EU (+ UK), or if you target EU (+ UK) users. The ePrivacy Directive (or Cookie Law) applies to most websites that can be accessed by EU users and that run cookies, trackers or similar technologies.

            ✅ Do you have a valid, up-to-date and easily accessible privacy policy in your website’s footer or app menu?

            ✅ Does your privacy policy describe all the types of personal data you collect, how, why, and who it gets shared with?

            ✅ Do you get user consent before collecting any personal data, e.g. on a contact form, or wheninstalling marketing cookies for advertising or analytics?

            ✅ If you install cookies, do you show an obvious cookie banner when a user first visits your website?

            ✅ Do you block cookie scripts to prevent non-exempt cookies from being installed before you get consent?

            ✅ Do you give users full granular consent options on your banner so they can filter out cookies they don’t want installed (e.g. by type of cookies and purposes)?

            ✅ Do you have a proper cookie policy or a section of your privacy policy dedicated to cookies?

            ✅ Do you maintain detailed records of consent for cookies, marketing activities and more? Do they include elements like timestamps, preferences expressed, and the specific form used?

            ✅ Do you inform users of and make it easy for them to exercise their rights, i.e. to fulfill their requests to access/correct/update/delete data you hold on them?

            ✅ Do you keep detailed internal records, including data retention policies, security measures or transfers outside the EU?

            ✅ Do you keep the data safe? Who is responsible for GDPR compliance within your organization?

            Simplify your GDPR compliance with iubenda

            At iubenda, we take a comprehensive approach to GDPR compliance. We built our compliance solutions with the strictest regulations in mind, giving you full options to customize as needed. This way, we’ll assist you with meeting your legal obligations, reduce your risk of litigation and protect your customers —building trust and credibility.

            And, wait for it: our solutions are made to simplify and speed up your compliance journey!

            💡 Please note that privacy laws are usually amended and updated. It’s therefore important to ensure that your policies meet the latest requirements. For this reason, we use dynamic embedding and NOT copy & paste. With this method, you can rest assured that your policy is up to date and being maintained remotely by our legal team.

            Here’s what you need to get started with full GDPR compliance:

            This legal document should state the ways in which your website or app collects, processes, stores, shares and protects user data, the purposes for doing so and the rights of the users in that regard.

            With our Privacy and Cookie Policy Generator you can create a beautiful, lawyer-crafted, precise privacy policy and seamlessly integrate it with your website or app. You can simply add any of several pre-created clauses at the click of a button or easily write your own custom clauses using the built-in form.

            The privacy policy also comes with the option to include a cookie policy (it’s necessary to include it if your website or app is using cookies). The policies are customizable to your needs and remotely maintained by an international legal team.

             

            For more information on privacy policies click here.

            Using cookies can mean both processing user data and installing files on the user devices. That’s why you need to meet the ePrivacy directive (Cookie Law)’s legal requirements if using tracking technologies. To help you out, we’ve created our comprehensive Privacy Controls and Cookie Solution. It’s an easy-to-use cookie policy and cookie consent solution (including banner management), it’s fast and does not require heavy investments.

            Many Data Protection Authorities across the EU have strenghtened their requirements and aligned their rules on cookies and trackers with the requirements of the GDPR. More specifically, it’s required that you record and store proofs of your users’ preferences.

            Cookie and Consent Preference Log are now available in our Privacy Controls and Cookie Solution. Click here for more info!

            In order to make your web forms fully GDPR compliant – regardless of how many users you have – you must also store proof of consent. You must demonstrate that consent was collected, when it was provided, by whom, which preferences were expressed, which legal or privacy notice was presented.

            Do all of the above with iubenda’s Consent Database. It helps you record and manage GDPR consent and privacy preferences for each of your users. It smoothly integrates with your consent collection forms, syncs with your legal documents and includes a user-friendly dashboard for reviewing consent records of your activities.

            To meet the record-keeping requirement from the GDPR text, our Register of Data Processing Activities helps you record and manage all the data processing activities within your organization. You can list processing activities from 1800+ pre-made options, divide them by area, assign processors and other member roles, and document legal bases and other GDPR-required records.

            For a list of the full features of the Register of Data Processing Activities, read our guide here.

            GDPR compliance made easy

            Get started now

            See also

            The post What is the GDPR? The Ultimate Guide to GDPR Compliance appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Navigating Whistleblowing Laws: An International Overview https://www.iubenda.com/en/help/143589-navigating-whistleblowing-laws-an-international-overview/ Wed, 29 Nov 2023 11:16:56 +0000 https://help.iubenda.com/?p=143589 Whistleblowing Laws play a crucial role in promoting transparency and accountability in organizations. Understanding the legal aspects surrounding whistleblowing is essential for businesses to ensure compliance and protect employees who report wrongdoing.  This article provides a comprehensive overview of international whistleblowing laws, with a specific focus on the EU Whistleblower Directive, and highlights best practices for […]

            The post Navigating Whistleblowing Laws: An International Overview appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Whistleblowing Laws play a crucial role in promoting transparency and accountability in organizations. Understanding the legal aspects surrounding whistleblowing is essential for businesses to ensure compliance and protect employees who report wrongdoing. 

            This article provides a comprehensive overview of international whistleblowing laws, with a specific focus on the EU Whistleblower Directive, and highlights best practices for businesses.

            Whistleblowing Laws

            Importance of Whistleblowing Laws

            Whistleblowing serves as an important mechanism to expose fraud, corruption, and other unethical practices within organizations. By encouraging employees to report misconduct, businesses can address issues promptly, prevent financial losses, protect their reputation, and foster a culture of integrity. Whistleblowing also helps in detecting regulatory violations and ensuring compliance with laws and regulations.

            For a more detailed overview on Whistleblowing, see here

            International Whistleblowing Laws

            In the European Union, the new EU Whistleblower Directive has been introduced, mandating each member country to incorporate it into their national legal frameworks. See the EU whistle blow Directive Breakdown below 👇

            Whistleblowing laws in the United States encompass a range of federal, state, and local statutes designed to encourage and protect individuals who expose illegal or unethical activities within organizations. Key features of these laws include confidential handling of disclosures, financial awards, and independent reporting channels. Some notable laws include:

            • Whistleblower Protection Act of 1989: Aimed at safeguarding federal employees who report governmental violations, mismanagement, and corruption, this act shields them from negative job repercussions. It ensures civil protections against punitive measures like job termination or demotion, but does not extend to issues like tax law or political financing.
            • Lloyd-La Follette Act of 1912: A pioneering statute in whistleblower legislation, particularly for federal employees, granting them the right to freely communicate with Congress without obstruction or denial.
            • Freedom of Information Act of 1966: While not directly a whistleblower law, it aids whistleblowing efforts by permitting public access to federal agency records, essential for uncovering misconduct.
            • Civil Service Reform Act of 1978: Initially offering protection to federal employees, this act was later expanded to include some degree of protection for private-sector employees as well.
            • No FEAR Act of 2002: This act actively discourages federal managers and supervisors from illegal discrimination and retaliation, making them accountable under whistleblower and antidiscrimination laws.

            Whistleblowing laws in Asia reflect a diverse and evolving legal landscape, shaped by cultural, regulatory, and economic factors. Here’s an overview of the current state of whistleblowing laws and practices in various Asian countries:

            • Asia-Pacific Whistleblowing Trends: The region has seen an upsurge in whistleblower reports, attributed to new regulations, media focus, and incentives in some areas. While many companies acknowledge the need for effective whistleblowing programs, implementation varies. Common issues reported include workplace harassment and policy breaches.
            • China: There’s notable growth in whistleblowing programs, especially in government sectors, with new regulations including financial incentives. Corporate responses, however, are mixed, with some concerns over the motives behind reports.
            • Japan & Australia: Both countries are enhancing whistleblower protections. Japan is revising its laws to boost confidentiality and protection, and Australia has implemented reforms encouraging reporting and offering stronger protections.
            • Regional Developments: Increased efforts are being made to safeguard whistleblowers’ identities and ensure confidentiality. This includes tougher penalties in Korea and Japan against exposing whistleblowers, and legislative updates in New Zealand.
            • India: Despite passing a Whistleblowing Act in 2014, implementation remains pending, reflecting a delay in formal protections in some parts of the region.

            Overall, the Asian region shows a growing recognition of the importance of whistleblowing in corporate governance and compliance, with increasing efforts to provide legal protections and incentives for whistleblowers. However, cultural and hierarchical norms often present challenges, and there is still significant variation in the effectiveness and scope of whistleblower laws across different countries.

            Whistleblower Directive Breakdown 

            Directive (EU) 2019/1937 of the European Parliament and of the Council, on the protection of persons who report breaches of Union law, also known as the “Whistleblower Directive”, was adopted on October 23, 2019, and entered into force on December 16, 2019.

            Who has to comply with the Whistleblower Directive?

            All public legal entities and private companies with more than 50 employees based in the European Union (and municipalities with more than 10,000 inhabitants) are required to comply with the obligation to establish an internal reporting channel.

            Important date: By December 17, 2023, private sector legal entities with 50 to 249 employees, are required to establish and activate an internal reporting channel to receive reports

            The directive sets minimum standards for the protection of whistleblowers across the European Union and requires all EU Member States to implement corresponding national legal frameworks 👇

            🇦🇹 Austria: Implemented – Austria’s “HinweisgeberInnnenschutzgesetz” (HSchG) was approved in February 2023, transposing the EU Whistleblowing Directive. The law came into force on February 25, 2023, allowing a six-month transition period for entities with 250 or more employees to establish internal whistleblowing systems.

            🇧🇪 Belgium: Implemented – Belgium’s Chamber of Representatives passed a bill in 2023 to protect whistleblowers, translating the EU Whistleblowing Directive into Belgian law. The law is set to come into force in 2023.

            🇧🇬 Bulgaria: Implemented – Bulgaria approved its whistleblowing law in January 2023, aligning with the EU Whistleblowing Directive. The law, effective from May 4, 2023, includes provisions for employers in the private sector with 50 to 249 employees, applicable from December 17, 2023.

            🇭🇷 Croatia: Implemented – Croatia adopted the “Croatian Whistleblower Protection Act” in late 2022, addressing loopholes and incorporating extended mechanisms to comply with the EU Whistleblowing Directive.

            🇨🇾 Cyprus: Implemented – Cyprus transposed the EU Whistleblowing Directive on February 4, 2022, introducing new reporting provisions and protective measures for whistleblowers in the private and public sectors.

            🇨🇿 Czech Republic: Implemented – The Czech Republic passed a new Whistleblower Act in June 2023, transposing the EU Whistleblowing Directive, effective from August 1, 2023.

            🇩🇰 Denmark: Implemented – Denmark passed the Whistleblower Protection Act in June 2021, making it the first EU member state to implement the EU Whistleblowing Directive into national law.

            🇪🇪 Estonia: In progress – Estonia’s transposition process is ongoing, with a protection bill passing the first reading in 2022. Delays and criticism have complicated the process.

            🇫🇮 Finland: Implemented – Finland transposed the EU Whistleblowing Directive, with the new legislation effective from January 1, 2023. It enhances protection for whistleblowers and mandates internal reporting channels for eligible entities.

            🇫🇷 France: Implemented – France passed a law in March 2022, amending the existing Sapin 2 law to align with the EU Whistleblowing Directive, covering entities with 50 or more employees.

            🇩🇪 Germany: Implemented – Germany’s Whistleblower Protection Act came into force in July 2023 after initial rejection in February 2023. The act aims to protect whistleblowers and ensure transparency.

            🇬🇷 Greece: Implemented – Greece’s draft whistleblower protection legislation, submitted in October 2022, was passed in November 2022 and is now in force, with different implementation dates for compliance measures.

            🇭🇺 Hungary: Implemented – Hungary passed the Whistleblower Protection Act in May 2023, completing the transposition process.

            🇮🇪 Ireland: Implemented – Ireland transposed the EU Whistleblowing Directive in July 2022, extending protection and introducing formal reporting channels, effective from January 1, 2023.

            🇮🇹 Italy: Implemented – Italy approved a delegation law in March 2023, completing the transposition process for the Whistleblowing Directive.

            🇱🇻 Latvia: Implemented – Latvia transposed the EU Whistleblowing Directive in January 2022, with new measures effective from February 4, 2022.

            🇱🇹 Lithuania: Implemented – Lithuania amended existing legislation in February 2022, aligning with the EU Whistleblowing Directive.

            🇱🇺 Luxembourg: Implemented – Luxembourg’s Whistleblower Protection Act, passed in May 2023, exceeds the minimum directive requirements, offering broad protection and a support point for whistleblowers.

            🇲🇹 Malta: Implemented – Malta amended the Whistleblower Act in December 2021, enhancing protection for whistleblowers in compliance with the EU Whistleblowing Directive.

            🇳🇱 The Netherlands Implemented – The Netherlands transposed the directive in January 2023, introducing updated whistleblowing procedures and the appointment of an independent reporting body.

            🇵🇱 Poland: In progress – Poland is evaluating a new law, the draft Act on the Protection of Persons Who Report Breaches of Law, to meet the requirements of the EU Whistleblowing Directive.

            🇵🇹 Portugal: Implemented – Portugal implemented the directive in December 2021, with new measures effective from June 18, 2022.

            🇷🇴 Romania: Implemented – Romania adopted an improved version of its national whistleblowing law in December 2022, aligning with the EU Whistleblowing Directive.

            🇸🇰 Slovakia: Implemented – Slovakia passed the Whistleblower Law in May 2023, enhancing existing measures to align with the EU Whistleblowing Directive.

            🇸🇮 Slovenia: Implemented – Slovenia passed the Whistleblower Protection Act in January 2023, broadening protection to comply with the EU Whistleblowing Directive.

            🇪🇸 Spain:  Implemented – Spain approved new whistleblower protection legislation in February 2023, completing the transposition process.

            🇸🇪 Sweden: Implemented – Sweden transposed the directive in September 2021, rectifying flaws in existing measures to guarantee anonymity and confidentiality.

            📣
            Did you know iubenda has a tailored made tool for the EU Whistleblower Directive?

            This tool helps keep you compliant with a secure channel for submitting and managing whistleblower reports. Maintain an easy-to-use reporting form for employees and other stakeholders, and manage the whole process from an all-in-one dashboard.

            Click here to learn more!

            Will the EU whistleblower Directive Apply Outside of the EU? 

            🇨🇭Switzerland: Will not be implemented – no whistleblowing legislation in effect. The Swiss Code of Obligationshighlights employees’ duty of loyalty and confidentiality to their employer, which is interpreted as an obligation to report any misconduct internally first. However, Swiss law itself has not expressly provided for the establishment of internal reporting channels.

            🇬🇧 United Kingdom: Will not be implemented – The UK, post-Brexit, is not obligated to transpose the EU Whistleblowing DirectiveHowever, UK businesses operating in mainland Europe above a certain size are subject to the directive. The UK has its own national whistleblower protection legislation in the form of PIDA, criticized for its complexity and outdated nature.

            🇺🇸 The Federal Trade Commission: Will not be implemented – The US adopted the whistleblower protection act (WPA) in 1989. The Act applies at the federal level and does not provide for the establishment of reporting channels in the fashion of Whistleblower Directive.

            When does the Whistleblower Directive Apply Outside of the EU?

            In general terms, any non-EU private legal entity having a presence (branch) in a Member State of the EU and employing at least 50 employees, may be subject to the Directive standards and relevant national legislation.

            Global Organizations 

            🇺🇳 The United Nations Convention Against Corruption (UNCAC) encourages member states to establish mechanisms to protect whistleblowers and provide legal safeguards.

            🌐 The Organization for Economic Co-operation and Development (OECD) Guidelines recommend member countries to have whistleblower protection laws in place.

            What type of wrongdoing/misconduct can be reported by Whistleblowing?

            Whistleblowers can report a wide range of issues in several areas, including but not limited to:

            👉 Protection of privacy and personal data
            👉 Consumer protection
            👉 Violations of company policies and procedures
            👉 Financial misconduct
            👉 Money laundering and terrorist financing
            👉 Fraud
            👉 Network and information system security
            👉 Harassment or discrimination
            👉 Safety concerns (product safety and compliance, food and feed safety, transport safety) 
            👉 Public health or animal health and welfare concerns
            👉 Environmental issues

            Whistleblowing Best Practices for Businesses

            To navigate whistleblowing laws effectively, businesses should consider the following best practices:

            • Develop comprehensive whistleblowing policies and procedures that align with international standards and local regulations.
            • Establish clear reporting channels, both internal and, where required, external, to facilitate reporting.
            • Ensure confidentiality and anonymity for whistleblowers to encourage reporting without fear of reprisals.
            • Provide training and awareness programs to educate employees about whistleblowing procedures and their rights.
            • Implement robust investigation processes to address reports promptly and take appropriate action.
            • Regularly review and update whistleblowing policies to align with evolving legal requirements and best practices.

            Understanding the legal aspects of whistleblowing, including international laws and specific mandates like the EU Whistleblower Directive, is crucial for businesses. 

            By complying with these laws and implementing best practices, organizations can foster a culture of transparency, protect whistleblowers, and effectively address misconduct. This not only ensures compliance but also enhances corporate governance, reputation, and ethical standards.

            Meet EU Whistleblower Directive Requirements in minutes!

            Activate now

            The post Navigating Whistleblowing Laws: An International Overview appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Managing Whistleblowing: How Organizations Should Handle Reports https://www.iubenda.com/en/help/143363-how-organizations-should-handle-whistleblowing-reports/ Fri, 24 Nov 2023 12:41:26 +0000 https://help.iubenda.com/?p=143363 Handling whistleblowing reports in the right way is key to complying with whistleblowing legislations and guidelines. It’s important to handle them with confidentiality and to implement the proper security measures, to avoid negative consequences that could expose the whistleblower to retaliation. In this guide, we explain how organizations should handle whistleblowing reports, while preserving confidentiality […]

            The post Managing Whistleblowing: How Organizations Should Handle Reports appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Handling whistleblowing reports in the right way is key to complying with whistleblowing legislations and guidelines. It’s important to handle them with confidentiality and to implement the proper security measures, to avoid negative consequences that could expose the whistleblower to retaliation.

            In this guide, we explain how organizations should handle whistleblowing reports, while preserving confidentiality and protection – in keeping with the EU Whistleblowing Directive.

            Fostering an ethical workplace culture

            Before explaining how to address a whistleblowing report, it’s important to highlight that the first thing to do is to foster an ethical workplace culture. By ethical, we mean a culture that encourages employees to speak up when problems arise. Employees should never fear any kind of retaliation, and should always feel safe in reporting their concerns.

            It’s a good practice to implement training and a solid whistleblowing policy, to help employees understand whistleblowing. Having a standardized process in place also helps management to follow the whole whistleblowing procedure easily.

            Each company will have to draft its own policy, depending on the size and nature of the organization, but here you can find a free template that you can customize or use as a starting point.

            ⚖
            Understanding the law: the EU Whistleblower Directive

            The protection of whistleblowers is not just a best practice, but it’s now law in the European Union. In particular, whistleblowing is regulated by Directive (EU) 2019/1937, also known as the Whistleblower Directive, which came into effect on December 16, 2019.

            The Directive enhances protection for people reporting breaches of EU law in their work environment and it requires Member States to align their national laws to provide an adequate level of protection throughout the EU.

            The Whistleblower Directive applies to:

            • EU private companies with 50 or more employees;
            • non-EU companies with an EU branch, that have 50 or more employees within the EU;
            • local authorities serving over 10,000 people.

            In order to comply, companies must:

            • Establish safe and confidential internal reporting channels. The deadline for complying with this requirement is December 17th, 2023.
            • Provide training for employees and stakeholders, to explain the directive, whistleblower rights, and reporting procedures.
            • Ensure the confidentiality and protection of the personal data of whistleblowers.
            • Implement anti-retaliation policies, conduct fair investigations, and support whistleblowers facing retaliation.
            🇪🇺 Learn more about the Whistleblower Directive here

            Receiving a whistleblowing report

            As a company, receiving a whistleblowing report is never easy, and for many the first reaction would be to ignore it and keep things as they are. Don’t do this! Ignoring a whistleblower complaint can have negative consequences, and can also put you in breach of the law.

            So, if you receive a whistleblowing complaint, make sure to assign it to an impartial designated team or person, who will take care of investigating the complaint.

            Investigating the report

            Once you receive a whistleblowing report, the designated team should start the investigations promptly. In the beginning, it’s important to get as much information as possible, to determine whether the complaint is an actual whistleblowing case or it’s a personal grievance. If the latter is the case, then you can dismiss the report and have the HR team handle the matter (but still, don’t ignore it!).

            Every whistleblowing report usually contains all the necessary information and documentation to investigate the problem. However, if the report doesn’t contain sufficient grounds to suspect actual misconduct and is not anonymous, you can ask the whistleblower to provide additional information. Moreover, according to the EU Whistleblowing Directive, you should provide first feedback to the whistleblower within 7 days, letting them know that the report has been received.

            The investigation generally consists of evaluating the documentation, interviewing the employees, and discussing with the whistleblower. Of course, anyone potentially connected to the allegation should not be involved in the investigation.

            Addressing the findings

            Once the investigation has been completed, the designated team should address the findings and summarize the results, including any corrective measures that have been taken or are planned. Every decision that could affect the organization should be transparently communicated to the whole team.

            The designated team has also the duty to follow up with the whistleblower within 3 months, providing further feedback on the report and the investigation.

            Ensuring confidentiality and protection

            The key to successfully handling a whistleblowing report is always ensuring confidentiality and protection for the whistleblower. As we mentioned earlier, whistleblowers should never fear any kind of retaliation for speaking up.

            One way of doing this is to use a digital system that allows for anonymous reports, like iubenda’s Whistleblowing Management Tool. In this way, the identity of the whistleblower remains protected and it’s still possible to provide the required feedback.

            Anyway, whistleblowers can also choose to disclose their identity and confidentiality should still be observed. The European Data Protection Supervisor (EDPS) has issued a series of guidelines on how to process personal information within a whistleblowing procedure. According to these guidelines, companies need to apply the principles of the GDPR to whistleblowing procedures and, more specifically:

            • treat the information they receive with the utmost confidentiality;
            • do not process more personal data than what is needed;
            • inform the people involved on the way their personal data will be processed as soon as practically possible;
            • implement data security measures.

            Manage whistleblowing reports with iubenda

            One of the best ways to handle whistleblowing reports is by using a safe whistleblowing platform, which allows you to streamline the whole process while ensuring confidentiality and data protection.

            iubenda’s Whistleblowing Management Tool is designed just for that! It allows organizations to keep a safe reporting channel, where whistleblowers can submit their reports anonymously and Whistleblower Managers can keep track of every phase of the process, all from an intuitive dashboard.

            Handle Whistleblowing Reports with iubenda

            Try it now

            Get set up in minutes

            The post Managing Whistleblowing: How Organizations Should Handle Reports appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            The A-Z of Whistleblowing Reporting Process in the Workplace https://www.iubenda.com/en/help/143344-whistleblowing-reporting-process-in-the-workplace/ Fri, 24 Nov 2023 11:58:42 +0000 https://help.iubenda.com/?p=143344 Whistleblowing, a vital mechanism for maintaining organizational ethics and accountability, involves employees reporting suspected wrongdoing or misconduct within their organization. For whistleblowing to be effective, it is imperative to have a well-defined and transparent reporting process. In this guide Whistleblowing legal requirements The whistleblowing reporting process Internal reporting channels External reporting channels Public disclosure Best […]

            The post The A-Z of Whistleblowing Reporting Process in the Workplace appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Whistleblowing, a vital mechanism for maintaining organizational ethics and accountability, involves employees reporting suspected wrongdoing or misconduct within their organization. For whistleblowing to be effective, it is imperative to have a well-defined and transparent reporting process.

            In the European Union, whistleblowing is regulated by Directive (EU) 2019/1937, also known as the Whistleblower Directive, which came into effect on December 16, 2019. The Directive enhances protection for people reporting breaches of EU law in their work environment and it requires Member States to align their national laws to provide an adequate level of protection throughout the EU.

            The Whistleblower Directive applies to:

            • EU private companies with 50 or more employees;
            • non-EU companies with an EU branch, that have 50 or more employees within the EU.
            • local authorities serving over 10,000 people.

            In order to comply, companies must:

            • Establish safe and confidential internal reporting channels. The deadline for complying with this requirement is December 17th, 2023.
            • Provide training for employees and stakeholders, to explain the directive, whistleblower rights, and reporting procedures.
            • Ensure the confidentiality and protection of the personal data of whistleblowers.
            • Implement anti-retaliation policies, conduct fair investigations, and support whistleblowers facing retaliation.
            🇪🇺 Learn more about the Whistleblower Directive here

            The whistleblowing reporting process

            The whistleblowing reporting process is made of different phases.

            Recognition of wrongdoing and reporting the concern

            The first phase, which starts the reporting process, is the recognition of wrongdoing within a company. Whistleblowers can report a wide range of issues in several areas, including but not limited to:

            • Protection of privacy and personal data
            • Consumer protection
            • Violations of company policies and procedures
            • Financial misconduct
            • Money laundering and terrorist financing
            • Fraud
            • Network and information system security
            • Harassment or discrimination
            • Safety concerns (product safety and compliance, food and feed safety, transport safety)
            • Public health or animal health and welfare concerns
            • Environmental issues

            Once the wrongdoing has been documented, the whistleblower can report it by choosing either an internal or external reporting channel.

            Internal reporting channels are usually preferred, but if these are not effective or could lead to retaliation, they can also report directly to competent national authorities or even make a public disclosure in certain circumstances.

            Handling and investigating the report

            Once the report has been received, the organization needs to address it. Each organization should have a clear whistleblowing policy, that defines how the reporting process will be handled and designate an impartial person or department to receive and follow up on reports.

            The designated team will then start the investigation, determining the soundness of the complaint and whether additional information is necessary. In certain cases, the company may also need to inform the people concerned of the allegations made against them.

            Resolutions and follow-up

            The whistleblower should expect a first follow-up within 7 days. This is a formal acknowledgment that the report has been received and investigations will start.

            Once the investigation is completed and the company has taken any necessary action, the report can be considered complete. The whistleblower should receive another feedback on the report within 3 months maximum.

            Protection for the whistleblower

            Directive (EU) 2019/1937, also known as the Whistleblower Directive, particularly stresses the importance of protecting whistleblowers from any kind of retaliation. Employees should feel safe in reporting any wrongdoing within their working environment, without fearing being fired, demoted, or harassed.

            That’s why it is essential that a company establishes both a clear policy on whistleblowing and a safe and confidential reporting channel.

            Moreover, whistleblowers can also choose whether to remain anonymous or to disclose their names. The identity of the whistleblower can be disclosed only if they grant their consent. In either case, the organization has to safeguard their identity and avoid any type of retaliation.

            Lastly, reporting persons should be offered strong legal protection. This includes, but is not limited to:

            • access to comprehensive and independent information and advice;
            • effective assistance from competent authorities;
            • legal aid in criminal and cross-border civil proceedings;
            • exclusion of liability in respect of the acquisition of the information that is reported or publicly disclosed.

            Internal and external reporting channels

            According to the EU Whistleblower Directive, people can report wrongdoing in the workplace in three ways:

            • Internal reporting channels (preferred).
            • External reporting channels to national authorities designated by Member States.
            • Public disclosure. This option should be used only in certain conditions, for example when no appropriate action has been taken after reporting internally/externally.

            Let’s go through each one of them.

            Internal reporting channels

            Internal reporting channels are the preferred method for whistleblower complaints. According to the EU Directive, all private companies with 50 or more employees and all public entities must set up effective and confidential reporting channels. Remember: the deadline for complying with this requirement is December 17th, 2023.

            Types of internal reporting channels

            Whistleblowers should be able to submit their complaints in writing, orally, or in person.

            To submit a report orally or in person, the whistleblower should contact the designated team or person who is in charge of whistleblowing within the organization. In these cases, anonymity can’t always be guaranteed, but the company still needs to ensure confidentiality.

            To submit a report in writing, an organization can either create an internal procedure – for example, setting up a specific email address to which to send the complaints – or rely on a third-party platform. Usually, these platforms allow streamlining the whistleblowing process, while ensuring anonymity and confidentiality.

            iubenda’s Whistleblowing Management Tool


            Tailored for the EU Whistleblower Directive, our tool helps keep you compliant with a secure channel for submitting and managing whistleblower reports. Maintain an easy-to-use reporting form for employees and other stakeholders, and manage the whole process from an all-in-one dashboard.

            External reporting channels

            If the internal reporting channel isn’t considered safe or confidential, or if the report could lead to retaliation, the whistleblower can also report directly to competent national authorities.

            The EU Whistleblowing Directive requires Member States to designate a competent authority, which should receive the complaints, investigate and then give appropriate follow-up to the reports.

            Here is a list of the competent authorities in Europe:

            Country Competent Authority
            Austria Austrian Federal Competition Authority (AFCA)
            Belgium Federal Ombudsman
            Bulgaria Commission for Personal Data Protection (CPDP)
            Croatia Ombudswoman of Croatia
            Czech Republic Ministry of Justice
            Denmark National Whistleblower Scheme
            Finland Chancellor of Justice
            France Several competent authorities depending on the subject matter: here’s a list. The French Defender of Rights is the centralized contact point for whistleblowers.
            Germany Federal Office of Justice
            Greece Office of Complaints of the General Secretariat against Corruption (GSAC)
            Ireland Protected Disclosures Commissioner
            Italy Anti-Corruption Authority (ANAC)
            Latvia Several competent authorities depending on the subject matter. The State Chancellery is the centralized contact point for whistleblowers.
            Lithuania Prosecutor’s Office of the Republic of Lithuania
            Luxembourg Several competent authorities depending on the subject matter: here’s a list.
            Malta Office of the Ombudsman
            Netherlands Authority for the Financial Markets for the Netherlands
            Norway Several competent authorities, such as the Norwegian Labor Authority, the police and the Data Protection Authority.
            Portugal National Anti-Corruption Mechanism
            Romania National Integrity Agency
            Slovakia Whistleblower Protection Office
            Slovenia 22 different state institutions are responsible for receiving and handling the external reports.
            Spain Independent Authority for the Protection of Informants
            Sweden Several competent authorities depending on the subject matter. The Swedish Work Environment Authority is the centralized contact point for whistleblowers.

            Public disclosure

            The last-resort reporting channel is public disclosure, which should only be used in certain conditions. A few examples are:

            • no appropriate action has been taken after reporting internally or externally;
            • the whistleblower did not receive appropriate feedback within the timeframe set by the law;
            • it is reasonable to suspect a collusion between the perpetrator of the crime and the state authorities responsible for prosecuting them;
            • in cases of urgent or grave danger to the public interest.

            Public disclosure can happen via web platforms, social media, the press, elected officials, civil society organizations, etc. Even in this case, the whistleblower should be granted the same level of protection.

            Best practices for implementing whistleblowing procedures

            To sum up, there are three important steps that each organization should follow to implement a solid whistleblowing reporting process:

            1. Offer a clear whistleblowing policy: every employee should know how to send a whistleblowing report, who to contact for a complaint, and how the process will be handled. The policy should also address whistleblower protection and retaliation prevention strategies. Download a whistleblowing policy template here.
            2. Set up a secure and confidential reporting channel: this will help you protect whistleblowers from any kind of retaliation, by ensuring confidentiality and anonymity. Moreover, setting up a secure reporting channel is now mandatory within the European Union, for organizations that have 50 or more employees. You can choose to implement an internal reporting channel, or to rely on a third-party service, like iubenda’s Whistleblowing Management Tool.
            3. Designate a responsible team or person: the team will be the reference point for any employee willing to make a whistleblowing complaint. They will also be in charge of carrying out the investigation and sending timely feedback. Download an appointment template for assigning responsibility here.

            iubenda’s Whistleblowing Management Tool

            iubenda’s Whistleblowing Management Tool helps EU businesses ensure compliance. We’ve designed our product to streamline management within organizations, protect whistleblowers, and ensure businesses consistently adhere to the law.

            Here’s how it works:

            • Activate the Whistleblowing Management Tool from your iubenda dashboard (please note: you need an Ultimate plan to do it). Then embed the reporting form where it can be easily accessed by employees or other potential reporting persons.
            • When a report is submitted, your Whistleblowing Manager receives an email notification instantly, while the anonymous reporting option keeps whistleblowers’ identities a secret.
            • Your Whistleblowing Manager can view the details of the report in their dashboard and follow up when appropriate. Real-time updates help you stay informed of each report’s status throughout the entire process.

            iubenda helps you comply with the EU Whistleblowing Directive

            Create your reporting channel now

            The post The A-Z of Whistleblowing Reporting Process in the Workplace appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Understanding the Basics of Whistleblowing https://www.iubenda.com/en/help/142962-understanding-the-basics-of-whistleblowing/ Wed, 22 Nov 2023 10:11:42 +0000 https://help.iubenda.com/?p=142962 In the world of business ethics, understanding the basics of whistleblowing plays a pivotal role in maintaining transparency, accountability, and trust within the workplace.  This article aims to shed light on the essential elements of whistleblowing, clarifying its purpose, scope, and the critical role it serves in upholding ethical standards. We’ll also debunk common myths and […]

            The post Understanding the Basics of Whistleblowing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            In the world of business ethics, understanding the basics of whistleblowing plays a pivotal role in maintaining transparency, accountability, and trust within the workplace. 

            This article aims to shed light on the essential elements of whistleblowing, clarifying its purpose, scope, and the critical role it serves in upholding ethical standards. We’ll also debunk common myths and emphasize how an effective whistleblowing system can enhance corporate governance 👇

            Understanding the Basics of Whistleblowing

            Whistleblowing Defined

            Whistleblowing is the act of reporting misconduct, unethical behavior, or illegal activities within an organization by an employee or insider. It’s a mechanism through which individuals can bring to light issues that threaten the integrity and reputation of their workplace. 

            Contrary to popular misconceptions, whistleblowing is not about snitching or betraying one’s colleagues; it’s a means to rectify wrongdoing for the greater good.

            👀 Take a look at these Top 5 Legal Obligations For Businesses →

            The Purpose of Whistleblowing

            The primary purpose of whistleblowing is to promote integrity and ethical behavior within an organization. It serves as a crucial safeguard against:

            • corporate fraud;
            • corruption;
            • discrimination;
            • harassment; and 
            • other unethical practices. 

            By encouraging employees to speak up, whistleblowing helps organizations identify and rectify issues before they escalate, potentially saving them from legal and reputational damage.

            🆕
            New Legal Requirements

            The directive applies to private companies with 50 or more employees, local authorities serving over 10,000 people, and non-EU companies with over 50 employees within the EU. To comply, companies must:

            1. Establish Internal Reporting Mechanisms: Set up confidential channels for internal reporting of wrongdoing.
            2. Training and Awareness: Educate employees and stakeholders about the directive, whistleblower rights, and reporting procedures.
            3. Protecting Whistleblowers: Ensure the anonymity and protect personal data of whistleblowers, complying with regulations like the GDPR.
            4. Preventing Retaliation: Implement anti-retaliation policies, conduct fair investigations, and support whistleblowers facing retaliation.

            Penalties for non-compliance vary by member state and include financial penalties, reputation damage, and legal consequences. Companies are advised to review and align their policies with the directive to avoid these risks.

            iubenda offers a tool specifically for the EU Whistleblower Directive, providing a secure channel for submitting and managing reports, along with an easy-to-use reporting form and an all-in-one dashboard for process management.

            Click here to learn more!

            Scope of Whistleblowing

            Whistleblowing is not limited to exposing financial misconduct or fraud; it extends to various aspects of workplace misconduct, including but not limited to:

            1. Financial Wrongdoing: This includes embezzlement, accounting fraud, insider trading, and other financial irregularities.
            2. Safety Concerns: Whistleblowing can address issues related to unsafe working conditions, environmental hazards, and product safety.
            3. Ethical Violations: Employees can blow the whistle on discriminatory practices, harassment, or violations of company policies.
            4. Legal Violations: Any activities that breach local or international laws can be reported through whistleblowing.

            👀 Take a look at these Top 5 Legal Obligations For Businesses →

            Dispelling Common Myths

            To fully appreciate the importance of whistleblowing, it’s essential to dispel some common myths:

            • Myth 1: Whistleblowers are disloyal troublemakers. In reality, most whistleblowers act out of genuine concern for the organization’s well-being.
            • Myth 2: Internal reporting will always be enough. While internal reporting is encouraged, external reporting may be necessary when internal channels fail to address the issue adequately.
            • Myth 3: Whistleblowers are protected from retaliation. While protections exist, whistleblowers may still face challenges. Organizations should actively foster a culture of support and protection. By combining strengthened legal protections with a supportive organizational culture, the goal is to create a more effective and humane system for those who have the courage to speak out against wrongdoing. This dual approach—legislative reinforcement coupled with cultural change—is seen as a more comprehensive solution to protect the rights and well-being of whistleblowers.

            Enhancing Corporate Governance

            Implementing an effective whistleblowing system is a crucial step in enhancing corporate governance and accountability. It signals an organization’s commitment to ethical conduct and transparency, which can boost trust among stakeholders, including employees, customers, investors, and regulatory authorities.

            Whistleblowing is a powerful tool for maintaining ethical standards within organizations. It serves as a safety net against misconduct and corruption, benefiting businesses in the long run. 

            By dispelling myths and understanding its fundamental purpose, businesses can embrace whistleblowing as a means to foster transparency, accountability, and trust.

            For further information on whistleblowing regulations and guidelines, refer to:

            Need to address whistleblower reports effectively and stay compliant with the EU Whistleblower Directive?

            Our tailored solution is designed to help your organization seamlessly accept and manage whistleblower reports, ensuring adherence to regulatory standards.

            ✅ Key Features:

            • Secure Channel: Provide a confidential and secure channel for whistleblowers to submit reports.
            • Easy Reporting: Maintain an easy-to-use reporting form accessible to employees and stakeholders.
            • All-in-One Dashboard: Streamline the entire process with an all-in-one dashboard for efficient management.

            IMPORTANT: Even if your company is based outside the EU if you have an EU branch with at least 50 employees, it also needs to comply with the directive.

            Don’t wait to be found non-compliant. Take action now and ensure you’re fully prepared to handle whistleblower reports in compliance with the EU Whistleblower Directive.

            The post Understanding the Basics of Whistleblowing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Whistleblowing 101: A Guide to Whistleblowing Education in the Workplace https://www.iubenda.com/en/help/142946-whistleblowing-education-in-the-workplace/ Tue, 21 Nov 2023 17:25:48 +0000 https://help.iubenda.com/?p=142946 Whistleblowing, or the act of reporting unethical or illegal activities, is a vital aspect of maintaining integrity in the workplace and, at the same time, mandated by many legislations. Through this article, we aim to provide a clear blueprint for educating your employees about the importance of whistleblowing and the protocols involved. Let’s dive into […]

            The post Whistleblowing 101: A Guide to Whistleblowing Education in the Workplace appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Whistleblowing, or the act of reporting unethical or illegal activities, is a vital aspect of maintaining integrity in the workplace and, at the same time, mandated by many legislations. Through this article, we aim to provide a clear blueprint for educating your employees about the importance of whistleblowing and the protocols involved.

            Let’s dive into the core elements of whistleblowing and how to reinforce a company’s commitment to ethical practices and reporting.

            whistleblowing

            The Importance of Whistleblowing

            Whistleblowing plays a crucial role in exposing misconduct, ensuring transparency, and fostering a culture of honesty and accountability. Its significance is multifaceted, offering several benefits to organizations:

            1. Early Detection of Wrongdoing: It helps in identifying unethical or illegal activities early, preventing escalation, and protecting the organization from significant harm.
            2. Regulatory Compliance: A whistleblower reporting system helps comply with regulatory standards (such as the EU Whistleblower Directive), preventing legal issues.
            3. Enhanced Reputation: Organizations encouraging whistleblowing are seen as transparent and ethical, gaining a competitive advantage.

            👉 Discover the Six Essential Benefits of a Whistleblowing-Supportive Environment You Can’t Afford to Miss!

            💡 A whistleblower reporting system actively ensures an organization’s compliance with essential regulatory standards, including the EU Whistleblower Directive. This active compliance is crucial for meeting legal requirements and maintaining the organization’s integrity and ethical standards.

            Educating your team about whistleblowing is not just about teaching them to report wrongdoings; it’s about empowering them to be vigilant and responsible members of your organization. Teams should also be clear on how to use the different channels and reporting tools available to make this process work properly and reliably.

            A big step forward in this area is what the European Union (EU) did with the Whistleblowing Directive. This directive sets up strong legal rules all across the EU to protect people who whistleblow. It really shows how important these whistleblowers are in keeping things straight and transparent and also posing new challenges for businesses operating in the EU.

            👉 In response to the highlighted importance of whistleblowing as underscored by the EU directive and the ever-growing need for transparency and accountability in business practices, we’ve outlined several crucial components for an effective whistleblowing training program. These elements are designed to align with the latest regulations and foster an ethical culture in the workplace: ⬇

            Core Elements of Whistleblowing Training

            1. Understanding Whistleblowing: Start by defining whistleblowing and its importance. Emphasize that it’s not just about calling out illegal activities but also about identifying unethical practices. Make it clear that whistleblowing is a protective measure for the organization and its stakeholders.
            2. Recognizing What to Report: Train your team to identify potential issues that should be reported. This includes illegal activities, safety violations, financial mismanagement, and any actions that go against the company’s code of ethics.
            3. Reporting Channels: Introduce the different reporting channels available for employees to report concerns. Encourage the use of a whistleblowing management tool or a dedicated channel to streamline the reporting process. Keep in mind that a tool provides a centralized platform for receiving and managing reports, ensuring confidentiality and efficiency. This streamlines the process for both employees and the organization.
            4. Protection for Whistleblowers: Assure your employees that the company will protect them from any form of retaliation. Explain the policies in place that safeguard the identity and rights of whistleblowers.
            5. Case Studies and Role-Playing: Use real-life scenarios to help employees understand the practical aspects of whistleblowing. This hands-on approach reinforces the training and helps in better retention of the concepts.

            Role of Regular Training in Ethical Practices

            Regular training plays a key role in keeping ethical practices front and center in the workplace. It’s not just about having a one-time session on what’s right and wrong. Think of it as a continuous effort to keep everyone up-to-date and in the loop about ethical standards and procedures.

            These training sessions remind employees about the importance of honesty and responsibility at work. They also give updates on any new rules or changes in how things should be done, especially when it comes to reporting misconduct. It’s like a regular check-in that helps everyone stay on the same page and reinforces the idea that the company is serious about doing things the right way.

            In these trainings, it’s also a great opportunity to refresh everyone’s knowledge about the tools and channels available for whistleblowing. This way, employees feel more confident and supported when they need to report something that doesn’t seem right. Regular training is essential in building and maintaining a workplace culture where ethical behavior is the norm and everyone feels accountable for keeping it that way.

            💡 Why you need a Whistleblowing Management Tool


            Incorporating a whistleblowing management tool can significantly enhance the efficiency and effectiveness of your whistleblowing framework. Such tools offer a streamlined platform for accepting and managing whistleblower reports, ensuring that each report is properly documented, followed up on, and resolved.

            It also provides a secure and confidential way for employees to report issues, which can encourage more employees to come forward.

            Here’s how these tools make a difference:

            1. Confidentiality and Anonymity: These tools guarantee that whistleblowers can report issues anonymously. This encourages transparent communication without compromising personal data, creating a safe environment for raising concerns.
            2. Detailed Reports: They enable the collection of detailed reports, providing immediate access to necessary specifics while ensuring a confidential communication channel for whistleblowers.
            3. Live Status Updates: With real-time updates, you can stay informed about every report’s journey, ensuring prompt and effective responses to the concerns raised.
            4. Consistency Across Devices: These tools are user-friendly and accessible from any device, offering whistleblowers a seamless experience regardless of how they choose to report.
            🚀

            Transform the way your organization handles reports and fosters transparency


            👉 Simplify the whistleblowing process with just three easy steps

            Start now

            Real-World Examples of Effective Whistleblowing Training

            In recent years, several high-profile cases have highlighted the importance of effective whistleblowing policies and training in organizations. Here’s a closer look at how some companies have responded to their respective crises with an emphasis on whistleblowing training:

            1. Volkswagen (VW):
            • Incident: VW was found to have cheated emissions tests, with vehicles emitting far more pollutants than legally allowed. This deceit, known as the “Dieselgate” scandal, was reportedly known internally since 2007, but no effective action was taken.
            • Response: The scandal highlighted the need for robust whistleblowing policies. It suggested that VW may not have had clear and robust education around its whistleblowing and anti-corruption policies, which could have given employees the confidence to make disclosures. This led to severe financial liabilities and damage to the company’s reputation.

            Source: https://www.personneltoday.com/hr/vw-whistleblowing-cost-ineffective-disclosure-procedures/

            1. Barclays Bank:
            • Incident: A whistleblower made an anonymous disclosure about inappropriate recruiting by the CEO, leading to retaliation attempts by the CEO to unmask the whistleblower.
            • Response: The case led to fines imposed by multiple financial regulators against the CEO and highlighted the importance of protecting whistleblowers within the bank.

            Source: https://www.blueprintforfreespeech.net/en/prize/recipients/2019/anonymous-barclays-whistleblower

            1. General Motors (GM):
            • Incident: GM faced a major recall due to faulty ignition switches linked to several fatalities. An employee who had raised safety concerns was reportedly discouraged from speaking up.
            • Response: Following this, GM implemented a “Speak Up for Safety Program” and appointed a new global vice president of safety, showing a commitment to encouraging and protecting whistleblowers.

            Source: https://www.motortrend.com/news/report-gm-silenced-safety-defect-whistleblower/

            1. Siemens AG:
            • Incident: Siemens was involved in a large-scale bribery scandal, with systematic corrupt practices across various projects.
            • Response: Siemens underwent a complete transformation. This included replacing the entire Board, introducing compliance measures across all departments, and implementing compliance training for all employees. Siemens is now recognized for having a best-in-class compliance system and actively fighting against corruption.

            Source: https://inspiringstory.org/2020/06/06/052-siemens-from-bribery-scandal-to-ethical-leadership/

            🔎 These examples demonstrate the critical importance of not only having whistleblowing policies in place but also ensuring that employees are properly educated and feel safe to report misconduct. The cases underscore the need for organizations to foster a culture of openness and integrity where whistleblowing is seen as a positive and protected action.

            Drawing inspiration from these real-world cases, let’s explore a practical training workshop designed to translate the lessons learned into actionable skills and knowledge for employees.

            We aim not just understanding the theory behind whistleblowing, but also practicing it in real-life scenarios. The following is an example of an interactive training workshop designed to engage employees actively and deepen their understanding of ethical decision-making and the use of whistleblowing channels.

            ⚠ Please note, this is just an example to illustrate how such training might be conducted. It should be tailored to fit the specific needs and context of your organization.


            Title: “Navigating Ethical Dilemmas: A Whistleblowing Workshop”

            Objective: To enhance employees’ understanding and confidence in handling ethical dilemmas and using whistleblowing channels effectively.

            Duration: 2 hours

            Materials Needed: Scenario handouts, whistleblowing policy documents, reporting tool demonstration setup, feedback forms.

            Agenda:

            Introduction (15 minutes):

            • Welcome and objectives overview.
            • Brief review of the company’s whistleblowing policy and the importance of ethical practices.

            Interactive Scenario Discussion (45 minutes):

            • Divide participants into small groups.
            • Distribute scenario handouts detailing hypothetical, but realistic, ethical dilemmas that could occur in the workplace.
            • Each group discusses the scenario, focusing on identifying the ethical issue, deciding the best course of action, and determining how to report it using the company’s channels.

            Group Presentations and Feedback (30 minutes):

            • Each group presents their scenario and proposed actions.
            • Facilitator and other participants provide feedback and discuss alternative approaches.

            Demonstration of Whistleblowing Management Tool (15 minutes):

            • Demonstrate how to use the whistleblowing management tool.
            • Highlight features like anonymity, report tracking, and follow-up procedures.

            Q&A and Discussion (10 minutes):

            • Open floor for questions and further discussion.
            • Encourage sharing of any concerns or clarifications regarding whistleblowing processes.

            Conclusion and Feedback (5 minutes):

            • Summarize key takeaways.
            • Distribute feedback forms to gather participants’ opinions on the workshop’s effectiveness and areas for improvement.

            Post-Training Follow-Up:

            • Compile and review feedback.
            • Plan for implementing suggested improvements in future sessions.
            • Distribute a summary of the session and key points to all participants for reference.

            Whistleblowing is more than just a policy; it’s a commitment to uphold the highest standards of integrity within your organization.

            By educating your team on whistleblowing protocols and the importance of speaking out safely, you contribute to a healthier, more transparent workplace. Remember, an informed and empowered team is your best defense against unethical practices.

            Easily meet legal requirements with the Whistleblowing Management Tool

            Activate now

            Get set up in minutes!

            The post Whistleblowing 101: A Guide to Whistleblowing Education in the Workplace appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Ethics at Work: Crafting a Supportive Whistleblowing Culture https://www.iubenda.com/en/help/142908-ethics-at-work-crafting-a-supportive-whistleblowing-culture/ Mon, 20 Nov 2023 18:29:27 +0000 https://help.iubenda.com/?p=142908 In today’s privacy-conscious business world, ensuring an ethical work environment is paramount. A key aspect of this is governmental support for whistleblowing. i.e., creating and supporting a process through which employees can report unethical practices without fear of retaliation. With the deadline for compliance with the EU’s whistleblowing directive quickly approaching, it’s mandatory that businesses […]

            The post Ethics at Work: Crafting a Supportive Whistleblowing Culture appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            In today’s privacy-conscious business world, ensuring an ethical work environment is paramount. A key aspect of this is governmental support for whistleblowing. i.e., creating and supporting a process through which employees can report unethical practices without fear of retaliation.

            With the deadline for compliance with the EU’s whistleblowing directive quickly approaching, it’s mandatory that businesses comply if the law applies to them.

            In this post, we’ll cover how you, as an employer, can create and benefit from a whistleblowing-friendly environment, improving ethical standards and reputation, and avoiding penalties for non-compliance.

            whistleblowing

            Benefits of a Whistleblowing-Supportive Environment

            6 benefits of whistleblowing organizations cannot afford to ignore

            Whistleblowing provides several key benefits to organizations that are essential for maintaining integrity, compliance, and a positive workplace culture. Here are six benefits that organizations cannot afford to ignore:

            1. Early Detection of Wrongdoing: Whistleblowing allows organizations to identify and address unethical or illegal activities early on. This early detection can prevent minor issues from escalating into major crises, saving the organization from significant financial and reputational damage.
            2. Regulatory Compliance: Many industries are subject to strict regulatory requirements. Whistleblowers can play a vital role in ensuring that an organization is complying with these regulations, thereby avoiding costly legal penalties and sanctions. For comprehensive details on compliance requirements, read below our full section on The EU Whistleblowing Directive Enters into Force.
            3. Enhanced Reputation: Organizations that encourage whistleblowing and handle reports effectively are often viewed as transparent and ethical. This enhances their reputation among customers, investors, and the public, which can be a significant competitive advantage.
            4. Employee Engagement and Trust: By providing a safe and confidential avenue for employees to report concerns, organizations can foster a culture of openness and trust. This can lead to increased employee engagement, lower turnover rates, and a more positive workplace environment.
            5. Risk Management: Whistleblowing helps in identifying risks that may not be apparent through standard risk management processes. This proactive approach to risk management can save the organization from unexpected shocks and losses.
            6. Innovation and Improvement: Feedback from whistleblowers can also highlight areas of inefficiency or ineffectiveness within an organization. This can drive innovation and improvement, leading to better business processes, products, and services.

            Crafting Policies that Support Whistleblowers

            The cornerstone of promoting whistleblowing in the workplace is to develop robust policies that protect and encourage employees to come forward. These policies should be:

            • clear,
            • accessible,
            • and provide a straightforward process for reporting unethical behavior.

            💡 It’s essential to ensure confidentiality to protect whistleblowers from any form of retaliation.

            Role of Management and Staff

            👉 Management plays a crucial role in fostering a whistleblowing culture.

            Leaders must lead by example, demonstrating a commitment to ethical practices. Training sessions for management and staff on the importance of whistleblowing and how to handle reports effectively are essential. It’s equally important for staff to understand their role in this culture. They should be encouraged to voice concerns without fear and be assured that their concerns will be taken seriously and investigated impartially.

            Integrating a dedicated whistleblowing management tool can be instrumental in this process. Such a tool assists in efficiently and transparently accepting and managing whistleblower reports across the organization.

            Ensuring Easy Submission and Secure Management of Whistleblowing Reports

            For a whistleblowing culture to be effective, the submission and management of reports must be straightforward and secure.

            Organizations should invest in tools that allow for anonymous reporting and secure handling of sensitive information. These tools should be easy to use, ensuring that employees at all levels can report without any technical barriers. Moreover, these systems must comply with regulatory requirements, providing an additional layer of trust and legitimacy to manage whistleblower reports.

            📌 The EU Whistleblowing Directive Enters into Force

            A significant development in the realm of whistleblowing is the implementation of the European Union (EU) Whistleblowing Directive. This directive marks a major step forward in establishing a legal framework to protect whistleblowers across the EU. It requires organizations, both public and private, with more than 50 employees or an annual turnover of more than €10 million, to establish internal channels and procedures for whistleblowing.

            Key Provisions and Compliance Strategies of the Directive:

            1. Establishing Internal Reporting Mechanisms: Organizations are required to set up secure and confidential channels for employees to report wrongdoing internally. These mechanisms must prioritize the confidentiality and secure handling of data, along with effective case management.
            2. Training and Awareness Programs: It’s essential for companies to educate employees and stakeholders about the directive. Tailored training programs should be implemented to enhance understanding of whistleblower rights, reporting procedures, and the organization’s commitment to non-retaliation.
            3. Protection of Whistleblowers: A critical aspect of compliance is the protection of whistleblowers’ personal data. Companies must ensure the anonymity of whistleblowers when requested and comply with data protection laws, such as the GDPR.
            4. Preventing Retaliation Against Whistleblowers: Proactive measures must be taken to shield whistleblowers from retaliation. This includes enacting robust anti-retaliation policies, conducting impartial internal investigations, and supporting whistleblowers facing any form of backlash.

            By adhering to these provisions and implementing these strategies, organizations can effectively align with the EU Whistleblowing Directive, thereby fostering an environment of transparency and ethical conduct.

            Impact on Organizations

            With the EU Whistleblowing Directive in force, organizations within the EU must align their policies and procedures accordingly. This involves setting up secure and confidential reporting channels, training employees on the new processes, and ensuring that there is a clear understanding of the protections afforded to whistleblowers.

            The Directive also encourages organizations to foster a culture that values ethical reporting, reinforcing the importance of whistleblowing in maintaining corporate integrity.

            👀 Final Thoughts

            The enactment of the EU Whistleblowing Directive is a landmark event in the evolution of ethical workplace practices. It not only reinforces the protections for whistleblowers but also emphasizes the need for organizations to foster a culture of transparency and accountability.

            As companies adapt to these changes, they will find that embracing the Directive not only complies with legal requirements but also enhances their overall ethical framework and corporate reputation.

            Whistleblowing compliance is easy with iubenda

            Set up and use your Whistleblowing Management Tool in three easy steps

            Activate now

            The post Ethics at Work: Crafting a Supportive Whistleblowing Culture appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Google Ads Consent Mode – Everything You Need To Know https://www.iubenda.com/en/help/142541-google-ads-consent-mode-2/ Wed, 08 Nov 2023 11:14:22 +0000 https://help.iubenda.com/?p=142541 💡 Already implemented the Privacy Controls and Cookie Solution but having trouble with Google Consent Mode? Check here to troubleshoot the most common issues. With an ever-growing interest in data protection, user consent and privacy are not just buzzwords, but essential components of any activity online. Google Consent Mode for Google Ads helps advertisers respect […]

            The post Google Ads Consent Mode – Everything You Need To Know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            💡 Already implemented the Privacy Controls and Cookie Solution but having trouble with Google Consent Mode? Check here to troubleshoot the most common issues.

            With an ever-growing interest in data protection, user consent and privacy are not just buzzwords, but essential components of any activity online. Google Consent Mode for Google Ads helps advertisers respect user privacy while running effective ad campaigns.

            But what is Google Consent Mode? And why do you need to use it?

            In this guide, we explain what Google Consent Mode is, why it’s important for Google Ads, and how it could benefit your marketing efforts. Let’s dive right in!

            What is Google Ads Consent Mode?

            In Google Ads, Consent Mode is a framework that helps website owners gain more accurate insights into conversion data while honoring user consent preferences as legally required. Google Consent Mode allows you to adjust how your Google Tags behave based on your users’ consent status and helps you to gather data for non-consented users, at an aggregate level. Through conversion modeling, Google Consent Mode is able to recover up to 70% of reported conversion losses due to user consent choices.

            Google Consent Mode adds two new tag settings that help manage advertising and analytics cookies: ad_storage and analytics_storage. These tags control the behavior of Google products based on the user consent choices, adjusting the conversion measurement accordingly:

            • When a user consents to advertising cookies, the conversion measurement continues normally.
            • When advertising cookies are rejected, Google Consent Mode still provides useful insights at an aggregate level through modeled conversions. Conversion modeling uses machine learning and observable user journeys to analyze trends and model the relationship between conversion rates and user consent — without identifying individual users.
            Credit: Google

            This ensures that the website offers a higher level of data protection without completely losing the ability to track user interactions and campaign performance.

            So far, the Google products which support Google Consent Mode are:

            • Google Ads
            • Google Analytics
            • Floodlight
            • Conversion Linker

            Do I need Google Consent Mode?

            As Google specifies, Google Consent Mode isn’t suitable for all advertisers.

            Google Ads Consent Mode is specifically designed for advertisers who serve ads to users in the European Economic Area or the UK, and who:

            • Have already implemented a strict consent banner; and
            • Are blocking tags that help with conversion measurement.

            If this is your situation, then enabling Google Consent Mode may be beneficial for you and your business.

            But please note: you need to meet a certain threshold for Consent Mode modeling to work. Google defines this threshold as follows:

            The click threshold for conversion modeling is 700 ad clicks over 7 days for a domain x country grouping.

            Absolutely. Under regulations like the GDPR, users must opt in to the use of non-essential cookies, which include those used for advertising purposes. Google Ads consent is critical as it directly impacts the effectiveness of your advertising efforts. Without proper consent, your ability to track conversions, retarget visitors, and personalize ads is significantly reduced.

            Google Ads Consent Mode can help you recover conversion losses, but it doesn’t make your website compliant with privacy laws! You still need to add a cookie consent banner and implement the prior blocking of cookie scripts, as required by privacy laws.

            Moreover, Google Consent Mode does not work with scripts that don’t belong to Google. For example, if you’re using the Facebook Pixel, you would need to block it before users give their consent.

            There are many ways of prior-blocking cookies and other trackers. For example, you could do it manually. This method requires you to identify the scripts that are subjected to the requirement of prior consent. Then, the scripts must be manually modified, so they can be recognized, stopped, and then released depending on what the user chooses.

            A much simpler way is to rely on solutions that allow you to automatically block cookie scripts, without coding. That’s what iubenda’s Autoblocking feature is for!


            iubenda is a Google CMP Partner that helps you with cookie consent requirements: create your cookie consent banner, add a cookie policy and automatically block cookie scripts from running before consent. All this from a single dashboard!

            iubenda’s CMP is Google-certified and comes with Google Consent Mode support, to help you maximize your ad revenue.

            In order for the Google Consent Mode to work properly, you need to implement the correct Google consent setting. This will allow the Google services to behave based on the consent given by the user.

            Note ⚠

            Google Consent Mode requires gtag.js or Google Tag Manager to run. Find out how to set up Google Tag Manager here.

            1. Start with the Consent Initialization trigger: the Consent Initialization trigger is used for tags that set or update the user consent state for your site, such as a consent management platform. Make sure to enable it for all your pages in Google Tag Manager.
            2. Then you need to make sure that the default consent for Google Consent Mode tags is set to "denied". If the consent is granted, the tags will be updated.

            You can learn more about Google’s consent setting in this guide by Google.

            How to implement Google Consent Mode with a CMP

            Google Consent Mode can be implemented both manually or through a Consent Management Platform (CMP).

            A Consent Management Platform (CMP) is a platform designed to handle users’ consent preferences in a transparent and documented manner. To simplify the implementation of its Consent Mode, Google is partnering closely with a few Google-certified CMPs that are already integrated with Google Consent Mode. iubenda is one of them!

            Let’s take a look at how to implement Google Consent Mode with iubenda’s CMP.

            1. Autoblocking

            By selecting the autoblocking of cookie scripts in the Privacy Controls and Cookie Solution, Google Consent Mode will be automatically enabled and it will run on Google services-related scripts. That’s it!

            Autoblocking enabled iubenda

            2. Google Tag Manager template

            As a CMP Partner, iubenda is making the support for Google Consent Mode easier for our users. Our Google Tag Manager template is part of this process.

            The template is a straightforward way to implement Google Consent Mode on your website, as it requires way less coding than the manual implementation. You just need to add it to your GTM installation, configure the tags, and embed it.

            Google Tag Manager template iubenda

            3. Manual tagging

            If you’re using the old iubenda Cookie Solution script and relying on manual tagging for prior blocking, you need some extra coding to enable Google Consent Mode.

            Let’s use the old Google Analytics script as an example.

            The code needs to go from this:

            1. <!-- Global site tag (gtag.js) - Google Analytics -->
            2. <script async src="https://www.googletagmanager.com/gtag/js?id=GA_MEASUREMENT_ID"></script>
            3. <script>
            4. window.dataLayer = window.dataLayer || [];
            5. function gtag() {
            6. dataLayer.push(arguments);
            7. }
            8. gtag('js', new Date());
            9. gtag('config', 'GA_MEASUREMENT_ID');
            10. </script>

            To this:

            1. <script>
            2. // Initialize the data layer for Google Tag Manager (this should mandatorily be done before the Privacy Controls and Cookie Solution is loaded)
            3. window.dataLayer = window.dataLayer || [];
            4. function gtag() {
            5. dataLayer.push(arguments);
            6. }
            7. // Default consent mode is "denied" for both ads and analytics as well as the optional types, but delay for 2 seconds until the Privacy Controls and Cookie Solution is loaded
            8. gtag("consent", "default", {
            9. ad_storage: "denied",
            10. analytics_storage: "denied",
            11. functionality_storage: "denied", // optional
            12. personalization_storage: "denied", // optional
            13. security_storage: "denied", // optional
            14. wait_for_update: 2000 // milliseconds
            15. });
            16. // Improve ad click measurement quality (optional)
            17. gtag('set', 'url_passthrough', true);
            18. // Further redact your ads data (optional)
            19. gtag("set", "ads_data_redaction", true);
            20. </script>
            21. // Global site tag (gtag.js) - Google Analytics
            22. <script async src="https://www.googletagmanager.com/gtag/js?id=GA_MEASUREMENT_ID"></script>
            23. <script>
            24. window.dataLayer = window.dataLayer || [];
            25. function gtag() {
            26. dataLayer.push(arguments);
            27. }
            28. gtag('js', new Date());
            29. gtag('config', 'GA_MEASUREMENT_ID'); //replace GA_MEASUREMENT_ID with the ID of your Google Analytics property
            30. </script>

            Basically, the data layer that forces ad_storage, analytics_storage and the other tags to denied needs to be added to your page before the Google service-related script is loaded.

            Then you need to add the Privacy Controls and Cookie Solution snippet to the same code:

            1. <!-- Global site tag (gtag.js) - Google Analytics -->
            2. <script>
            3. // Initialize the data layer for Google Tag Manager (this should mandatorily be done before the Privacy Controls and Cookie Solution is loaded)
            4. window.dataLayer = window.dataLayer || [];
            5. function gtag() {
            6. dataLayer.push(arguments);
            7. }
            8. // Default consent mode is "denied" for both ads and analytics as well as the optional types, but delay for 2 seconds until the Privacy Controls and Cookie Solution is loaded
            9. gtag("consent", "default", {
            10. ad_storage: "denied",
            11. analytics_storage: "denied",
            12. functionality_storage: "denied", // optional
            13. personalization_storage: "denied", // optional
            14. security_storage: "denied", // optional
            15. wait_for_update: 2000 // milliseconds
            16. });
            17. // Improve ad click measurement quality (optional)
            18. gtag('set', 'url_passthrough', true);
            19. // Further redact your ads data (optional)
            20. gtag("set", "ads_data_redaction", true);
            21. // Google Tag Manager
            22. (function(w, d, s, l, i) {
            23. w[l] = w[l] || [];
            24. w[l].push({
            25. 'gtm.start': new Date().getTime(),
            26. event: 'gtm.js'
            27. });
            28. var f = d.getElementsByTagName(s)[0],
            29. j = d.createElement(s),
            30. dl = l != 'dataLayer' ? '&l=' + l : '';
            31. j.async = true;
            32. j.src =
            33. 'https://www.googletagmanager.com/gtm.js?id=' + i + dl;
            34. f.parentNode.insertBefore(j, f);
            35. })(window, document, 'script', 'dataLayer', 'GTM-XXXXXX'); //replace GTM-XXXXXX with the ID of your Google Analytics property
            36. </script>
            37. <!-- iubenda Privacy Controls and Cookie Solution -->
            38. <script>
            39. var _iub = _iub || [];
            40. _iub.csConfiguration = {
            41. lang: "en",
            42. siteId: 12345678, //use your siteId
            43. cookiePolicyId: 12345678, //use your cookiePolicyId
            44. countryDetection: true,
            45. perPurposeConsent: true,
            46. purposes: "1,4,5",
            47. consentOnContinuedBrowsing: false,
            48. banner: {
            49. position: "float-top-center",
            50. acceptButtonDisplay: true,
            51. customizeButtonDisplay: true,
            52. rejectButtonDisplay: true
            53. }
            54. };
            55. </script>
            56. <script src="https://cdn.iubenda.com/cs/iubenda_cs.js" charset="UTF-8" async></script>

            Find more detailed instructions in our step-by-step guide.

            Troubleshooting Google Consent Mode Misconfigurations

            If your Site Scanner shows an “Attention Required” alert, or you encounter issues with Google Consent Mode, a misconfiguration likely needs fixing. Here are some common reasons why:

            1. Outdated Snippet or Missing DataLayer

            Problem:
            Your website is using an old version of the iubenda snippet. This outdated snippet doesn’t support important features like autoblocking or managing user consent with Google Consent Mode. Your website might also be missing the required dataLayer configuration. (The dataLayer sends user consent choices to Google, and without it, your tags may not work correctly.)

            💡 How to fix it:
            Re-embed the updated code snippet on your site to ensure proper functionality.

            2. Incorrect Script Placement

            Problem:
            The iubenda snippet might be placed incorrectly, such as after Google’s script, causing Google Consent Mode to not function as expected.

            💡 How to fix it:
            Ensure the Iubenda snippet is positioned correctly in the code—ideally, for example, before any Google-related scripts.

            Correct placement:

            <!-- iubenda snippet placed before Google script -->
            <script src="https://embeds.iubenda.com/widgets/[site-code].js"></script>
            
            <!-- Google script -->
            <script async src="https://www.googletagmanager.com/gtag/js?id=UA-XXXXXX-X"></script>

            This ensures that the iubenda Consent Mode activates first and properly manages user consent before other scripts load.

            iubenda: your Google-certified CMP

            According to Google, from January 2024, if you do not use a Google-certified CMP integrated with the Transparency and Consent Framework, your ads will not be served to EEA and UK traffic.

            Are you looking for a trusted ally in your digital advertising journey? iubenda’s got your back!

            Our Google-certified CMP simplifies the consent practices, offering a simple integration with both Google Ads Consent Mode and IAB’s Transparency and Consent Framework. Our CMP empowers you to stay on the right side of the law while maximizing your ad performance.

            The post Google Ads Consent Mode – Everything You Need To Know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Cookie Policy – Everything you need to know https://www.iubenda.com/en/help/124203-cookie-policy-do-you-need-one-heres-everything-you-need-to-know/ Sun, 20 Aug 2023 22:44:38 +0000 https://help.iubenda.com/?p=124203 If your website is using any type of cookies, you’ll likely need a cookie policy. But what is it? What should it include? And how can you tell if your site uses cookies? In this post, we’ll explain everything you need to know about cookies, cookie policies and even show you a sample template. Keep […]

            The post Cookie Policy – Everything you need to know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            If your website is using any type of cookies, you’ll likely need a cookie policy. But what is it? What should it include? And how can you tell if your site uses cookies?

            cookie policy

            In this post, we’ll explain everything you need to know about cookies, cookie policies and even show you a sample template. Keep reading!

            Let’s start from the basics. To understand if you need a cookie policy, you need to know what cookies are first.

            What are cookies?

            Cookies are small data files generally stored on a user’s computer/browser. Every time you go back to a website you’ve already visited, cookies remember your preferences (such as your password or language).
            Cookies can have different purposes:

            • Some of them are meant to give you a more enhanced experience of the website you’re visiting. For example, trackers can remember your username and password or the items you’ve added to your cart during online shopping. These are the so-called technical cookies.
            • Others can track your online behavior to give you targeted advice: have you ever looked for something to buy online, and then ads for that same thing would pop up everywhere? Well, that’s because of profiling cookies, or trackers.

            If your website uses cookies – even just technical cookies – you’ll need a cookie policy.

            COOKIE POLICY GENERATOR

            Craft your Cookie Policy effortlessly

            Start using our generator today to create a Cookie Policy for your website that is customizable, professional, and drafted by an international legal team. A simple way to handle compliance.

            Video Thumbnail
            0:37
            video
            0:22

            See it in action (0:37)

            In short, a cookie policy is a document that gives information about the cookies and trackers used on a website including details about the types of cookies used, the function, purpose and storage duration of the cookie on the user’s computer. 

            The exact details of what needs to be included in a cookie policy depends on the data privacy law that applies to you.

            Keep in mind that having a this policy is a legal requirement under various privacy laws like the GDPR, ePrivacy and even US laws like the CCPA/CPRA.

            Most likely yes. If your site uses cookies or trackers that you’ll likely need a policy as cookie and tracking related disclosures are required under several global privacy laws like the ePrivacy, GDPR, CCPA/CPRA and more.

            The ePrivacy Directive & GDPR in Europe are quite strict about data protection. The GDPR, known for being the most restrictive, specifically mentions online identifiers like cookies in Recital 30, highlighting them as a form of data collection. It requires you to get consent from your visitors before tracking them with cookies.

            In the other side the CCPA/CPRA in California, USA shares its goal of protecting user privacy. While there are some differences—for example, the CPRA allows cookies to be loaded automatically but requires that users have a way to opt out—the core idea is the same: having a Cookie Policy is essential for compliance.

            We’ve provided a few details about the main laws below.

            When it comes to cookies, trackers and similar technologies, you can think of the ePrivacy and the GDPR as complementing and working alongside each other.

            Under the law, you’re required to inform users that you’re using cookies on your site and obtain their consent before doing so. In practice, you’ll need to:

            • show a cookie banner on the user’s first visit;
            • implement a cookie policy that provides further details about your use of cookies; and
            • block non-exempt cookie scripts from running prior to consent.

            👉 Learn more about the legal requirements concerning cookies here.

            While the wording and requirements are not exactly the same as the European laws, some US laws like the CPRA (CCPA amendment) require you to inform users of your site’s use of trackers, and to give them the opportunity to easily opt-out. This differs from European laws, which instead require to get the user’s consent before running cookies and trackers (aka opt-in).

            ⚠ Remember, privacy laws can apply to you even if you’re not based in the region it comes from.
            If you’re not sure about which privacy laws apply to you, do this 1-min quiz → 

            Cookie policies are important because they inform users visiting a website how that website uses cookies. Cookies are small files that remember what you like on a site, like your password or what’s in your shopping cart. By having a cookie policy in place, websites follow laws that protect user’s privacy online. This cookie policy helps visitors understand what information the site collects about them and how it uses that information.

            How are a cookie policy and a privacy policy different?

            A cookie policy is a part of a privacy policy but focuses specifically on the use of cookies on a website. While the privacy policy talks about all the ways a website collects, uses, and protects your personal information, the cookie policy specifically tells you about the cookies the website uses. It explains what types of cookies are there, why they are used, and how you can manage or turn them off.


            Feature Cookie Policy Privacy Policy
            What it Covers Talks about how a website uses cookies (small data files) to track users. Explains how a website collects, uses, shares, and protects user information.
            Purpose To inform users about the types of cookies the site uses and why. To inform users about their rights and how their personal data is handled.
            Information Collected Typically includes information on browsing habits and preferences. Can include personal details like name, address, email, and browsing data.
            User Control Users can often choose to accept or reject cookies. Users are informed about how they can control their personal information.
            Legal Requirement Required by law in many places to obtain consent before using cookies. Required by law in many places to ensure users’ privacy is protected.

            Here are the key elements typically included in a comprehensive cookie policy (Keep in mind that specific requirements may vary depending on jurisdiction):

            • Overview: Begin with a brief introduction explaining the purpose of the policy and its relation to the website’s privacy practices.
            • Types of Cookies: Provide an explanation of the different types of cookies used on the website, such as essential cookies, functional cookies, analytical cookies, and advertising or targeting cookies. Describe each type and its purpose.
            • Cookie Details: Present a list or table of the specific cookies used on the website, including their names, purposes, expiration dates, and any third parties involved in placing or accessing those cookies.
            • Consent: Explain how the website obtains user consent for the use of cookies. Describe the methods used, such as explicit consent through a cookie banner or implied consent through browser settings. If applicable, mention the possibility of withdrawing consent.
            • Third-Party Cookies: If the website allows third-party cookies, disclose the third-party services or partners involved and provide links to their respective cookie policies or opt-out mechanisms.
            • Cookie Management: Explain how users can manage or disable cookies through browser settings or other mechanisms. Provide instructions or links to relevant resources if available.
            • Data Protection and Privacy: Address how the website handles personal data collected through cookies. Describe the data protection measures in place and link to the website’s privacy policy for more detailed information.
            • Updates to the Policy: Clarify that the cookie policy may be subject to periodic updates and provide the date of the most recent update.
            • Contact Information: Include contact details for visitors to reach out with questions, concerns, or requests regarding the cookie policy or their personal data.

            It’s important to note that the specific requirements for a cookie policy may vary depending on the applicable laws and regulations in different countries or regions. Therefore, it’s recommended to consult with legal professionals or seek guidance specific to your jurisdiction to ensure compliance.

            There are some elements that every generic policy has to include:

            • the types of cookies that you’re installing, for example, tracking cookies, advertising, etc.;
            • any third parties that run cookies on your site/app;
            • the purposes for why each category of cookies is used;
            • the details on how users can exercise their legal rights in regard to cookies. For example, how they can manage their preferences or withdraw consent.

            Also, consider that your policy should be available in all the languages in which your services are provided.

            You can create your cookies policy with online generators, like iubenda’s Privacy and Cookie Policy Generator.
            iubenda can help you create a comprehensive cookie policy, with clauses written by actual lawyers.
            All you need to do is:

            • Scan your website and to see what kind of cookies you’re running.
            • Create your documents in a few clicks.
            • Add it to your website.

            Not sure how to get started with your Cookie Policy?

            Use our site scanner to see what kind of cookies you’re running

            Scan your Website for Free Now!

            To help you have a better idea of how it should look, here’s a template. Just click the button below to open it 👇

            💡 Remember: This is a sample use this template as a guide, but don’t just copy and paste!

            It’s against your best interests as, legally, cookie policies need to be specific to the cookies and scripts running on YOUR site.

            👋 Try iubenda’s Generator instead
            Creating your cookie policy has never been so easy!

            Moreover, our Generator is supported by an international legal team, which takes care of updating your documents when the laws change. So, you have just one thing left to do: focus on your business.

            Max Mara

            The simple but elegant cookie banner that pops up on the footer of the Max Mara site is a good example of persistent visibility without interrupting the user’s browsing experience. The inclusion of a “Continue without accepting” option respects user preferences and provides an alternative for those who may choose not to consent to cookies, promoting user choice and privacy.

            Cookie policy example from the MaxMara site

            Adidas 

            The Adidas cookie banner has a floating banner on their website that adheres to GDPR. The banner features ‘accept,’ and ‘reject,’ buttons placed at an equal levels, with the same color and level of visual prominance. Ensureing that it’s not just in line with laws like the GDPR and ePrivacy, but also with the French DPA’s (the CNIL) guidelines.

            Cookie policy example from Adidas site

            la Repubblica

            The publication la Republica is a good example of how transparency can boost conversion. The publication explains their purposes for running personalized ads and gives users the option to subscribe to their paid publication for an ad-free experience. You can read more about paywalls for publishers here → 

            Example of publisher cookie policy

            🚀 Check out more examples here!

            Regularly updating your document is necessary to stay complaint with evolving regulations and to provide accurate information to your website visitors.

            In general, to update your cookie policy, you’ll need to:

            1. Add info about any new cookies or similar technologies running on your site. So for example, if you added new social buttons to your site, you’d need to update your privacy and cookie policies to include disclosures about the new cookies, their purposes, and duration.
            2. Add disclosures related to any updated laws that may apply to you or your users. For example, if you’re based in California USA and decide to expand your audience to include users from Virginia, or from the UK, you’ll need to update your policies to include the disclosures required under those privacy laws. Alternatively, if the laws that apply to you change, for example, the German Data Protection Authority issues new requirements for cookie policies – then you’ll need to update your cookie policy to include the new information.

            Luckily, if you’re using iubenda, we regularly monitor and automatically handle these updates for you. Our free site scanner also regularly scans your site to alert you of any compliance issues. Learn more here.


            Stay Compliant Effortlessly ✅
            • Let iubenda handle the hassle of updating your cookie policy.
            • We constantly monitor evolving laws and keep your policy up-to-date.
            • Focus on your business while we take care of the legalities.
            Proactive Updates for Peace of Mind ✅
            • Trust iubenda to proactively update necessary clauses on our end.
            • Rest assured that your cookie policy will always be current.
            • Stay compliant without the stress of manual updates.
            Website Scans for Informed Compliance ✅
            • Our regular website scans keep you informed about new services.
            • Ensure all required elements are included in your policy.
            • Be ready for any changes while we handle the monitoring.
            Your Business, Our Priority ✅
            • Experience a seamless solution tailored to your needs.
            • Let iubenda manage legal aspects so you can focus on your core business.
            • Join thousands of satisfied customers and enjoy peace of mind

            Get a Cookie Policy for your website

            Try our Generator risk-free

            The post Cookie Policy – Everything you need to know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Green Light for the Data Privacy Framework: EU to US Personal Data Transfers Now Approved  https://www.iubenda.com/en/help/65844-eu-us-trans-atlantic-data-privacy-framework/ Tue, 08 Aug 2023 08:42:10 +0000 https://help.iubenda.com/?p=65844 On July 10, 2023, the European Commission made a significant announcement by adopting its adequacy decision on the EU-US Data Privacy Framework (DPF).  This decision signifies that the United States is once again recognized as providing an adequate level of protection to its European Union (EU) counterpart. Consequently, personal data can now flow freely from the […]

            The post Green Light for the Data Privacy Framework: EU to US Personal Data Transfers Now Approved  appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            On July 10, 2023, the European Commission made a significant announcement by adopting its adequacy decision on the EU-US Data Privacy Framework (DPF). 

            This decision signifies that the United States is once again recognized as providing an adequate level of protection to its European Union (EU) counterpart. Consequently, personal data can now flow freely from the EU to US self-certified companies without the need for additional safeguards

            This article will delve into the details of the decision and highlight the key revisions made to the invalidated Privacy Shield framework.

            • July 2000: The European Commission adopted the decision on the adequacy of the protection provided by the Safe Harbor privacy principles.
            • October 2015: Safe Harbor was invalidated further to the first Schrems decision issued. 
            • July 2016: The European Commission adopted the decision on the adequacy of the protection provided by the EU-US Privacy Shield.
            • July 2020: The Court of Justice of the European Union (CJEU) declared the EU-US Privacy Shield as incompatible with GDPR and, therefore, no longer valid
            • March 2022: President von der Leyen and President Biden reached an agreement in principle on a new trans-Atlantic Data Privacy Framework.
            • October 2022: President Joe Biden signed executive order 14086 on Enhancing Safeguards for United States Signals Intelligence Activities. 
            • December 2022: The European Commission adopted its draft adequacy decision on the EU-U.S. Data Privacy Framework.
            • February 2023: The European Data Protection Board adopted its opinion on the draft adequacy decision.
            • May 2023: Non-binding resolution of the European Parliament was issued.
            • July 2023: Nearly all EU Member States representatives approved the draft adequacy decision.
            • July 2023: The European Commission formally adopted its adequacy decision on the EU-U.S. Data Privacy Framework.

            The French data protection authority, CNIL (Commission nationale de l’informatique et des libertés), has issued an FAQ document concerning the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework. Within this FAQ, CNIL outlines the essential provisions of the DPF and provides guidance on how French organizations can transfer data to U.S. entities in cases where the latter have not adopted the DPF agreement. Such transfers can be achieved through mechanisms such as SCCs (Standard Contractual Clauses) or any other method specified under Article 46 of the GDPR.

            Furthermore, CNIL emphasizes the importance of data exporters undertaking an impact analysis of data transfers (referred to as AITD or TIA) to determine, on a case-by-case basis, whether they meet the level of protection mandated by European Union law.

            EU-US Data Privacy Framework

            The EU-US DPF marks a crucial step towards reinstating trust and confidence in transatlantic data transfers. 

            After the Schrems II judgment by the CJEU, the previous Privacy Shield framework was invalidated due to concerns over access to data by US intelligence agencies. 

            The newly adopted framework addresses these concerns through several notable revisions:

            1. Necessary and Proportionate Access to Data

            Under the EU-US DPF, access to data by US intelligence agencies is now limited to what is deemed “necessary and proportionate.

            This provision ensures that data transfer complies with stringent privacy standards while balancing legitimate national security interests.

            2. Two-Layer Redress Mechanism

            To enhance accountability and protect the rights of EU individuals, a new two-layer redress mechanism has been established.

            1. The first layer consists of a Civil Liberties Protection Officer (CLPO) from the US intelligence community, who independently and objectively investigates complaints submitted by EU individuals, free of charge and in their own language directly to the data protection authorities of their countries. These complaints are then transmitted by the European Data Protection Board to the US.
            2. The second layer comprises the Data Protection Review Court (DPRC), which acts as an independent and binding authority. The DPRC hears appeals against decisions made by the CLPO. Importantly, the DPRC members possess specific qualifications and operate outside the US government’s influence or instructions, ensuring impartiality and fairness.

            3. Empowering EU Individuals

            The adequacy decision grants EU individuals whose data has been transferred to self-certified US companies several important rights. These rights include the ability to:

            1. access their data;
            2. request corrections; 
            3. delete incorrect or unlawfully handled data, and 
            4. access redress avenues through a free-of-charge independent dispute resolution mechanism and an arbitration panel.

            4. Wider Applicability and Safeguards

            The safeguards provided by the US government within the EU-US DPF extend beyond data transferred through this specific framework. They also apply to data transferred via other mechanisms, such as:

            • standard contractual clauses; or 
            • binding corporate rules. 

            This broader application ensures a consistent level of data protection for EU individuals, regardless of the specific transfer mechanism utilized.

            5. Periodic Reviews and Continuous Compliance Monitoring

            To ensure ongoing compliance and effectiveness, the EU-US DPF will be subject to periodic reviews. 

            The first review is scheduled to take place within a year from the framework’s entry into force. The European Commission will continuously monitor relevant developments in the US to ensure that the established safeguards are maintained.

            Further to its last plenary meeting, the EDPB has adopted an information note for both individuals and entities carrying out data transfers to the U.S., which clarifies that no supplementary measures are required for transfers based on the adequacy decision. However, transfers to U.S. entities not included on the ‘Data Privacy Framework List’ require additional safeguards, such as SCCs or BCRs. The information note further reaffirms that EU individuals can submit a complaint to their national data protection authority to make use of the new redress mechanism regardless of the transfer tool used to transfer personal data to the U.S.

            What do you need to do now? 

            Currently, there is no immediate action required. We need to wait for US companies to complete the self-certification process before data flows can begin.

            The adoption of the EU-US Data Privacy Framework by the European Commission represents a significant milestone in transatlantic data privacy. With the adequacy decision in place, the flow of personal data from the EU to US companies can resume without additional safeguards, provided they participate in the EU-US DPF. 

            The companies listed at this this link under the tab “Active” are the ones that have already self-certified for compliance with the new DPF (EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, or both as specified under “Framework”).

            Using Google Analytics or any affected services? Remember to include them in your privacy policy.

            Update your Privacy Policy

            The post Green Light for the Data Privacy Framework: EU to US Personal Data Transfers Now Approved  appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            US State Privacy Laws Overview https://www.iubenda.com/en/help/111288-us-state-privacy-laws-overview/ Mon, 30 Jan 2023 12:19:23 +0000 https://help.iubenda.com/?p=111288 Businesses are subject to additional regulations as a result of state privacy laws in the US imposing new technical and legal hurdles. Different state privacy laws in the US are providing customers with more control over their personal information, by giving customers certain rights and requiring businesses to be open about their privacy practices.  Keep […]

            The post US State Privacy Laws Overview appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Businesses are subject to additional regulations as a result of state privacy laws in the US imposing new technical and legal hurdles. Different state privacy laws in the US are providing customers with more control over their personal information, by giving customers certain rights and requiring businesses to be open about their privacy practices. 

            Keep in mind that, consumer rights and enforcement all varied significantly across different states. That’s why we’ve created this article to clear up a few of the legalizes and help direct you to the right place for your needs.

            Not sure if US laws apply to you? Do this free 1-min quiz

            We will assist you in complying with any applicable privacy laws in the US. Our solutions handle the difficult technical and legal lifting, taking the guesswork out of compliance. 

            🔎
            Find out how our products can help you comply

            See our specific guide, How to comply with US state privacy laws using iubenda or keep reading to find out, if when and how your business needs to comply with the changing legal landscape in the US.

            🇺🇸 US State Laws Overview 

            California: CCPA (as updated by CPRA)

            Effective Date: January 1, 2023

            Key Updates:

            • Introduced sensitive personal information (SPI) as a separate data category.
              • Businesses handling SPI must provide a “Limit the Use of My Sensitive Personal Information” link on their websites.
            • Expanded consumer rights, including the right to correct inaccuracies and opt out of data sharing (for purposes of behavioral advertising).
            • Added principles of data minimization, purpose limitation, and storage limitation.
            • Requires honoring Opt-Out Preference Signals (OOPS) sent from browsers or similar technologies.

            How to Comply:

            • Update privacy policies to include SPI-related disclosures.
            • Implement mechanisms to process opt-out requests and signals and provide SPI usage controls.

            🔗 Detailed Guide to CPRA Compliance
            🔗 CCPA vs. CPRA: Key Differences

            Virginia: VCDPA

            Effective Date: January 1, 2023
            Key Requirements:

            • Businesses must provide a clear and accessible privacy notice outlining data practices.
            • Consumers have the right to access, delete, and correct their data, as well as to opt out of certain processing activities, and businesses must comply with such requests within 45 days.

            How to Comply:

            • Display privacy notices to meet requirements.
            • Use iubenda tools to automate and simplify compliance.

            🔗 Detailed Guide to the Virginia Consumer Data Protection Act 
            🔗 VCDPA FAQs

            Colorado: CPA

            Effective Date: July 1, 2023
            Universal Opt-Out Mechanism Deadline: July 1, 2024
            Key Requirements:

            • Enhanced consumer rights, including the ability to opt out of:
              • Targeted advertising
              • Sale of personal data
              • Profiling
            • Businesses must honor universal opt-out signals by mid-2024.

            How to Comply:

            • Provide comprehensive privacy notices that include opt-out options.
            • Develop systems to honor universal opt-out mechanisms.

            🔗 Full Colorado Privacy Act Guide

            Utah: UCPA

            Effective Date: December 31, 2023
            Key Requirements:

            • Provides consumers with rights to:
              • Access
              • Delete
              • Data portability
              • Opt-out of certain processing
            • Businesses must respond to consumer requests within 45 days.

            How to Comply:

            • Ensure your business grants UCPA’s consumers’ rights and follows response requirements;
            • Be transparent regarding your data processing activities and include required disclosures in your privacy policy.

            🔗 Utah Consumer Privacy Act Overview

            Connecticut: CTDPA

            Effective Date: July 1, 2023
            Key Requirements:

            • Consumers in Connecticut can:
              • Access
              • Correct
              • Delete
              • Opt-out of certain data processing activities
              • Exercise data portability rights
            • Controllers are required to:
              • Provide privacy notices
              • Conduct data protection assessments
              • Implement easy ways for consumers to give and withdraw consent.

            How to Comply:

            • Review internal practices to ensure compliance with notice and consent requirements.

            🔗 Connecticut Data Privacy Act Details

            Oregon: OCPA (Oregon Consumer Privacy Act) 

            Effective Date: July 1, 2024 

            Key Requirements:

            • Consumers gain rights to:
              • Access their data 
              • Correct inaccuracies 
              • Delete personal data 
              • Opt-out of targeted advertising, data sales, and profiling 
            • Requires a clear privacy notice outlining data practices. 

            How to Comply:

            • Update privacy policies to reflect consumer rights. 
            • Implement mechanisms for managing opt-outs and consumer requests. 

            🔗 Oregon Consumer Privacy Act Overview

            Texas: TDPSA (Texas Data Privacy and Security Act) 

            Effective Date: July 1, 2024 

            Key Requirements:

            • Consumers have the right to:
              • Access their personal data 
              • Correct inaccuracies 
              • Delete personal data 
              • Opt-out of targeted advertising, sale of data, and profiling 
            • Requires businesses to respond to consumer requests within 45 days. 

            How to Comply:

            • Provide detailed privacy notices and tools for opt-out requests. 
            • Conduct assessments to ensure compliance. 

            🔗 Comprehensive Guide to Texas Data Privacy Law
            🔗 Detailed Look at Texas TDPSA

            Montana: MTCDPA (Montana Consumer Data Privacy Act) 

            Effective Date: October 1, 2024 

            Key Requirements:

            • Grants rights to consumers to:
              • Access, correct, and delete their data 
              • Opt-out of targeted advertising, data sales, and profiling 
            • Requires businesses to provide privacy notices and conduct data protection assessments. 

            How to Comply:

            • Make sure privacy policies inform about consumer rights. 
            • Implement robust data protection measures. 

            🔗 Understanding the Montana Consumer Data Privacy Act

            Iowa: ICDPA (Consumer Data Protection Act)

            Effective Date: January 1, 2025 

            Key Requirements:

            • Introduces consumer rights to:
              • Access and delete personal data 
              • Data portability 
              • Opt-out of the sale of personal data.
            • Businesses must respond to consumer requests within 90 days. 

            How to Comply:

            • Review privacy practices and update notices. 
            • Implement systems to manage and honor consumer requests. 

            🔗 Newly Enacted Iowa Privacy Law

            New Jersey: NJDPA (New Jersey Data Protection Act) 

            Effective Date: January 15, 2025

            Key Requirements:

            • Requires comprehensive privacy notices. 
            • Introduces consumer rights, including access, correction, deletion, and opt-outs for targeted advertising, data sales, and profiling. 

            How to Comply:

            • Develop clear and transparent privacy notices. 
            • Implement consumer data rights management tools. 

            🔗 New Jersey Data Protection Act Overview

            Delaware: DPDPA (Delaware Personal Data Privacy Act) 

            Effective Date: January 1, 2025 

            Key Requirements:

            • Establishes rights to access, correct, delete, and opt out of, among others, targeted advertising. 
            • Requires privacy notices and data protection impact assessments. 

            How to Comply:

            • Update privacy policies and implement data rights systems. 
            • Conduct data impact assessments to ensure compliance. 

            🔗 Delaware Personal Data Privacy Act Overview

            New Hampshire: NHDPA (New Hampshire Data Protection Act) 

            Effective Date: January 1, 2025.

            Key Requirements:

            • Provides consumers with rights to access, correct, and delete personal data. 
            • Requires businesses to notify consumers about their data practices. 

            How to Comply:

            • Create clear privacy notices and opt-out mechanisms. 
            • Ensure compliance with rights request processing. 

            🔗 New Hampshire Data Protection Act Overview

            Nevada: Nevada Privacy Law 

            Effective Date: First enacted in 2017 and subsequently amended in 2019 and 2021

            Key Requirements:

            • Consumers can opt out of the sale of their personal data. 
            • Operators are required to make available a comprehensive and accessible privacy notice.

            How to Comply:

            • Enable users to opt out of the sale of personal data. 
            • Include mandatory disclosures in your privacy notice.

            🔗 Nevada Privacy Law Overview

            Nebraska: NDPA (Nebraska Data Privacy Act)

            Effective Date: January 1, 2025
            Key Requirements:

            • Grants consumers rights to access, correct, delete, and opt out of targeted advertising.
            • Requires businesses to implement privacy notices that clearly describe data practices.
            • Mandates data protection impact assessments for certain processing activities.

            How to Comply:

            • Update privacy notices to reflect consumer rights and data processing activities.
            • Implement systems to manage consumer requests regarding access, correction, deletion, and opt-out preferences.
            • Conduct data protection impact assessments where applicable.

            🔗 Nebraska Data Privacy Act Overview

            Minnesota: MCDPA (Minnesota Consumer Data Privacy Act)

            Effective Date: July 31, 2025

            Key Requirements:

            • Grants consumers rights to access, correct, delete, and opt out of targeted advertising and data sales.
            • Defines sensitive data, including biometric, genetic, and child data (under 13 years old).
            • Requires businesses to implement data security, privacy notices, and data minimization.
            • Mandates explicit consent for processing sensitive data and data of children.
            • Provides consumers the right to challenge profiling results and request third-party disclosures.

            How to Comply:

            • Obtain explicit consent for sensitive data and children’s data.
            • Implement clear privacy notices detailing data processing practices.
            • Allow consumers to exercise their rights easily, including opting out of targeted ads and data sales.
            • Ensure strong data security and conduct regular privacy assessments.
            • Maintain records of consumer requests for at least 24 months and be prepared for enforcement actions.

            🔗 Minnesota Consumer Data Privacy Act Overview

            Tennessee: TIPA (Tennessee Information Protection Act)

            Effective Date: July 1, 2025

            Key Requirements:

            • Grants consumers rights to access, correct, delete, and opt out of targeted advertising, data sales, and profiling.
            • Defines sensitive data, including financial information, genetic/biometric data, child data (under 13), and precise geolocation data.
            • Requires businesses to limit data collection, obtain consent for sensitive data, and provide clear privacy notices.
            • Mandates data protection assessments for high-risk processing activities and strong data security practices.
            • Imposes obligations for transparency, consumer rights management, and contracts with processors.

            How to Comply:

            • Obtain consent for processing sensitive data and non-essential data uses.
            • Implement a clear and accessible privacy notice detailing data practices, consumer rights, and opt-out options.
            • Respond to consumer rights requests within 45 days and provide information free of charge up to twice a year.
            • Conduct data protection assessments for high-risk activities and ensure robust security measures.
            • Establish a process for consumer appeals and complaints, including the option to contact the Tennessee Attorney General

            🔗 Tennessee Information Protection Act Overview

            Indiana: ICDPA (Indiana Consumer Data Protection Act)

            Effective Date: January 1, 2026

            Key Requirements:

            • Applies to for-profit businesses conducting business in Indiana or targeting Indiana residents that, in the previous year, processed data of 100,000 Indiana consumers, or 25,000 consumers, if more than 50% of their revenue comes from selling personal data; nonprofits are excluded.
            • Grants consumers the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, data sales, and certain profiling.
            • Defines sensitive data broadly, including racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, certain processing of genetic/biometric data, data from known children under 13, and precise geolocation data.
            • Requires consent for processing sensitive data and for data uses that are not reasonably necessary or compatible with disclosed purposes.
            • Mandates clear, accessible privacy notices, data minimization, reasonable security practices, processor contracts, and data protection impact assessments for high-risk processing activities.

            How to Comply:

            • Obtain affirmative consent before processing sensitive data or using personal data for new, unrelated purposes, and comply with COPPA for children’s data.
            • Provide a transparent privacy notice describing data categories, purposes of processing, consumer rights, opt-out methods, request submission mechanisms, and third-party data sharing.
            • Establish secure and reliable methods for submitting consumer rights requests, without requiring account creation.
            • Respond to consumer requests within 45 days (information should be provided for free at least once a year), provide an appeal process with responses within 60 days, and allow denied appeals to be referred to the Indiana Attorney General.
            • Conduct and document data protection impact assessments for targeted advertising, data sales, sensitive data processing, and other high-risk activities, and maintain strong administrative, technical, and physical safeguards.

            Kentucky: KCDPA (Kentucky Consumer Data Protection Act)

            Effective Date: January 1, 2026

            Key Requirements:

            • Applies to for-profit businesses conducting business in Kentucky or targeting Kentucky residents that, in the previous year, controlled or processed personal data of 100,000 consumers, or 25,000 consumers if more than 50% of their revenue is derived from selling personal data; no general revenue threshold applies and nonprofits are excluded.
            • Grants consumers the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, data sales, and profiling that produces legal or similarly significant effects.
            • Defines sensitive data to include racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used for the identification of a natural person, personal data of known children under 13, and precise geolocation data.
            • Requires consent for processing sensitive data and for processing personal data for purposes that are not reasonably necessary or compatible with disclosed purposes.
            • Imposes obligations for data minimization, transparent privacy notices, reasonable security safeguards, processor contracts, and documented data protection assessments for high-risk processing activities.

            How to Comply:

            • Obtain affirmative consent before processing sensitive data or using personal data for new, unrelated purposes, and ensure compliance with COPPA for children’s data.
            • Publish a clear and accessible privacy notice describing categories and purposes of data processing, consumer rights and appeal process, opt-out mechanisms, request submission methods, and third-party data sharing.
            • Provide one or more secure and reliable methods for submitting consumer rights requests.
            • Respond to consumer requests within 45 days and provide information in response to a request free of charge up to twice per year; establish an appeal process with written responses within 60 days, and make available a mechanism to contact the Kentucky Attorney General if an appeal is denied.
            • Conduct and document data protection assessments for targeted advertising, sale of personal data, sensitive data processing, and other activities that present a heightened risk of harm, and maintain appropriate administrative, technical, and physical security measures.

            Rhode Island: DTPPA (Data Transparency and Privacy Protection Act)

            Effective Date: January 1, 2026

            Key Requirements:

            • Applies to for-profit entities conducting business in Rhode Island or targeting Rhode Island residents that, in the previous year, controlled or processed personal data of at least 35,000 customers (excluding data processed solely for payment transactions), or 10,000 customers if more than 20% of their gross revenue is derived from the sale of personal data; nonprofits are excluded.
            • Requires any commercial website or internet service provider operating in Rhode Island or otherwise subject to Rhode Island jurisdiction to designate a controller.
            • Grants consumers the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects.
            • Defines sensitive data to include racial or ethnic origin, religious beliefs, health conditions or diagnoses, sex life or sexual orientation, citizenship or immigration status, genetic or biometric data used for identification of an individual, personal data of known children under 13, and precise geolocation data.
            • Requires consent to process sensitive data, provides enhanced consent and revocation obligations, and mandates clear transparency around data sales and targeted advertising.

            How to Comply:

            • Obtain affirmative consent before processing sensitive data, ensure COPPA compliance for children’s data, and provide mechanisms for consumers to grant and revoke consent, honoring revocations within 15 days.
            • Publish a clear and accessible privacy notice detailing categories of personal data collected, third parties to whom data is or may be sold, an active contact method, consumer rights, and methods for consumers to exercise their rights.
            • Implement secure and reliable methods for consumers to exercise their rights, including the ability to submit opt-out requests directly or through authorized agents.
            • Respond to consumer requests within 45 days (information in response to a request should be given free of charge at least once per year), provide written appeal responses within 60 days, and allow consumers to submit complaints directly to the Rhode Island Attorney General if an appeal is denied.
            • Enter into appropriate processor contracts, maintain reasonable administrative, technical, and physical security safeguards, and conduct documented data protection impact assessments for high-risk processing activities, including targeted advertising, data sales, and sensitive data processing.

            The post US State Privacy Laws Overview appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Brazil Cookie Requirement Cheatsheet https://www.iubenda.com/en/help/110776-brazil-cookie-requirement-cheatsheet/ Mon, 23 Jan 2023 09:41:53 +0000 https://help.iubenda.com/?p=110776 The Brazilian data protection authority (ANPD) has published new guidance on cookies. In the table below we’ve highlighted some important aspects of the guidance.  🔎 For a more in-depth review of the content in the table below see our Brazil: New Cook Requirements → Brazil Questions 🇧🇷 Brazil Is consent by scrolling valid? NO Are explicit […]

            The post Brazil Cookie Requirement Cheatsheet appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            The Brazilian data protection authority (ANPD) has published new guidance on cookies. In the table below we’ve highlighted some important aspects of the guidance. 

            🔎 For a more in-depth review of the content in the table below see our Brazil: New Cook Requirements →

            Questions
            🇧🇷 Brazil
            Is consent by scrolling valid?

            NO

            Are explicit “accept” AND “reject” buttons required to be on the cookie notice?

            YES

            The wording proposed by the Authority for this button is the following: “Reject cookies that are not necessary”.

            Must accept and reject options be equally conspicuous (equal prominence requirement)

            YES

            The accept button must be as prominent as the “Reject” button.

            Is the prior blocking of cookies necessary where consent is required?

            It has not been explicitly required by the Authority’s guidelines

            Must cookies be listed one by one?

            NO

            Cookies shall be listed by Category.

            What should I include in the First Layer of my Cookie banner?

            1. A reject button; 
            2. An accept button;
            3. A management option (This third button shall redirect users to the second layer of the banner to allow the granular provision of consent on the basis of the categories of non-necessary cookies; and 
            4. A link for the exercise of rights. 

            What should I include in the Second Layer of my Cookie banner?

            1. Categorization of cookies: display the cookies grouped per category. 
            2. Purposes of cookies: a simple, clear and precise description of the purposes for which the categories of cookies are installed is required.
            3. Browser settings: in the second layer of the banner and in the Privacy/Cookie Policy more in detail, information on how to manage cookie preferences through the browser or device settings shall be provided.

            Must consent be granular on a per-purpose basis?

            YES

            However, please note that the list of cookies presented for the collection of consent must not be too granular as this would lead to a hindrance for the users to express their will in a clear and positive manner.

            Should withdrawing consent be as simple as giving it?

            YES

            Users must be able to revoke the consent provided for the use of cookies at any time in a simplified and free-of-charge manner.

            Is the use of a consent banner recommended?

            YES

            Are strictly necessary cookies exempt from the consent requirement?

            YES

            Do third parties have to be listed and identified?

            YES

            Sharing of personal data with third parties must be provided in your cookie policy.

            Are pre-ticked boxes allowed?

            NO

            How iubenda can help you manage the new Cookie Requirements

            It is simple to respect Brazil’s cookie requirements with iubenda. 

            Simply begin generating, and depending on where you and your users are based, our configuration process will recommend the appropriate options, such as LGPD protection.

            Additionally, our solution has a geo-location capability so that you can always show the appropriate notices and guidelines to the users you need to.

            🚀
            How to adopt the new cookie requirements?

            We’ve created a checklist of the steps you must do to comply with Brazil’s latest cookie requirements for your convenience. 

            The post Brazil Cookie Requirement Cheatsheet appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            CCPA toll-free number requirement https://www.iubenda.com/en/help/109571-ccpa-toll-free-number-requirement/ Thu, 05 Jan 2023 11:54:11 +0000 https://help.iubenda.com/?p=109571 The CCPA has a specific requirement for businesses that process personal data: they need to provide a toll-free number to their users. But why do they need to have a toll-free number? And does this requirement affect all businesses? Why does CCPA require a toll-free number? Under CCPA, and also under the CPRA (the CCPA […]

            The post CCPA toll-free number requirement appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            The CCPA has a specific requirement for businesses that process personal data: they need to provide a toll-free number to their users.

            But why do they need to have a toll-free number? And does this requirement affect all businesses?

            CCPA toll-free number requirement

            Why does CCPA require a toll-free number?

            Under CCPA, and also under the CPRA (the CCPA amendment), users have different rights that they can exercise at any time. One of these is the right to access: users can request a business that collects and process their personal information to access the data they have about them.

            As a business, you must provide consumers with two or more methods for submitting access requests. These methods can vary from business to business, but must include, at a minimum, a toll-free number and, if the business has a website, the website address.

            📌 The toll-free number requirement is also included in the new CCPA amendment, the California Privacy Rights Act (CPRA).

            Are there exceptions to the CCPA toll-free number requirement?

            Yes, there are. 

            An amendment of the CCPA published on October 2019 by the California Attorney General added some exceptions to this requirement. More specifically, a business can avoid providing a toll-free number if: 

            • it “operates exclusively online”; and if
            • it has a “direct relationship with a consumer from whom it collects personal information”.

            If your business meets both these requirements, then you can provide an email address and your website address for your users to submit their requests. 

            🆕
            There are new privacy requirements in the US!

            Besides the CCPA’s requirements, new privacy laws are being enforced across the US: California’s CPRA, Virginia’s VCDPA, Colorado’s CPA and many more.

            If you’re doing business in the US, you may need to comply.

            iubenda’s set of solutions is designed to help you comply across multiple legislations in the easiest way.

            The post CCPA toll-free number requirement appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Utah Consumer Privacy Act (the UCPA) https://www.iubenda.com/en/help/107774-utah-consumer-privacy-act-the-ucpa/ Wed, 07 Dec 2022 17:13:29 +0000 https://help.iubenda.com/?p=107774 On March 24, 2022, Utah’s Governor Spencer Cox signed into law the Utah Consumer Privacy Act (the UCPA). The Utah Consumer Privacy Act (UCPA) went into effect on December 31, 2023. Utah will join California (CCPA) and Virginia (VCDPA) with comprehensive data privacy laws, as it rolls out its new Utah Consumer Privacy Act. Following shortly are […]

            The post Utah Consumer Privacy Act (the UCPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            On March 24, 2022, Utah’s Governor Spencer Cox signed into law the Utah Consumer Privacy Act (the UCPA).

            The Utah Consumer Privacy Act (UCPA) went into effect on December 31, 2023. Utah will join California (CCPA) and Virginia (VCDPA) with comprehensive data privacy laws, as it rolls out its new Utah Consumer Privacy Act. Following shortly are Colorado (CPA) Connecticut (CTDPA).

            ⏰ Short on time? Jump to what you need to do to prepare for the UCPA →

            Overview of the Utah Consumer Privacy Act

            The UCPA is a new consumer privacy law in Utah went into effect on December 31, 2023. The UCPA is similar to the Virginia Consumer Data Protection Act (VCDPA), but takes a lighter, more business-friendly approach to consumer privacy. The UCPA is intended to provide a workable standard for businesses while also protecting Utah consumers’ guaranteed rights.

            To comply with the UCPA, businesses must take several steps, including reviewing and updating their privacy notice, implementing processes to respond to consumer requests, and providing an opt-out mechanism for sensitive data processing.

            🔎 Keep reading to learn more about the upcoming changes in Utah, or jump to what you need to do to prepare for the UCPA → 

            ❓
            What is considered personal data under the UCPA?

            Under the Utah Consumer Privacy Act (UCPA), “personal data” is defined as information that is linked or reasonably linkable to an identified or identifiable individual. This includes any data that can be used to directly or indirectly identify a person, such as their name, address, email address, phone number, or other similar identifiers. The UCPA does not consider de-identified data, aggregated data, or publicly available information as personal data.

            Will you be affected by the UCPA?

            To determine if you will be affected by the Utah Consumer Privacy Act (UCPA), you will need to assess if it meets the criteria listed in the law. The UCPA applies to any organization that:

            1. Conducts business in Utah; or
            2. Produces a product or service that is targeted to consumers who are Utah residents;
            3. Has annual revenue of $25,000,000 or more; and
            4. Satisfies one or more of the following thresholds:
            5. During a calendar year, controls, or processes personal data of 100,000 or more consumers; or
            6. Derives over 50% of the entity’s gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.

            If you meet the above criteria, it will be subject to the UCPA. 

            Privacy Policy requirements under the UCPA

            If you’re subject to the Utah Consumer Privacy Act (UCPA), you must provide a privacy policy that is reasonably accessible and clear to consumers. Your privacy policy should include the following:

            1. Categories of Personal Data Processed: Identify the types of personal data that your organization collects and processes, such as names, email addresses, and payment information.
            2. Purposes for Processing Personal Data: Describe the reasons why your organization collects and processes personal data, such as to fulfill orders, provide customer support, or improve products or services.
            3. Consumer Rights: Explain how consumers can exercise their rights, such as the right to access and delete their personal data. Note that the UCPA does not grant consumers the right to request the correction of inaccurate personal data.
            4. Sharing of Personal Data: Disclose the categories of personal data that your organization shares with third parties, if any. For example, you may share payment information with a payment processor or mailing addresses with a shipping provider.
            5. Third Parties: Identify the categories of third parties with whom your organization shares personal data, if any. This could include vendors, service providers, or marketing partners.

            If your organization sells* consumers’ personal data to one or more third parties or processes personal data for targeted advertising purposes, you must clearly and conspicuously inform consumers of these activities and provide a way for them to opt out.

            *Sale→ under the UCPA means the exchange of personal data for monetary consideration by a controller to a third party. 

            Remember: It’s important to regularly review and update your privacy policy to ensure that it accurately reflects your organization’s data processing practices and compliance with the UCPA.

            Remember: It’s important to regularly review and update your privacy policy to ensure that it accurately reflects your organization’s data processing practices and compliance with the UCPA.

            🚀 Did you know?

            iubenda’s Privacy and Cookie Policy Generator allows you to add all currently required US state-level privacy disclosures in one simple click!

            Simply click “Enable disclosures for Users residing in the United States” to activate the new US-specific clauses.

            👉 Easily create your privacy policy for the upcoming UCPA →

            Consumer rights under the UCPA

            Under the UCPA, consumers will have enhanced rights in regard to their personal data, including: 

            • Right to access
            • Right to delete
            • Right to data portability
            • Right to opt out of certain processing

            ❗ Please note that, unlike laws like the GDPR, the UCPA currently does not grant consumers the right to request the correction of inaccurate personal data.

            When entered into force, you will have additional responsibilities, including responding to consumers’ requests for the exercise of their rights within a 45-day period.

            Sensitive Data under the UCPA

            Sensitive data is given special consideration under the UCPA. You must not process sensitive data without providing clear notice and an opportunity to opt out of the processing. This applies to personal data that reveals an individual’s:

            • racial or ethnic origin;
            • religious beliefs;
            • sexual orientation;
            • citizenship or immigration status; or
            • information regarding medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional;
            • the processing of genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual; or
            • specific geolocation data.

            ⚠ If you process sensitive data, you must provide a clear notice that informs consumers of the type of sensitive data you collect and the purpose for which you process it. Additionally, you must provide an opportunity for consumers to opt out of the processing of their sensitive data. You must also obtain verifiable parental consent if the sensitive data concerns a known child who is younger than 13 years old.

            Under the Utah Consumer Privacy Act (UCPA), consumers have the right to opt out of the processing of their personal data for targeted advertising purposes or the sale of their personal data to third parties. However, the Act does not provide specific guidelines on how you should enable consumers to exercise this right.

            To comply with the UCPA, you must:
            • provide consumers with a means to submit opt-out requests; and
            • specify the right they intend to exercise. 

            The method for submitting opt-out requests is left up to the discretion of the controller, as long as it is accessible and clear to the consumer.

            You are not required to honor consumers’ opt-out requests through opt-out preference signals like the GPP and GPC.

            Unlike other US state-level privacy legislations, it’s important to note that, under UCPA, opt-out links come into consideration only in relation to consumers’ right to opt out of the processing of sensitive data.

            To ensure compliance with the UCPA, you should include a clear and accessible opt-out process in your privacy policy.

            How to Prepare for the UCPA

            The Utah Consumer Privacy Act (UCPA) imposes certain obligations on businesses that collect, process, or sell personal data of Utah residents. To prepare with the UCPA, you should:

            ✅ To help you comply with the UCPA, here is a checklist:
            1. Determine if your business is subject to the UCPA.
            2. Create a clear and accessible privacy policy that includes all required elements.
            3. Provide notice and an opportunity to opt-out of the processing of sensitive data.
            4. Enable consumers to exercise their right to accessdeletionportability, and opt out.
            5. Provide a clear and conspicuous notice about the sale* of personal data and processing for targeted advertising purposes and how to opt out.
            6. Implement appropriate security measures to protect personal data.

            Utah’s consumer privacy act went into effect on December 31, 2023

            Get Prepared Now

            The post Utah Consumer Privacy Act (the UCPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Connecticut Data Privacy Act (CTDPA) https://www.iubenda.com/en/help/107759-connecticut-data-privacy-act-ctdpa/ Wed, 07 Dec 2022 16:53:43 +0000 https://help.iubenda.com/?p=107759 On May 10, 2022, Connecticut Governor Ned Lamont signed into law Senate Bill No. 6, An Act Concerning Personal Data Privacy and Online Monitoring, also known as the Connecticut Data Privacy Act (CTDPA), joingin California(CCPA), (CPA), Virginia (VCDPA), Utah (UCPA), and, Connecticut (CTDPA), with comprehensive data privacy laws The CTDPA took effect on July 1, 2023 and will affect persons that do business in Connecticut […]

            The post Connecticut Data Privacy Act (CTDPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            On May 10, 2022, Connecticut Governor Ned Lamont signed into law Senate Bill No. 6, An Act Concerning Personal Data Privacy and Online Monitoring, also known as the Connecticut Data Privacy Act (CTDPA), joingin California(CCPA), (CPA), Virginia (VCDPA), Utah (UCPA), and, Connecticut (CTDPA), with comprehensive data privacy laws

            The CTDPA took effect on July 1, 2023 and will affect persons that do business in Connecticut or provide products/services to residents of Connecticut. In other words, your organization does not need to be located in Connecticut to be affected by the CTDPA. 

            ⏰ Short on time? Jump to what you need to do to prepare for the CTDPA →

            Overview of the Connecticut Data Privacy Act

            The CTDPA is a new comprehensive privacy law in Connecticut that was signed into law on May 10, 2022, and becomes effective on July 1, 2023. 

            This law requires you to provide consumers with clear and meaningful privacy notices that include information on personal data processing, purposes, consumer rights, and third-party sharing, among other requirements. The law also requires you to obtain prior consent for the processing of sensitive data, the processing of personal data for targeted advertising or sale (whenever the consumer is at least 13 but younger than 16), and to provide consumers with opt-out links for targeted advertising or sale.

            Consumers in Connecticut will have enhanced rights to, among others, access, correct and delete, their personal data under this law, and you must conduct data protection assessments and provide an easy way for consumers to withdraw their consent. 

            The law also sets a deadline of January 1, 2025 for businesses to respect consumer opt-out preference signals.

            The CTDPA is similar to other comprehensive privacy laws in other states, such as the Virginia Consumer Data Privacy Act (VCDPA), and focuses on protecting consumer data privacy and giving consumers control over their personal information.

            🔎 Keep reading to learn more about the upcoming changes in Connecticut, or jump to what you need to do to prepare for the CTDPA → 

            ❓
            What is considered personal data under the CTDPA?

            Under the Connecticut Data Privacy Act (CTDPA), “personal data” is defined as any information that is linked or reasonably linkable to an identified or identifiable individual. This includes any data that can be used to identify an individual, such as a name, address, phone number, email address or social security number. However, the definition of personal data does not include de-identified data or publicly available information.

            Will you be affected by the CTDPA?

            Whether your organization will be affected by the Connecticut Data Privacy Act (CTDPA) depends on whether it meets certain criteria. Specifically, the provisions of the Act apply to persons that conduct business in Connecticut or produce products or services that are targeted to Connecticut’s residents and that during the preceding calendar year:

            1. Controlled or processed personal data of at least 100,000 consumers (excluding personal data controlled or processed to exclusively complete a payment transaction); or
            2. Controlled or processed personal data of at least 25,000 consumers and derived more than 25% of their gross revenue from the sale of personal data.

            If your organization meets either of these criteria, then it will be subject to the provisions of the CTDPA. 

            Privacy Policy under the CTDPA

            Connecticut’s new privacy law requires that you provide consumers with a clear and meaningful privacy notice that is reasonably accessible. Here’s a checklist of what needs to be included in your privacy policy to comply with the new law:

            • Categories of Personal Data: Your privacy policy must include a list of the categories of personal data that you process.
            • Purposes for Processing: Your privacy policy must clearly state the purposes for processing personal data. This includes any reason why you collect and use personal data, such as to fulfill a contract or provide a service.
            • Consumer Rights: Your privacy policy must explain how consumers can exercise their rights under the law. This includes how a consumer can access, correct, delete, or restrict the processing of their personal data. You must also include information on how a consumer can appeal a decision related to their request.
            • Third-Party Sharing: If you share personal data with third parties, your privacy policy must specify the categories of personal data that you share. 
            • Third-Party Categories: Your privacy policy must also specify the categories of third parties with which you share personal data.
            • Contact Information: Your privacy policy must provide an active electronic mail address or other online mechanism that consumers can use to contact you with questions or concerns about their personal data.
            • Sale or Targeted Advertising: If you process personal data for the purposes of sale or targeted advertising, your privacy policy must clearly and conspicuously disclose this fact. You must also provide information on how consumers can exercise their right to opt out of such processing.

            By following this checklist and including all the required information in your privacy policy, you can ensure that you comply with Connecticut’s new privacy law and provide consumers with the transparency and control they need to protect their personal data.

            🚀 Did you know?

            iubenda’s Privacy and Cookie Policy Generator allows you to add all currently required US state-level privacy disclosures in one simple click!

            Simply click “Enable disclosures for Users residing in the United States” to activate the new US-specific clauses.

            👉 Easily create your privacy policy for the upcoming CTDPA →

            Consumer rights under the Connecticut Data Privacy Act

            Under Connecticut’s new privacy law, consumers have several rights when it comes to their personal data. The following is a list of the consumer rights included in the law:

            1. Right to confirmation and access: Consumers have the right to confirm whether their personal data is being processed and to access that data, with some limited exceptions such as when such disclosure would reveal a trade secret.
            2. Right to correct inaccurate data: Consumers have the right to correct any inaccurate personal data.
            3. Right to delete personal data: Consumers have the right to request that their personal data be deleted.
            4. Right to data portability: Consumers have the right to request that their personal data be provided to them in a portable and easily accessible format, subject to technical feasibility and trade secret limitations.
            5. Right to opt out: Consumers have the right to opt out of the processing of their personal data for certain purposes, including:
              1. Targeted advertising
              2. Sale of personal data (with some limited exceptions)
              3. Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
              4. /ol>

            ⚠ If the personal data being processed belongs to a known child, the parent or legal guardian may exercise these consumer rights on behalf of the child.

            You must provide your consumers with clear and accessible ways to exercise these rights. 
            This means that you must have a mechanism in place for consumers to request access to, correction of, or deletion of their personal data. Additionally, you must provide consumers with a clear and accessible way to opt-out of the processing of their personal data for the purposes of targeted advertising, sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

            Sensitive Data under the Connecticut Data Privacy Act

            Sensitive data refers to personal data that requires extra protection due to its potential impact on an individual’s privacy and fundamental rights. The Connecticut law recognizes the following types of sensitive data:

              <
            • Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship, or immigration status. 
            • Genetic or biometric data processed for the purpose of uniquely identifying an individual. 
            • Personal data collected from a known child.
            • Precise geolocation data.

            Opt-in under the CTDPA

            ⚠ You are required to obtain consumer’s prior consent for the processing of consumers:

            • sensitive data; and 
            • personal data for purposes of targeted advertising or sale, if the consumer is at least 13 but younger than 16.

            Opt-out links and a universal mechanism for submitting opt-out requests are important features of the CTDPA. Specifically, the Act requires you to provide a “clear and conspicuous link” on your website for consumers to opt out of the sale or targeted advertising of their personal data. This requirement takes the CTDPA a step closer to the CPRA model with reference to the processing for sale and targeted advertising.

            Effective January 1, 2025, you must also allow consumers to opt out of the processing of their personal data for targeted advertising or sale through an opt-out preference signal sent via a platform, technology, or mechanism, with the consumer’s consent. 

            This mechanism must:

            • not unfairly disadvantage other controllers,
            • require an affirmative and unambiguous choice from the consumer, 
            • be easy to use, 
            • be as consistent as possible with other similar mechanisms required by federal or state laws or regulations, and 
            • enable the controller to determine whether the consumer is a resident of Connecticut and has made a legitimate opt-out request.

            It is essential that you comply with these opt-out requirements to ensure consumers have the ability to control their personal data and protect their privacy. If your business hasn’t started doing so already, you must respect opt-out preference signals, by January 1, 2025.

            How to prepare for the Connecticut Data Privacy Act

            The Connecticut Data Privacy Act (CTDPA) is a comprehensive privacy law that will significantly impact the way businesses collect, process, and share personal data of Connecticut residents. As the CTDPA took effect on July 1, 2023, businesses operating in Connecticut must start preparing now to comply with the new law.

            ✅ To prepare for the CTDPA, take the following steps:
            1. Review and update your privacy policy and website notice to ensure they are in compliance with the CTDPA’s requirements.
            2. Ensure that you have implemented reasonable security measures to protect personal data from unauthorized access, use, disclosure, or destruction.
            3. Establish and document processes for handling consumer requests.
            4. Obtain prior consent from consumers for processing sensitive personal data, and for processing personal datafor targeted advertising or sale.
            5. Provide a clear and conspicuous opt-out link on your website for consumers to opt out of targeted advertisingor sale of their personal data.
            6. By January 1, 2025, ensure that you have established an opt-out preference signal mechanism to allow consumers to opt out of the processing of their personal data for targeted advertising or sale.

            Mitigate risks and demonstrate commitment to protecting your consumers’ privacy

            Take action now

            The post Connecticut Data Privacy Act (CTDPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Colorado Privacy Act (CPA) https://www.iubenda.com/en/help/107739-colorado-privacy-act-cpa/ Wed, 07 Dec 2022 16:39:07 +0000 https://help.iubenda.com/?p=107739 Went into effect July 1, 2023, Colorado will join California (CCPA), and Virginia (VCDP). with comprehensive data privacy laws, as it rolls out its new Colorado Privacy Act (CPA). Following shortly are Utah (UCPA), and, Connecticut (CTDPA). ⏰ Short on time? Jump to what you need to do to prepare for the CPA → Here’s what you need to know about the CPA […]

            The post Colorado Privacy Act (CPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            Went into effect July 1, 2023, Colorado will join California (CCPA), and Virginia (VCDP). with comprehensive data privacy laws, as it rolls out its new Colorado Privacy Act (CPA). Following shortly are Utah (UCPA), and, Connecticut (CTDPA).

            ⏰ Short on time? Jump to what you need to do to prepare for the CPA →

            Overview of the Colorado Privacy Act

            The Colorado Privacy Act (CPA) is a state-level privacy law that was signed into law in July 2021 and, took effect on July 1, 2023. The CPA is designed to protect the privacy rights of Colorado residents by regulating how businesses collect, process, and store personal data. 

            Under the CPA, businesses must disclose their data collection practices, obtain consumers’ consent to process sensitive personal data, and provide consumers with the right, among others, to access, delete, or correct their personal data. 

            The CPA also mandates that businesses implement reasonable data security measures to protect personal data and imposes penalties for non-compliance. Overall, the CPA brings Colorado in line with other states that have enacted comprehensive privacy legislation.

            🔎 Keep reading to learn more about the upcoming changes in Utah, or jump to what you need to do to prepare for the CPA → 

            ❓
            What is considered personal data under the CPA?

            Under the CPA, “personal data” is defined as information that is linked or reasonably linkable to an identified or identifiable individual. This refers to any information that can be used to identify an individual, either on its own or in combination with other information. However, de-identified data or publicly available information are excluded from the definition of personal data under the CPA.

            Will You Be Affected by the Colorado Privacy Act (CPA)?

            The CPA applies to controllers that conduct business in Colorado or intentionally target Colorado residents with commercial products or services, and:

            • control or process the personal data of 100,000 consumers or more during a calendar year; or 
            • derive revenue from the sale of personal data and process or control the personal data of 25,000 consumers or more.

            *Sale → means the exchange of personal data for monetary or other valuable consideration by a controller to a third party. 

            Privacy Policy under the CPA

            Specifically, the CPA requires you to provide a privacy notice that includes the following information:

            1. Categories of personal data collected or processed.
            2. Purposes for which the categories of personal data are processed.
            3. How and where consumers can exercise their rights, including the contact information and how to appeal a controller’s action with regard to a consumer’s request.
            4. Categories of personal data that are shared with third parties, if any;
            5. Categories of third parties with whom the personal data are shared, if any.

            If you sell personal data to third parties or processes personal data for targeted advertising, you must disclose the sale or processing and provide a clear and conspicuous method for consumers to opt out of the sale or processing.

            🚀 Did you know?

            iubenda’s Privacy and Cookie Policy Generator allows you to add all currently required US state-level privacy disclosures in one simple click!

            Simply click “Enable disclosures for Users residing in the United States” to activate the new US-specific clauses.

            👉 Easily create your privacy policy for the upcoming CPA →

            Consumer rights under the CPA

            Under the CPA, consumers have the right to:

            • opt-out of the processing of personal data for targeted advertising, sale and certain profiling; and 
            • access, correct, delete, and obtain their personal data in a portable manner. 

            Consumers can invoke and exercise their rights granted under the CPA at any time by submitting requests in accordance with the methods indicated in your privacy notice.

            You will have 45 days to respond to any user requests, and you will also have additional responsibilities, including respecting user-selected universal opt-outs.

            Sensitive Data under the CPA

            Under the Consumer Privacy Act (CPA), “Sensitive data” is defined as personal data that reveals specific categories of information about an individual, including their: 

            1. racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship, or citizenship status;
            2. genetic or biometric data that may be used to uniquely identify them; and
            3. personal data from a known child.

            The Act also imposes restrictions on the processing of sensitive data. You may process sensitive data only if the consumer (or a child’s parent or legal guardian, if the personal data regards a known child) has given explicit consent.

            ⚠ If you are processing sensitive data, you must take reasonable measures to protect the confidentiality, integrity, and availability of the sensitive data.

            Under the CPA, there are no indications that opt-out links enabling consumers to opt-out of the processing of personal data for certain purposes are required. However, if you are processing personal data for targeted advertising or sale, you are required to provide a clear and conspicuous method for consumers to exercise their right to opt out.

            This method must be clearly and conspicuously described in the privacy notice and must be readily accessible outside the privacy notice. 

            Effective July 1, 2024, you must allow consumers to exercise their right to opt out through a user-selected universal opt-out mechanism.

            How to prepare for the Colorado Privacy Act (CPA)

            The Colorado Privacy Act will have significant implications for businesses operating in Colorado, requiring them to implement specific privacy measures and comply with a range of new regulations. 

            ✅ To prepare for the CPA, take the following steps:
            1. Determine whether the CPA applies to your business based on the criteria outlined in the act.
            2. Conduct a comprehensive data inventory to identify what personal data is collected, processed, and stored.
            3. Update your privacy policy to comply with the CPA’s requirements.
            4. Establish a process for responding to data subject requests, including the right to access, delete, and correct personal data.
            5. By July 1, 2024, ensure that you have established an opt-out preference signal mechanism to allow consumers to opt-out of the processing of their personal data for targeted advertising or sale.

            Colorado Privacy Act took effect on July 1, 2023

            Get Prepared Now

            The post Colorado Privacy Act (CPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Virginia Consumer Data Protection Act (VCDPA) https://www.iubenda.com/en/help/106345-virginia-consumer-data-protection-act-vcdpa/ Fri, 18 Nov 2022 11:28:14 +0000 https://help.iubenda.com/?p=106345 The Virginia Consumer Data Protection Act (VCDPA) was signed into law in March 2021, and Virginia became the second state in the United States to enact a comprehensive data privacy law after California.  The VCDPA went into effect on January 1, 2023, and affects organizations that do business in Virginia or provide products/services to people […]

            The post Virginia Consumer Data Protection Act (VCDPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            The Virginia Consumer Data Protection Act (VCDPA) was signed into law in March 2021, and Virginia became the second state in the United States to enact a comprehensive data privacy law after California. 

            The VCDPA went into effect on January 1, 2023, and affects organizations that do business in Virginia or provide products/services to people in Virginia. In other words, your organization does not need to be located in Virginia to be affected by the VCDPA.

            🚀 Learn more about the VCDPA in this article, including whether or not you’ll be affected and how to become compliant.

            Short on time? Jump to what you need to do to prepare for the VCDPA →

            What is the Virginia Consumer Data Protection Act (VCDPA)?

            The VCDPA grants users the right to access their data and requests that organizations remove their personal data. It also compels businesses to complete data security assessments when processing personal data for, among others, targeted advertising and sales.

            Under the VCDPA, personal data means any information that is linked or reasonably linkable to an identified or identifiable person.

            Therefore it’s important to note that IP addresses can be considered personal data as long as they are “linked or reasonably linkable to an identified or identifiable natural person”.

            Will my Organization be affected by the VCDPA?

            To fall under the scope of the Act, organizations doing business in Virginia must meet one of two levels, and both thresholds address a minimum number of affected users. 

            Organizations that control or process:
            1. at least 100,000 users’ personal data in a calendar year, or 
            2. at least 25,000 users’ personal data while generating more than 50% of gross revenue from the sale of that data

            will be affected by the VCDP. Keep reading to find out how your business can become compliant. 👇

            📌 Your Privacy Policy under the VCDPA

            Your organization must provide users with a reasonably accessible, clear, and meaningful privacy notice. Here is the full checklist of information that you must include in your privacy policy. 

            Privacy Policy Checklist ✅

            Include the categories of personal data processed by your organization.

            Include your organization’s purpose for processing personal data.

            Inform your users of how they may exercise their rights (see below), including how they can appeal a decision on their requests. You must provide one or more methods for users to submit a request.

            Include the categories of personal data that your organization shares with third parties if any.

            Include the categories of third parties, if any, with whom your organization shares personal data.

            💡
            Did you know?

            iubenda’s Privacy and Cookie Policy Generator allows you to add all United States disclosures in one simple click!

            Simply click “Enable disclosures for Users residing in the United States” to activate the new US-specific clauses.

            Keep reading to learn more about the upcoming changes in Virginia, or find out how iubenda can help you comply →

            📌 Users’ Rights

            Residents of Virginia have the following rights under Virginia’s VCDPA:

            • the right to know if their personal data is being collected or processed;
            • to gain access to their personal data collected or processed by the controller;
            • to obtain a portable and usable copy of their personal data kept by a controller;
            • to not face discrimination because they exercised their rights; 
            • to have inaccurate personal data corrected; 
            • to have personal data deleted; and 
            • to opt out of having their personal data collected or processed for the purposes of targeted advertising, sale, and profiling.

            📌 Opt out Links

            Please be informed that under the VCDPA, there are no indications that opt out links enabling users to opt out of the processing of personal data for certain purposes are required

            The provisions of the VCDPA, in fact, treat users’ opt out rights in the same manner as any other users’ rights granted under the Act. See how to respond to users’ requests below 👇

            📌 How to respond to users’ requests

            Your business needs to comply with users’ requests as follows:

            • you need to comply with the request within 45 days. The response period may be extended one time by 45 additional days when reasonably necessary, as long as you inform your user of any extension within the initial 45-day response period, together with the reason for the extension;
            • if you decline to take action regarding your users’ request, inform the user of such rejection within 45 days, indicating the relevant justification and instructions on how to appeal the decision;
            • if you are unable to authenticate a request using commercially reasonable efforts, you are not required to comply with the request, and you may ask for additional information, which is reasonably necessary to authenticate the user and its request.

            📌 What happens if I don’t comply with the VCDPA?

            As the VCDPA does not establish a dedicated privacy Agency, the Attorney General has exclusive authority to enforce its provisions.

            Prior to initiating any action, the Attorney General will provide a 30 days written notice identifying the specific provisions that have been or are being violated:

            👉 If within the 30-day period, you cure the noticed violation and provide the Attorney General with a written statement that the alleged violations have been cured and that no further violations shall occur, no action will be initiated against your business.

            👉 If your business continues to violate the provisions of the Act following the cure period or a written statement made to the Attorney General, the Attorney General may initiate an action and seek an injunction to restrain any violations and civil penalties of up to $7,500 for each violation.

            What you need to do to prepare for the VCDPA

            The United States gains another data privacy regulation through Virginia’s Data Protection Act (VCDPA).

            If your organization is already in compliance with the GDPR and California’s CCPA/CPRA, the chances are you won’t have to do much to bring your website into compliance with Virginia’s VCDPA. However, it’s important you consider the changing landscape of privacy laws across the US and think about ways in which you can meet even the strictest of privacy standards. 

            How can iubenda help you Comply with the VCDPA

            iubenda has created the tools to help you simultaneously comply with the various legislations across the United States!

            📌 Privacy and Cookie Policy generator → 
            Our Privacy and Cookie Policy generator provides the option to add “service” clauses to comply with each US legislation.

            Specific service clauses related to the VCDPA include:
            1. Profiling of Virginia consumers;
            2. Collection of personal data about Virginia consumers below the age of 13; and
            3. We do not collect personal data about Virginia consumers below the age of 13.

            To enable the new US-specific clauses, simply click “Enable disclosures for Users Residing in the United States” from within the Privacy and Cookie Policy Generator. This will allow you to meet the strictest of US standards

            📌 Privacy Controls and Cookie Solution → 
            Additionally, our Privacy Controls and Cookie Solution allows you to meet the remaining requirements for your Privacy Notice. 

            Within the configurator, simply: 

            1. select US legislation within the Generator; and
            2. activate the automated configuration to synchronize with your privacy notice and privacy control choices.
            🚀
            The VCDPA wen into effect on January 1, 2023

            If your organization falls under the scope of the VCDPA, you should have begun looking into compliance solutions that are well-trusted and drafted by lawyers.

            So, if you haven’t got one already, get started today.

            Comply Now

            The post Virginia Consumer Data Protection Act (VCDPA) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            🇧🇷 Brazil: New Cookie Recommendations https://www.iubenda.com/en/help/104366-brazil-new-cookie-requirements/ Fri, 21 Oct 2022 11:20:36 +0000 https://help.iubenda.com/?p=104366 Brazil: New Cookie recommendations – The Brazilian data protection authority (ANPD) has published new guidance on cookies. The guidelines aim to highlight both beneficial and detrimental behaviors connected to the usage of cookie banners and policies. Also included are recommendations on what to avoid when creating cookie banners and standards and best practices related to […]

            The post 🇧🇷 Brazil: New Cookie Recommendations appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            Brazil: New Cookie recommendations – The Brazilian data protection authority (ANPD) has published new guidance on cookies.

            The guidelines aim to highlight both beneficial and detrimental behaviors connected to the usage of cookie banners and policies. Also included are recommendations on what to avoid when creating cookie banners and standards and best practices related to cookie policies and cookie banners.

            The ANPD also emphasized that the guidelines will be accessible to comments and contributions from the public, stating that suggestions could be submitted to the ANPD Ombudsman via the Fala.BR Platform. You can access the news release here and the guideline here (available in Portuguese)

            Without further ado, let’s jump straight into the new guidance on cookie recommendations 👇

            Brazil: New Cookie recommendations

            📌 Cookie Policies 

            The new guidelines offer clear recommendations in regard to cookie policies, stating that you must provide your users with information on: 

            1. the specific purposes that justify the collection of personal data through cookies,
            2. the retention period, and
            3. sharing of personal data with third parties, if applicable.

            Your cookie policy must be accessible through a link in the cookie banner and be easily accessible if integrated with the Privacy Policy.

            The Authority provides a number of options for you to present the Cookie Policy to users

            • as a specific section of the Privacy Policy;
            • in a specific and separate location; or
            • in the cookies banner.

            💡 Did you know that with iubenda’s Privacy Controls and Cookie Solution, you can automatically link your cookie policy to your cookie banner? Not using iubenda’s privacy and cookie policy? Not to worry, our Privacy Controls and Cookie Solution also allows you to link your own, see the image below. 

            📌 The Cookie Banner

            1. First layer of the banner (“Accept” and “Reject” buttons)

            The Authority advises not to include differently conspicuous buttons on the initial layer of the banner. Meaning the “Accept” and “Reject” buttons, as well as the “management option” for non-necessary cookies buttons, must all be the same.

            The example below illustrates the first layer conceived by the Authority, with the three buttons mentioned above.

            Image: ANPD Guiding Handbook Cookies and Personal Data Protection 

            Reject button: your banners ‘reject’ button must be easily visible both in the first and second layers of the banner. 

            The wording proposed by the Authority for this button is the following: 

            “Reject cookies that are not necessary”.

            Accept button: your banners’ “accept” button must be as prominent as the “Reject” button.

            The wording proposed by the Authority for this button is the following: 

            “Accept all cookies”

            Management option: The management option on your cookie banner must redirect your users to the second layer of the banner to allow the granular provision of consent on the basis of the categories of non-necessary cookies.

            The wording proposed by the Authority for this button is the following: 

            “Select cookies”

            Link for the exercise of rights: the banner must include an easily accessible link that allows your users to exercise their rights. These rights include, by way of example: 

            • learning more about how their data is used and the retention period, 
            • requesting the deletion of data, 
            • objecting to the processing of data, 
            • revoking consent for the use of cookies.

            2. Second layer of the banner 

            Consent

            In the second layer of the banner, you must obtain consent per purpose according to the categories disclosed.

            However, the list of cookies presented for the consent collection must not be too granular, as this could hinder the users from expressing their will clearly.

            💡 iubenda’s Privacy Controls and Cookie Solution allows you to obtain granular consent by means of toggles.

            Cookie Categories 

            You must display the cookies grouped per category. The categories are described on the basis of the use and purposes of cookies. Users should be able to give their specific consent to each category of cookies separately.

            Purposes of cookies 

            You must provide a simple, clear, and precise description of the purposes for which the categories of cookies are installed.

            Pre-ticked boxes 

            Pre-ticked boxes are not allowed. The Authority specifies that cookies based on consent must be disabled by default, see the image below. Manual deactivation is also considered not in line with the guidance.

            Image: ANPD Guiding Handbook Cookies and Personal Data Protection 
            Browser settings 

            In the second layer of the banner, information on how to block cookies through the browser settings must be provided. If it is not possible to disable the cookie or tracker in this way, you must inform users about it (see the image below).

            Image: ANPD Guiding Handbook Cookies and Personal Data Protection 
            Withdrawal of consent 

            You must provide your users with the possibility to revoke the consent provided for the use of cookies at any time in a simplified and free-of-charge manner. The procedure must be similar to the one used to obtain consent. 

            Only strictly necessary cookies

            Even if your website merely uses strictly necessary cookies, you are still subject to the requirement related to the cookie policy, as the principle of transparency and free access, as well as the exercise of data subjects’ rights, equally apply.

            📌 Categories of cookies

            The guidance includes a non-exhaustive list of cookie categories based on the most popular types of cookies and according to the following aspects:

            • the entity responsible for their management;
            • the need;
            • the purpose; and
            • the information retention period.

            📌 Legal basis

            The Authority clarifies in the guidance that the legal bases of consent and legitimate interests are the “most usual and relevant to the context analyzed”. 

            However, if the LGPD standards are met, we can expect that gathering personal data via cookies may rely on other legal bases.

            How iubenda can help you manage the new Cookie recommendations 

            Do you have users in more than one country (e.g., Brazil AND Portugal) and need to comply with multiple laws?

            With iubenda, it is easy to meet Brazil’s cookie recommendations. Just start generating, and our configuration wizard suggests the right settings, like LGPD protection, based on where you and your users are based.

            Our Solution also comes with a geo-location feature so that you’re always displaying the right notice and policies to the users you need to.

            And did we mention that our clauses are updated when the law changes to help you stay compliant?

            🇧🇷
            How to adopt the new cookie recommendations?

            For your convenience, we’ve created a brief checklist of the steps you must do to comply with Brazil’s latest cookie recommendations.

            See also

            The post 🇧🇷 Brazil: New Cookie Recommendations appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Consent vs. Legitimate interest: what’s the difference? https://www.iubenda.com/en/help/78656-consent-vs-legitimate-interest/ Wed, 05 Oct 2022 13:13:05 +0000 https://help.iubenda.com/?p=78656 Consent or legitimate interest: what do they mean exactly? Which one should you choose?There isn’t one single answer, even though many data protection authorities across Europe have limited the use of legitimate interest.But first, we need to understand why you need to choose between consent or legitimate interest in the first place. Why do you […]

            The post Consent vs. Legitimate interest: what’s the difference? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Consent or legitimate interest: what do they mean exactly? Which one should you choose?
            There isn’t one single answer, even though many data protection authorities across Europe have limited the use of legitimate interest.
            But first, we need to understand why you need to choose between consent or legitimate interest in the first place.

            Why do you need to choose between consent or legitimate interest?

            Consent and legitimate interest are two of the six legal bases of the GDPR.
            According to the GDPR, to start processing your users’ personal data, you need a legal basis, that is a legal reason to validate your activity. For your processing activity to be lawful, it should be necessary to achieve your purposes. If you can achieve them without processing any data, or with the least amount of data possible, then the processing should be avoided, and you don’t need a legal basis.
            Now, let’s have a closer look at what consent and legitimate interest mean.

            The definition of consent is pretty straightforward: your users give you permission to start collecting and using their personal information.
            However, for consent to be valid, it needs to meet specific requirements. As stated in the GDPR, consent should be freely given, specific, informed and unambiguous.

            What does this mean, exactly?

            It means that, before starting processing on the basis of consent, you need to make sure that your users have been informed about your activity and that they’ve agreed to it freely. This also means that the mechanism for acquiring consent should require a positive action by the user (e.g., you should avoid pre-ticketed boxes in your consent forms). It’s also important to provide them with a means to withdraw their consent whenever they want.

            You can learn more about consent and the GDPR here.

            📌 What’s legitimate interest?

            The UK’s ICO defines legitimate interest as the most flexible legal bases. And indeed, the processing on the basis of legitimate interest doesn’t require a specific purpose nor the users’ consent. The purpose of the processing is the legitimate interest of the data controller (i.e. a website or app owner) or of a third party.
            Since legitimate interest can apply to a wide number of situations, you should be careful in assessing whether your interests are balanced with your users’ rights and freedoms.

            For this reason, the ICO suggests a three-part test to assess whether legitimate interest can apply:

            1. Purpose test: is there a legitimate interest behind the processing?
            2. Necessity test: is the processing necessary for that purpose?
            3. Balancing test: is the legitimate interest overridden by the individual’s interests, rights or freedoms?

            As there is no specific purpose for legitimate interest, you should be even more transparent with your users and explain what the legitimate interests of the processing are.

            When can I rely on consent or legitimate interest?

            It all depends on how you are going to use the data you collect and how intrusive of their privacy the processing will be.
            According to ICO, you can rely on legitimate interest when:

            • the processing is not required by law but is of a clear benefit to you or others;
            • there’s a limited privacy impact on the individual;
            • the individual should reasonably expect you to use their data in that way; and
            • you cannot, or do not want to, give the individual full upfront control (i.e. consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.

            However, there are cases when legitimate interest is not allowed. For example, many data protection authorities, such as the Italian Garante, have issued new guidelines on cookie usage and they have explicitly forbidden legitimate interest as a valid legal basis for profiling cookies.

            In general, consent is often the safer choice. Relying on the wrong legal basis could invalidate your activity and expose you to serious consequences. So it’s always better to play it safe!

            💡

            We hope this post helped you determine your legal basis. Now you’re ready for the next, crucial step.


            👉 Find out How to write your privacy policy

            Learn more

            The post Consent vs. Legitimate interest: what’s the difference? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            How to Handle Data Privacy Complaints | Your 5-Step guide https://www.iubenda.com/en/help/78016-how-to-handle-data-privacy-complaints-your-5-step-guide/ Thu, 22 Sep 2022 13:20:26 +0000 https://help.iubenda.com/?p=78016 Your business can receive a privacy complaint if a user believes its rights have been infringed. Your business must respond as soon as feasible to complaints that involve users’ personal information.  This 5-step guide will help you in responding to and resolving privacy complaints in a method that may mean the difference between settling the […]

            The post How to Handle Data Privacy Complaints | Your 5-Step guide appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Your business can receive a privacy complaint if a user believes its rights have been infringed. Your business must respond as soon as feasible to complaints that involve users’ personal information. 

            This 5-step guide will help you in responding to and resolving privacy complaints in a method that may mean the difference between settling the complaint effectively and having it escalated to your national Data Protection Authority. 

            💡Privacy complaints can be useful to your business since they frequently identify areas where processes can be improved, and future risk decreased.

            How to handle data privacy complaints

            📌 Step 1 – Receive 

            Acknowledge the complaint as soon as possible. A prompt acknowledgment offers an early impression that your business is responsive and efficient, and it saves time by preventing the users from sending a following-up.

            Even if the complaint requires further investigation or will be handled informally, addressing it soon helps lay the groundwork for good contact with the user. 

            This is also a chance to inform the users about how the complaint will be handled by:

            1. providing a link to your complaints procedure if you have one;
            2. outlining the stages in the complaint procedure and the expected timelines for resolution;
            3. providing information on how your business collects, uses, and discloses personal information when handling a complaint; and
            4. providing the users with a contact from within your business that will be handling the complaint.

            📌 Step 2 – Recognize 

            Any data protection issues should be handled as soon as feasible. Initially, attempt to study everything you can. You must collect all necessary data thoroughly, fairly, and precisely.

            After you have understood the situation of the complaint, you should respond to a privacy complaint promptly. If your company waits, it is doubtful that the privacy issue will be resolved without being escalated.

            If the inquiry is expected to take some time, follow up on your initial response. Inform them so that they are aware of your efforts to resolve the issue. 

            💡 When possible, use simple language rather than technical or legal jargon. People will trust you more if you keep them informed, and if everyone knows what to expect, things will go more smoothly. A complainant who believes they have been heard, their concerns addressed, and they have been treated with respect is more likely to resolve their complaint

            📌 Step 3 – Record 

            Keep a record of all significant conversations as well as copies of any relevant papers, including the logic behind your decisions and any actions you take—or do not take—from start to finish. It will also provide proof of your actions, which your Data Protection Authority may require in the future.

            📌 Step 4 – Respond

            When your investigation is finished, notify the recipient of the findings. Describe what you did to address the data protection issue, as well as any following steps you took. Give them enough information to comprehend how you got at your conclusion. It may be useful to list the areas of concern in bullet points and, when possible, answer each one with relevant proof.

            A statement such as “We have no been able to uphold your complaint,” “We were unable to confirm your version of events,” or “Your complaint did not show anything improper” is not an explanation; it is a conclusion.

            You want your user to feel understood and taken seriously. If you can demonstrate to them that you have spent the time on their personal request, you will not only build trust with them but also reduce the chances of the complaint going any further.

            Explain why you were unable to uphold the complaint. Your complaint outcome letter should demonstrate that you have, At the very least, have:

            1. assessed the complaint against the relevant privacy principles;
            2. considered all other relevant criteria, such as legislation applicable to the agency and any relevant policies, standards, or directives; and 
            3. determined the extent to which the complaint is or is not substantiated and all the reasons for this.

            💡 Write in simple, accurate, and straightforward language. This will help you deliver your message to the user and avoid any misunderstandings. Provide your contact information so that your user can contact you if they have any more queries regarding the complaint.

            📌 Step 5 – Review

            After you’ve handled the complaint, take some time to think about what happened. Consider whether there is anything you can learn or do better to prevent future complaints. If you consistently find a high frequency of complaints, a small change can make a big difference. 

            Taking these 5 steps will help ensure your compliance with privacy laws and reduce liability risks.

            Important Reminder

            You may be in violation of several laws if you do not have an up-to-date privacy policy. You can further your efforts to comply with laws such as the GDPR by providing user-friendly privacy notices when you collect personal information. See how to easily edit and update your privacy policy here.

            The post How to Handle Data Privacy Complaints | Your 5-Step guide appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            FADP Updates – What You Need to Know https://www.iubenda.com/en/help/75419-fadp-updates-what-you-need-to-know/ Tue, 30 Aug 2022 09:04:57 +0000 https://help.iubenda.com/?p=75419 Are you a publisher targeting users in Switzerland? Starting July 2024, it’s essential to integrate a certified CMP compliant with the TCF. This change to an opt-in model is crucial to maintain proper ad display and protect your revenue streams. Learn more → The new Federal Data Protection Act (FADP) is the result of a […]

            The post FADP Updates – What You Need to Know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            Are you a publisher targeting users in Switzerland? Starting July 2024, it’s essential to integrate a certified CMP compliant with the TCF. This change to an opt-in model is crucial to maintain proper ad display and protect your revenue streams. Learn more →

            The new Federal Data Protection Act (FADP) is the result of a complete revision of the previous Swiss Data Protection Act, which was passed on 25 September 2020 and entered into force September 2023.

            The FADP contains similar provisions to the GDPR with some differences with respect to legal bases and sanctions.

            Switzerland has a law governing data privacy known as the Federal Act on Data Protection, which dates back to 1992 and it was partially updated in 2019.

            The Swiss Parliament has therefore adopted a fully revised version of the law to be more in line with the GDPR. The intention is that it will uphold a comparable quality of privacy and security as the rest of the EU, even though it will maintain the original concepts and vary slightly in some areas.

            Updates to the FADP

            In the updated FADP, privacy by design is introduced, resulting in stricter due diligence requirements for data processors and companies that store private data. Companies must now design their procedures with compliance in mind.

            • Biometric and genetic information are now considered sensitive data.
            • If there is a significant risk to the rights or privacy of data subjects, impact assessments must be carried out.
            • The obligation to disclose information has been extended.
            • It is now required to keep a register of processing activities. However, the regulation permits exemptions for SMEs whose handling of personal data carries only a small risk of harming the data subject.
            • In the event of a data security breach, prompt reporting must be made to the Federal Data Protection and Information Commissioner (FDPIC).
            • Profiling, or the automated processing of personal data, is now a recognized legal notion.
            • The FADP does not require a legal basis to process personal data according to the general principle of the law, which maintains that data processing activity is lawful in principle and a legal basis is only required should the data controller needs to justify processing. 
            • The opt-in/opt-out mechanism operates differently as (prior) consent may need to be employed in fewer situations.
              • the processing of personal data worthy of special protection, 
              • high-risk profiling by private individuals, 
              • profiling by a federal body.
            • Sanctions are directly aimed at natural persons even within organization.
            • Finally, the FADP contains more categories of sensitive data

            Make sure your company is up-to-date with the main international legislations. You can easily generate and manage your documents with iubenda’s Privacy and Cookie Policy Generator

            FADP updates and GDPR: What are the main differences?

            • information concerning automated decision-making;
            • the recipients or categories of recipients of the personal data, if any, to which personal data is disclosed;
            • the countries or international organizations to which the personal data is disclosed, if any.
              FADP GDPR
            Applicability The FADP applies to you if your organization is based either in Switzerland or outside of Switzerland, and you are processing data of Swiss data subjects (except processing carried out for personal activities). The GDPR applies to you if your organization is based in the EU or processing data of EU data subjects (except processing carried out for personal or domestic activities)
            Sensitive Data Under the FADP sensitive data include:
            • data concerning religious, philosophical, political, or trade union opinions or activities;
            • data concerning health, privacy, or racial or ethnic origin;
            • genetic data;
            • biometric data that uniquely identify a natural person;
            • administrative and criminal prosecutions and sanctions;
            • data concerning social assistance measures.
            Under the GDPR, sensitive data include:
            • data concerning religious or philosophical beliefs, political, or trade union opinions;
            • data concerning health, sexual orientation, racial or ethnic origin;
            • genetic data;
            • biometric data
            Data Controller/Data Processor The Data controller and the Data Processor may enter into an agreement to regulate the processing of the data. Data Processing Agreement required
            Conditions of processing With regard to private, express consent is required only for:
            • the processing of personal data worthy of special protection;
            • the processing of sensitive personal;
            • high-risk profiling by private persons
            • profiling by a federal body.
            Federal bodies have the right to process personal data only if there is a legal requirement to do so. These include:
            • the data processed consists of sensitive personal data
            • profiling is carried out;
            • the purpose of the processing or the type of processing is likely to result in a serious interference with the fundamental rights of the data subject.
            Opt-in principle.
            Disclosure obligations

            The controller is to provide the following information within 30 days from the data subject’s access request (concerning the processing of the data subject’s personal data):

            • the identity and contact details of the data controller;
            • the categories of personal data being processed;
            • the purposes of processing;
            • the duration of storage of such personal data or the criteria used to determine such duration if the former is not available;
            • if the personal data was not collected directly from the data subject, the source of such personal data;
            The GDPR contains all the same elements as the FADP but also includes the requirements to disclose the legal basis for processing as well as the rights granted to the data subject such as the right to a copy of the data, the right to lodge a complaint and the right to withdraw consent to the data processing.
            Transfer of personal data abroad

            Personal data may only be transferred to foreign countries or international bodies that are deemed to provide an adequate level of protection, as verified by the Swiss Federal Council. In the absence of such an adequacy decision, personal data can be transferred abroad pursuant to:

            • an international treaty;
            • contractual provisions between the controller and the processor and its contracting partner communicated beforehand to the FDPIC;
            • specific safeguards prepared by the competent federal body and previously communicated to the FDPIC;
            • standard data protection clauses subject to the prior approval of the FDPIC;
            • binding corporate rules previously approved by the FDPIC.

            Several exceptions to the transfer of personal data abroad are also provided for under the FADP. These include:

            • the explicit consent to the transfer of personal data being granted by the data subject;
            • the transfer of personal data is related to the performance or the conclusion of a contract between the controller and the data subject or the controller and a contracting partner in the interest of the data subject;
            • the transfer is necessary to safeguard an overriding public interest, enforce a legal claim before a court of law, to protect the life of the data subject or a third party where it is not possible to obtain the prior consent of the data subject within a reasonable time, the data subject has granted access to the data and has not expressly prohibited its processing, and the data originates from a legal register which is available to the public or to persons that possess a legitimate interest to such register.
            • Adequacy decisions of the European Commission;
            • Standard Contractual Clauses; and
            • Binding Corporate Rules.
            Data Protection Officer Under the FADP you are not required to have a Data Protection officer, it is optional. The GDPR requires the appointment of a Data Protection Officer for private businesses
            Data Breach Notifications The FDPIC only needs to be notified in the event of a high risk security breach as soon as possible. Notification to the data subjects is to be made only if necessary for the protection of the data subject or so requested by the FDPIC. Data breaches must be reported to the DPA within 72 hours.The data subject must be informed in the event of a high risk.
            Penalties of non-compliance Fines of up to CHF 250,000 against the persons or entity responsible. Fines of up to EUR 10/20 million or 2/4% of annual worldwide turnover of the organization.

            Do these changes apply to my company? 

            This law applies to the processing of personal data concerning individuals by:

            👉 private persons;

            👉 federal agencies.

            It does not apply to the processing of personal data by individuals for exclusively personal use. 

            iubenda will continue to keep you updated about the changes made to the FADP; in the meantime, if you haven’t done so already, make sure you have an updated and compliant privacy and cookie policy in place. 

            💡
            How to Prepare for the FADP

            The revised Swiss Federal Act on Data Protection (FADP) entered into force September 2023.

            👉 See our guide How to Prepare for the FADP to see what steps you can take today!

            The post FADP Updates – What You Need to Know appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            The Right to be Forgotten and iubenda’s Consent Database https://www.iubenda.com/en/help/74228-right-to-be-forgotten-and-iubendas-consent-solution/ Wed, 03 Aug 2022 09:24:39 +0000 https://help.iubenda.com/?p=74228 Article 17 of the GDPR, “the right to erasure,” also known as the “right to be forgotten,” allows individuals to request that data controllers remove their personal data. But the right to be forgotten involves much more than an individual simply asking a company to delete their personal data. Short on time? Jump to:  What […]

            The post The Right to be Forgotten and iubenda’s Consent Database appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            Article 17 of the GDPR, “the right to erasure,” also known as the “right to be forgotten,” allows individuals to request that data controllers remove their personal data.

            But the right to be forgotten involves much more than an individual simply asking a company to delete their personal data.

            Short on time? Jump to: 

            What is the right to be forgotten? 

            The right to be forgotten appears in Article 17 of the GDPR, stating that if one of a number of conditions applies,

            “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data *without undue delay.” 

            *“Without undue delay” is considered to be within one month after receiving the request. 

            Additionally, the data controller must take appropriate measures to confirm the identity of the data subject behind the request.

            When does the right to be forgotten apply?

            The specific conditions under which the right to be forgotten is applicable are outlined in Article 17. An individual has the right to have their personal data deleted if:

            1. Personal data is no longer required for the purposes for which they were collected or processed.
            2. The data subject withdraws the consent, and there are no other legal grounds for the processing.
            3. The data subject objects to the processing (which relied on the ground of legitimate interest), and there are no overriding legitimate grounds for the processing. This applies even when using personal data for direct marketing.
            4. The processing of the personal data was done unlawfully.
            5. The personal data must be deleted for the controller to comply with a legal requirement under EU or Member State legislation.
            6. The collection of personal data is related to the provision of services for the information society.

            Can the data controller override the user’s right to be forgotten?

            Yes, in the following situations, the data controller can override the users’ right to be forgotten:

            • Processing is required in order to exercise the right of freedom of expression and information. 
            • Processing is required to carry out a task in the public interest, to comply with a legal requirement, or for the controller to exercise official responsibility.
            • Processing is required for reasons of public interest in the field of public health.
            • Processing is required for archiving in the public interest, historical or scientific research, or statistical purposes.
            • Processing is required to establish, exercise, or defend legal claims.

            Additionally, if an organization can demonstrate that a request to delete personal data was unreasonable or incorrect, the company may demand a “reasonable fee” or reject the request.

            When exercising the user’s right to be forgotten, many factors are at play, and each request needs to be evaluated individually.

            First of all, it is up to the data controller to determine whether a request for the removal of personal data should be carried out. The data controller must reply to the request within one month and communicate the related decision:

            1. if the assessment carried out points to the fact that the request needs to be processed (one of the specified situations listed in Article 17 of the GDPR applies); or 
            2. if the conclusion is that the request cannot be carried out due to a certain reason. In this instance, the data controller also needs to communicate why the request could not be fulfilled.

            Suppose the result of the data controller assessment indicates that it is necessary to remove the personal data kept in the Consent Database. In that case, iubenda will be available to help with the technicalities.

            However, the data controller will need to make an API call to log the deletion if they want to move forward with a request to exercise the right to be forgotten. Please keep in mind that the data controller will need to modify the API call to include the relevant personal data.

            Please see this example below:

            curl --location --request POST 'http://consent.iubenda.com/consent' --header 'Content-Type:application/json' --header 'ApiKey:YOUR_PRIVATE_API_KEY' --data-raw '{
              "subject":{
                "id":"subject_id"
              },
              "preferences":{
                "preferencel":"false",
                "preference2":"false",
                "rightToBeForgotten":"true"
              },
              "proofs":[
                {
                  "content":"The user requested to be forgotten,and this is the proof of it"
                }
              ]
            }
            '

            The data controller can use the same method of communication that the user used to express the request. For example, if the user communicated the request with an email address, the data controller can use that same email address to contact the user.

            For compliance reasons, the proof of users’ consent and any withdrawals must be kept. However, the data controller who receives a request to exercise the right to be forgotten must consider each request individually.

            For all data processing operations to be carried out on the legal basis of consent, the data controller must maintain track of the proof of consent obtained.

            On the other hand, users are entitled to revoke any prior consent they may have given for the processing of their personal data under. 

            With the help of the Consent Database, it is possible to manage user consent and keep the consent records needed by the GDPR.

            Store GDPR proofs of consent now!

            Explore our Consent Database

            If you need further assistance exercising your user’s right to be forgotten, don’t hesitate to contact our support team. 

            See also: 

            The post The Right to be Forgotten and iubenda’s Consent Database appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            CPRA: Intro to the CCPA 2.0 and how it affects you https://www.iubenda.com/en/help/73819-cpra-intro-to-the-ccpa-2-0-and-how-it-affects-you/ Tue, 26 Jul 2022 14:14:59 +0000 https://help.iubenda.com/?p=73819 CPRA: Intro to the CCPA 2.0 and how it affects you. In 2020, the California Consumer Protection Act (CCPA) was enacted to address the increasing concerns about the sale and collection of personal information in California. The current CCPA grants various rights to residents of California and regulates the actions of businesses that sell or […]

            The post CPRA: Intro to the CCPA 2.0 and how it affects you appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>

            CPRA: Intro to the CCPA 2.0 and how it affects you. In 2020, the California Consumer Protection Act (CCPA) was enacted to address the increasing concerns about the sale and collection of personal information in California.

            The current CCPA grants various rights to residents of California and regulates the actions of businesses that sell or collect personal information. However, it leaves the consequences of third-party processing of consumer data somewhat open to interpretation. This prompted an amendment to the CCPA, which has come to be known as the California Privacy Rights Act (CPRA).

            💡 The CPRA builds on the CCPA’s existing provisions, establishes new consumer rights, and adds new requirements for companies that gather personal data from California residents.

            🚀 Short on time? Start your compliance with the CPRA today!

            📌 Updates to the definition of a business under the CPRA

            Criteria for Qualifying as a Business has been updated; find out if you classify as a business by answering the questions below: 

            1. Are you a legal entity that operates for profit?
            2. Do you collect personal information (PI) from Califonia consumers?
            3. Do you determine the purposes and means of processing personal information? 

            Does your business meet one or more of the following conditions: 

            (A) A gross revenue of over $25 million in the previous calendar year.

            (B) Buys, sells, or distributes the personal information of 100,000 or more customers or households each year, either alone or in combination.

            (C) Obtain 50% or more of its yearly income from selling or sharing personal information about customers? 

            If you answered yes, then under the CPRA, your organization could classify as a business.

            🤔 Not sure if the CPRA applies to you? Do this 1 min quiz!

            What does this mean for my business?

            Because of some changes in the criteria, entities that would be subject to the CPRA may be different from the ones that fall under the criteria of the CCPA.

            🚀 Does your business fall under the scope of the CPRA? See how to comply →

            📌 Sensitive personal information under the CPRA

            The CPRA introduced a different category of protected data to the mix: sensitive personal information (SPI). This idea is quite similar to Article 9 of the General Data Protection Regulation (GDPR), which asks for a higher level of data protection for the sensitivity of personal information.

            What is considered sensitive personal information under the CPRA? See here for a full checklist (Click on as amended November 3, 2020, and scroll down to the definition). SPI that is “publicly available” can not be considered sensitive personal information or personal information.

            The CPRA puts particular standards and limits on SPI, providing consumers greater control over how organizations use their personal information.

            1. Updated disclosure requirements – Your business needs to provide consumers with the following information on SPI in the privacy policy: whether the information will be sold or shared, and the duration of the retention.
            2. Purpose limitation – You need to disclose the additional and specific purpose for which the sensitive personal information may be used or disclosed to third parties.
            3. Limit the use and disclosure – provide a clear and visible link, “Limit the use of my Sensitive Personal Information”, on your homepage and a notice of right to limit the use/disclosure of sensitive personal information. However, there are cases where a business is not required to offer consumers a right to limit the use/disclosure of SPI and display relevant notice, namely whenever sensitive personal information is processed:
            • to perform services or provide goods (only for use reasonably expected by an average consumer);
            • to prevent, detect and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information;
            • to resist malicious, deceptive, fraudulent, or illegal actions directed at the business and prosecute those responsible for those actions;
            • to ensure the physical safety of natural persons;
            • for short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, provided that the personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business;
            • to perform services on behalf of the business (e.g., customer service, processing or fulfilling orders and transactions, processing payments, etc.);
            • to verify or maintain the quality or safety of a product, service or device that is owned, manufactured, manufactured for or controlled by the business and to improve, upgrade or enhance the service or device that is owned, manufactured by, manufactured for or controlled by the business; and
            • for purposes that do not infer characteristics about the consumer.

            Please verify whether your sensitive personal information processing activities fall within the scope of such exceptions.

            What does this mean for my business?

            With the implementation of SPI, businesses, as specified by the CPRA above, must be extra diligent in protecting this type of data and responding appropriately when a customer wishes to opt-out. Extra standards must be established if a business plans to handle consumers’ SPI. Businesses that keep SPI, for example, must have a clear and visible link on their websites labeled “Limit the Use of My Sensitive Personal Information” that allows customers to limit the processing of their SPI.

            🚀
            iubenda’s Privacy and Cookie Policy Generator takes the guesswork out of the game!

            We will automatically fill in your documents with any processing of sensitive personal information depending on the services you add. Simply click Enable disclosures for Users Residing in the United States from within the Generator.

            Want to know more about the easy ways iubenda can help comply? Click here →

            📌 Notice at Collection

            Do I need to provide a notice at collection? 

            If your business collects consumers’ personal information or sensitive personal information you must provide them with a notice at or before the collection of data. 

            The notice at collection gives users a tool to control how your company uses their personal information and sensitive personal information, informing users, among others, about:

            1. the categories of personal information and sensitive personal information, if any, collected from them; 
            2. the purposes for which personal information and sensitive personal information are collected or used; and 
            3. whether the information is sold or shared.

            Where should the notice at collection be available?

            The Notice at Collection must be displayed where consumers can easily see it at or prior to the moment of collecting any personal information. For example, by including a link to the notice on your website’s homepage and all web pages where personal information is collected.

            👉 You must provide a conspicuous link on your site’s home page and on every page where personal information is collected.

            👉 For Webforms, use a conspicuous link to the notice in close proximity to the fields in which your users input their personal information or in close proximity to the button by which your users submit their personal information.

            👉 If you collect personal information through a mobile application, provide a link to the notice on the mobile application’s download page and within the application, such as through the application’s settings menu. 

            What should the notice at collection include?

            The notice at collection should include, according to the CPRA:

            • a list of the categories of personal information and sensitive personal information that will be collected;
            • the purpose(s) for which the categories of personal information and sensitive personal information are collected and used;
            • whether each category of personal information and sensitive personal information is sold or shared;
            • the retention period for each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine such period;
            • if the business sells or shares personal information, a link to the notice of right to opt-out of sale/sharing; and
            • a link to the business privacy policy.

            The iubenda Privacy Policy and Privacy Controls and Cookie Solution can easily help you display a “Notice at Collection” link for your users residing in California, as required by the law. You simply have to enable the US State Laws option. 

            💡Make sure you enable the privacy widget, which will be displayed on every page of your website after your user has set their preferences. This allows the user to easily update their privacy preferences once they’ve been set.

            📌 Consumer Privacy Rights Have Been Expanded

            Below are four consumer privacy rights from the CCPA that the CPRA has updated.

            1. Right to Opt-Out of Third-Party Sales and Sharing: 
              1. CCPA – Under the CCPA, customers have the option to opt out of companies selling personal data.
              2. CPRA – In addition to selling, the CPRA broadens this right to include the sharing of personal information.
            2. Right to know 
              1. CCPA – Under the CCPA, companies must reply to consumer requests for personal information obtained during the previous 12 months.
              2. CPRA – Under some conditions, the CPRA extends this period, allowing consumers to seek personal information gathered after the previous 12-month limit. Businesses must inform consumers about their right to request disclosure about what personal information is sold or shared and to whom;
            3. Right to delete
              1. CCPA – California residents can use the CCPA to request that a company remove their personal information if it is no longer required to satisfy one of the objectives specified in Cal. Civ. Code Sec. 1798.105
              2. CPRA – Businesses must inform consumers about their right to request the deletion of their personal information and grant such requests unless the information is reasonably necessary for the business to complete the transaction, fulfill a warranty, recall a product or ensure security and integrity.
            4. Right to data transfer
              1. CCPA – Contains a “right to know,” which implies that customers have the right to get a copy of their personal information by mail or online.
              2. CPRA – A customer can now request that a business transfer certain personal information to another organization.

            Now we’ve been through the four changes from the CCPA’s consumer privacy rights, let’s go through the four additional consumer privacy rights added by the CPRA: (not included in the CCPA)

            1. Right to Correct Information: A consumer has the right to request that any incorrect personal information provided by a company be corrected.
            2. Right to Restrict Use and Disclosure of Sensitive Personal Information: A consumer has the right to restrict the usage and disclosure of their SPI to “use that is necessary to execute the services or deliver the products reasonably expected by an ordinary consumer who requests such goods and services.”
            3. Access to Information On Automated Decision Making: A consumer has the right to obtain “meaningful information about the logic involved in such decision-making processes, as well as a description of the process’s expected outcome with respect to the consumer.”
            4. Right to Opt-Out of Automated Decision-Making Technology: A consumer has the right to opt out of automated decision-making technology.
            What does this mean for my business?

            Businesses must ensure that they are prepared to comply with the new and enhanced consumer privacy rights included in the CPRA.

            They will need to establish solid systems and controls to guarantee that they are capable of and prepared to respond quickly to customer requests. To prepare for CPRA compliance, many firms may need to make major modifications to their existing security and privacy measures, recruit extra people, or contract third-party services.

            👉 Please note that under the CPRA, companies are required to wait 12 months after a consumer has denied selling or sharing their personal information before seeking another approval of consent.

            👉 Moreover, as a business, you must provide consumers with two or more methods for submitting their requests. These methods can vary from business to business, but must include, at a minimum, a toll-free number and, if the business has a website, the website address. However, a business can avoid providing a toll-free number if: it “operates exclusively online”; and if it has a “direct relationship with a consumer from whom it collects personal information”.

            📌 Rights for minors

            The CPRA requires you to comply with the COPPA, which governs children’s privacy rights, with specific reference to the sale and sharing of children’s personal information.

            Therefore, if your business is selling or sharing the personal information of consumers:

            • under the age of 13, your business must obtain and maintain records that the consent to the sale or sharing of the children’s personal information comes from their parents or guardians.
            • from the ages of 13 to 16, your business must allow users an option to opt-in to the sale or sharing of their personal information and maintain records of the opt-in. When your business receives a request to opt-in, you are required to inform the user of their right to opt-out. 

            📌 Incorporating GDPR Principles 

            The following concepts are not part of the CCPA, but they are now codified as part of the CPRA:

            • Data minimization
            • Purpose limitation 
            • Storage limitation 
            What does this mean for my business?

            By explicitly codifying these principles in the CPRA, California has empowered the state regulator to enforce and potentially penalize businesses that fail to:

            1. reasonably limit the collection of personal information to what is necessary for the purpose for which it was collected, and;
            2. limit personal information’s retention to the shortest amount of time necessary to fulfill the purpose for which it was collected.
            3. As a consequence of these principles, the CPRA includes a new requirement. Opt-in permission is required following a previously decided Opt-out. Your businesses must allow consumers:

              1. to opt-in to the sale/sharing of their personal information after opting out; and 
              2. notify consumers that opted out of the sale/sharing of personal information whenever consumers initiate a transaction/attempt to use a product implying the sale/sharing of personal information, that the action requires the sale/sharing of personal information, and provide instructions on how to opt-in.

            📌 Expansion of Legally Actionable Data in a Breach

            CCPA – In the case of a data breach, consumers have the private right to sue if their nonencrypted or nonredacted personal information is disclosed due to a business’s failure to establish adequate security measures and practices relevant to the nature of the information handled. 

            CPRA – The ‘right’ does not change direction; it does add consumer login passwords to the list of personal information categories that may be actionable under the statute.

            What does this mean for my business?

            The CPRA’s broadening of its scope to include login credentials as a legally actionable personal information security breach might be a reaction to the current surge of authentication attacks impacting customers. Many companies may choose to mandate multi-factor authentication as an additional security layer in addition to more advanced levels of data encryption.

            📌 Opt out requirements 

            Under the CPRA, it should be noted that businesses must also allow and process consumers’ Opt-out Preference Signals.

            Opt out preference signal means a signal that is sent by a platform, technology, or mechanism, on behalf of the consumer that communicates their choice to opt out of the sale and sharing of personal information. The signal will automatically opt out for all websites the user visits without them having to make individual requests. 

            💡 Did you know iubenda’s Privacy Controls and Cookie Solution automatically detects and honors opt out preference signals like the GPC and GPP, as mandated by the CPRA? With this feature, users can effortlessly rely on our solution to manage these signals without needing to take any extra steps.

            📌 Privacy Policy 

            The CPRA adds to the requirements of the CCPA. Here is the full checklist of information that you must include in your privacy policy. 

            Include the categories of personal information that your business has sold or shared with third parties in the last 12 months, a list of relevant third parties, and your business’s purpose. You also need to disclose if you have not sold or shared users’ personal information within the last 12 months.
            Add a statement regarding whether or not your business knows it sells or shares the personal information of users under the age of 16.
            Include the categories of personal information that your business has disclosed (for business purposes) to third parties in the last 12 months, a list of relevant third parties, and your business’s purpose. You shall also disclose if you have not disclosed consumers’ personal information in the preceding 12 months.
            State whether or not your business uses or discloses sensitive personal information for purposes other than those specified in the act.
            Provide any links to online request forms or portals so your users can make requests regarding their personal information being collected, disclosed, or sold.
            Provide means for users to request the correction of inaccurate personal information.
            Include, if your business uses or discloses sensitive personal information for reasons other than those mentioned in the act, information on consumers’ right to limit the use or disclosure of their sensitive personal information and how to exercise it.
            Provide information on users’ right to non-discrimination for the exercise of their privacy rights.
            Add a general description of the process your business implements to verify users’ requests to know, delete, and correct, when applicable, including any information the user must provide.
            Explain how an opt-out preference signal will be processed for the user (i.e., whether the signal applies to the device, browser, consumer account, and/or offline sales, and in what circumstances) and how the user can use an opt-out preference signal.
            Provide additional reporting requirements (section 7102 of the regulations) if your business collects large amounts of personal information.

            How can iubenda help you prepare for CPRA?

            The CPRA becomes law on January 1, 2023, and became enforced as of July 1, 2023.

            Please be informed that following the decision of the Sacramento County Superior Court the enforcement of the final regulations issued by the California Privacy Protection Agency has been delayed to March 29, 2024. The decision, however, does not affect the CPRA statutory provisions, which are enforced as of July 1, 2023.

            Our solutions handle the complex technical and legal work, taking the uncertainty out of compliance so that you can concentrate on expanding your company.

            Privacy Controls and Cookie Solution →
            Our Privacy Controls and Cookie Solution will auto-configure to meet the most stringent US legal standards. 

            👉 Simply choose the regions where you and your users are located, and the solution will do the rest!

            Privacy and Cookie Policy Generator →
            Use our Privacy and Cookie Policy Generator to identify services that are active on your website that might:

            1. qualify as a sale under the CCPA; and 
            2. qualify as sharing of personal data under the CPRA;
            3. qualify as sensitive personal information 

            👉 Activate US-specific clauses by clicking “Enable disclosures for users residing in the United States.”

            🚀
            Want to get compliant today?

            If your organization falls under the scope of the CPRA, you should begin looking into compliance solutions that are well-trusted and drafted by lawyers.

            Comply Now

            The post CPRA: Intro to the CCPA 2.0 and how it affects you appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            UK Data Reform Bill and AI Regulation https://www.iubenda.com/en/help/73808-uk-data-reform-bill-and-ai-regulation/ Tue, 26 Jul 2022 13:44:07 +0000 https://help.iubenda.com/?p=73808 UK Data Reform Bill and AI regulations: to encourage innovation and increase public trust in the technology. Background Data Reform Bill  Artificial intelligence (AI) regulation What does this mean for me?  Background The UK government revealed a pair of post-Brexit data reform measures to promote responsible data usage and economic innovation on Monday (July 18th). The government announced the Data […]

            The post UK Data Reform Bill and AI Regulation appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

            ]]>
            UK Data Reform Bill and AI regulations: to encourage innovation and increase public trust in the technology.

              UK Data Reform Bill and AI Regulation

              Background

              The UK government revealed a pair of post-Brexit data reform measures to promote responsible data usage and economic innovation on Monday (July 18th).

              The government announced the Data Protection and Digital Information Bill in the House of Commons. According to a statement from Minister for Media, Data, and Digital Infrastructure Matt Warman, the data protection reform bill will,

              change the UK’s independent data laws.

              The government is releasing a series of proposals to control the use of artificial intelligence at the same time as the new legislation. The UK Department for Digital, Culture, Media & Sport released a press statement that read, 

              “The Bill will seize the benefits of Brexit to keep a high standard of protection for people’s privacy and personal data while delivering around (1 billion pounds) in savings for businesses.”

              Data Reform Bill 

              The proposal was described in detail by Warman, who claimed that it would save businesses “around 1 billion (pounds) over ten years.” In addition to requiring telecom companies to notify the UK Information Commissioner’s Office if unwanted communications are occurring on their networks, the bill would increase fines for non-compliant nuisance calls and texts.

              The Data Reform Bill is divided into six sections: 
              1. data protection; 
              2. digital verification services; 
              3. customer data and business data; 
              4. provisions about digital information; 
              5. regulation and oversight; and 
              6. final provisions.

              When browser-based or comparable solutions are sufficiently developed, the reform will also,

              pave the way for the removal of irritating banners for other types of cookies,” according to Warman.

              👉 Requirements for cookie banner popups for “low-risk activities, such as audience measurement.” are also included.

              The proposal also calls for reforming digital identities, which would,

              give people more security and choice when they want to prove things about themselves online or via apps instead of with physical documents.

              The bill would also loosen some restrictions on using personal data for scientific purposes providing scientists the clarity and confidence they need to move on with “life-improving” and “life-saving” research.

              The bill would regulate how elected officials and politicians use data and how it is shared with national security and law enforcement agencies. “They will provide agencies clarity on their obligations, boosting the public’s confidence in how their data is being used,” said Warman.

              Following public feedback from a year ago, the UK released details of its proposed Data Reform Bill. The future of the UK’s adequacy agreement with the EU has been on everyone’s mind with the proposed changes to its data protection legislation.

              “The EU does not require countries to have the same rules to grant adequacy,” 

              Warman also added in the release on July 18th that “it is our belief that these reforms are compatible with maintaining a free flow of personal data from the European Economic Area.

              Artificial intelligence (AI) regulation

              The UK government released a proposal for different laws and guidelines for AI and machine learning. The latest AI plans are a part of its national AI strategy.

              The six guiding principles of the AI proposal are to ensure that technology is: 
              • used safely;
              • technically secure as intended; 
              • transparent and understandable; 
              • takes into account fairness, identifies “a legal person to be responsible for AI,”; and 
              • makes clear the avenues for redress.

              What does this mean for me? 

              This bill is still being discussed and is not yet in force, so there’s nothing you need to do right now. As always, we will keep our eye on the latest updates and ensure that all of our solutions are in line with the latest requirements to help you stay compliant. 

              Since this conversation is ongoing, the UK government welcomes public feedback. If you’re interested in participating in these changes, you can read some of the questions the policy paper has opened below.

              1. What are the most important challenges with our existing approach to regulating AI? Do you have views on the most important gaps, overlaps, or contradictions?
              2. Do you agree with the context-driven approach delivered through the UK’s established regulators set out in this paper? What do you see as the benefits of this approach? What are the disadvantages?
              3. Do you agree that we should establish a set of cross-sectoral principles to guide our overall approach? Do the proposed cross-sectoral principles cover the common issues and risks posed by AI technologies? What, if anything, is missing?
              4. Do you have any early views on how we best implement our approach? In your view, what are some of the key practical considerations? What will the regulatory system need to deliver on our approach? How can we best streamline and coordinate guidance on AI from regulators?
              5. Do you anticipate any challenges for businesses operating across multiple jurisdictions? Do you have any early views on how our approach could help support cross-border trade and international cooperation in the most effective way?
              6. Are you aware of any robust data sources to support monitoring the effectiveness of our approach, both at an individual regulator and system level?

              The 10-week request for evidence is open and closes on September 26th. The UK government has provided this contact for you to send your views: evidence@officeforai.gov.uk

              🚀
              Want to keep updated about news in the UK?

              iubenda will keep you informed of any changes with the UK GDPR and our products will be aligned with any updates made, follow this page →

              See also: 

              The post UK Data Reform Bill and AI Regulation appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Is Google Analytics illegal in the EU and UK? https://www.iubenda.com/en/help/72017-is-google-analytics-illegal-in-the-eu-and-uk/ Wed, 22 Jun 2022 16:00:39 +0000 https://help.iubenda.com/?p=72017 📢 Important Update: EU-US Data Privacy Framework Agreement Reached! 🌍🤝 In light of this significant development, we have updated our coverage to reflect the latest information. To stay up-to-date on the new EU-US Data Privacy Framework agreement and its implications, we invite you to read our latest article on the topic. 🔍 Discover the latest: EU […]

              The post Is Google Analytics illegal in the EU and UK? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              📢 Important Update: EU-US Data Privacy Framework Agreement Reached! 🌍🤝

              In light of this significant development, we have updated our coverage to reflect the latest information. To stay up-to-date on the new EU-US Data Privacy Framework agreement and its implications, we invite you to read our latest article on the topic.

              🔍 Discover the latest: EU to USA Personal Data Transfers Now Approved

              Thank you for your continued support and trust in our coverage of important global issues!

              You might have heard talk of Google Analytics being illegal in Europe or violating the GDPR. Like most things related to privacy, it’s not always that straightforward. We’ve written this post to explain better what all the talk is about, what it might mean so far, and how it could affect you if you use Google Analytics in Europe.

              Based in the UK? Then this post is also relevant to you as the GDPR rules are still applicable in the UK under the “UK GDPR.” 

              In Short

              👉 What happened: Several European data protection authorities have found that Google Analytics’ processing of European user data could result in illegally transferring data outside of Europe. The authorities deemed Google Analytics compliance measures to be insufficient as a result of investigations conducted in relation to the use of Google Analytics 3. Here’s why →

              👉 Google’s response: Due in part to this conversation around the use of Google Analytics, Google released Google Analytics 4 in an attempt to address some of the concerns.

              👉 Do you need to stop using Google Analytics altogether? There’s no direct answer yet as this is a developing case. Some Authorities, like the Italian Garante, have stated that if you choose to continue using Google Analytics, additional security measures must be taken. Google Analytics 4 attempts to address the main concerns, but keep in mind that since the DPA investigations were based on Google Analytics 3, there is, as of yet, no way to know definitively if the Authorities will consider the use of GA4 to be enough. More info on what you can do here → 

              What is the legal reasoning behind the Google Analytics decision?

              To understand the most recent decisions that have impacted Google Analytics 3, we have to look back to the Schrems II verdict published by the European Union’s Court of Justice in July 2020.

              Schrems II declared the “Privacy Shield” invalid. The Privacy Shield framework allowed and validated transfers between the US and the EU. Since the framework was declared invalid, any data transfers between the EU and the US are prohibited unless participants, such as data controllers or processors, take additional measures to meet European standards of adequacy (for the protection of data). 

              You might be asking yourself why EU-US data transfers are prohibited unless extra precaution is taken? The reason for this hinges on the CLOUD ACT, which requires US-based companies, such as Google Analytics, to transmit data in their possession, custody, or control to US government agencies, regardless of whether the data is stored inside or outside the US.

              The French, Austrian, Danish, and Italian Data Protection Authorities (DPAs), found that Google Analytics’ processing of European user data could result in illegally transferring data outside of Europe. The mentioned European DPAs carried out these investigations in collaboration and in response to a number of complaints.

              As a result, the authorities deemed Google Analytics 3 compliance measures insufficient.

              By-country breakdown

              Follow this evolving case law and watch the latest decisions unfold below:

              We will keep updating this post as the situation develops. Last updated: September 2022

              Update: On the 27th and 28th of September, the Italian Data Protection Authority published the decisions issued on the 7th and 21st of July against IlMeteo S.r.l. and Fastweb S.p.A. concerning the use of Google Analytics. The decisions only concern the use of Analytics 3 (GA 4 could not be taken into account because the complaints were made prior) and contain the same grounds as the first decision issued by the Garante on 9.6.2022.

              As in the first case, the Italian Authority concludes with a warning and an order to comply within the 90-day period, taking appropriate additional measures. Otherwise, the Garante may issue an order suspending the flow of personal data to Google LLC.

              On 23rd June 2022, the Italian DPA (Garante) has agreed with The French, Austrian and Danish DPAs, releasing a decision ordering the organization involved in the proceeding to verify that their use of cookies and other tracking tools comply with data protection regulations, with particular attention to Google Analytics 3 and similar services.

              Websites using Google Analytics 3, without the safeguards provided by the EU Regulation, violate data protection law as user data is transferred to the United States, a country without an adequate level of protection.

              Key points

              👉 The Garante made this decision at the conclusion of a thorough investigation.

              👉 The investigation revealed that organizations using Google Analytics 3 collect data, through cookies, on how users interact with those websites, including the specific pages visited and the services used.

              👉 The IP address of the user’s device, details about the browser, operating system, screen resolution, selected language, and the date and time of the website visitors are among the several pieces of data gathered. It was emphasized in the Guarantee decision that IP address is personal data and that even if it were abbreviated, Google would still be able to read it with other data and capabilities it has. This is why the processing was declared unlawful.

              The French DPA (CNIL) released a decision on February 10th, 2022 ordering a French website manager to comply with the General Data Protection Regulation (GDPR) and to discontinue the use of Google Analytics 3.

              CNIL has recently published FAQs on the topic. The CNIL posted this document on its site to clear any doubts regarding the decision made on February 10. However, they haven’t added anything new to what has already been announced in the Authority’s decision.

              Key points

              As far as the FAQs are concerned, there are no particular changes to what the Authority already stated in its decision of 10.2.2022. It is just that the arguments have been reported in a more schematic manner:

              👉 the additional measures put in place by Google Analytics 3 are not sufficient to prevent access by US government agencies under the CLOUD Act;

              👉 the website operator has one month to discontinue the service and opt for another service that is compliant;

              👉 a proxyfication method can be considered, which allows, when properly configured, to send only pseudonymized data to a server located outside the EU.

              The Austrian DPA (DSB) published a decision on April 22nd, 2022 in which they found an unnamed EU website operator in violation of Article 44 of the GDPR.

              Key Points

              👉 The DSB explained that by using Google Analytics 3, the website operator gave Google LLC access to browser information, IP addresses, and unique user identification numbers.

              👉 Although the website operator acknowledged that Standard Contractual Clauses (SCCs) had been reached with Google LLC, the DSB determined that these SCCs did not offer an acceptable level of protection in accordance with Article 44 of the GDPR.

              👉 The DSB determined that Chapter V of the GDPR could not be implemented when using Google Analytics 3. The website operator had stopped using the tool before the complaint procedure was over, so it was not necessary to use its enforcement powers in this case.

              In a press release from the Danish DPA (Datatilsynet), the authority has said,

              if you use Google Analytics, you must put in place a plan to bring your use of (Google Analytics) into compliance by implementing supplementary measures.

              They mention the use of pseudonymization as one possible technical measure that may be relevant when using Google Analytics. Datatilsynet also points to the guidance created by The French Data Protection Authority for organizations wishing to establish effective pseudonymization by means of a so-called reverse proxy.

              Key points

              👉 On the basis of the Austrian judgment as well as the other expected decisions regarding the use of Google Analytics, the Danish Data Protection Agency plans to prepare a summary, indicative text.

              👉The Datatilsynet emphasized the need for authorities to share a common understanding of the decision because it involves a set of shared European rules.

              On 15 December 2022, the Spanish Data Protection Authority issued a decision in response to one of the complaints filed by NOYB concerning the unlawful use of Google Analytics.

              The Spanish Authority takes a different approach than other DPAs in transferring personal data when using Google Analytics, as the decision is based on the limited use of Google Analytics by the company involved.

              👉 Unlike previous decisions, the Spanish DPA did not order the company to stop using Google Analytics or to use a tool that does not involve a transfer outside the EU.

              Instead, the Authority concluded that there was no evidence of a breach of the GDPR and decided not to pursue the investigation and sanction either the company or Google. In particular, the Authority argued that the company stopped using Google Analytics shortly after becoming aware of the Schrems II ruling and did not process data to identify website users.

              Furthermore, the authorities found that, prior to the discontinuation, the use of the service was compliant as it was carried out on a limited level and in view of the following factors:

              1. the company involved is a non-profit public body, and its website did not use Google Analytics for commercial or business purposes;
              2. its website only uses the free version of Google Analytics;
              3. the service was only used to analyze statistical information;
              4. the processing involved aggregated information that does not allow users to be identified; and
              5. the processing did not include personal data, as users’ IP addresses were not processed.

                Given the above, the Authority ruled out the offense because the company did not transfer the personal data of EU users to the US, precisely since it did not process the data.

                What does this mean for you

                The Spanish DPA’s ruling cannot be considered conclusive as the jurisprudential and political scenario remains in flux. Therefore, upcoming developments still need to be monitored.

              The Norwegian data protection authority, Datatilsynet, has issued guidance on website analytics and tracking which includes but is not limited to: the maintenance of compliance with the GDPR, minimization of data collection and the avoidance of personal data flow to unsafe third countries. 

              This guidance follows the release of Datatilsynet’s decision on Google Analytics in response to a complaint lodged by noyb against the telecommunication company Telenor ASA in relation to its website, telenor.com. Datatilsynet concluded that “when the website used Google Analytics, personal data was transferred to the United States in violation of the rules. In other words, the use of Google Analytics was illegal.” It therefore issued a reprimand “to Telenor for having transferred personal data to a third country without complying with the conditions laid down in Chapter V GDPR, in violation of Article 44 GDPR.

              Datatilsynet has also considered that the EU-US DPF now makes it easier to legally transfer personal data to self-certified companies in the United States, which also includes Google. However, the DPA does not rule out that there may be other privacy challenges with the tool and therefore directs users to its newly issued guidance.

              Press Release here →

              What is different about Google Analytics 4?

              Due in part to this conversation around the use of Google Analytics, Google released Google Analytics 4 in an attempt to address some of the concerns.

              • Google Analytics 4 uses IPs at first to decide where to store users’ other personal data (the server or data center depends on the user’s IP). It then eliminates IP addresses completely in an attempt to mitigate the problem of transferring European data to the United States.
              • Google Analytics 4 will also offer country-level controls and customization options to allow you to minimize the collection of user-specific data.

              For more detailed information on Google Analytics 4 see here.

              What action do I need to take?

              As it is still difficult to gauge the impact of the decision on Google Analytics, it is up to each business to decide on which action to take. 
              Since the main issue at hand is the transfer of European data to the US and the potential risks involved, in general, it could be a good idea to:

              • switch to a non-US based Analytics company, or
              • if you choose to continue using Google Analytics, you should upgrade to GA4* and implement additional measures using the available settings.

              *Please be aware, however, that since the DPA investigations were based on Google Analytics 3, there’s as of yet no way to know definitively if the Authorities will consider the use of GA4 to be enough.

              If you choose to continue using Google Analytics, here are a few things you can do to bring you closer to compliance:

              1. You can limit data gathering by using Google’s extensive privacy controls, ranging from restricting advertising features to fully deactivating data collection. 
              2. An internal assessment of Google Analytics can be used to determine whether some or all metrics are appropriate for your company. Google Analytics 4 now provides the option to: turn off the collection of Google Signals data based on geographic area and turn off the collection of granular data on location.
              3. In light of CNIL’s FAQs on this topic, it’s worthwhile mentioning proxy servers. Using a proxy server to avoid direct contact between the user’s computer and Google Analytics might be possible.

              FAQs

              Data Protection Authorities found that data transfers to the US don’t have the same protection standards as in the EU.

              The situation stems from a set of U.S. laws that allow government organizations to request access to consumers’ personal data from US-based services, regardless of where the data centers or servers are located.

              In light of this, NOYB filed 101 complaints with European DPAs to find that transferring European users’ data to the U.S. was unlawful. The decisions, which have noted the illegitimacy of the transfers, focus on the analysis of additional technical, contractual and organizational measures.

              The use of an encryption key by the company in question was deemed insufficient as the key was owned by Google LLC. From this, it follows that as long as the encryption key remains accessible to the importer (in this case, Google Analytics), the measures taken cannot be considered appropriate.

              Furthermore, contractual and organizational measures are not evaluated because the others are always considered insufficient if technical measures are missing.

              Based on the decisions issued so far, we can assume that the possible legal consequences are as follows:

              1. Receiving an order to identify additional technical measures within 60 (CNIL) or 90 days (Garante).
              2. Receiving an order to discontinue the service and replace it with another.

              Please note that to date, no economic sanctions are being issued for the use of Google Analytics.

              *As always, we’re following this evolving case and will keep this post updated with the latest developments. Bookmark this post to make sure that you don’t miss an update!

              The post Is Google Analytics illegal in the EU and UK? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              UK GDPR Post Brexit Updates https://www.iubenda.com/en/help/71983-uk-gdpr-post-brexit-updates/ Wed, 22 Jun 2022 15:09:31 +0000 https://help.iubenda.com/?p=71983 Please note that this Bill is not in force yet; iubenda will keep you informed of any changes and our products will be aligned with any updates made. Update: The UK government released a proposal for different laws and guidelines for AI and machine learning. See here for more on the UK Data Reform Bill […]

              The post UK GDPR Post Brexit Updates appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              Please note that this Bill is not in force yet; iubenda will keep you informed of any changes and our products will be aligned with any updates made.

              GDPR Post Brexit

              Update: The UK government released a proposal for different laws and guidelines for AI and machine learning. See here for more on the UK Data Reform Bill and AI Regulation.

              Following a public consultation, the UK has released details of its proposed Data Reform Bill, which will alter the privacy framework in the UK’s post-Brexit version of the GDPR

              The revisions include, among other things, a revamp of the national DPA (ICO) and a restriction on the number of rules that can be applied to: 

              • cookies;
              • DPO meetings; and 
              • the need to conduct DPIAs.

              The UK government has long claimed that the GDPR’s lack of clarity made obtaining consent from individuals

              “a box-ticking process”

              with the current approach disproportionately burdening small enterprises.

              The government has intimated that the Data Reform Bill will eliminate the requirement for organizations to obtain explicit consent before processing personal data on every occasion; however, it hasn’t specified how this will be implemented. The new data protection guidelines, however, will be based on results rather than the letter of the law, according to the report.

              1. The Bill will target pop-up cookie consent boxes. 
              2. An opt-out mechanism will be adopted as part of the new ideas, with the goal of minimizing the requirement for users to click through consent banners on every page.
              3. The Bill eliminates the balancing criteria for data usage based on a list of legitimate interests. When an interest appears on the list, it will be regarded as legitimate.

              “The government emphasizes the need to remove unnecessary barriers to cross-border data flows, notably by advancing an ambitious program of sufficiency evaluations,” according to the report.

              The United Kingdom has expressed a desire to form new data partnerships with countries such as the United States, Australia, Singapore, and the Republic of Korea. This has raised concerns in Brussels; if EU-UK data flows continue in lockstep, EU citizens’ data may be transferred to third countries with relaxed privacy standards.

              Additionally, nuisance call companies might face fines of up to £17.5 million. The maximum financial penalty for cold callers will be increased from £500,000 in accordance with the GDPR (PECR).

              Some organizations will not need to designate a data protection officer (DPO) or complete data protection impact assessments (DPIA) when developing new products or services under this new method.

              On the other hand, organizations will still need to implement a privacy management program to guarantee they are held accountable for handling personal data.

              See also

              The post UK GDPR Post Brexit Updates appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Third party vs Data Processor https://www.iubenda.com/en/help/66232-third-party-vs-data-processor/ Thu, 21 Apr 2022 15:59:15 +0000 https://help.iubenda.com/?p=66232 Third party vs. data processor: how to differentiate them? There are some key differences you need to understand when it comes to data protection. One of these is the distinction between a data processor and a third party. It’s fundamental to understand it, especially if you are a website or app owner. For example, you may be required […]

              The post Third party vs Data Processor appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Third party vs. data processor: how to differentiate them? There are some key differences you need to understand when it comes to data protection. One of these is the distinction between a data processor and a third party.

              It’s fundamental to understand it, especially if you are a website or app owner. For example, you may be required different legal documents to make sure you’re complying with the applicable law

              So let’s jump straight to definitions!

              What is a data processor?

              According to the GDPR, a data processor is: 

              a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

              Data controllers (i.e. the website or app owner) often rely on external suppliers to provide services or other features in their website. These suppliers are the data processors, and they take on the duty of processing personal data on behalf of the data controllers and following their direct instructions.

              The data processor does not set the purposes for which the data is used, and therefore only processes the data on behalf of the controller (not for the processor’s own interest).

              Some examples of processors include your website host, or email management platforms like Mailchimp.

              To ensure the processing is carried out lawfully, the data controller and data processor govern their relationship with an agreement called Data Processing Agreement (DPA). This contract will specify the rights and responsibilities of each party.

              What is a third party?

              On the other hand, the GDPR defines a third party as:

              a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

              The definition may not seem so different from the previous one, but there is a key difference: a third party does not process personal data on behalf of the controller. Instead, they simply receive your users’ personal data and are authorized to process it as they want. Thus, they don’t need to follow the controller’s instructions.

              Furthermore, third parties may set their own purposes for which the user data is used and therefore may process user data in their own interest.

              Some examples of third parties might be social plugins and media display services on your website.

              Be careful, though! You can’t just simply transfer personal data to third parties. You need a valid legal basis to do so. For many cases, the legal basis may be your users’ consent, which must meet specific requirements.

              Third party vs data processor: practical examples

              Now let’s take into consideration some practical examples, to understand the difference even better. 

              Example of data processor

              You are a business owner who wants to create a website for his activity. However, since you don’t have the expertise to create a website from scratch, you decide to rely on a web agency, which will create the website and take care of legal compliance, too. 

              ➡ In this case, the web agency is a data processor. 
              So what you’ll need to do is to sign a Data Processing Agreement, with all the relevant instructions on how you intend to use the data you will collect through your website. 

              Example of third party

              You use social media plugins on your website to increase the reach of your content. In this way, it will be much easier for your users to share an article you wrote. However, when you set up social media plugins, you accept to send back to social media platforms some of the information you’ve directly collected. These platforms then may use this information for their own purposes. 

              ➡ Social media here are third parties, and you’ll need to take all the necessary steps to ensure you’re complying with the law.

              Do you have a complete privacy policy?

              The above-mentioned third parties need, by law, to be listed in your document.

              👉 Check out what info should be included in your privacy policy!

              The post Third party vs Data Processor appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              What are trackers? https://www.iubenda.com/en/help/64227-what-are-trackers/ Wed, 23 Mar 2022 12:12:01 +0000 https://help.iubenda.com/?p=64227 Have you ever looked for something to buy online and then ads for that same thing would pop up everywhere? Well, that’s because of trackers. But what exactly are trackers? Is there a difference between trackers and ad trackers? How can using them affect your online business? In this short post, we’ll answer all these […]

              The post What are trackers? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Have you ever looked for something to buy online and then ads for that same thing would pop up everywhere? Well, that’s because of trackers.

              But what exactly are trackers? Is there a difference between trackers and ad trackers? How can using them affect your online business?

              In this short post, we’ll answer all these questions! Jump to →

              what are trackers

              🔍 What are trackers?

              Trackers are scripts that websites install on your device.

              They can have different purposes. Some of them are meant to give you a more enhanced experience of the website you’re visiting. For example, they can remember your username and password or the items you’ve added to your cart during online shopping.

              Others can track your online behavior to give you targeted advice, like the ads we’ve mentioned earlier.

              Cookies and trackers: is there a difference?

              Not really. Cookies are a type of tracker.

              More specifically, cookies are small data files generally stored on a user’s computer/browser. Every time you go back to a website you’ve already visited, cookies remember your preferences (such as your password).

              💡 Cookies are usually divided into first-party and third-party cookies.

              • First-party cookies are those managed directly by the owner of the site/app.
              • On the contrary, third-party cookies are managed by third parties and enable their services. Typically, third-party cookies are present when a site/app uses third-party services to incorporate images, social media plugins, or advertising.

              What about ‘similar technologies’?

              Alongside cookies, you may have heard the expression “similar technologies.”

              Even though cookies are the most popular of trackers, they aren’t the only ones. Mozilla has listed some of the most common:

              • Embedded scripts: these trackers are embedded as visible or invisible elements on a web page, like pixel tags and tracking pixels. Pixel tags are short snippets of code that collect information about your browsing activity.
              • Fingerprinters: these are one of the most complex. Fingerprinters can record your online behavior and the configuration and settings of your device: what browser you use, what’s your operating system, or your screen resolution. In this way, they can create your unique profile, just like your fingerprint.
              👉 So, if you’re running an online business – be it a simple website, an app, or e-commerce – you are probably using trackers.

              That’s why it’s useful to know more about how trackers work and how international privacy laws regulate their specific usage.

              For example, the European Union issued the ePrivacy Directive – also known as Cookie Law – which establishes provisions for the protection of the electronic privacy of EU-based users. Though the Cookie Law was first enforced in 2002, it still applies today, complementing the GDPR.

              🔍 Is there a difference between trackers and ad trackers?

              As we explained in the paragraph above, not all trackers are advertising ones.

              Let’s take cookies, for instance.
              While there are cookies that are essential to the functioning of a website (the so-called “technical cookies”), there are also others – usually third-party ones – that are installed by ad networks. They are responsible for the tailored ads you see when surfing the internet.

              As a website owner, you may want to monetize your website’s traffic through digital advertising. That’s 100% lawful, but you must be aware that there are guidelines to follow.

              To ensure that digital advertising is carried out under the GDPR, IAB Europe created the Transparency and Consent Framework:

              The TCF creates an environment where website publishers can tell visitors what data is being collected and how their website and the companies they partner with intend to use it. The TCF gives the publishing and advertising industries a common language with which to communicate consumer consent for the delivery of relevant online advertising and content.

              You can learn more about the TCF here.

              Yes, there are.

              Let’s take the EU Cookie Law, for instance.

              The Cookie Law requires that every website or app owner who uses trackers should do at least these three things:

              1. inform users that the website uses cookies through a cookie banner;
              2. disclose all relevant details about the usage and purpose of cookies in a cookie policy;
              3. block cookies from running if users’ don’t grant their informed consent.

              Curious to learn more about collecting cookie consent?

              If you need to set up a cookie banner (or have already done so!), make sure to check out this short guide:

              👉 Don’t make these 5 mistakes when collecting cookie consent!

              The post What are trackers? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Global Email Marketing Cheatsheet https://www.iubenda.com/en/help/39705-global-email-marketing-cheatsheet/ Thu, 24 Jun 2021 09:24:00 +0000 https://help.iubenda.com/?p=39705 Where and when you can send legally emails without obtaining prior consent from your users (and without breaking the law) Exclusions Be careful. The following does not apply if: A user has opted out, meaning they have specifically requested not to receive your emails in the past (e.g. by unsubscribing from your newsletter) You promote […]

              The post Global Email Marketing Cheatsheet appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Where and when you can send legally emails without obtaining prior consent from your users (and without breaking the law)
              Exclusions

              Be careful. The following does not apply if:

              • A user has opted out, meaning they have specifically requested not to receive your emails in the past (e.g. by unsubscribing from your newsletter)
              • You promote third-party products or place ads in your emails (sorry, this is called DEM, Direct Email Marketing, and requires consent)

              *NB: The information included in this table is updated in line with the legislations in force as of March 2021. If any changes should occur to these laws, this table will be updated accordingly.

              Countries
               
              Can I send marketing emails to users that have already purchased something
              from me?
              Can I send marketing emails to users that have no connection
              to me (cold emailing)?
              🇦🇷 Argentina

              YES

              YES

              🇦🇺 Australia

              YES

              NO

              🇧🇷 Brazil

              YES

              YES

              🇨🇦 Canada

              YES

              NO

              🇪🇺 European Union

              YES

              NO

              🇬🇧 United Kingdom

              YES

              NO

              🇭🇰 Hong Kong

              YES

              NO

              🇮🇱 Israel

              YES

              NO

              🇯🇵 Japan

              YES

              NO

              🇲🇦 Morocco

              YES

              NO

              🇳🇿 New Zealand

              YES

              NO

              🇸🇬 Singapore

              YES

              NO

              🇿🇦 South Africa

              YES

              NO

              🇺🇸 United States

              YES

              YES

              You can’t go completely wild. 🤷‍♂️ Here are some things that you must legally keep in mind:

              • The contact details of your company (via, for example, a link to your About or Impressum page)
              • The opportunity to opt-out of receiving your emails
              • For EU countries: your emails must relate to services similar to the ones already purchased by the recipient

              Do you have an email newsletter?

              Find out what the legal requirements are for drafting, sending and requiring consent for your newsletter:

              👉 How to Make your Emails and Newsletter Compliant (with Form Examples)

              The post Global Email Marketing Cheatsheet appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Privacy Policy for Windows Apps https://www.iubenda.com/en/help/39254-privacy-policy-for-windows-apps/ Tue, 15 Jun 2021 11:00:07 +0000 https://help.iubenda.com/?p=39254 As per Microsoft’s app submissions guide, if your Windows 10 application or game accesses, collects or transmits any Personal Information, in order to publish your app on the Microsoft Store you need to provide a link to your privacy policy. “You are responsible for ensuring your app complies with privacy laws and regulations, and for […]

              The post Privacy Policy for Windows Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              As per Microsoft’s app submissions guide, if your Windows 10 application or game accesses, collects or transmits any Personal Information, in order to publish your app on the Microsoft Store you need to provide a link to your privacy policy.

              “You are responsible for ensuring your app complies with privacy laws and regulations, and for providing a valid privacy policy URL if required.

              You must indicate whether or not your app accesses, collects, or transmits any personal information. If it does, a privacy policy URL is required. Otherwise, it is optional (though if we determine that your app requires a privacy policy, and you have not provided one, your submission may fail certification).

              To help you determine if your app requires a privacy policy, review the App Developer Agreement and the Microsoft Store Policies.“

              In short
              • Platform requirements aside, under almost all global legislations – and particularly under the GDPR – privacy notices are legally required.
              • If your app handles personal or sensitive user data, you need to add a valid privacy policy in two places: your App’s listing page (in the Microsoft store) and within your app.
              • If applicable, you have to disclose how you treat sensitive user and device data.
              • If your app processes personal data for reasons unrelated to its functionality, you must highlight – prior to the collection and transmission – how the user’s data will be used and collect user consent.
              • If your app is likely to be used by kids, you are subject to additional safety requirements
              • With iubenda you can create a privacy policy (and a Terms and Conditions document) for your app.

              Privacy policy requirements for Windows apps

              While it might seem like a convenient idea to reach for sample privacy policies for apps, or privacy policy templates – this is often a very risky idea. Consider that the exact required contents of a privacy policy depends upon the laws applicable to you and the specific processing activities of your app.

              Failure to meet these critical legal requirements can end up costing you – so it’s always a good idea to ensure that your privacy documents are fully customized to your particular situation.

              Furthermore, for example, if you have international customers, your privacy policy may need to address requirements across multiple geographical boundaries and legal jurisdictions. Therefore, it’s always advisable that you approach your (legally mandated) privacy policy with the strictest applicable regulations in mind.

              What basic information should be included in a Windows app privacy policy?

              Let’s start with the minimum legal requirements. These are the most basic elements that a privacy policy should have:

              • Who is the app owner?
              • What data is being collected? How is that data being collected?
              • What is the Legal basis for the collection? (e.g. consent, necessary for your service, legal obligation etc.) – This is more specifically related to the GDPR and EU Law, however, even if you fall outside of GDPR obligations, under most countries’ legislations, you’ll still need to say why you’re processing the personal data of users.
              • For which specific purposes are the data collected? Analytics? In-app advertising?
              • Which third parties will have access to the information? Will any third party collect data through widgets (e.g. social buttons) and integrations (e.g. Facebook Connect)?
              • What rights do users have? Can they request to see the data you have on them, can they request to rectify, erase or block their data?
              • Description of process for notifying users and visitors of changes or updates to the privacy policy
              • Effective date of the privacy policy

              Terms and Conditions (also called ToS – Terms of Service, Terms of Use or EULA – End User License Agreement) set the way in which your app or its content may be used, in a legally binding way. Not only are crucial for protecting you from potential liabilities, but (especially in cases where something is being sold to consumers) they often contain legally mandated information such as users’ rights, withdrawal or cancellation disclosures.

              Some specific instances where they might be needed are where you:

              • need to make legally required disclosures related to consumer rights (especially withdrawal and cancellation rights);
              • have different user levels (eg. registered vs non-registered);
              • your platform allows users to sell or trade with other users;
              • facilitate or otherwise process payments and/or other sensitive user data;
              • want to set the rules for user behavior and state grounds for termination of accounts;
              • participate in affiliate programs;
              • provide a software or service which can potentially cause harm if misused;
              • would like to have some legally enforceable control over, and set rules about, how your app may be used.

              As an app owner, particular emphasis should be given to account termination clauses, payment conditions and the limitation of liability clauses (and disclaimers).

              Our Term and Conditions Generator helps you to easily generate and manage documents that are engineered to meet the specific requirements of all major app stores and up to date with the main international legislations.

              Example privacy policy for Windows apps

              Here’s an example of privacy policy, created with our generator.

              Article 10.5 of Microsoft Store Policies provides an overview of Microsoft’s privacy guidelines

              “The following requirements apply to products that access Personal Information. Personal Information includes all information or data that identifies or could be used to identify a person, or that is associated with such information or data.

              • If your product accesses, collects or transmits Personal Information, or if otherwise required by law, you must maintain a privacy policy. You must provide users with access to your privacy policy by entering the privacy policy URL in Partner Center when you submit your product.
              • Your privacy policy must inform users of the Personal Information accessed, collected or transmitted by your product, how that information is used, stored and secured, and indicate the types of parties to whom it is disclosed.
              • It must describe the controls that users have over the use and sharing of their information and how they may access their information, and it must comply with applicable laws and regulations. “
              Sharing data with third parties

              According to Microsoft:

              “You may publish the Personal Information of customers of your product to an outside service or third party through your product or its metadata only after obtaining opt-in consent from those customers. Opt-in consent means the customer gives their express permission in the product user interface for the requested activity, after you have:

              • Described to the customer how the information will be accessed, used or shared, indicating the types of parties to whom it is disclosed, and
              • Provided the customer a mechanism in the product user interface through which they can later rescind this permission and opt-out.”

              This means that, if you fall within the scope of the GDPR, you’ll likely also need to maintain valid records of consent.

              How to add a privacy policy to your Windows App

              Our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

              The process is straightforward and intuitive, simply:

              1. Click to add your services
              2. Fill out your web/app owner and contact details
              3. Embed in your app

              1. Add your services

              • If you use Twitter or other auth (=OAuth) services for user management, then add the respective service by clicking “Add a service” then start typing the name of the service you’d like to add. Remember to include all services processing personal information. If you handle user registration yourself, don’t forget to add the “Direct Registration” service.
              • Select each applicable service from the list of suggestions that show up and customize by simply adding the specific types of personal data you collect. Our lawyer-crafted clauses automatically include the relevant user-rights disclosures and service definitions based on your input here.
              • If you’d like to add a custom service clause, simply click the “Create custom service” button and fill out the built-in form.

              2. Fill out your app owner and contact details

              Enter:

              • name and full address;
              • email address.

              Congratulations! Your policy has been created. Simply check that all the details are correct, then embed.

              3. Embed

              As we said above, you have to include a link to your privacy policy within the app and in the Partner Center when you submit your product.

              Within the app

              For apps, direct link or direct text embedding methods are best. Microsoft specifically requires “a link” to the privacy policy, so the direct link method is sufficient in meeting Microsoft’s requirements, however if your app processes user data while offline, be sure to provide users with an in-app offline method of accessing the privacy policy in order to be legally compliant.

              Whichever embed method you choose, remember that you’re required to choose a location that is easily accessible and visible to users.

              Generate your privacy policy for the Microsoft Store

              Start generating

              See also

              The post Privacy Policy for Windows Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Google Play adds new “safety section” to make data collection more transparent https://www.iubenda.com/en/help/38933-google-play-new-safety-section/ Tue, 25 May 2021 15:15:42 +0000 https://help.iubenda.com/?p=38933 Google has officially released the new safety section on Google Play. In this post, we’ll look at the latest changes and what this means for app developers and their users. Under Google Play’s current requirements, App developers are required to inform users about the types of data they collect and whether they share this data with third parties. The Data […]

              The post Google Play adds new “safety section” to make data collection more transparent appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Google has officially released the new safety section on Google Play. In this post, we’ll look at the latest changes and what this means for app developers and their users.

              Under Google Play’s current requirements, App developers are required to inform users about the types of data they collect and whether they share this data with third parties
              The Data safety section is now available on Google Play for all users, starting from late April 2022.

              According to Google, the purpose behind the new safety section is to ensure greater transparency and to make the Google Play Store safer for users.

              In addition to the previous requirements, users can see the new summary on the app’s store listing page. In this section developers can share and highlight safety details, such as:

              • Whether and what data are collected;
              • whether and what data are shared with third parties;
              • the app has security practices, like data encryption and whether users can ask for data to be deleted;
              • whether a qualifying app follows their Families policy;
              • the app has been independently validated against a global security standard (more specifically, the MASVS).

              What does the safety section include?

              The new safety section on Google Play displays all relevant information about collecting and processing users’ data. Users can tap into the summary to see details like:

              • What type of data is collected and shared, such as location, contacts, personal information (e.g., name, email address), financial information and more
              • How the data is used, such as for app functionality, personalization, and more
              • Whether data collection is optional or required in order to use an app
              safety section
              How the new safety looks like. Credits: Play console help
              Images are directional and subject to change

              App developers are responsible for the information displayed in their safety section and must comply with it. 

              What should developers do to comply with Google Play safety section?

              Overall, app developers will need to share their disclosures in the new safety section and have a valid privacy policy in place.

              Google underlines that: “All developers that have an app published on Google Play must complete the Data safety form, including apps on internal, closed, open, or production testing tracks.“

              Even for apps that do not collect user data, developers are required to fill out the form and provide a link to their privacy policy. In this case, the form and privacy policy may indicate that no user data is collected or shared.

              The Data safety form has been available on the App content since October 2021. Developers can submit information in the Google Play Console for review. Starting from late April 2022, the Data safety section is available on Google Play to all users. 

              google play timeline
              Google Play safety section timeline

              By July 20, 2022 all new apps and app updates will be required to have this section approved. New app submissions and app updates will be rejected in Play Console if the form has unresolved issues.

              After the deadline, non-compliance could result in additional enforcement actions, such as the removal of the app’s store listing from Google Play.

              How iubenda can help you to meet Google Play requirements

              iubenda allows you to generate lawyer-crafted, fully customizable privacy policies that are optimized to meet app store requirements. Furthermore, our “simplified” view makes it easier for your users to understand what they’re consenting to and what types of data your app is collecting and processing.

              iubenda's Privacy Policy for Google Play's safety section

              Our Privacy and Cookie Policy Generator helps you easily meet Google Play’s disclosure requirements – just choose the Google Play Store service from within the list of services in the generator and you’re done!

              All our legal texts are periodically updated by our lawyers to ensure that they’re always up to date with the latest legal and third-party requirements.

              Create a privacy policy for your Google Play App

              Start generating

              See also

              The post Google Play adds new “safety section” to make data collection more transparent appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Italy’s new cookie guidelines (and how to comply) https://www.iubenda.com/en/help/31246-italy-new-cookie-rules/ Tue, 22 Dec 2020 15:59:57 +0000 https://help.iubenda.com/?p=31246 On July 10th, 2021, the Italian Data Protection Authority (“Garante Privacy”) approved new guidelines for cookie usage. We’ve created this guide to help you understand these changes and meet them with minimum effort (the deadline for compliance was January 10th, 2022). In short If you or your users are based in Italy, the Italian requirements […]

              The post Italy’s new cookie guidelines (and how to comply) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              On July 10th, 2021, the Italian Data Protection Authority (“Garante Privacy”) approved new guidelines for cookie usage. We’ve created this guide to help you understand these changes and meet them with minimum effort (the deadline for compliance was January 10th, 2022).

              In short
              • If you or your users are based in Italy, the Italian requirements apply to you.
              • Cookie banner
                • “Accept” and “Reject” buttons (or an “x” command with the reject function) are required.
                • Users need to be able to make any granular choice as to the functionalities, the third parties and the categories of cookies to be installed (the implementation details are left to the service provider on purpose, while the guidelines suggest that allowing user choices by grouping is considered a way to achieve the goal).
                • Users must be able to access and edit their tracking preferences at any time after setting their initial preferences.
              • Collection of consent
                • Consent by simple scrolling is no longer valid.
                • Cookie walls are not admitted unless the website offers the data subject an alternative way to access the content or services without providing their consent.
              • Validity period of users’ consent preferences: after requesting consent the first time, at least 6 months must have passed before users can be asked again to give consent.
              • Analytics cookies
                • First-party analytics cookies may be placed without collecting users’ consent (and prior blocking).
                • Third-party analytics cookies may be placed without collecting users’ consent (and prior blocking) only under certain conditions.
              • Proof of consent: you need to prove that you have obtained valid consent according to the standards of the GDPR.
              • Legal grounds other than users’ consent: legitimate interest never constitutes a valid legal basis.
              • See our demo for proper set up.
              • These rules are now in-force (the deadline for compliance was January 10th, 2022).

              📌 Do these requirements apply to you?

              Are you or your users based in Italy? Then Italian requirements apply to you.

              italian data protection authority

              📌 Key requirements and what you need to do

              The banner constitutes a valid mechanism to obtain users’ consent, if a website uses profiling cookies or other tracking tools.

              The Italian Data Protection Authority requires that the banner or, alternatively, an area or window displayed at the users’ first access to a website include the following elements:

              • a short notice on the website’s use of technical cookies and any profiling cookies or other tracking tools, with the relevant purposes;
              • a link to the cookie policy which indicates any other recipients of personal data, the data retention period and the rights of users;
              • if you choose to use continued browsing through a positive, unequivocal action as a form of consent, this must be clearly stated on the banner. Please note, however, that “simple scrolling” is not considered a valid method to collect users’ consent;
              • a link to a dedicated area where users can make any granular choice as to the functionalities, the third parties and the categories of cookies to be installed;
              • a “command” to accept all cookies or other tracking tools; and
              • a “command” to reject all cookies or other tracking tools.

              After users have already set their consent preferences, on subsequent visits to the same website there is no need to present them with the initial banner, but instead, users should have access to the privacy/cookie policy and a dedicated area where they can express their preferences at a more granular level.

              * If a website only installs technical cookies, the banner is not necessary. Information on the use of these technical cookies can be placed on the homepage of the website or in the privacy notice etc.

              💡 How to solve this with iubenda

              Our Privacy Controls and Cookie Solution allows you to activate “Accept”, “Customize”, “Reject” and “Continue without accepting” buttons (the last one can be used as an alternative to the close “x” to continue without accepting and close the banner), per-category consent, list tracking purposes in the notice, explicitly mention the right to withdraw consent and your users to access and edit tracking preferences at any time:

              • Tick the “Explicit Accept and Customize buttons”, “Explicit Reject button” (or “Display a “Continue without accepting” button to allow users to continue without accepting and close the banner”), “List tracking purposes in the notice” and “Explicitly mention the right to withdraw consent” checkboxes in the Privacy Controls and Cookie Solution configurator.
              • Enable the “Per-category consent” option to give users more granular control on which categories of trackers to give consent to. Read the documentation and see our demo for proper set up.
              • Customize the privacy widget to allow users to edit their consent preferences on subsequent visits.

              Take a look at our Privacy Controls and Cookie Solution introduction guide to learn more.

              Scrolling or scroll down is now to be considered unsuitable for the collection of valid consent. The only exception is if scrolling is part of a series of actions that unambiguously indicate the users’ willingness to provide consent.

              The Garante also considers so-called “cookie walls” to be unlawful unless users are offered an alternative way to access the website, content or service without having to provide their consent (to be assessed on a case-by-case basis).

              💡 How to solve this with iubenda

              You can easily deactivate consent on scroll and consent on page interaction (also not allowed) in the Privacy Controls and Cookie Solution configurator. Just deselect “Consent on continued browsing” under “Consent”.

              Users may be prompted to provide consent again only if:

              • consent conditions have changed (e.g. new third-party services have been added or old ones have been taken out); or
              • the website owner has no technical means to keep track of previous consent (e.g. the user has deleted the consent cookie placed on his device); or
              • at least 6 months have passed since the last time you requested their consent.
              💡 How to solve this with iubenda

              The default validity for our Privacy Controls and Cookie Solution is 12 months, which already complies with the Garante’s indications. If you had customized it, scroll our configurator’s “Advanced view” to “Validity period of user’s consent preferences (days)”, and make sure you set it to at least 180 days.

              Analytics cookies

              Cookies are to be identified on the basis of two main categories: technical cookies and profiling cookies.

              The Italian Data Protection Authority also clarifies that first-party analytics cookies may in principle be placed without collecting users’ consent.

              As for third-party analytics cookies, they may be placed without collecting users’ consent only if the following conditions are met:

              • they do not allow for a specific user’s identification (e.g. they only use abridged IPs or they are not assigned to one single device, but to several);
              • their use is limited to a single website or mobile application;
              • the output is not shared or disclosed to third parties;
              • data collected is not enriched with other data.
              💡 How to solve this with iubenda

              If you’re using Google Analytics, take a look at our guides to IP anonymization or Google Consent Mode as valid alternatives to prior blocking for Google Analytics. Anyway, please note that in certain countries (e.g. Belgium, Ireland and the UK) analytics cookies always require consent. As a result, prior blocking remains the safest option.

              The Garante states that the owner of a website is required to prove that they have obtained valid consent according to the standards of the GDPR (see proof vs records of consent).

              💡 How to solve this with iubenda

              The Cookie and Consent Preference Log is now available in our Privacy Controls and Cookie Solution. Click here for more info on how to activate the Cookie and Consent Preference Log within your Privacy Controls and Cookie Solution.

              If you have activated the Cookie and Consent Preference Log, you are already collecting consents in accordance with the new guidelines of the Italian Data Protection Authority.

              You can now request a new consent when preferences are not stored in the log, for example because they were collected before the activation of the Cookie and Consent Preference Log. To do so, just integrate the Privacy Controls and Cookie Solution using the new code available (you will notice the presence of the invalidateConsentWithoutLog parameter).

              In the configurator’s advanced view you will find the option “Request new consent when preference record is not found”.

              You can choose to request new consents immediately (default option, in the code you will have "invalidateConsentWithoutLog": true) or choose a specific date.

              Remember that as of January 10th, only consents registered according to GDPR standards are considered valid, therefore, if you haven’t made these changes yet, you should do so right away.

              The Italian Data Protection Authority explicitly states that cookies (and other trackers) can’t be placed on any legal grounds other than users’ consent or, if the conditions of the “strictly necessary” exception apply (i.e. cookies strictly necessary and solely used to carry out or facilitate the communication or to provide the service explicitly requested by the user) without the users’ consent.

              The website owner’s “legitimate interestdoes not constitute a valid legal basis.

              💡 What you need to do

              If you’ve activated the TCF, you need to make sure the purposes are based on only consent (and not legitimate interest).

              To do this, in the Privacy Controls and Cookie Solution configurator, go into the “Advanced Options” and scroll to “IAB Transparency and Consent Framework”. Under “Restrict Purposes” choose “Consent Only” for active purposes.

              Meet Italy’s requirements in the easiest way!

              👉 Using iubenda already for both your Privacy and Cookie Policy and Cookie Consent?

              Then you only need to go to your dashboard and make sure your configuration is tweaked according to our instructions above.

              👉 Have users in Italy but not using our solutions yet?

              Start using our Privacy and Cookie Policy Generator and Privacy Controls and Cookie Solution to create your Cookie Policy & Cookie Banner and easily meet these cookie consent requirements.

              👉 Cookie Consent Cheatsheet

              Make sure to also check out our Cookie Consent Cheatsheet for a clear overview of the Italian cookie consent regulations. Curious if the Italian regulations are stricter than those of other countries? You can find that out, too.

              Manage cookie consent with the Privacy Controls and Cookie Solution

              Generate a Cookie Banner

              See our demo

              See also

              The post Italy’s new cookie guidelines (and how to comply) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              LGPD Privacy Policy Example https://www.iubenda.com/en/help/27616-lgpd-privacy-policy-example/ Thu, 17 Sep 2020 15:29:18 +0000 https://help.iubenda.com/?p=27616 A privacy policy is mandatory under many privacy laws. Under the LGPD (Brazil’s new General Data Protection Law), companies must include specific disclosures about the processing user data in their privacy policies. This information: Does the LGPD apply to you? The LGPD applies in two scenarios: when you process data process data in Brazil (e.g. via a server); […]

              The post LGPD Privacy Policy Example appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              A privacy policy is mandatory under many privacy laws.

              Under the LGPD (Brazil’s new General Data Protection Law), companies must include specific disclosures about the processing user data in their privacy policies.

              This information:

              • must be made available in a clear, adequate, and notable manner, and
              • should be easily accessible throughout your website/app.
              Does the LGPD apply to you?

              The LGPD applies in two scenarios:

              If your processing activities fall within either category, then the law applies to you.

              What does the LGPD require for a Privacy Policy?

              In order to be compliant, your policy must at the very least contain:

              • the specific purpose of the processing;
              • the type of processing and the duration of the processing;
              • the identity and contact details of the data controller;
              • information about who the data is shared with and why;
              • the responsibilities of any processors or agents that will carry out the processing;
              • the applicable user rights and how they can be exercised.

              Example of an LGPD-compliant privacy policy

              Here’s an example of an LGPD-compliant privacy policy, created with our generator. See the section dedicated to Brazilian consumers and their privacy rights for more details.

              Privacy Policy

              How iubenda can help you create an LGPD compliant privacy policy

              All privacy policies generated with iubenda allow you to be compliant with the LGPD, as they contain the option to easily apply the legal standards defined by the LGPD to Brazilian users.

              With our Privacy and Cookie Policy Generator you can create a beautiful, lawyer-crafted, precise privacy policy and seamlessly integrate it with your website or app. You can simply add any of several pre-created clauses at the click of a button or easily write your own custom clauses using the built-in form.

              Our solution makes it easy for you to meet LGPD requirements, with one-click activation for:

              • Displaying LGPD related language, disclosures, and instructions as legally required.
              • Automatically updating your embedded privacy policy with the LGPD text once activated within the generator – no need to re-integrate the code on your site!

              Make your site LGPD compliant in minutes

              Start generating

              About us

              iubenda

              Achieve LGPD compliance for your site, app and business. Easily manage consent, processing records and more.

              www.iubenda.com

              See also

              The post LGPD Privacy Policy Example appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              What is LGPD and how do you become compliant? https://www.iubenda.com/en/help/26706-lgpd-guide-2/ Wed, 12 Aug 2020 23:19:32 +0000 https://help.iubenda.com/?p=26706 Brazilian General Data Protection Law (LGPD) Guide What is the LGPD, does it affect you, and how do you achieve LGPD compliance? We break it down in easy, understandable terms in the sections below. In short: The LGPD, Brazil’s new General Data Protection Law. The enforcement date is officially September 18th, 2020. The law, while […]

              The post What is LGPD and how do you become compliant? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Brazilian General Data Protection Law (LGPD) Guide

              What is the LGPD, does it affect you, and how do you achieve LGPD compliance? We break it down in easy, understandable terms in the sections below.

              In short:

              What is the LGPD and what does it require you to do?

              The Brazilian General Data Protection Law, the Lei Geral de Proteção de Dados Pessoais (LGPD) can be considered as Brazil’s answer to the GDPR – with the Brazilian law aligning with the European Regulation in many ways, while differing in others. It’s intended to replace or supplement its current dispersed legal landscape (of over 40 federal sector-based norms) with one main regulatory framework.

              The LGPD aims at creating a new legal framework for the use of personal data in Brazil, both online and offline, in the private and public sectors.

              In general, the LGPD requires that you only process personal data for legitimate, specific, explicit and clearly communicated purposes. As with the GDPR, principles of transparency and data minimization (only use the data you need) apply.

              Despite a previous proposal to delay the enforcement date of the LGPD to December, after a vote by the Senate, the delay suggestion was removed from the conversion Bill (PLV) 34/2020. Brazil’s President has since sanctioned the Bill, confirming the LGPD’s enforcement date as September 18th, 2020. In this context, a decree was issued to create the National Data Protection Authority called the Autoridad Nacional de Protección de Datos (ANPD).

              The Brazilian DPA (ANPD) issued an updated version of its “Guidance for Personal Data Processing Agents and Data Protection Officers,” clarifying concepts under the LGPD and previous guidance. Read the updates here.

              Special definitions used below
              • The term “user” here means a natural person whose personal data is processed by a controller or processor (known formally as the holder or data subject).
              • The term “data controller” means any natural or legal person, whether public or private, involved in determining the purpose and ways of processing the personal data.
              • The term “data processor” or “operator” means any person or legal entity involved in processing personal data on behalf of the controller.
              • The term Data Protection Authority (DPA) within this document refers to the Brazilian Data Protection Authority (ANPD)

              For example, an internet company may collect user information via their website and store it using a 3rd party cloud service. In this scenario, the internet company is the data controller and the organization running the cloud service is the data processor.

              Where does the LGPD apply? (Territorial scope of the LGPD)

              As with the GDPR, the LGPD has a territorial scope that extends outside of Brazil. This means that you may have to comply even if you or your business are not based in Brazil. In practical terms, the LGPD applies to you if:

                • your data processing activities are carried out in Brazil (e.g. you use servers based in Brazil);
                • you offer or supply goods or services to persons located in Brazil, regardless of their nationality; or
                • you process data which refer to individuals located in Brazil (even if the person was only in Brazil at the time of the collection of the data and has since changed locations).

              In general terms, you can likely assume that the LGPD will apply to you if you either process the personal data of people located in Brazil or process the personal data of anyone, regardless of nationality, within the Brazilian territory.

              Exceptions of applicability

              Some exceptions of applicability of the LGPD exist, even where the data controller falls within the territorial scope of the law. Those exceptions are listed below. The LGPD does not apply if:

                • the processing of the personal data is carried out by a natural person, solely and exclusively for private, non-commercial purposes; or
                • the personal data are processed solely for one of the following purposes:
                    • journalistic or artistic expression,
                    • academic research,
                    • public safety,
                    • national defense and security,
                    • investigation and prosecution of criminal offenses.

              What is “Personal Data” under the LGPD?

              The LGPD uses a broad definition of personal data. As with the GDPR, personal data within the context of the LGPD is any data that can be linked to an identified or identifiable individual. All in all, it is considered to be personal data any data that relates to an identified or identifiable individual. This includes pieces of data that can be combined with other information to identify any individual.

              What about the LGPD and Anonymized data?

              Truly anonymized data (data that cannot directly or indirectly lead, within reasonable means, to the identification of a person) falls outside the scope of the LGPD. However, if the anonymization process can be reversed or if the data is used for behavioral profiling purposes then the LGPD will still apply.

              Examples of personal data include (but are not limited to) basic identity data such as names, health, genetic & biometric data, web data such as IP addresses, personal email addresses, political opinions, and sexual orientation data.
              Examples of non-personal data might include company registration numbers, generic company email addresses such as info@company.com, and anonymized data.

              Special note on sensitive data under the LGPD

              The LGPD identifies “sensitive” data as being apart from “regular” personal data and applies special rules to this category of personal data. Sensitive data is any data related to racial or ethnic origin, religious belief, political opinion, health or sexual life data; or data that allows the unequivocal and persistent identification of the user, such as genetic or biometric data.

              Since the processing of sensitive data is more likely to expose the user to risk of discrimination, sensitive data must be processed with extra layers of security with very specific legal bases for processing in place.

              In general, you can only process sensitive data if the user (or their parent/legal guardian if the person is a minor) has given consent for the particular processing. Some exceptions apply.

              💡 Tip: you can use the floating menu at the left to jump to the sections you want to read next (e.g. “how to comply”)

              MAIN LGPD REQUIREMENTS AND HOW TO COMPLY WITH THE LGPD

              Key concepts of the LGPD

              Principles of Processing

              The principles for processing data are very similar to those of the GDPR. In particular:

                • There must be a purpose for processing. This means that any data processing activity must be carried out for legitimate, specific, explicit, and clearly communicated purposes – you must not do any additional processing which is not in line with the communicated original purposes.
                • Adequacy. Both the way of processing data, and processed data itself, must be justifiably in line with the purposes of processing.
                • Purpose limitation. This is similar to the concept of data minimalization under the GDPR and simply means you must only process data that is necessary for the fulfillment of your stated purposes of processing.
                • Freedom in exercising rights and free access to information. Users must be able to freely exercise their rights under the LGPD and have unencumbered, easy access to any information about the processing of their personal data – free of charge.
                • Data integrity/quality. You, the data controller, must ensure the accuracy of the data processed and keep it updated and relevant, in accordance with the purpose for processing it.
                • Transparency. Information about your data processing must be clear, accurate and easily available to users. Users must also be able to access information about the third-parties that their data is shared with.
                • Security. Both the data controller and any processors (operators) must be sure to have technical and organizational measures in place that protect personal data from unauthorized access, accidental or unlawful destruction, loss, alteration and unauthorized communication or dissemination.
                • Prevention. It’s the responsibility of both the data controller and the processor to have technical and organizational measures in place to prevent any damage being caused by the processing of personal data;
                • Non-discrimination. No data processing should occur for discriminatory purposes.
                • Accountability. As the data controller, you must comply with the law and must be able to prove it.

              Legal basis for processing data under the LGPD

              Under the LGPD data can only be processed if there’s at least one legal basis for doing so.

              The legal bases are:

                • Consent from the user
                • The fulfillment of a legal or regulatory obligation which applies to the data controller
                • The execution of public policies (where those policies are supported via laws, regulations or contractual agreements)
                • The carrying out of studies by research bodies – where possible ensuring the anonymization of the personal data being used*
                • The fulfillment of a contractual agreement of which the user is a participant (or its precursory activities)
                • The regular exercising of rights in judicial, administrative or arbitral proceedings *
                • The protection of life or physical safety of the user or a third party
                • The protection of health – in a procedure performed by health professionals, health services or the health authority*
                • The legitimate interests of the data controller or third party, except where overridden by the interests, rights, and freedoms of the user
                • Credit protection, including the provisions of the relevant legislation*

              *Not included as a legal basis under the GDPR.

              Consent under the LGPD

              Since consent is such a critical topic and often quite relevant when it comes to online processing, we’ll take a look at the specific requirements for consent under the LGPD below.

              Under the LGPD, consent must be “free, informed and unambiguous”. This means that the consent must not be coerced, the consenting action required of the user should be clear and users must be adequately informed before granting consent. Consent must also be provided for a specific purpose and it must always be possible for users to revoke/ withdraw consent.

              Under the LGPD, consent must be free, informed and unambigious.

              In regards to consent for children under 12, you are required to get specific and prominent consent from a parent or guardian. Consent can be given by a 13 – 18* year old provided that the processing of their personal data is done in their best interest. You must make every reasonable effort (using available technology) to verify that the person giving consent actually holds parental responsibility for the child.

              *Note: In Brazil, the recognized age for full contractual capacity is 18.

              Publicly available data

              Pre-LGPD legislation allowed companies to collect and process personal data made publicly available over the internet or any public source for any reason, however, under the LGPD this is no longer allowed.

              Under the LGPD guidelines, public personal data may only be collected and used in two ways:

                • for the same purpose that the data was originally processed under – in which case the user’s consent in not required; or
                • for a different purpose, strictly where you, the data controller, can legitimately apply a valid legal basis for the processing (more below).

              Note: Due to the above, “scraping” or otherwise collecting publicly-available data for marketing, etc. will likely be limited under the LGPD.

              Sensitive data

              When it comes to the processing of sensitive data, consent can be avoided only if the processing is absolutely necessary for:

                • complying with legal obligation which lies with the data controller;
                • shared processing needed for the public administration to execute legal or regulatory public policies;
                • conducting studies by a research body – ensuring, whenever possible, that the sensitive personal data is anonymized;
                • the protection of the life or physical safety of the user or a third party;
                • health protection, exclusively, in procedures performed by health professionals, health services or a health authority;
                • health supervision in a procedure performed by health professionals or health entities;
                • the regular exercising of rights – including contractual, judicial, administrative, as well as those granted via arbitral proceedings; or
                • fraud prevention and security of the user (e.g. for identification and authentication of registration in electronic systems) – as long as the rights of the users are protected and unless superseded by rights and freedom of the user.

              Children’s data

              Under the LGPD, exceptions to the consent requirement for processing the data of children apply if the processing is needed in order to contact the parents or legal guardians or to protect the child. The data can only be used once and must not be stored, must not be shared with third-parties without the proper consent.

              User’s rights under the LGPD

              Under the LGPD, users (“data subjects”) have the right to:

                • Confirmation. Users have the right to have the existence of processing confirmed.
                • Access. Users have the right to access their data being processed by the data controller.
                • Data portability. Users have a right to the portability of their data to another service or product provider, upon express request, in accordance with the regulations of the national authority and subject to commercial and industrial secrets.
                • Rectification. Users have the right to have their personal data rectified if it is inaccurate or incomplete.
                • Anonymization. Users are entitled to the anonymization, blocking or elimination of unnecessary or excessive personal data, or of any data that is not being processed in compliance with LGPD
                • Deletion. Users have the right to have their personal data deleted if the processing of that data was based on consent.
                • Information. Users have the right to be informed about sub-processors and other third parties that access or process their personal data. Users also have the right to be informed about their consent choices and the consequences of refusing consent.
                • Revocation. Users have the right to revoke or withdraw consent.
                • Bring complaint. Users have the right to lodge a complaint with the Data Protection Authority (DPA).
                • Object. Users have the right to oppose the processing of their personal data where there is non-compliance with the provisions of the law.
                • Request review. Users have the right to request the review of decisions made solely on the basis of automated processing of personal data which affect their interests. This includes decisions used to define their personal, professional, consumer and credit profile, or the aspects of their personality.

              Controller and processor obligations under the LGPD

              Cross-border data transfers

              If you need to transfer LGPD protected data outside of Brazil, there are some guidelines to keep in mind. The LGPD allows the cross-border transfer of personal data if an adequate level of protection of the personal data is provided.

              In practical terms, this means that the transfer is allowed if the receiving country is considered to have a legislation that provides for an adequate level of protection. The assessment of the adequacy level of the receiving country or international organization is made by the Data Protection Authority (DPA).

              If the adequacy level is not met, it may still be possible to transfer the data abroad where one of the following conditions are met:

                • the data controller receives the informed, explicit, prior consent of the user – which must be separated from the other processing purposes and requests;
                • the data controller ensures compliance with LGPD via a dedicated contractual section, standard contractual clauses, or global corporate rules;
                • the data transfer meets standards set via valid certificates and codes of conduct regularly approved by the DPA;
                • the DPA directly authorizes the transfer;
                • the transfer is needed for international legal cooperation between public intelligence, investigation and prosecution bodies (in accordance with international law);
                • the transfer is needed to protect the life or physical safety of the user or a third party;
                • the transfer is needed for enforcing public policy;
                • the transfer results in a commitment made in an international cooperation agreement;
                • the transfer is essential for meeting a legal obligation of the data controller or is necessary for the exercising of rights in Court or arbitration proceedings; or
                • the transfer is needed to fulfil an agreement with the user.

              Data processing records

              Under the LGPD, both data controllers and processors must maintain records of their personal data processing activities – especially when the processing is based on legitimate interest. All controllers and processors – regardless of size, frequency of processing or type of data processed – must meet this record-keeping obligation. However, exemptions may be granted by the Data Protection Authority.

              All controllers and processors must meet this record-keeping obligation.

              Data protection impact assessment (DPIA)

              In essence, a data protection impact assessment (DPIA) is a process used to help the data controller comply with data privacy rules – ensuring that the main principles are effectively met.

              Under the LGPD, the DPIA documentation generally contains the description of the activities of processing personal data that could generate risks to civil rights and liberties, as well as measures, safeguards and mechanisms to mitigate that risk.

              The DPIA document must at least include:

                • a description of the categories of data processed;
                • the methods used to collect the data;
                • the security measures used; and
                • a description of the measures used to mitigate the risks involved in processing the personal data.

              The law does not explicitly state when a DPIA is needed, but the Data Protection Authority can request that a DPIA be performed and provided by the data controller at any time.

              Appointment of a data protection officer

              Under the LGPD, you, the data controller, must appoint a Data Protection Officer (DPO). There are no exemptions to this rule. DPOs are individuals who are responsible for the following:

                • receiving complaints and communications from users, providing clarifications and adopting relevant measures;
                • advising the data controller’s employees and contractors in regards to the measures which must be taken to protect the personal data processed;
                • receiving communications from the DPA and adopting relevant measures; and
                • performing any other duties “as determined by the data controller or established in complementary rules”.

              Data security and data breaches

              Under the LGPD data controllers, processors or any other agent involved in the processing of the personal data must implement security, technical and administrative measures in order to protect personal data from unauthorized accesses and accidental or unlawful destruction, loss, alteration, communication or any kind of illegitimate processing.

              Any security incident that could create risk or damage to users must be communicated within a reasonable timeframe to the DPA.

              The communication must at least include:

                • a description of the nature of the personal data affected;
                • information on the affected users;
                • information about the technical and security measures used to protect the data – subject to commercial and industrial secrecy;
                • the risks related to the incident;
                • the reasons for any delay in reporting the incident to the DPA (in cases in which communication was not immediate); and
                • the measures that were or will be adopted to reverse or mitigate the effects of the damage.

              Upon notification of the breach, the DPA may order the data controller to alert the media, or take other steps to mitigate the damaging effects of the incident.

              Transparency

              As it is with the GDPR, transparency is a core principle of the LGPD. Under the LGPD users have the right to facilitated access to information about the processing of their personal data – which must be made available in a clear, adequate, and notable manner.

              These disclosures include:

                • the specific purpose of the processing;
                • the type of processing and the duration of the processing;
                • the identifying details of the data controller;
                • the controller’s contact information;
                • information about who the data is shared with and why;
                • the responsibilities of any processors or agents that will carry out the processing;
                • the user’s (data subject) rights, with explicit mention of the user rights provided in Art. 18 of the LGPD (mentioned above), how to exercise those rights, and whether any personal data will be processed to respond to a request to exercise those rights.

              Accountability: privacy by design and default

              The LGPD states that both data controllers and processors may put into place internal processes and policies that ensure compliance with the law. This includes a privacy governance program and measures that show its effectiveness.

              The governance program should, as a minimum:

                • show the controller’s commitment to ensure compliance with rules and good practices;
                • be applicable to the entire set of personal data under the control of the particular data processor – regardless of the means used to collect the data;
                • be adapted to the particular structure, scale, and volume of the operations, as well as to the sensitivity of the data being processed;
                • establish adequate policies and safeguards based on a process of systematic evaluation of the impacts on and risks to privacy;
                • have the purpose of creating a relationship of trust with the user via transparency;
                • ensure that mechanisms for the user to participate are integrated into the program’s general governance structure and establish and apply internal and external mechanisms of supervision;
                • have plans and solutions in place for responding to incidents; and
                • be constantly updated based on information obtained from continuous monitoring and periodic evaluations.

              The data controller must be able to demonstrate the effectiveness of their privacy governance program when needed – especially if requested to do so by the national authority.

              Consequences of non-compliance

              UPDATEOn February 27 2023, the Brazilian Autoridade Nacional de Proteção de Dados (ANPD) published regulations for the application of administrative sanctions (In Portuguese) which will empower the ANPD to give sanctions for non-compliance with the General Data Protection Law (LGPD).

              The legal consequences for non-compliance can include fines of 2% of a company’s annual turnover, up to 50 million Brazilian reais (currently roughly €8M or US$9M), per violation. But perhaps equally as concerning are the other potential corrective actions that may be taken against those who are found to be in violation.

              The legal consequences for non-compliance can include fines of 2% of a company’s annual turnover, up to BRL 50 million (€8M)

              Under the LGPD, the Brazilian Data Protection Authority has corrective powers which include issuing warnings and fines, publicizing of the violation, and blocking or deleting the processing activities or personal data to which the infraction refers – this means that if the infraction occurred in regards to email address collection, the offending data controller could risk losing the entire associated email list. The Brazilian DPA may also demand that the database related to the incident be partially suspended for up to 6 months, potentially halting any other activities that might make use of said database.

              Additionally, like the GDPR, the LGPD allows users with a cause of action to seek civil damages (pecuniary or moral) for violation of the privacy law.

              How to comply with the LGPD

              LGPD compliance checklist

              Identify (and document) your legal bases for processing personal data. Data controllers must define a legal basis for each processing activity and document the legal basis in their records of processing.

              Maintain a record of data processing activity (required under Art. 37). While the LGPD does not include specific requirements for the form or content of these records, however, they will likely be similar to the register of processing required under Art. 30 of the GDPR. iubenda makes creating & maintaining data processing records easy. Read more here.

              Include required disclosures in your privacy policy. Required (Art. 9) to meet LGPD transparency requirements. Read about our Privacy Policy Generator’s one-click LGPD disclosure setting.

              Collect and maintain valid proof of consent (required under Art. 8). As it is with the GDPR, under the LGPD the burden of proof to demonstrate valid consent lies with you, the data controller. iubenda makes creating & maintaining consent records incredibly easy. Read more here.

              Appoint a data protection officer (DPO) – required under Art. 41. Under the LGPD, it’s mandatory that all data controllers appoint a DPO, who will then be tasked with the activities mentioned here. Currently, the law does not require the DPO to be physically located in Brazil, and also leaves the possibility open for controllers to appoint third-party individual consultants as their DPO.

              Develop internal policies and procedures for honoring the rights of users and responding to related user requests. Data controllers must reasonably respond to data subjects’ requests to exercise their rights under the LGPD, including access, correction, anonymization, deletion and portability.

              Implement a security protocol. Both controllers and processors must adopt security measures designed to safeguard and protect personal data. The DPA may provide guidelines for minimum technical standards in the future. Other legal frameworks under Brazilian law provide additional guidance related to existing standards, such as Brazil’s Civil Rights Framework for the Internet also known as Marco Civil da Internet (which settles principles, guarantees, rights, and duties for the users of the web in Brazil).

              Develop an incident response and remediation plan (in accordance with Art.50). Controllers and processors must implement an incident response plan that ensures the controller is able to comply with the mandatory incident reporting requirements (see below).

              If a data breach poses significant risk or damage to users, you must notify the DPA and users (in accordance with Art.50).

              Perform data protection impact assessments (DPIAs). DPIAs may be mandatory in situations characterized as risky or, at the request of the authority, where the processing of data is based on legitimate interest.

              Implement privacy by design and default. Under the LGPD, it’s mandatory to put measures in place by default, which guarantee the protection of personal data. In practical terms, the default settings should be those which guarantee the highest protection level.

              Comply with cross-border data transfer requirements. Ensure that you’re aware of any applicable limits on cross – border data transfers and comply with the relevant provisions. More details here.

              How iubenda can help you to comply with LGPD requirements

              In terms of compliance, one of the fundamental steps is ensuring that your documents inline with legal requirements. At iubenda, we take a comprehensive approach to data law compliance. We build solutions with the strictest regulations in mind, giving you full options to customize as needed. We help you with meeting your legal obligations, reduce your risk of litigation and protect your customers —building trust and credibility.

              Here’s what you need to get started with full compliance:

              Privacy Policy

              All privacy policies generated with iubenda allow you to be compliant with the LGPD, as they contain the option to easily apply the legal standards defined by the LGPD to Brazilian users.

              With our Privacy and Cookie Policy Generator you can create a beautiful, lawyer-crafted, precise privacy policy and seamlessly integrate it with your website or app. You can simply add any of several pre-created clauses at the click of a button or easily write your own custom clauses using the built-in form.

              Our solution makes it easy for you to meet LGPD requirements, with one-click activation for:

                • Displaying LGPD related language, disclosures, and instructions as legally required; and
                • Automatically updating your embedded privacy policy with the LGPD text once activated within the generator – no need to re-integrate the code on your siteu0021

              The privacy policy also comes with the option to include a cookie policy (it’s necessary to include it if your website or app is using cookies and has EU users). The policies are customizable to your needs and remotely maintained by an international legal team.

               

              For more information on privacy policies click here.

              Register of Data Processing Activities

              Meeting LGPD regulations can be a technical challenge to implement in practical terms. This is especially true for your register of data processing activities.

              Our solution helps you to easily record and manage all your data processing activities so that you can easily comply with mandatory LGPD requirements and meet your legal obligations. It allows you to create records of processing activity: add processing activities from 1700+ pre-made options, divide them by area (sub-divisions within which data processing activities are the same), assign processors and other member roles, and to document legal bases and other LGPD-required records.

              For a list of the full features of the Register of Data Processing Activities click here or read the guide here.

              Managing consent and maintaining detailed records related to it

              In order to comply with privacy laws such as the LGPD and GDPR, you must keep proof of consent in order to demonstrate that consent was collected in a legally compliant way.

              Our Consent Database simplifies this process by helping you to easily store proof of consent and manage consent and privacy preferences for each of your users. It allows you to track every aspect of consent (including the legal or privacy notice and the consent form that the user was presented with at the time of consent collection) and the related preferences expressed by the user.

              To use, simply activate the Consent Database within your dashboard and get the API key, then install via HTTP API or JS widget and you’re done; you’ll be able to retrieve consents at any time and keep them updated.

              For a list of the full features of the Consent Database click here or read the guide here.

              Privacy Controls and Cookie Solution

              💡 Did you know that The Brazilian data protection authority (ANPD) has published new guidance on cookies? You need to display a cookie banner and ask for your users’ consent before installing non-necessary cookies. For more on this, check out our Brazil: New Cookie Requirements guide here 

              Our Privacy Controls and Cookie Solution is easy to generateu0021 Plus, you can customize your cookie banner, seamlessly collect consent and implement prior blocking with asynchronous re-activation.

              Make your site LGPD compliant in minutes

              Start generating

              Please note that from time to time, laws are amended and updated. It’s therefore important to ensure that your policies meet the latest requirements. For this reason, we use embedding and NOT copy & paste. With this method, you can rest assured that your policy is up to date and being maintained remotely by our legal team.

              See also

              The post What is LGPD and how do you become compliant? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Web agency’s responsibilities according to the GDPR https://www.iubenda.com/en/help/26171-web-agency-responsibilities-gdpr/ Thu, 30 Jul 2020 16:21:31 +0000 https://help.iubenda.com/?p=26171 If a web agency handles personal data on behalf of its clients, it is highly likely that it would act as data processor. For example, this may occur where an agency host clients’ personal data on its own servers or manage clients’ mailing list on behalf of the latter. In these cases, the web agency […]

              The post Web agency’s responsibilities according to the GDPR appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              If a web agency handles personal data on behalf of its clients, it is highly likely that it would act as data processor. For example, this may occur where an agency host clients’ personal data on its own servers or manage clients’ mailing list on behalf of the latter.

              In these cases, the web agency needs to be formally appointed as data processors and it must:

              What’s the difference between data controller and data processor?

              The term “data controller” means any natural or legal person determining the purposes and means of the processing of personal data of its users. It’s the one who determines “why” and “how” the personal data collected should be processed, usually the owner of the site/app (in this case, the client).

              The term “data processor” means any natural or legal person who processes personal data on behalf of the data controller. This is the case, for example, of an agency that runs newsletters or marketing campaigns for its clients.

              Agency duties

              According to the GDPR, these are the obligations of the data processor (agency) towards the data controller (client):

              • The agency is only obliged to process personal data on the client’s documented instructions. This means that the agency must strictly adhere to the client’s processing instructions, which are generally defined for the most part in the data processing agreement mentioned above. The client’s instructions will cover the entire data processing cycle, i.e., from collection to termination of processing. It follows that, once the processing services have been completed, the agency will have to cancel or return the personal data to the client, depending on the instructions given by the client (i.e the data controller).
              • Personal data must be treated with the utmost confidentiality: to ensure this, the agency must ensure that the processing is carried out only by authorized personnel who are bound (or legally bound by) an obligation of confidentiality. Written processing instructions usually fulfill this obligation to employees. These instructions contain clauses on how to process the data and rules on privacy in the course of processing operations.
              • The agency must then ensure that all required security measures are taken and may not resort to using an outside party’s services (e.g. as a sub-processor) without the client’s prior written authorization.
              • The agency’s obligations of assistance and cooperation are fundamental. Through the adoption of appropriate technical and organizational measures, the agency must help the client respond to users’ requests to exercise their rights. Let us suppose, for example, that a user requests the rectification of his email address in a database used to send Direct Email Marketing (DEM). If the agency in charge of the maintenance of the related database and the sending of such emails receives the request of the person concerned, it must immediately inform the client (i.e the data controller) and proceed according to the instructions provided.
              • The agency must assist the client in fulfilling any obligations arising from situations like a data breach, during any prior consultation with the supervisory authority or should a Data Protection Impact Assessment become necessary.
              • The agency must make available to the client all the information in its possession that is necessary to demonstrate the client’s compliance with legal obligations. In doing so, it may not hinder any review activities (including inspections) carried out directly by the client or by any other person commissioned by the client.
              Indemnity and iubenda software

              It should be stressed that an indemnity exonerates the agency from the responsibilities inherent in the “goodness” of iubenda’s products, not from all liability.

              For example, if the agency adds the Google Analytics clause to the Privacy and Cookie Policy and the link to the provider’s privacy policy is wrong, this is iubenda’s responsibility. However, if the agency adds Google Analytics, but the website uses a different service, the burden falls on the agency unless the agency proves to be exempt (for example, if the customer has approved the documents or has explicitly requested the inclusion of that clause).

              Client and agency duties in case of damages to users

              Article 82 of the GDPR is the key rule on civil liability in the processing of personal data and the consequent right to compensation, and specifies that:

              Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

              While the data controller (client) is liable for the damage caused by the processing that violates the GDPR, the data processor (agency) is only responsible for the damage caused by the processing if:

              • it has not fulfilled its obligations under the GDPR, or
              • acted inconsistently or contrary to the client’s (legitimate) instructions.

              The agency might respond in cases where:

              • it transgresses the client’s instructions (even if it exceeds the limits of its competence, in which case the GDPR provides for it to assume responsibility as an independent owner);
              • it does not assist the client (e.g., for data breaches or impact assessment);
              • does not make the necessary information in its possession available to the client;
              • does not inform the customer that an instruction from the customer violates the law;
              • while being obliged to do so, does not appoint a DPO (Data Protection Officer);
              • appoints a sub-processor not previously authorized;
              • appoints a sub-processor who does not offer sufficient guarantees;
              • does not keep a register of processing operations.

              The conditions of exemption from liability

              The customer or the agency can only be exempted from liability if they can prove that the damage is in no way attributable to them (e.g., if it results from a data processing that is not done by them).

              Joint and several liability

              If the damage is attributable to more data controllers or data processors (or both), each of them is jointly and severally liable for the full amount of the incident.

              In this case, the responsible person who has compensated for the damage costs in full (in solidum) can claim each share of remaining compensation corresponding to each share of liability of the rest of the owners or liable parties involved.

              Learn how to make your clients’ sites and apps legally compliant with iubenda

              See also

              The post Web agency’s responsibilities according to the GDPR appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Terms and Conditions for eCommerce (and how they protect your online store) https://www.iubenda.com/en/help/25877-terms-conditions-ecommerce-stores/ Thu, 02 Jul 2020 07:43:53 +0000 https://help.iubenda.com/?p=25877 If you run an eCommerce store, Terms and Conditions are absolutely vital: customers must be made aware of the business owner’s rules relating to return, withdrawal or cancellation policies. What are Terms and Conditions? Terms and Conditions (also known as Terms of Use or Terms of Service) allow you, the owner, to set the way […]

              The post Terms and Conditions for eCommerce (and how they protect your online store) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              If you run an eCommerce store, Terms and Conditions are absolutely vital: customers must be made aware of the business owner’s rules relating to return, withdrawal or cancellation policies.

              Terms and Conditions for eCommerce

              What are Terms and Conditions?

              Terms and Conditions (also known as Terms of Use or Terms of Service) allow you, the owner, to set the way in which your product, service or content may be used, in a legally binding way.

              Does my online store needs Terms and Conditions?

              Everyone from bloggers to eCommerce, SaaS, and Enterprise businesses can benefit from setting Terms and Conditions, however, in some cases it can be mandatory. Terms and Conditions are relevant for avoiding misuse in general, but also specifically correlate to applicable law.

              This brings us to eCommerce stores.

              Not only are Terms and Conditions crucial for protecting you from potential liabilities, but – especially in cases of eCommerce stores – they often contain legally mandated information such as users’ rights, withdrawal or cancellation disclosures.

              A valid Terms and Conditions document is generally required whenever complex issues are at stake, such as in the case of eCommerce, where sensitive information such as payment data is processed.

              In these cases, the Terms and Conditions typically contains legal information related to conditions of sale and disclosures on methods of payment, shipping, delivery, withdrawals, and cancellation conditions etc. – as commonly required by consumer protection regulations.

              What to include in Terms and Conditions for online stores

              Terms and Conditions are fundamental to mount an adequate and proper defense, should the need arise. To protect your online store in a preventative way, a good Terms and Conditions document should contain the following clauses:

              • Identification of the business (seller contact details)
              • Description of the service that your site/app provides
              • Information on risk allocation, liability, and disclaimers
              • Warranty/Guarantee information (where applicable)
              • The existence of a withdrawal right (if applicable)
              • Terms of delivery of product/service
              • Conditions of use/purchase (e.g. age requirements, location-based restrictions)
              • Refund policy/exchange/termination of service and related info
              • Info related to methods of payment

              Where to display Terms and Conditions

              A proper Terms and Conditions document won’t do your business any good if no one sees it: here’s why the best idea is to add it a link to your site’s footer so that it is always visible and accessible.

              In addition to the website’s footer, other advantageous locations to place Terms and Conditions links are signup and checkout forms.

              Example of Terms and Conditions for eCommerce

              The document below is an example of Terms and Conditions for eCommerce created with iubenda Terms and Conditions Generator. Click on the button to open it:

              Terms and Conditions

              Terms and Conditions Generator for eCommerce stores

              Our Terms and Conditions Generator lets you easily generate and manage Terms and Conditions that are:

              • professional;
              • customizable from over 100 clauses;
              • available in 10 languages;
              • drafted by an international legal team; and
              • up to date with the main international legislations.

              Our solution is powerful, precise, and capable of handling even the most complex, individual scenarios and customization needs.

              See it in action:

               

              It comes with:

              • guided set-up;
              • hundreds of possible personalizations;
              • legislation monitoring;
              • plug-and-go integrations for popular store platforms such as Shopify, WooCommerce, Wix, Squarespace and Webflow;
              • pre-defined scenarios: buildable text modules for marketplace, affiliate programs, copyright, eCommerce, mobile, and more.

              Our Terms and Condition Generator is optimized for everything from eCommerce, blogs, and apps, to complex scenarios like marketplace and affiliate scenarios. Read more about it here or start generating your Terms and Conditions below.

              Generate Terms and Conditions for your eCommerce store

              Start generating

              See also

              The post Terms and Conditions for eCommerce (and how they protect your online store) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              GDPR treatment of services that do not collect personal data https://www.iubenda.com/en/help/25229-gdpr-treatment-of-services-that-do-not-collect-personal-data/ Wed, 17 Jun 2020 14:05:09 +0000 https://help.iubenda.com/?p=25229 Some software, services, and widgets do not collect personal data. Should these services still be included in your privacy policy? What about the cookie policy? In this post, we answer these questions and take a look at how the GDPR and ePrivacy relate to services that do not process personal data. Some popular services of […]

              The post GDPR treatment of services that do not collect personal data appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Some software, services, and widgets do not collect personal data. Should these services still be included in your privacy policy? What about the cookie policy? In this post, we answer these questions and take a look at how the GDPR and ePrivacy relate to services that do not process personal data.

              Some popular services of various kinds (such as for analytics or heat mapping purposes) make the claim that their services do not collect personal data. This means that whenever users navigate a website or use an app that such services are integrated into, their personal data is not collected and processed by that service.

              When these claims are usually made in two distinct cases:

              • Where these services actually do not collect any personal data at all.
              • Where the personal data is anonymized before it’s collected in such a way that it doesn’t allow the user to be identified. This anonymization can be done in various ways, for example, by hashing.

              Hashing is a procedure by which given data (such as an e-mail address or an IP address) is processed automatically via an algorithm into a unique sequence of values (numbers and letters). These cryptographic hash functions cannot be reversed: once the hashed output is generated, there is virtually no way to invert the function in order to re-generate the source information. If you’d to know more technical details about this, you can read Opinion 05/2014 on Anonymization Techniques released by the former Article 29 Data Protection Working Party.

              Let’s take a look at how these cases are treated by the GDPR and ePrivacy below.

              📌 Must I mention services that do not collect personal data in my privacy policy?

              There is no need to mention these services in your privacy policy. Articles 13 & 14 of the GDPR (which establish what information controllers must provide to data subjects within their privacy policy) only apply when personal data is collected. Therefore, services that do not collect personal data must not be mentioned.

              Furthermore, considering the general principle of transparency (via Articles 5 & 12 of the GDPR), services that do not collect personal data should not be mentioned – as this could mislead users into thinking that those services do collect and process personal data.

              With consideration to the above, we’ve adopted a policy of not adding such services to the generator. To clarify, these services can still be added as a custom service if you’d like, but we do not offer them as standard (pre-built) integration.

              Which services fall within this category?

              Currently, we’ve determined that the following services fall under this policy:

              📌 Must I mention services that do not collect personal data in my cookie policy?

              The above reasoning does not equally apply to cookie policies. In this case, EU law requires website or app providers to disclose any cookies or similar tracking technologies, regardless of whether they collect and process personal data or not. This approach has been confirmed most recently by the European Court of Justice in its Planet49 decision.

              Therefore, technologies that must be mentioned inside the cookie policy are not just cookies but also similar technologies* that allow for the accessing or storing of information on the user’s device, including – but not limited to -tracking pixels, installed fonts etc.

              Therefore, when using iubenda to generate a cookie policy you will have the option to include such services regardless of whether or not they process personal data.


              *Not sure what cookie “similar technologies” are? Read what the UK’s Data Protection Authority has to say about them here.

              🚀
              5 things you need to do now to comply with GDPR

              How to comply with GDPR? Compliance can be difficult to achieve if you don’t know where to start.
              Here you’ll find 5 easy things you need to do to get GDPR-compliant.

              The post GDPR treatment of services that do not collect personal data appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Is the use of a cookie wall allowed in European Countries? https://www.iubenda.com/en/help/24487-cookie-walls-gdpr/ Fri, 15 May 2020 16:03:33 +0000 https://help.iubenda.com/?p=24487 If you spend time on the internet, you’ve probably come across a cookie wall or a paywall. In this post, we’ll explore whether, under the GDPR, using either method is legally allowed or not. Before we dive into the legal requirements, though, let’s go over what these methods actually are. In short: What is a […]

              The post Is the use of a cookie wall allowed in European Countries? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              If you spend time on the internet, you’ve probably come across a cookie wall or a paywall. In this post, we’ll explore whether, under the GDPR, using either method is legally allowed or not. Before we dive into the legal requirements, though, let’s go over what these methods actually are.

              A cookie wall is a pop-up that blocks your navigation on a website, asking you to accept cookies. The main difference between a cookie banner and a cookie wall is that a cookie wall won’t allow you to navigate the site if you refuse to accept cookies, even the ones that aren’t strictly necessary.

              👉 The cookie wall is a mechanism where the user has only one option to access the website: accept the processing of the cookies. The cookie wall is generally prohibited.

              Since this can affect publishers’ ability to earn, some within the industry have tried to make use of the current “gray area” to shift the landscape to one that is more profitable. One example of this is the so-called “paywall”.

              👉 The paywall is a method where the user is given another option to access the content, for example, to pay or subscribe instead of giving consent for the use of cookies.

              Are cookie walls GDPR-compliant?

              While legislations may vary slightly between EU countries, in general, cookie walls are most likely not allowed as they can be considered contrary to the GDPR’s requirement for “freely given” consent.

              • On a member-state level, some countries such as Germany and Belgium state explicitly that they do not allow cookie walls.
              • Other countries, such as the UK and Ireland, do not yet have definitive statements.
              • The Italian DPA (Garante Privacy) stated in its latest Guidelines on cookies and other tracking tools that the cookie wall is unlawful except when the website provides the data subject with the option of accessing equivalent content or services without giving his or her consent to the storage and use of cookies or other tracking tools – which will have to be verified on a case-by-case basis.

              Are paywalls an appropriate solution?

              The Data Protection Authorities of different EU countries have issued their opinion on paywalls as well.

              Italy 🇮🇹

              As we mentioned in the previous paragraph, the Italian DPA stated that cookie walls are unlawful except when the website provides the option of accessing equivalent content or services without giving consent to cookies.

              As regards paywalls, the Garante published a press release to inform that it’s analyzing this solution as implemented by some Italian publishers.

              France 🇫🇷

              The French CNIL indicated that the paywall system is a valid solution as long as the subscription to the site has a modest and fair cost so that it does not constrain the user’s free choice. The fairness of the cost should be evaluated on a case-by-case basis.

              Austria 🇦🇹

              The DSB issued a decision about the “pay or okay” system adopted by an Austrian media outlet. The system gives users a choice between paying for a subscription or allowing all their data to be processed. DSB said that this choice doesn’t give users real freedom to consent. They also said they are worried about the idea of “blanket consent” where people who can’t afford to pay are forced to give their consent anyway. However, the DSB did not make a decision about whether the “pay or okay” system or the subscription fee of 8 euros per month (96 euros per year) is fair or not.

              The key takeaway from the DSB’s decision is that if a “pay or okay” system is used, users should have the option to give granular consent instead of just a general one. It’s important to note that the DSB reached this decision specifically because users were only given a choice between paying or allowing all their data to be processed without the option for more granular consent.

              Spain 🇪🇸

              The Spanish DPA indirectly shared its position, implying that cookie walls can be used as long as the user has been clearly informed of the two available options for accessing the service:

              1. accepting the use of cookies; or
              2. another alternative, “not necessarily free of charge“, that doesn’t require giving consent to cookies.

              The European Data Protection Board 🇪🇺

              In response to the formal request of the DPAs of Norway, the Netherlands, and Hamburg, the European Data Protection Board (EDPB) issued an Opinion that offers new guidance. The EDPB emphasizes the need for large online platforms to offer consumers alternatives that preserve their privacy. Specifically, it advises that when devising alternatives to current models, platforms should provide a truly equivalent option that does not require consumers to pay a fee.

              When a fee-based alternative is provided, platforms should also consider offering a complimentary option, such as using contextual advertising or allowing users to select their preferred advertising types, rather than relying on intrusive behavioral advertising. This approach, where advertising relies minimally or not at all on personal data, aligns closely with GDPR standards for obtaining valid consent and underscores the importance of offering genuine choices to users.

              In simpler terms, this could imply providing users with three options rather than the limited binary choice:

              1. Accept All: this includes also consenting to the processing of data for behavioral advertising
              2. Accept with Non-Behavioral Advertising: Consent without behavioral tracking.
              3. Pay: Access with a fee without personal data being processed for behavioral advertising purposes.

              The Opinion mainly focuses on large online platforms but also seems to set a general standard that could apply to various digital services.

              Further guidelines are expected to be developed. This development could significantly influence how consent-based practices are enforced throughout the EEA, promoting a uniform approach to privacy and consent.

              Frequently Asked Questions

              What is a cookie wall?

              A cookie wall is a pop-up that blocks the navigation on a website, asking you to accept all cookies. A cookie wall doesn’t allow you to navigate a site if you refuse to accept cookies.

              What does a cookie wall look like?

              The one below is an example of a cookie wall, even though it’s just a partial one. In fact, this one doesn’t block the navigation of the whole website, but just a piece of content that needs cookies to load. However, the functioning is the same: you can’t access the website or content if you don’t accept cookies.

              example of a cookie wall

              Is paying to remove cookies illegal?

              It depends. For some European Data Protection Authorities, it is considered a valid alternative when the cost is fair; instead other DPAs don’t consider the paywall as a valid alternative to cookies.

              According to the European Data Protection Board, when a fee-based alternative is provided, platforms should also consider offering a third option, such as contextual advertising or allowing users to select their preferred advertising types.

              Are cookie walls GDPR compliant?

              While legislations may vary slightly between EU countries, in general, cookie walls are most likely not allowed as they can be considered contrary to the GDPR’s requirement for “freely given” consent.

              What is the difference between a cookie wall and a cookie banner?

              A cookie banner is a pop-up that asks users for consent to cookies. A cookie banner allows you to accept all cookies, reject them, or accept only the strictly necessary ones.

              A cookie wall works in the same way, but it blocks the navigation of the website if you don’t accept all cookies, even those that aren’t strictly necessary.

              How iubenda can help you collect GDPR consent (while still monetizing your content!)

              Our Privacy Controls and Cookie Solution has specific consent recovery features that give publishers the freedom to place the accept button in a subscription pop-up or other elements in cases you might choose to use methods like paywalls.

              Learn more here

              Or get in contact with us for further information on this option.

              See also

              The post Is the use of a cookie wall allowed in European Countries? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              Privacy Policy for Facebook Pages https://www.iubenda.com/en/help/22930-privacy-policy-facebook-page-2/ Thu, 12 Mar 2020 16:31:37 +0000 https://help.iubenda.com/?p=22930 We all know that a privacy policy is mandatory under many privacy laws. Even if you run your business only on Facebook – without a website – you need to have a privacy policy available for your customers to read. What you need to do Provide a privacy policy Here’s what Meta states on their […]

              The post Privacy Policy for Facebook Pages appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              We all know that a privacy policy is mandatory under many privacy laws. Even if you run your business only on Facebook – without a website – you need to have a privacy policy available for your customers to read.

              What you need to do

              Provide a privacy policy

              Here’s what Meta states on their Pages, Groups and Events Policies:

              This is the updated quote:

              Should you wish to collect content or information from people who interact with your Page, group or event (e.g. information obtained from a call-to-action button) you must first provide them with notice. People from whom you collect content or information must explicitly consent to your use of their data. You must clearly explain that you (and not Meta) are collecting this data.

              In order to be compliant, your policy must be up-to-date, understandable, unambiguous, and easily accessible. Also, it has to:

              • describe the personal data collected and the purposes of their collection;
              • accurately list all the third parties the data is shared with; and
              • inform users of their rights in relation to their data.

              See this privacy policy created with our generator for an example of how these elements come together. Click on the button to open the document:

              Privacy Policy

              Specify you’re using Page Insights and communicate your legal basis

              As explained in Facebook’s Data Policy under “How do we use this information?”, Meta also collects and uses information to provide analytics services called Page Insights to Page admins to help them understand how people interact with their Pages and the content associated with them.

              Also, you should communicate your legal basis:

              You should ensure that you also have a legal basis for the processing of Insights data. In addition to the information provided to data subjects by Meta Ireland via the Information about Page Insights, you should identify your own legal basis including the legitimate interests you pursue

              You can create your own custom clause to disclose your use of Page Insights. Visit our page to learn more.

              Most importantly, if GDPR applies to your situation, do not forget to mention on which legal base you are relying on in order to process statistical data. You can rely on any of the 6 legal bases provided under the GDPR.

              Meta’s responsibilities

              As stated in the Page Insights Controller Addendum, Meta is taking on major responsibilities:

              Unless specified otherwise in this Page Insights Addendum, between you and Meta Ireland, Meta Ireland assumes the responsibility for compliance with the applicable obligations under the GDPR for the processing of Insights data (including, but not limited to, Articles 12 and 13 GDPR, Articles 15 to 21 GDPR, Articles 33 and 34 GDPR). Meta Ireland will implement appropriate technical and organizational measures to ensure the security of the processing in accordance with Article 32 GDPR.

              Joint controllership

              The processing of personal data for Page Insights might be subject to the joint controllership arrangement: basically, if you’re a Facebook Page admin, both you and Meta are responsible for complying with the GDPR in relation to Meta’s Page Insights service.

              In any case, there is no need to add a joint controller statement, since Meta takes care of this aspect:

              Meta Ireland will make the essence of this Page Insights Addendum available to data subjects (Article 26(2) GDPR). This is currently done via the Information about Page Insights data which can be accessed from all Pages.

              Facebook Page Insights Controller Addendum Requests

              If you need assistance with regard to a request in accordance with the Page Insights Controller Addendum, you can submit this form:

              Facebook Page Insights Controller Addendum Requests

              In fact, on the Page Insights Controller Addendum Meta says:

              If data subjects exercise their rights under the GDPR with regard to the processing of Insights data against you (Article 26(3) GDPR), or you are contacted by a supervisory authority with regard to the processing of Insights data, each a “request”, you will forward all relevant information regarding such requests to us promptly but within a maximum of seven calendar days. For this purpose, you can submit this form. Meta Ireland agrees to answer requests from data subjects in accordance with our obligations under this Page Insights Addendum. You agree to take all reasonable endeavors in a timely manner to cooperate with us in answering any such request. You are not authorized to act or answer on Meta Ireland’s behalf.

              How to add a privacy policy to your Facebook Page

              Facebook allows you to link to your privacy policy on your page: click on About > Edit Privacy Policy to enter your privacy policy link.

              How iubenda can help you create a privacy policy for your Facebook page

              Our Privacy and Cookie Policy Generator makes it easy to create a privacy policy (also) for Facebook pages: with hundreds of pre-crafted clauses, our generator lets you easily include all elements commonly required across many regions and third-party services, while applying the strictest standards by default – giving you the option to fully customize as needed.

              All our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

              Create a privacy policy for your Facebook page

              Start generating

              See also

              The post Privacy Policy for Facebook Pages appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              An In-depth Look at the CCPA Concept of Sale https://www.iubenda.com/en/help/22574-guide-to-the-ccpa-concept-of-sale/ Thu, 20 Feb 2020 16:22:18 +0000 https://help.iubenda.com/?p=22574 The following document is meant to explain our reasoning for certain service defaults categorized as a sale within the generator and serve as a basic guide in cases where you’re unsure if our defaults apply to you. In practice, we can’t confirm whether or not your individual use of a service can be considered a […]

              The post An In-depth Look at the CCPA Concept of Sale appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              The following document is meant to explain our reasoning for certain service defaults categorized as a sale within the generator and serve as a basic guide in cases where you’re unsure if our defaults apply to you. In practice, we can’t confirm whether or not your individual use of a service can be considered a sale – this is something that you must decide based on your individual processes. In cases where you’re still unsure whether or not your use of a service constitutes a sale, we suggest that you consult with your lawyer.

              To get started, we’ll explain in detail what constitutes a sale under the CCPA, what classifies an exception to sale then examine iubenda “sale” defaults for services within the generator. 👇

              What is a “sale” under the CCPA?

              Under the CCPA, a sale is defined as:

              “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.”

              In other words, any arrangement between a business and a third party or other business, that allows the business to receive some value (monetary or not) in exchange for the personal information of consumers* is virtually included in the “sale” definition.

              *See CCPA definition of “consumer” here.

              Under the CCPA, consumers have “the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.” This is the right to opt out.

              If the exchange of personal information between a business and other business is not defined as a “sale,” then the business is not prohibited from disclosing personal information to the other business without the opt-out option provided some conditions and thresholds are met. In other words, exchanging information that does constitute a “sale” under the CCPA does not trigger additional obligations about the opt-out process.

              What is not considered a “sale” under the CCPA?

              The CCPA does provide exceptions to its definition of a “sale” of a consumer’s personal information.

              (A) A consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party, provided the third party does not also sell the personal information, unless that disclosure would be consistent with the provisions of this title. An intentional interaction occurs when the consumer intends to interact with the third party, via one or more deliberate interactions. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumer’s intent to interact with a third party.

              (B) The business uses or shares an identifier for a consumer who has opted out of the sale of the consumer’s personal information for the purposes of alerting third parties that the consumer has opted out of the sale of the consumer’s personal information.

              (C) The business uses or shares with a service provider personal information of a consumer that is necessary to perform a business purpose if both of the following conditions are met:
              (i) The business has provided notice that information being used or shared in its terms and conditions consistent with Section 1798.135.
              (ii) The service provider does not further collect, sell, or use the personal information of the consumer except as necessary to perform the business purpose.

              (D) The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with Sections 1798.110 and 1798.115. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with Section 1798.120. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).

              In other words, a “sale” does not occur when:

              • a consumer intentionally directs the business to disclose personal information;
              • the business shares the personal information for a consumer that has opted out of the sale of personal information for the purpose of alerting the third party of this opt-out; or
              • the business shares personal information with a service provider that is necessary to perform a business purpose.

              Let’s focus on the “service provider” exception. Under (C) in the above (more information about the definition of a “service provider” and “business purpose” is discussed below).

              If a business discloses personal information to a service provider, then the business is obligated to:

              • Provide notice in the online privacy policy that personal information is being used or shared with a service provider for a business purpose.
              • Ensure the service provider does not further collect, sell, or use the personal information except necessary for the business purpose.

              It is important to note that disclosure of personal information to service providers from businesses are permitted, even where a consumer has opted out. This is because, as stated above, this does not qualify as a “sale” of personal information.

              What is a “service provider” under the CCPA?

              The “service provider” exception to a sale of personal information may be the most popular exception and allows a business to seek shelter under this exception where it applies. Under the CCPA, a “service provider” is defined as:

              a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that processes information on behalf of a business and to which the business discloses a consumer’s personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the entity receiving the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business, or as otherwise permitted by this title, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract with the business.

              In other words, under the CCPA, a “service provider” meets these conditions:

              • Be a business entity
              • Be a processor to a business (for example, process information on behalf of the business)
              • Receives the information from a business for business purposes
              • Receives the information pursuant to a compliant written contract (a compliant written contract must prohibit the service provider that receives the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for business.).

              How does a “service provider” qualify for the exception?

              A business will not be deemed to be a seller of consumer personal information when this information is exchanged with a “service provider” where:

              • The exchange of consumer personal information is necessary for a business purpose
              • The exchange of consumer personal information is received by a service provider pursuant to a written contract between the business and the other business that acts as a service provider.

              First, let’s go over the written contract requirement. The written contract can take the form of a CCPA Service Provider Addendum attached to other existing terms and contracts. The CCPA specifies that this written contract include provisions that “prohibits the entity receiving the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business[.]”

              (A) Prohibits the person receiving the personal information from:
              (i) Selling the personal information.
              (ii) Retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract.
              (iii) Retaining, using, or disclosing the information outside of the direct business relationship between the person and the business.

              (B) Includes a certification made by the person receiving the personal information that the person understands the restrictions in subparagraph (A) and will comply with them.
              A person covered by paragraph (2) that violates any of the restrictions set forth in this title shall be liable for the violations. A business that discloses personal information to a person covered by paragraph (2) in compliance with paragraph (2) shall not be liable under this title if the person receiving the personal information uses it in violation of the restrictions set forth in this title, provided that, at the time of disclosing the personal information, the business does not have actual knowledge, or reason to believe, that the person intends to commit such a violation.

              In review, the written contract must include:

              • A provision where the service provider agrees not to sell the personal information.
              • A provision that prohibits the service provider from retaining, using, or disclosing the personal information other than for the specific business purpose in the contract.
              • A provision that prohibits the service provider from retaining, using, or disclosing the personal information outside of the direct business relationship between the business and the service provider.

              Now, let’s go over the “business purpose” requirement. The CCPA defines “business purpose” broadly.

              “Business purpose” means the use of personal information for the business’ or a service provider’s operational purposes, or other notified purposes, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the operational purpose for which the personal information was collected or processed or for another operational purpose that is compatible with the context in which the personal information was collected. Business purposes are:

              (1) Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.

              (2) Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.

              (3) Debugging to identify and repair errors that impair existing intended functionality.

              (4) Short-term, transient use, provided the personal information that is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

              (5) Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

              (6) Undertaking internal research for technological development and demonstration.

              (7) Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

              In other words, a business purpose is:

              • auditing;
              • detecting security incidents and protecting against fraud;
              • debugging errors that impair intended functionality;
              • short-term use of personal information provided that the personal information is not disclosed to a third-party or used to build a profile about the consumer;
              • performing services such as customer service, order fulfillment, processing payments, and other similar services;
              • internal research for technological development; or
              • undertaking activities for quality control.

              What are some examples of service providers?

              Listed below are a few examples of service providers that collect, access, maintain, use, process and transfer the personal information of the customers of a business for the business’ purpose of performing the service providers obligations.

              Here are just a few examples of potential service providers:

              • Web host. A business most likely uses another business to host a website. It is foreseeable that a web host acts as a “service provider” for a business.
              • CRM cloud software. Businesses may use CRM cloud software to store consumer’s personal information. It is foreseeable that CRM cloud software functions as a “service provider” as defined under the CCPA for a business.

              As stated above, a written contract and conditions must be in place with any and all third-party businesses that act as “service providers” to qualify for the exception to “sale” of personal information.

              About “sale” defaults for services within the Generator

              It is important to note that while using personal information for a “business purpose” does exempt that information from opt-out requirements, it does not exempt that personal information from CCPA disclosure requirements.

              The services categorized inside the following purposes would most likely be a “sale” of personal information because they likely involve a transfer to personal information outside the scope of a business purpose or any other exception to a “sale”:

              iubenda categories/purposeshow we categorize by default
              Access to third-party accounts(likely) sale
              Advertising(likely) sale
              Advertising serving infrastructure(likely) sale
              Analytics(likely) sale
              Beta Testing(likely) sale
              Commercial affiliation(likely) sale
              Contacting the User(likely) sale
              Content commenting(likely) sale
              Content performing and features testing (A/B testing)(likely) sale
              Data transfer outside the EU(likely) sale
              Displaying content from external platforms(likely) sale
              Heat mapping and session recording(likely) sale
              Interaction with data collection platforms and other third parties(likely) sale
              Interaction with external social networks and platforms(likely) sale
              Interaction with live chat platforms(likely) sale
              Interaction with online survey platforms(likely) sale
              Managing data collection and online surveys(likely) sale
              Managing landing and invitation pages(likely) sale
              Managing web conferencing and online telephony(likely) sale
              Platform services and hosting(likely) sale
              Registration and authentication(likely) sale
              Remarketing and behavioral targeting(likely) sale
              RSS feed management(likely) sale
              Social features(likely) sale
              Tag Management(likely) sale
              User database management(likely) sale

              The following services would most likely provide a necessary “business purpose” (the personal information is used for a business’ or service provider’s operation purposes) and, therefore, fall under the “business purpose” exception to a “sale” of personal data. Remember, as discussed in the CCPA, the business is required to enter into a written contract with the service provider that “prohibits the [service provider] receiving the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business[.]”

              iubenda categories/purposeshow we categorize by default
              Device permissions for Personal Data access(possibly) no sale
              Handling activity data(possibly) no sale
              Handling payments(possibly) no sale
              Registration and authentication provided directly by {insert application}(possibly) no sale
              Selling goods and services online(possibly) no sale
              SPAM protection(possibly) no sale

              • Interaction with support and feedback platforms – In this case, a third-party service may collect browsing data and usage data from a user. Because browsing data and usage data may fall or may not fall under the definition of a “sale” this selection depends on particular use cases. It depends on the business reasons for using a third-party service for support and feedback.
              • Managing contacts and sending messages – In this case, this depends about whether or not it falls under a “sale” because services that collect data concerning messages from a user may collect data outside the scope of a “business purpose” and, therefore, be defined as a “sale.” It depends on the business reasons for using a third-party service to manage contacts and send messages.
              • Managing support and contact requests – A third party service that manages support and contact requests could be “sale” or a business purpose exception, it depends on the business reasons for using a third-party service to manage support and contact requests.
              • Traffic optimization and distribution – Traffic optimization and distribution may provide a “business purpose” such as using a cloud storage provider. Traffic optimization and distribution may also constitute a “sale” of personal information by storing user data on a third party. It all depends on the business reasons for the transfer of personal information by a business to a third party for traffic optimization and distribution.
              • Backup saving and management – A backup saving and management service may provide a “business purpose” such as using a cloud storage provider. A backup saving and management service may also constitute a “sale” of personal information by storing user data on a third party. It all depends on the business reasons for the transfer of personal information by a business.
              • Hosting and backend infrastructure – A hosting service may provide a “business purpose” such as using a cloud storage provider. A hosting service may also constitute a “sale” of personal information by storing user data on a third party. It all depends on the business reasons for the transfer of personal information by a business.
              • Infrastructure monitoring – Infrastructure monitoring may provide a “business purpose” such as using a cloud storage provider. Infrastructure monitoring may also constitute a “sale” of personal information by storing user data on a third party. It all depends on the business reasons for the transfer of personal information by a business.

              Create a privacy policy

              Start generating

              The post An In-depth Look at the CCPA Concept of Sale appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>
              What is CCPA? CCPA Compliance Guide https://www.iubenda.com/en/help/19133-ccpa-compliance-guide/ Fri, 30 Aug 2019 16:17:12 +0000 https://help.iubenda.com/?p=19133 CCPA stands for California Consumer Privacy Act. It came into effect on January 1, 2020, in the state of California, United States. CCPA compliance is designed to enhance privacy rights and consumer protection for California residents. The CCPA grants various rights to California residents and regulates the actions of businesses that collect or sell personal […]

              The post What is CCPA? CCPA Compliance Guide appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

              ]]>

              CCPA stands for California Consumer Privacy Act. It came into effect on January 1, 2020, in the state of California, United States. CCPA compliance is designed to enhance privacy rights and consumer protection for California residents.

              The CCPA grants various rights to California residents and regulates the actions of businesses that collect or sell personal information. However, it leaves the consequences of third-party processing of consumer data somewhat open to interpretation. This prompted an amendment to the CCPA, which has come to be known as the California Privacy Rights Act (CPRA).

              Update

              The California Privacy Rights Act (CPRA), which became effective in January 2023, expands on a few key elements of the existing California Consumer Privacy Act (CCPA) by further protecting consumers’ privacy. The CPRA supplements – but does not replace nor repeal – the existing framework provided by the CCPA.

              In this guide, we explain everything you need to know about CCPA compliance and what you need to do to align with its requirements.

              Please note: the compliance section of this guide has been updated to align with the amended version of the CCPA which is currently in force — the CPRA.

              What is the CCPA?

              The California Consumer Privacy Act is a comprehensive data privacy law, designed to enhance privacy rights and consumer protection for California residents.

              The main purpose of CCPA is to provide individuals with greater control over their personal information and to regulate how businesses collect, use, and share that information.

              As we already mentioned, the CCPA was amended to include new requirements that were left open to interpretation. In January 2023, the California Privacy Rights Act (CPRA) came into force, integrating the CCPA.

              What is the difference between CCPA and CPRA?

              The CPRA builds on the protections provided by the CCPA, but it introduces new requirements for businesses.

              Here are a few key differences:

              • The CPRA has a broader scope than the CCPA.
              • The CPRA adds new categories of sensitive personal information, such as health data and precise geolocation.
              • The CPRA enhances consumer rights, adding the right to correct inaccurate information and the right to limit the use and disclosure of sensitive personal information.
              • The CPRA imposes additional requirements on businesses, such as the obligation to conduct regular risk assessments and to submit annual privacy audits to the California Privacy Protection Agency (CPPA).
              💡

              Want to learn more?


              Check out CCPA vs CPRA here

              What is personal information under the CCPA?

              Under the scope of the California Consumer Privacy Act, “personal information” is defined as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

              The CCPA further details that personal information can include, but is not limited to:

              • identifiers such as a real name, alias, postal address, unique personal identifier, online identifier IP address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers;
              • commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
              • biometric information;
              • internet or other electronic network activity information, including browsing history, search history, and information relating to website, application or ad interaction;
              • geolocation data;
              • audio, electronic, visual, thermal, olfactory, or similar information;
              • professional or employment-related information;
              • educational information — other than what is publicly available as defined here; or
              • any inferences drawn from information such as those mentioned above, which is used to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

              When does the CCPA apply?

              In general, CCPA compliance is needed when BOTH of the following conditions apply:

              • you have a business; and
              • you target Californian consumers.

              However, you need to make sure your business falls within the scope of the CCPA. To do that, let’s have a closer look at the key definitions.

              👋 Does the CCPA apply to me?


              Short on time? Take this 1-minute quiz and find out immediately!

              Key definitions

              📌 Consumer

              Under the CCPA, a “consumer” is defined as a natural person who is a California resident.

              📌 Business

              Under the scope of the California Consumer Privacy Act, a “business” is defined as a for-profit organization that collects personal information of consumers, determine the purposes and method of the processing, targets Californian residents (whether or not the business is actually based in California), and meets at least one of the following requirements:

              • it has annual gross revenues exceeding twenty-five million dollars ($25,000,000); or
              • it derives 50% or more of its annual revenues from selling the personal information of consumers; or
              • it buys, receives, sells, or shares the personal information of 50,000 or more consumers annually for the business’ commercial purposes. Since IP addresses fall under what is considered personal data — and “commercial purposes” simply means to advance commercial or economic interests — it is likely that any website with at least 50k unique visits per year from California falls within this scope.

              📌 Sale

              Sale within the context of CCPA compliance is defined as: “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration“.

              📌 Valuable consideration

              While the CCPA does not currently explicitly define “valuable consideration”, under Californian contract law it is defined as “[a]ny benefit conferred, or agreed to be conferred, upon the promisor, by any other person, to which the promisor is not lawfully entitled, or any prejudice suffered, or agreed to be suffered, by such person, other than such as he is at the time of consent lawfully bound to suffer, as an inducement to the promisor, is a good consideration for a promise.” (Cal. Civ. Code § 1605).

              Within this context, a “valuable consideration” can be broadly interpreted as meaning all agreements where personal information is exchanged – and the transferring entity receives any benefit to which it would not be legally entitled to without the agreement.

              Important

              CalOPPA has not been repealed by the CCPA and still applies. This is something to take note of even if the definition of “business” above does not apply to you, as you may still need to comply with CalOPPA, or both laws may be applicable to you. Read more about CalOPPA here.

              CCPA vs GDPR

              Some have called the CCPA “the California GDPR“, so here’s how these two privacy laws actually compare:

              CCPA GDPR
              Enforcing body? The attorney general of the state of California, USA. National (EU member state) data protection agencies.
              Who needs to comply? Any for-profit business that targets Californian consumers and either:
              • processes the personal data of at least 50K Californian consumers (IP addresses are considered personal data, so this would apply to any website with at least 50K visits from Californian consumers); or
              • makes at least 50% of its revenue from sharing Californian consumer data for any profit – monetary or otherwise; or
              • has an annual revenue of 25M or more.
              Any entities (non-profit or otherwise – including NGOs, individuals, and public entities) that target EU consumers, or which are based in the EU.
              What types of data are protected? Any data that relates to, or is capable of being associated with a particular consumer or household, with the exception of public government records. Any data that can lead to the identification of an individual.
              Are IP addresses considered Personal Data?
              Consent required before processing? Only in the case of minors and in cases of previous opt-out. Yes, unless another legal basis legitimately applies.
              Must Businesses give consumers the option to opt-out or withdraw consent? Yes, must provide DNSMPI link and honor opt-out requests. Users have both the right to withdraw consent and the right to object to processing (potentially applicable even in cases where the processing is justified using a legal basis other than consent).
              Protections also apply to business to business (B2B) interactions? No, CCPA protections apply to consumers only. The GDPR makes no differentiation between protections applied to B2B and B2C (business to consumer) interactions, it simply applies its protections to “data subjects”, who are defined as any “identifiable natural persons” residing in the EU.
              Security requirements? The CCPA lists no specific security requirements but gives consumers the explicit right to bring suit for damages resulting from a business’ failure to implement appropriate security practices. The GDPR requires both controllers and processors to implement security methods appropriate to the particular risk involved. Security methods should be “state of the art” implying that the security methods should on par with the latest standards.
              Penalties of non-compliance? Fines of up to $7,988 per individual violation. The CCPA also gives consumers the right to bring suit for damages. Fines of up to EUR 20 M (22 M USD) or 4% of annual global revenue – whichever is greater, potential audits and sanctions. The GDPR also gives data subjects the right to sue if their rights were violated.
              Applicable users’ Rights at a glance
              Right to be informed
              The right of access
              The right to portability
              The right to rectification ×
              The right to be deleted
              The right to object Somewhat covered by the right to opt-out

              CCPA Consumer Rights

              Under CCPA, consumers have specific rights that you must respect to achieve CCPA compliance.

              The California Privacy Protection Agency has recently unveiled a new website, aimed at providing Californians with comprehensive information about their privacy rights. This online platform serves as a key resource for understanding the protections offered by the California Consumer Privacy Act (CCPA) and offers guidance on various privacy-related issues, enabling Californians to take informed actions regarding their privacy.

              The right to be informed

              Under the CCPA, consumers have a right to be informed about how their information is processed at or before the point of collection.

              Under the California Consumer Privacy Act you must disclose:

              • the categories of personal information the business collects, sells, or shares;
              • the categories of third parties with whom the business shares personal information;
              • the categories of sources from which that information was collected;
              • the business/ commercial purpose for collecting or selling consumers’ personal information;
              • consumers rights and how to exercise them; and
              • how the consumer can object to the selling of their data, via a “Do not sell my data” link (if data is sold).

              The right of access

              Under the CCPA, consumers have a right to access their personal information when verifiably requested*.

              In particular, consumers have the right to access:

              • the categories of the consumer’s personal information collected in the past 12 months;
              • specific pieces of information collected about them;
              • the categories of sources from which the business collected the information;
              • the purposes for collecting or selling the information;
              • the categories of third parties that the personal information is shared with;
              • the categories of personal information sold and the categories of third parties that the personal information was sold to;
              • the categories of personal information disclosed for business purposes.

              *Verifiably requested or a “verifiable consumer request” means a request that is made by a consumer, by a consumer on behalf of the consumer’s minor child, or by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumer’s behalf, and that the business can reasonably verify . . . to be the consumer about whom the business has collected personal information. Cal. Civ. Code § 1798.140(y)

              You must provide consumers with two or more methods for submitting access requests, including at a minimum, a toll-free telephone number, and if the business maintains an internet web site, a web site address. You must also make reasonable efforts to verify that the person making the request is either the consumer about whom the information was collected, or authorized to request this information on behalf of the consumer as outlined above.

              The right to portability

              Under the California Consumer Privacy Act, the right to data portability is bundled together with the right to access, under Section 1798.100 (d).

              Where businesses fulfill Access requests “electronically”, it’s also required that the information be provided to the consumer in “a portable and, to the extent technically feasible, in a readily usable format that allows the consumer to transmit this information to another entity without hindrance”.

              Information requests must be fulfilled, free of charge, within 45 days of the consumer’s verifiable request. This time period may be further extended once by an additional 45 days, if reasonably necessary, and provided that the consumer is given notice of the extension within the first 45-day period.

              The disclosures made in the fulfillment of the request should cover the 12-month period preceding the receipt of the request.

              Delivery format

              Businesses must respond through either regular mail or in an electronic format (such as email, file download, etc.). If delivered electronically, the law mandates that the information must be “portable”, i.e. delivered in a format that’s easy to use and that allows transmission of the information to another entity without hindrance.

              Exceptions and limits
              • Consumers are allowed a maximum of 2 requests over a period of 12 months.
              • Single one-time instances of processing are excluded if the information is not sold or retained by the business or used to otherwise re-identify the person.
              • No response is necessary if the business has not actually collected information on the consumer in question.

              The right to be deleted

              The CCPA grants consumers the right to request the deletion of any personal information that has been collected about them. If a verifiable request for deletion is received from a consumer, you must delete the consumer’s personal information from your records and instruct any related service providers to delete the consumer’s personal information from their records.

              You must provide consumers with two or more methods for submitting requests, including, at a minimum, a toll-free telephone number, and if the business maintains an internet website, a website address. You must also make reasonable efforts to verify that the person making the request is either the consumer about whom the information was collected, or authorized to request this information on behalf of the consumer as outlined above.

              This request must be fulfilled free of charge, within 45 days of the consumer’s verifiable request. This time period may be further extended once by an additional 45 days, if reasonably necessary, and provided that the consumer is given notice of the extension within the first 45-day period.

              Exceptions and limits

              Businesses are not required to comply with the request of deletion if the information is needed:

              • to complete the transaction that the personal information was collected for;
              • for the provision of a good or a service requested by the consumer, or to otherwise carry out an agreement between the business and the consumer;
              • to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
              • to debug to identify and repair errors;
              • to exercise of free speech, or exercise another consumer’s right to free speech;
              • to comply with the California Electronic Communications Privacy Act (CalECPA);
              • for public or peer-reviewed scientific, historical, or statistical research in the public interest;
              • in order to comply with a legal obligation;
              • to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business;
              • for solely internal use in a lawful manner compatible with the context in which the consumer provided the information.

              The right to opt-out

              The right to say no to the sale of their data

              Under the CCPA, a consumer has the right, at any time, to tell a business which sells their personal information to third parties, that they must stop selling such personal information.

              What is a sale under the California Consumer Privacy Act and how do you “sell” personal information?

              As mentioned above, under the CCPA, “sell”, “selling”, “sale”, or “sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic means, a consumer’s personal information by the business to another business or a third party, for monetary or other valuable consideration.

              Two less obvious examples of what could* be considered “selling” under the CCPA are:

              • sharing user data with ad networks, and other third-parties in order to display targeted advertising for a benefit including revenue; or even
              • using 3rd-party analytics program for retargeting or otherwise generating a user-profile for selling to the consumer.

              *Keep in mind that at this stage of implementation some factors may change as the law is further refined.

              If you “sell” consumers’ personal information to third parties, you must disclose this fact to consumers, and must also inform them that have the right to opt-out of the sale of their personal information (as per “The right to be informed” listed above).

              A consumer cannot be asked to create an account in order to opt-out. Instead, this process should be facilitated via a “Do Not Sell My Personal Information” (“DNSMPI“) link on your website or privacy notice.

              If a business receives direction from a consumer not to sell the consumer’s personal information, it is prohibited from selling the personal information of that consumer unless the consumer subsequently provides express authorization for the sale of their personal information (Opt-in).

              Businesses may only ask for a consumer’s authorization one more time, and only 12 months after the consumer have opted-out.

              The right to opt-in

              Prior consent for minors

              Businesses are prohibited from selling the personal information of consumers if the business has actual knowledge that the consumer is under the age of 16. In such cases, businesses may only sell the information if:

              • the consumer is between 13 and 16 and has opted-in; or
              • the consumer is less than 13 years of age and the consumer’s parent or guardian has opted-in on the consumer’s behalf.

              The right to not be discriminated against

              Even if the consumer exercises their privacy rights

              To achieve CCPA compliance, businesses are prohibited from discriminating against consumers for exercising their rights granted under the law. Prohibited forms of discrimination include:

              • Denying goods or services to the consumer.
              • Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
              • Providing a different level or quality of goods or services to the consumer, if the consumer exercises the consumer’s rights under this title.
              • Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.
              Exceptions and limits
                • A business may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale of personal information, or the deletion of personal information. In such cases, such financial incentives must be disclosed to users via the homepage of your website and within your privacy policy.

                  Businesses are prohibited from using financial incentive practices that are “unjust, unreasonable, coercive, or usurious in nature”.

                CCPA Fines and Penalties

                Consumers have the right to sue* businesses that violate the law. The associated fines will be between $100 and $750, or any higher amount related to actual damages (where larger damages can be proven).
                *This only applies to the actual businesses themselves and not “service providers” acting on behalf of the business.

                “As required under the CCPA, the California Privacy Protection Agency has adjusted, and will do so every other year, monetary thresholds, monetary damages, administrative fines, and civil penalties, in line with increases to the Consumer Price Index (CPI). The current adjustment is effective on January 1, 2025. The monetary threshold within the definition of businesses has been raised to $26,625,000, while administrative fines and civil penalties to $2,663 for each violation or $7,988 for each intentional violation and violations involving the personal information of consumers whom the violator has actual knowledge are under 16 years of age”.

                CCPA compliance – How to make your site/app compliant

                CCPA compliance is, similarly to compliance with other privacy laws, a multi-faceted process that involves honest review, planning and technical and legal implementation.

                Regardless of how you choose to approach the implementation process, there are still a few basic steps you’ll need to take before even getting to the implementation stage. Let’s take a look at them, as well as the rest of the implementation process, below.

                (This compliance section has been updated to align with the amended version of the CCPA which is currently in force — the CPRA.)

                Perhaps one of the most important steps for CCPA compliance is to honestly review and assess your own processes and systems.

                Some questions to ask yourself here are:

                • What categories of personal data do I collect and which categories of third parties do I share this data with?
                • Which sources do I collect this information from and what are their categories (e.g., analytics)?
                • What are the reasons or purposes of my data collection?
                • What are the CCPA consumer rights that apply to my processing activities?
                • Am I technically equipped to fulfill consumer rights-related requests such as deletion and access requests?
                  • How do I keep track of when such requests were fulfilled?
                  • Am I keeping track of all the service providers that access consumers’ personal information on my behalf?
                  • Can I reliably contact these parties to fulfill things like deletion requests?
                  • Do I maintain reliable records of the information and the categories of personal information I collect for each consumer?
                • Do I have available onsite the documents needed to make legally required disclosures?
                • Which exceptions reasonably and honestly apply to my scenario?

                The service, quality, levels and/ or prices you charge/ offer to consumers must not be influenced by or dependent on whether or not they’ve chosen to exercise their rights. The only exceptions to this rule are in cases where the value of service or good offered relies upon the data collected about the consumer (see example above).

                You may offer financial incentives (including payments) to consumers in exchange for accessing their personal information, however, you may only use financial incentives that are fair, reasonable, non-coercive and not extortionate. In all such cases, consumers must first be notified of such incentives via the homepage of your website.

                As a requirement under the consumer’s right to opt-out, you must provide an easily accessible, clear and conspicuous “Do Not Sell My Personal Information” (“DNSMPI”) link on your website’s homepage and within your privacy policy (with the appropriate disclosures of the associated consumer right).

                The link must take the user to a page where they can opt-out of the sale of their personal information.

                Where technically feasible, you are allowed to host and redirect California residents to a separate homepage with the visible DNSMPI link.

                Access, portability and deletion rights must be honored, at no cost to the consumer, within 45 days of receiving a verifiable request. The fulfillment period can be extended (only once) by a further 45 days if necessary, provided that the consumer is given notice of this fact.

                When fulfilling access and portability requests, the information returned to the consumer must be given in an easy-to-use and easily transmittable format.

                When a consumer exercises their opt-out rights (the right to say no to the sale of their data), you must comply upon receiving the request.

                In cases where you are aware of the fact that the consumer is a minor under the age of 16, you must not sell their information unless explicitly authorized to do so by a parent or guardian (for minors under 13) or if explicitly authorized to do so by the minor consumer in cases where the minor is between the ages of 13-16.

                Implementation can be complicated. This is where iubenda comes in: we take the weight off your shoulders by offering powerful software solutions — backed by our international legal team — which allow you to handle even the most complex situations within a few clicks and fully customize when needed.

                How can iubenda help you Comply?

                CCPA / CPRA Compliance in no time

                Our 360° solutions crafted by our expert legal team and help to keep you covered with minimal effort.

                Get Compliant in Minutes

                Get a CPRA-compliant Privacy Policy, customizable based on 1800+ clauses and available in 11 languages.

                Add a Privacy Controls widget to your site allowing California users to opt-out from processing.

                Among the few providers compatible with GPP & GPC, making it easier to honor these opt-out requests.

                Automatically store user preferences and document CPRA opt-outs.

                Laws, like the people, needs, and ideas they serve, are often dynamic “living” things. Similarly, your own business purposes, partners and processes may shift with time.

                For this reason, it’s vital that you periodically review and assess your internal processes, technical capabilities, and legal documents, and keep them up-to-date with legal requirements.

                How iubenda can help you with CCPA compliance

                Our solutions take the guesswork out of CCPA compliance by doing the heavy technical and legal lifting so that you can focus on growing your business.

                (This compliance section has been updated to align with the amended version of the CCPA which is currently in force — the CPRA.)

                See it in action 👇

                 

                Make your site CCPA compliant in minutes

                Start generating

                See also

                The post What is CCPA? CCPA Compliance Guide appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for Google OAuth https://www.iubenda.com/en/help/18852-privacy-policy-google-oauth-2/ Fri, 26 Jul 2019 14:53:37 +0000 https://help.iubenda.com/?p=18852 OAuth is commonly used as a way for users to grant websites or applications access to their account information on other sites but without giving access to their passwords. This mechanism is used by Google and other companies to allow users to share information about their accounts with third-party applications or websites. However, using this […]

                The post Privacy Policy for Google OAuth appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                OAuth is commonly used as a way for users to grant websites or applications access to their account information on other sites but without giving access to their passwords.

                This mechanism is used by Google and other companies to allow users to share information about their accounts with third-party applications or websites. However, using this feature also comes with its specific privacy-related responsibilities.

                Before your users log in to your web/mobile app with Google OAuth, you’ll need to configure the OAuth consent screen, which allows users to indicate whether or not they want to grant access to their private data and also provides a link to your privacy policy and terms of service document (also called terms and conditions).

                Google OAuth consent screen

                To protect you and your users, Google only allows applications that authenticate using OAuth to use authorized domains. Your application’s links – included the privacy policy link – must be hosted on a domain verified with Google (more on the Google Cloud Platform Console Help), as you can see on your Google Cloud Platform project dashboard > APIs & Services > Credentials > OAuth consent screen:

                Google Cloud Platform - OAuth consent screen

                How to create a privacy policy for your web/mobile app with Google OAuth

                Because a valid privacy policy must always be up-to-date and specific to your own particular situation, it can be a both legally and technologically difficult to write a compliant policy yourself.

                Here’s where our Privacy and Cookie Policy Generator comes in very handy: with 1700+ available clauses, our privacy policies contain all elements commonly required across many regions and services (including Google products), while applying the strictest standards by default – giving you the option to fully customize as needed.

                Our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

                Creating a privacy policy for your web/mobile app is straightforward and intuitive:

                • Enter the name of your website or app and start generating
                • Add any service you may be using. In this case, make sure to add the Google OAuth clause iubenda Privacy Policy - Google OAuth service
                • Fill out your web/app owner and contact details
                • Use the direct text embedding option (Pro License required) to embed the privacy policy into the body of one of your pages hosted on an authorized domain. You can copy and paste the JavaScript into your page, or call our API from your backend. The result will look as if it were natively a part of your own site. iubenda Privacy Policy - Direct Text Embedding
                Note

                When adding the Google OAuth clause, you’ll be asked to specify the place of processing:

                • If you or your users are based in the European Economic Area (EEA) or Switzerland consider to add Google Ireland Limited as the service provider.
                • If you or your users are based outside of the EEA, then add Google LLC.
                • If both of the above apply, then add both service providers.

                For more information read Place of Processing Customization for Google Services.

                Create a privacy policy for your web/mobile app with Google OAuth

                Start generating

                See also

                The post Privacy Policy for Google OAuth appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Place of Processing Customization for Google Services https://www.iubenda.com/en/help/14936-place-of-processing-customisztion-for-google-services/ Thu, 24 Jan 2019 17:54:47 +0000 https://help.iubenda.com/?p=14936 As of January 22nd, 2019, Google has updated the contracting party for all their services from Google LLC to Google Ireland Limited for all instances where End-users are based in the the European Economic Area (EEA) or Switzerland. Below you’ll find highlighted portions of the notification email sent by Google. Hello Administrator, This email is […]

                The post Place of Processing Customization for Google Services appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                As of January 22nd, 2019, Google has updated the contracting party for all their services from Google LLC to Google Ireland Limited for all instances where End-users are based in the the European Economic Area (EEA) or Switzerland.

                Below you’ll find highlighted portions of the notification email sent by Google.

                Hello Administrator,

                This email is to inform you about changes in our end-user facing Terms of Service and Privacy Policy for your users in the European Economic Area (EEA) or Switzerland that may affect and be noticed by users in your domain [redacted] as they access some of the Google Additional Services . . . For users in your domain that are based in the European Economic Area (EU countries, Iceland, Liechtenstein, and Norway) or Switzerland, starting January 22, 2019, services offered under the end-user facing Terms of Service will be offered by Google Ireland Limited instead of Google LLC. . . we’re also updating Google’s Privacy Policy for the Additional Services. The new policy specifies that Google Ireland Limited will be the data controller responsible for these users’ information and for complying with applicable privacy laws (unless otherwise stated in a service-specific privacy notice).

                You can read Google’s updated Terms here.

                Do these changes affect you?

                These changes may be applicable to you if you or any of your Users are based in the European Economic Area (EEA) or Switzerland.

                Here some examples of when this change may apply to you:
                • You’re based in the European Economic Area (EEA) or Switzerland and have EEA or Switzerland-based users.
                • All your users are based in the European Economic Area (EEA) or Switzerland, regardless of where you are based.
                • You’re based outside the European Economic Area (EEA) or Switzerland, e.g the US, and your users are based both in the US and the European Economic Area (EEA) or Switzerland.

                *If you’re not sure if you may have EEA or Switzerland based users, it’s best to err on the side of caution and assume that it applies to you as well.

                As quoted above, Google’s changes automatically apply to all your EEA and Switzerland-based end-users, regardless of where you are based.

                What do you need to do?

                Because you’re legally required to correctly identify third-party processors, we strongly suggest that you update the clauses in your policies that are related to affected Google services to include “Google Ireland Limited”.

                • AdMob
                • Android Pay
                • Backup on Google Drive
                • Beta by Crashlytics
                • Blogger
                • Crashlytics
                • Fabric Answers
                • FeedBurner
                • Firebase Authentication
                • Firebase Cloud Firestore
                • Firebase Cloud Functions
                • Firebase Cloud Messaging
                • Firebase Cloud Storage
                • Firebase Dynamic Links
                • Firebase Hosting
                • Firebase Invites
                • Firebase Notifications
                • Firebase Performance Monitoring
                • Firebase Realtime Database
                • Firebase Remote Config
                • Google Ad Manager Audience Extension
                • Google Ad Manager
                • Google AdSense
                • Google Ads Remarketing
                • Google Ads Similar Audiences
                • Google Ads conversion tracking
                • Google Analytics Advertising Reporting Features
                • Google Analytics Demographics and Interests Reports
                • Google Analytics for Firebase
                • Google Analytics with anonymized IP
                • Google Analytics
                • Google App Engine
                • Google Calendar widget
                • Google Cloud Storage
                • Google Drive account access
                • Google Fonts
                • Google Friend Connect
                • Google Maps widget
                • Google OAuth
                • Google Pay
                • Google Play Beta Testing
                • Google Signals
                • Google Site Search with AdSense
                • Google Site Search
                • Google Tag Manager
                • Google Website Optimizer
                • Google reCAPTCHA
                • Google+ +1 button and social widgets
                • Remarketing with Google Analytics
                • User ID extension for Google Analytics
                • YouTube OAuth
                • YouTube button and social widgets
                • YouTube video widget without cookies
                • YouTube video widget

                If you’re based outside Europe and have users from both outside and within the EEA and Switzerland, you should consider adding both “Google Ireland Limited” and “Google LLC” using the method detailed below.

                Changes to your Privacy Policy

                To edit, simply go to the relevant site area in your iubenda dashboard and click on the “Edit” button for your privacy policy.

                Next, click the pencil icon on the service you’d like to edit and simply click inside the “Select the region” field in order to update the information.

                Click on “Save and Close” and you’re done.

                Changes to your Cookie Policy

                If you’re using a cookie policy generated by iubenda (pro feature), your cookie policy will be automatically updated to reflect the changes made in your privacy policy.

                If you’re using an externally prepared cookie policy, you may need to seek legal assistance in order to manually update the relevant information.

                The post Place of Processing Customization for Google Services appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Amazon Affiliate Program – required privacy policy additions https://www.iubenda.com/en/help/13990-amazon-affiliate-program-required-privacy-policy-additions/ Fri, 04 Jan 2019 10:52:27 +0000 https://help.iubenda.com/?p=13990 Amazon’s Affiliate Program, also called Amazon Associates, has taken an explicit stance regarding privacy and the responsibility of their associates. The main privacy policy related requirements/ disclosures are included below (of course we highly suggest that you read through the entire updated Terms linked below). Disclosure Requirements This requirement is from Amazon’s Associates Program Operating […]

                The post Amazon Affiliate Program – required privacy policy additions appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Amazon’s Affiliate Program, also called Amazon Associates, has taken an explicit stance regarding privacy and the responsibility of their associates. The main privacy policy related requirements/ disclosures are included below (of course we highly suggest that you read through the entire updated Terms linked below).

                Disclosure Requirements

                This requirement is from Amazon’s Associates Program Operating Agreement and is related to transparency, and disclosing endorsements, a legal requirement under many countries’ laws :

                You must clearly state the following, or any substantially similar statement previously allowed under this Agreement, on your Site or any other location where Amazon may authorize your display or other use of Program Content: “As an Amazon Associate I earn from qualifying purchases.”

                Amazon’s Associates Program Operating Agreement, Section 5: Identifying Yourself as an Associate

                This particular disclosure needs to be included in an easily accessible location of your site, best practice would be to include the disclosure clearly and conspicuously on the same page as the particular affiliate link you’re using. The closer this disclosure is to your recommendation, the better.

                Privacy and Consent Requirements

                While Amazon does not explicitly state that you need to have a privacy policy or collect consent in order to use their services, they do directly say that you’re expected to comply with applicable law:

                You represent, warrant, and covenant that (a) you will participate in the Associates Program and create, maintain, and operate your Site in accordance with this Agreement, (b) neither your participation in the Associates Program nor your creation, maintenance, or operation of your Site will violate any applicable laws, ordinances, rules, regulations, orders, licenses, permits, guidelines, codes of practice, industry standards, self-regulatory rules, judgments, decisions, or other requirements of any governmental authority that has jurisdiction over you (including all such rules governing communications, data protection, advertising, and marketing)…

                Amazon’s Associates Program Operating Agreement, Section 4: Warranties

                They further say:

                In addition we may (a) monitor, record, use, and disclose information about your Site and users of your Site that we obtain in connection with your display of Special Links and Program Content (for example, that a particular Amazon customer clicked through a Special Link from your Site before buying a product on the Amazon Site),(b) review, monitor, crawl, and otherwise investigate your Site to verify compliance with this Agreement…

                Amazon’s Associates Program Operating Agreement, Section 12: Additional Provisions

                What does this mean for you?

                You need to comply with applicable law, not just because it’s in your best interest to comply with the law, but also because to choose not to do so can be considered a breach of Amazon’s terms.

                1. Under most countries’ laws (including US and European Law), you’re required to have a valid privacy policy in place. This policy should include the relevant information related to your status as an Amazon Associate and which data you collect.
                2. If you have any Europe-based users, you’ll need to comply with the Cookie Law since Amazon uses cookies to crawl your site. This typically requires:
                  • having a notice or cookie banner informing your users of your use of cookies;
                  • a link to a cookie policy;
                  • a mechanism to block scripts that may install cookies before consent is obtained; and
                  • a means of registering/ collecting the consent to cookies.

                How iubenda can help you to meet requirements

                Privacy and Cookie Policy Generator

                Our Privacy and Cookie Policy Generator generates precise, fully customizable, lawyer-crafted policies. It makes complying with applicable law a simple matter of selecting the clauses applicable to you and entering your information.

                Once you’ve generated your policy, simply head to your dashboard and add our “Amazon Affiliation” service:

                How to add iubenda's Amazon Affiliation service

                Save and close the services window and you’re done. Simply add your owner and site details if you haven’t already, and head back to your site area to manage and embed your policy.
                You can read more about how to generate a privacy policy here.

                Cookie Solution

                Our Cookie Solution makes it easy for you to meet the complex technical requirements of the Cookie Law. Simply get started with setting up the Cookie Solution by clicking here and begin customization. If you generated a privacy policy then you’ve got this step covered and you can simply click Generate under Cookie Solution in your dashboard.

                Customizing the Cookie Solution

                Next link your cookie policy — if you generated and activated one with us the link will automatically be added and it will contain all the relevant information; if providing a link to your own external cookie policy, we strongly suggest reading about what your cookie policy should contain by clicking here.

                Customize as needed and embed the Cookie Solution code on your site. Depending on which platform your website uses, you can simply install one of our many plugins to make the set-up process even easier:

                Note: when setting up the Cookie Solution, be sure to implement your Prior Blocking methods correctly. You can read more about that here.

                See also

                The post Amazon Affiliate Program – required privacy policy additions appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policies and Australian Law https://www.iubenda.com/en/help/13856-privacy-policies-and-australian-law/ Wed, 02 Jan 2019 13:29:21 +0000 https://help.iubenda.com/?p=13856 – by James D. Ford, GAICD of Blue Ocean Law Group (iubenda Legal Network partner in Australia + New Zealand), Sydney, Australia. Privacy policies are legally required under most countries’ legislations including Australia (subject to some exceptions which we will discuss below). Overseas laws may apply to your Australian website/app Firstly, your law(s) of reference determine […]

                The post Privacy Policies and Australian Law appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                – by James D. Ford, GAICD of Blue Ocean Law Group (iubenda Legal Network partner in Australia + New Zealand), Sydney, Australia.


                Privacy policies are legally required under most countries’ legislations including Australia (subject to some exceptions which we will discuss below).

                Overseas laws may apply to your Australian website/app

                Firstly, your law(s) of reference determine which rules you’re subject to. Simply put, the laws of a particular region [for example, the EU GDPR] can apply to you in addition to local Australian law even if you don’t live, or run your business there.

                In general, the laws of a particular region can apply if:

                • you base your operations there; or
                • you use processing services or servers based in the region; or
                • your service targets users from that region (example: accepting payment in Euros).

                So to be clear, this basically means that regional regulations may apply to you and/or your business whether you’re located in the region or not.

                Be on the safe side, ensure you comply with the strictest regulations.

                For that reason, it’s always advisable that you approach your data processing activities with the strictest applicable regulations in mind. You can read more about which privacy laws apply to you here.

                Another point in favor of having a comprehensive privacy policy in place is that it’s simply good business to have a Privacy Policy:

                Regardless of whether legal obligations apply, all customers/clients today fully expect their personal data will be respected and protected. Any breach, aside from potentially leading to legal consequences, will directly impact business reputation, and ultimately could cause a small business to shut-down due to public loss of confidence.

                Legal Background – Australian Privacy Act 1988 (Comm.)

                The Act and Australian Privacy Principles (‘APPs’) govern the collection, storage, use and disclosure of Personal Information.

                Australian businesses are bound by the Privacy Act 1988 if:

                Caution

                The additional “second set” of criteria mean that every business regardless of turnover may be caught if they sell or purchase Personal Information or handle specific categories of Personal Information, such as TFN (Tax File Numbers, Health + Medical Data, etc.)

                Small business operators generally are exempt from the act unless one of the above-mentioned points apply. If you are unsure here is a checklist provided by the OAIC: Does my Small Business need to comply with the Privacy Act?

                If you are still unsure you should take the cautious approach and put relevant privacy measures in place as well as seek Independent Legal Advice.

                What is considered Personal Information?

                Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

                • whether the information or opinion is true or not; and
                • whether the information or opinion is recorded in a material form or not.

                The above definition of Personal Information is quite broad, and can include Internet Protocol (IP) addresses, Unique Device Identifiers (UDIDs) such as for a mobile phone or tablet, and other unique identifiers in specific circumstances.

                Location information, may also be covered because it can reveal user activity patterns and habits.

                If you are unsure whether you are using Personal Information please refer to this guide issued by the OAIC, and if still unsure please seek independent Legal Advice.

                Important

                If you trade in, or use Personal Information to sell advertising, including via an app, you’ll likely fall under the Privacy Act.

                What does ‘trading in personal information’ mean?

                A business is ‘trading’ in Personal Information if it collects from or discloses to someone else, an individual’s Personal Information for a benefit, service or advantage.

                A benefit, service or advantage can be any kind of financial payment, concession, subsidy or some other advantage or service. For example, buying a mailing list without first getting the consent of all the individuals on that list, or disclosing customer details to someone else for some commercial (monetary or otherwise) gain.

                If you trade in Personal Information you will have to comply with the Australian Privacy Principles in the Privacy Act. Complying with the Privacy Act does not prevent you from collecting Personal Information for your business needs, but it does mean you must follow the rules about how to handle that information.

                If you are unsure whether you are using Personal Information to sell advertising, you should seek Independent Legal Advice.

                Exemptions may apply where “consent” has been obtained for small businesses with turnover of $3 million or less that are not considered an APP entity for any other reason (refer to the second set of criteria discussed above). However even in this case, your should have an easy-to-read Privacy Policy so that you can ensure that you obtain clear informed consent as required.

                In order to avoid any question regarding whether valid “consent” has been obtained in accordance with the requirements of the Privacy Act, it is recommended that you be as clear and transparent as possible in your Privacy Policy about what Personal Information you are collecting, what you are doing with it, and the reasons why.

                It’s also highly recommended you request that the user actively indicate consent by having them take an affirmative action such as ticking a checkbox or clicking a button. This can be facilitated by adding a checkbox with a link to the privacy policy to your data collection forms, and by using something like a site banner to alert and collect your users’ consent to tracking technologies such as cookies.

                iubenda’s Cookie Solution makes setting up a site banner and linking to the Privacy Policy pretty easy. You can read more about the Cookie Solution here as well as how to customize your site banner here.

                Consequences of non-compliance

                There are significant potential penalties that can be imposed for non-compliance, and for repeat breaches, including enforceable undertakings and fines of up to $1.7 million per violation.

                How iubenda can help

                iubenda offers a convenient solution for ensuring best practice and a regularly updated Privacy Policy.

                iubenda provides an easy to use, comprehensive and self-updating solution from the EU where the legal privacy framework is even more stringent than that of Australia.  

                So, how does the iubenda Privacy Policy solution help you to comply with the specifics of Australian Law?

                The following table lists the relevant APP (Australian Privacy Principle) requirements, the related iubenda feature and comments on how it applies courtesy of the Australia-based Blue Ocean Law Group.

                Requirement Source Does the iubenda Privacy Policy comply with APP requirements? Comments for Australians reading a privacy policy
                An entity must have a clearly expressed and up to date privacy policy. APP 1.3 Yes, compliant.

                Privacy policy notes the date that it was last updated on all documents. As these documents are regularly updated remotely, the solution easily meets this requirement.

                The Privacy Policy follows best practice by being easy to read, using simple language + visual icons + showing a summary level, with the ability to drill down to display the entire Privacy Policy (as well as the Privacy Policies of external companies with which personal data is stored – showing a level of transparency we have not seen before).

                The privacy policy must set out the kinds of personal information that the entity collects and holds. APP 1.4 (a) Yes, compliant. The privacy policy includes a section on the types of personal information collected. Businesses should consider all types of personal information collected, and whether any is sensitive, such that specific protection legislation applies (e.g.TFN, Health/Medical data, etc.).
                The privacy policy must set out how the entity collects and holds personal information. APP 1.4 (b) Yes, compliant. The privacy policy includes a section on how personal information is collected and held. All businesses should conduct a comprehensive audit into the sources of personal information, how this comes to the business and is then stored. Then update the privacy policy to reflect the results of the review.

                Also consider how long you need to hold information and if you can de-identify or destroy the information you no longer need.

                The privacy policy must set out how an individual may access personal information held about them and seek correction. APP 10 + 1.4 (d) Yes, compliant. The privacy policy states in an easily accessible manner where the owner may be contacted and states the minimum rights of people in the EU (among them, the right to access and rectification). It is recommended that Non-European users of iubenda may elect to extend these rights to other individuals by using the setting provided for this purpose.

                Relevant clauses are extracted below.

                The rights of Users Users may exercise certain rights regarding their Data processed by the Owner. In particular, Users have the right to do the following:

                • Access their Data. Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
                • Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
                • Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

                How to exercise these rights? Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

                The privacy policy must set out how an individual may complain about a breach of the APPs and how the entity will deal with a complaint. APP 1.4 (e) Yes, compliant. The privacy policy provides guidance on how to lodge complaints with public data protection authorities. However, additional descriptions about the handling of complaints may be added by copying the default wording and personalizing it via the “add a Custom Service” feature.

                Relevant clauses are extracted below…

                The rights of Users Users may exercise certain rights regarding their Data processed by the Owner.

                In particular, Users have the right to Lodge a complaint:

                Users have the right to bring a claim before their competent data protection authority. Businesses can further fine-tune this by using the* “Add Custom Service” feature of the Privacy Policy Generator*.

                One way to do this is by using the International or Australian Standard in the management of complaints [ISO 10002:2014 or AS/NZS 10002:2014], or by adding in the relevant contact information for complaints to be lodged initially directly with the company.

                If choosing to customize in this way, please be sure to mention that:

                • a response will be obtained within 14 days; and that
                • if the user is still not satisfied, they have the right to bring a claim before the competent data protection authority. In Australia, this is the OAIC – Office of the Australian Information Commissioner. https://www.oaic.gov.au/
                The privacy policy must set out if the entity is likely to disclose personal information to overseas recipients. APP 1.4 (f) Yes, compliant. The Privacy Policy makes reference to overseas disclosure.

                All businesses should disclose if an overseas transfer of data will occur.

                Most companies with existing Privacy Policies which have not been reviewed since this requirement was introduced in 2014 will find their existing Privacy Policies are not compliant. All businesses should review all contracts with external parties to ensure that they are contractually bound to comply with their Privacy Policy and standards, the Act and APPs.

                Following on from the review they should update their Privacy Policy so that it complies with APP 1.4 (f) and APP 1.4 (g). Note APP 8: “8.1 Before an APP entity discloses personal information about an individual to a person (the overseas recipient):

                1. who is not in Australia or an external Territory; and
                2. who is not the entity or the individual — The entity must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.”
                If the entity is likely to disclose personal information to overseas recipients, it must list the countries in which such recipients are likely to be located if it is practicable to specify those countries in the policy. APP 1.4 (g) Yes, compliant. The Privacy Policy makes reference to overseas disclosure. One highly suggested customization here is to use the “add a Custom Service” feature to include a list of the relevant country/countries (where practical and applicable).

                An entity must take such steps as are reasonable in the circumstances to make its APP privacy policy available:

                1. free of charge; and
                2. in such form as is appropriate.
                APP 1.5 Yes, Compliant. The Privacy Policy is available online. Another highly suggested customization here is to use the “add a Custom Service” feature to include that individuals can request a copy of the policy via post.

                Warning: a Privacy Policy is not a set and forget document.

                As your business circumstances change, your Privacy Policy needs to be audited against your internal business processes (practices, procedures and documents – as well as what is actually done).

                Your Privacy Policy needs to be regularly reviewed to ensure it is compliant with the latest changes to Australian law.  

                As Australia moves towards the standards set by the EU, including potentially larger fines, regular audits and legal reviews will become even more important.

                This is where the iubenda solution truly shines as all legal documents generated with iubenda are hosted by iubenda and regularly updated to meet the latest legal requirements. You can read more about the benefits of this here.

                Other Australian Privacy Legislation

                While iubenda’s solutions make compliance easy for many aspects of the law, full business compliance requires a holistic approach which includes regularly auditing your internal processes to see where other obligations may apply.

                The following is a (non-exhaustive) list of additional compliance obligations imposed by Australian Law which may apply to you:


                This post was written by James D. Ford, GAICD of Blue Ocean Law Group, Sydney, Australia. Blue Ocean Law Group is the Legal Network Partner of iubenda in Australia + New Zealand and can be contacted via ahoy@blueocean.law or toll-free 1800-0-Adapt. Blue Ocean Law Group also collaborates with iubenda to present regular free webinars entitled “How to make your website/app easily compliant with Australian Law?”

                Create a privacy policy

                Start generating

                The post Privacy Policies and Australian Law appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy policy, GDPR forms and consent collection for Mailchimp https://www.iubenda.com/en/help/13638-privacy-policy-gdpr-forms-and-consent-collection-for-mailchimp/ Tue, 11 Dec 2018 11:22:18 +0000 https://help.iubenda.com/?p=13638 If you have a website, a contact/subscribe form and you use Mailchimp to manage your email newsletter, you’re likely wondering if you need to disclose this in your privacy policy (or you might be wondering if you even need to have a privacy policy in the first place). The answer is YES, a privacy policy […]

                The post Privacy policy, GDPR forms and consent collection for Mailchimp appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                If you have a website, a contact/subscribe form and you use Mailchimp to manage your email newsletter, you’re likely wondering if you need to disclose this in your privacy policy (or you might be wondering if you even need to have a privacy policy in the first place).

                The answer is YES, a privacy policy containing the correct disclosures is required from both a legal and third-party perspective.

                This guide will show you how to create a privacy policy for Mailchimp, and as a bonus, will explain the additional steps you may need to take to ensure that your mailing list and newsletter activities are compliant.

                Third-party Requirements

                Mailchimp explicitly states in Section 20 of their Terms of Use, that you must be compliant with all applicable laws. This usually means your country’s privacy laws and those of your users’.

                You’re responsible for determining whether the Service is suitable for you to use in light of your obligations under any regulations like HIPAA, GLB, EU data privacy laws (including the General Data Protection Regulation) (collectively, “EU Data Privacy Laws”), United States export control laws and regulations and economic sanctions laws and regulations (“U.S. Export Control Laws and Regulations”), or other applicable laws.

                The requirements are even more explicit if you’re located in the EEA (including the UK and Switzerland) or have anyone located in these regions on your mailing list:

                If you’re located in the European Economic Area, the United Kingdom, or Switzerland (collectively, the “EEA”) and/or distribute Campaigns or other Content through the Service to anyone located in the EEA (each such Member an “EEA Member”) in creating your Campaign distribution list, sending Campaigns via the Service, and/or otherwise collecting information as a result of creating or sending Campaigns, you represent and warrant to Mailchimp that:

                1. You will clearly post, maintain, and abide by a publicly accessible privacy notice on the digital properties from which the underlying data is collected that satisfies the requirements of applicable data protection laws, describes your use of the Service, and includes a link to Mailchimp’s Privacy Policy.
                2. You will get and maintain all necessary permissions and valid consents required to lawfully transfer data to Mailchimp and to enable such data to be lawfully collected, processed, and shared by Mailchimp for the purposes of providing the Service or as otherwise directed by you.
                3. You will comply with all laws and regulations applicable to the Campaigns sent through the Service, including those relating to (a) acquiring consents (where required) to lawfully send Campaigns, (b) the Content of Campaigns, and (c) your Campaign deployment practices.

                In addition, if you are an EEA Member, you acknowledge and agree that we have your prior written authorization to respond, at our discretion, to any data subject access requests we receive from your contacts made under EU Data Privacy Laws, or, alternatively, we may direct any such contacts to you so that you can respond to the request accordingly.

                Now that we’ve established that Mailchimp requires you to adhere to all applicable law, let’s take a look at the legal requirements below.

                Legal Requirements

                General privacy requirements

                Under most countries’ laws, you’re required to have a valid privacy policy in place. The privacy policy should include accurate and clearly stated details of who is doing the processing and for what purpose. Not doing so can often result in major fines and sanctions.

                Consent requirements

                Informed Consent

                If you fall under the scope of laws such as the GDPR and even Canada’s PIPA, in order to be considered as valid, the consent you collect must meet specific requirements including that of fully and correctly informing your users’ of the purposes, methods, and parties involved in the processing of their data.

                Consent Records

                Under laws such as the GDPR, if you do not have valid records of the Consents collected, you consents may be considered invalid — in some instances requiring to re-obtain consent. Your consent records should relevant details of the individual consent including method of collection, proofs related to the actual form and the privacy policy active at the time of collection. Read more about records of consent here.

                How to Comply

                1. Create a privacy policy for Mailchimp

                • Click on Start Generating, select either Website or App and fill in the name, set your language and click the generate button. This will create and take you to your site area. Now, under Privacy and Cookie Policy, click Generate now.
                • Next, Add any service you might be using — be sure to include your own processing activities as well as those of any third parties. In this case, your direct processing activity would be your mailing list, so you’ll need to add the “Mailing List or Newsletter“; since you’re using Mailchimp to handle your mailing list, must also add the “Mailchimp” service. Important: also consider adding “Direct Email Marketing (DEM)” if you monetize your newsletter. Once you’re finished adding all applicable services, click Save & Close.
                • Finally, (if you haven’t already) fill out your website owner and contact details and you’re done!
                • You can then click on the Manage and Embed link near the top of the page to integrate the privacy with your site using one of these available methods. Best practice is to include a link to your privacy policy from your newsletter footer (where it’s easily accessible to subscribers), in addition to the mandatory links on your website.

                *All our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

                2. Enable Mailchimp’s GDPR fields

                Mailchimp has long made available a feature called GDPR fields: GDPR-friendly forms include checkboxes for opt-in consent, and editable sections that explain how and why you are using data. Please note that just enabling GDPR fields on your signup forms does not make you compliant.

                Here’s what you have to do:

                • set up your GDPR-friendly signup form (enabling and editing GDPR fields);
                • segment your list based on the marketing permissions you receive from your signup form; and
                • collect valid consent from new and existing contacts.

                Visit mailchimp.com/help to learn more about how to use these features.

                Caution

                Simply having these features enabled does not automatically make you compliant. Remember, consent must be collected in accordance with whichever countries’ law applies to you, and mailing lists must be managed in a compliant way. Some of these requirements depend heavily on how you design your forms and your actual newsletter. For a full overview of what’s required, and visual examples of how you can implement it, read our Email and Newsletter Compliance Guide.

                Double Opt-In (optional)

                Mailchimp offers two opt-in settings for your lists: single opt-in and double opt-in. While single opt-in only requires that users submit their information in order to be added to your list, double opt-in requires that users first validate their email address before being added to your mailing list. The validation is carried out when users click on a specific link contained in a confirmation message sent to their email address.

                Depending on your organization’s needs, you may want to try the double opt-in process, which includes an extra confirmation step that verifies each email address. This method of registration is considered best practice in many countries and might be required in some (e.g. Germany).

                🔎
                Looking for a simple and compliant way to manage consent for newsletter subscriptions?

                Try our Newsletter Opt-in Booster 👉 it adds a customizable signup form to your site, allowing you to collect and manage consent through a double opt-in process for a more engaged and responsive audience.

                Activate now

                You can read Mailchimp’s guide on how to enable double opt-in for your lists here.

                3. Sign the Mailchimp DPA

                As stated in their terms of use (section 20.5), if you’re located in the EEA (including the UK and Switzerland) or may have anyone located in these regions on your mailing list, you’re required to sign a DPA with Mailchimp.

                You will sign and return Mailchimp’s Data Processing Addendum, which sets out your and Mailchimp’s obligations with respect to data protections and security when processing personal information. Once signed, the Data Processing Addendum will form part of and be incorporated into the Agreement. You can access our data processing agreement here, where you will be directed to log in to your account to sign the agreement online.

                -Mailchimp Terms of Use

                If you fall within the scope of the GDPR (and you likely do), it’s mandatory that you keep valid records of consent. These records should include:

                • who provided the consent;
                • exactly when and how you acquired consent from the individual user;
                • the consent collection form the user was presented with at the time of the collection; and
                • which conditions and legal documents were applicable at the time that the consent was acquired.

                This is, of course, a technical challenge.

                Our Consent Database simplifies this process by helping you to easily store proof of consent and manage consent and privacy preferences for individual consents — allowing you to track every aspect of the consent collected.

                Simply activate the Consent Database, get the API key, then install via HTTP API or JS widget and you’re done! You’ll be able to retrieve consents at any time and keep them updated.

                For more info on the Consent Database, read the Consent Database introduction guide, or, for a practical look at how the solution can be used on a WordPress site, check out our guide on How to use the Consent Database with Contact Form 7.

                To get started simply:

                Create a privacy policy for Mailchimp

                Start generating

                See also

                The post Privacy policy, GDPR forms and consent collection for Mailchimp appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for Facebook Apps https://www.iubenda.com/en/help/13561-privacy-policy-for-facebook-apps/ Thu, 06 Dec 2018 16:25:39 +0000 https://help.iubenda.com/?p=13561 This post mainly answers the question of how and why you have to include a privacy policy in your Facebook application.  In this guide: Do you have to include a privacy policy when maintaining a Facebook app? Legal Facebook’s requirement/terms of use What happens if you don’t comply with these requirements Meeting Facebook’s (and your […]

                The post Privacy Policy for Facebook Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                This post mainly answers the question of how and why you have to include a privacy policy in your Facebook application. 

                Do you have to include a privacy policy when maintaining a Facebook app?

                In short, YES you do. There are both legal and third-party requirements to be met here.

                Web apps, like most apps, often collect some sort of personal data as a rule of thumb for various reasons. Personal data might be used for testing, providing insight into how the application is being used, monetization or for any number of other reasons. Under most countries’ legislations, if processing any kind of personal data, you’re required to have a compliant privacy policy made easily available to your users. Depending on your law of reference, personal data can include even ip addresses – and there are often hefty penalties (including fines, loss of services, audits and potential law suits) for non-compliance.

                You can find out how to determine your law of reference here.

                Facebook’s requirement/terms of use

                Facebook (now Meta) requires users of their app platform to use a privacy policy for an app as soon as you collect data from their users. In Meta Platform Terms you will find the following:

                • Provide and comply with a publicly available and easily accessible privacy policy.
                • The privacy policy must comply with applicable law and regulations and must accurately and clearly explain what data you are processing, how you are processing it, the purposes for which you are processing it, and how Users may request deletion of that data.
                • You may only data as clearly described in your privacy policy and in accordance with all applicable law and regulations, the Meta Platform Terms, and all other applicable terms and policies.
                • Your privacy policy will not supersede, modify, or be inconsistent with the Meta Platform Terms or any other applicable terms or policies.
                • You must retain all of your privacy policies in effect and provide them to Meta if they ask for them.
                • ou will maintain publicly available links to your privacy policies in the privacy policy field in the settings of your App Dashboard, as well as in any App Store that allows you to do so, if applicable, and ensure the links remain current and up to date.

                As well as:

                • You also must comply with all applicable laws and regulations (including the Children’s Online Privacy Protection Act (“COPPA”) and the Video Privacy Protection Act (“VPPA”)).
                Note

                As mentioned in the quote above, if your app is directed towards children based in the US, you’ll be required to comply with the U.S. Children’s Online Privacy Protection Act which introduces more stringent rules for your apps when you target children under the age of 13. Similarly, if you fall under the scope of the GDPR, you’ll need to comply with the GDPR’s guidelines for processing the data of minors.

                What happens if you don’t comply with these requirements?

                • Your Facebook App will not go live without a public and accessible Privacy Policy. Also keep in mind that Facebook doesn’t offer any kind of hosting service for this.
                • You may face legal consequences.

                Meeting your requirements here is actually quite straightforward:

                1. Create a compliant and valid privacy policy that makes all the legally required disclosures about your processing activities, including a clause that explicitly mentions the processing that Facebook does on your behalf and provide an easily accessible link to the policy from within the app (read about how to do this in the section below).
                2. If your app is accessible to people based in the EU, include a cookie policy and implement a system that notifies users of your use of cookies, blocks cookies prior to obtaining your users’ consent and be able to prove consent.
                3. Respect what you’ve stated in your privacy policy and ensure that you handle users’ data in a way that is compliant with applicable law.

                How to create a privacy policy for a Facebook app

                Here’s where our Privacy and Cookie Policy Generator comes in very handy: with 1700+ available clauses, our generator lets you easily include all elements commonly required across many regions and third-party services, while applying the strictest standards by default – giving you the option to fully customize as needed.

                All our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

                The generation process is easy and intuitive:

                The cookie policy is a section of the privacy policy dedicated to cookies. It details all legally required information including the categories of cookies used, their purposes, names the third parties who install or may install cookies through the website and provides links to said third parties’ respective privacy policy and possible consent forms.

                The Generator features a one-click set-up for the cookie policy which then automatically pulls all the relevant cookie information from the services indicated in your privacy policy. If using iubenda’s Cookie Solution to manage your cookies, the link to this cookie policy will be included in your cookie banner by default once activated.

                Managing cookies

                In addition to your cookie policy, you’ll need to notify users about your use of cookies (via something like a site banner), block scripts prior to obtaining consent and be able to show proof of the consent.

                🚀 Our Privacy Controls and Cookie Solution makes this task simple. Just click to activate, then integrate the script into your app (or website).

                The solution lets you block scripts prior to consent, gives you a customizable banner that links to your cookie policy, lets you remember consent for individual users and indicates proof of consent. It’s also integrated with IAB Europe’s Transparency and Consent Framework to facilitate preference management (if you choose to activate this feature).

                You can read more about setting up your app for the Cookie Law here or just start generating below (you can easily activate the Cookie Solution from within your site dashboard area).

                Create a policy for your Facebook app

                Start generating

                See also

                The post Privacy Policy for Facebook Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                COPPA and Mobile Apps for Children Aged Under 13 https://www.iubenda.com/en/help/13394-coppa-mobile-apps/ Thu, 29 Nov 2018 16:39:08 +0000 https://help.iubenda.com/?p=13394 This is a guide on how to design your apps for children aged under 13 (and websites, since apps are a subset to the web) on the privacy front and under the rule of COPPA 2013. COPPA is an abbreviation for the Children’s Online Privacy Protection Act (COPPA) that was enacted by Congress in 1998 and required […]

                The post COPPA and Mobile Apps for Children Aged Under 13 appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                This is a guide on how to design your apps for children aged under 13 (and websites, since apps are a subset to the web) on the privacy front and under the rule of COPPA 2013.

                COPPA is an abbreviation for the Children’s Online Privacy Protection Act (COPPA) that was enacted by Congress in 1998 and required the Federal Trade Commission to issue and enforce regulations concerning children’s online privacy. The amended Rule became effective on July 1st, 2013.

                The primary goal of COPPA is to protect children’s privacy online (and at the same time on the mobile ecosystem). COPPA puts parents in control over what information from their children.

                When Do I Fall under COPPA?

                When do you as a web or mobile developer or operator/owner of these services fall under COPPA? And what does that fact mean for you?

                The Rule applies to:

                • operators of commercial websites and online services (again, it includes mobile apps) directed to children under 13 that collect, use, or disclose personal information from children;
                • operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13;
                • websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children.

                In a nutshell: if you develop apps or run websites directed to children under 13 years of age and collect their personal information you are very likely to fall under COPPA and should therefore follow its rules.

                There are a few things we still have to look at more deeply here:

                • What is a website or online service as they are quoted in the Rule?
                • What is personal information exactly?
                • And what does collect, use or disclose mean in this context?

                Turns out the terms in the Rule are mostly defined broadly:

                Website or online service

                So what is the definition of a website or online service under COPPA?

                • mobile apps that send or receive information online (like network-connected games, social networking apps, or apps that deliver behaviorally-targeted ads);
                • internet-enabled gaming platforms;
                • plug-ins;
                • advertising networks;
                • internet-enabled location-based services;
                • voice-over internet protocol services.

                Personal Information

                What kind of information is considered personal and therefore triggers the COPPA compliance requirement? This is important: COPPA has updated the list for “personal information” that cannot be collected without parental notice and consent to include geolocation information, photographs, video and  audio files that contain a child’s image or voice.

                At large the list of personal information looks like this:

                • full name;
                • home or other physical address, including street name and city or town;
                • online contact information like an email address or other identifier that permits someone to contact a person directly — for example, an IM identifier, VoIP identifier, or video chat identifier;
                • screen name or user name where it functions as online contact information;
                • telephone number;
                • Social Security number;
                • a persistent identifier that can be used to recognize a user over time and across different sites, including a cookie number, an IP address, a processor or device serial number, or a unique device identifier;
                • a photo, video, or audio file containing a child’s image or voice;
                • geolocation information sufficient to identify a street name and city or town; or
                • other information about the child or parent that is collected from the child and is combined with one of these identifiers.

                What is, then, the collection of personal information like the above?

                Collecting Personal Information

                You are collecting information if you request, prompt, or encourage the submission of information, even if it’s optional.

                • let information be made publicly available (for example, with an open chat or posting function);
                • unless you take reasonable measures to delete all or virtually all personal information before postings are public and delete all information from your records;
                • or passively track a child online.

                If another company collects personal information through your child-directed site or service — through an ad network or plug-in, for example — you’re responsible for complying with COPPA.

                If you have actual knowledge that you’re collecting personal information directly from users of a child-directed site or service, you’re responsible for complying with COPPA, too. So how do you go from being required to follow COPPA’s rules, to actually complying?

                How Do I Comply with COPPA?

                • Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from children.
                • Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children.
                • Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties (unless disclosure is integral to the site or service, in which case, this must be made clear to parents).
                • Provide parents access to their child’s personal information to review and/or have the information deleted.
                • Give parents the opportunity to prevent further use or online collection of a child’s personal information.
                • Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security.
                • Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use.

                Let us dissect this again:

                Post a clear and comprehensive online privacy policy

                This is the first step where iubenda comes in helpful. To generate a privacy policy with us, visit the generator. You can add our COPPA compliance clause “The Service is directed to children under the age of 13”.

                Generally, if you feel like doing it by yourself you’ll have to follow this pattern: describe clearly and comprehensively how personal information is collected. The notice must describe not only your own practices (description of what is collected and how it is used), but also the practices of any others collecting personal information on your site or service, like for example third party applications you may be using.

                Link to your policy from a prominent spot. What separates the privacy policy under COPPA from other privacy policies is the inclusion of a description of parental rights. Your privacy policy must tell parents:

                • that you won’t require a child to disclose more information than is reasonably necessary to participate in an activity;
                • that they can review their child’s personal information, direct you to delete it, and refuse to allow any further collection or use of the child’s information;
                • that they can agree to the collection and use of their child’s information, but still not allow disclosure to third parties unless that’s part of the service (for example, social networking); and
                • the procedures to follow to exercise their rights.
                Privacy Policy Generator - COPPA clause

                If you want us to help you accomplish this, try the generator and don’t forget to add our COPPA clause.

                Before you start collecting personal information from children, you need to give parents “direct notice”. The notice must be clear and easy to read and include the following:

                • that you collected their online contact information for the purpose of getting their consent;
                • that you want to collect personal information from their child;
                • that their consent is required for the collection, use, and disclosure of the information;
                • the specific personal information you want to collect and how it might be disclosed to others;
                • a link to your online privacy policy;
                • how the parent can give their consent; and
                • that if the parent doesn’t consent within a reasonable time, you’ll delete the parent’s online contact information from your records.

                If you change your practices, make sure to send an updated direct notice to parents so they know about those changes. There are circumstances that allow to skip the requirement for getting parental consent. 

                Additionally to the direct notice you need to get parents’ verifiable consent before starting the collection of personal information from their children. The way you do this is up to you, but you should be able to ensure that the person giving consent is the child’s parent.

                Acceptable methods of verifiable parental consent:

                • sign a consent form and send it back to you via fax, mail, or electronic scan;
                • use a credit card, debit card, or other online payment system that provides notification of each separate transaction to the account holder;
                • call a toll-free number staffed by trained personnel;
                • connect to trained personnel via a video conference; or
                • provide a copy of a form of government issued ID that you check against a database, as long as you delete the identification from your records when you finish the verification process.

                The method “Email Plus”

                If you will use a child’s personal information only for internal purposes and won’t disclose it, you may use a method known as “email plus”.

                Using that method, you’ll send an email to the parent and have them respond with their consent. You must send a confirmation to the parent via email, letter, or phone call. Using “email plus”, you must let the parent know they can revoke their consent anytime.

                App Stores

                If you are a mobile developer, let us walk you through some of the relevant information from the documentation.

                Apple App Store and Coppa

                Apple has recently changed their App Store Review Guidelines and requires you to include a privacy policy. In their guideline they go on to declare a few relevant things:

                Apps in the Kids Category must not include links out of the app, purchasing opportunities, or other distractions to kids unless reserved for a designated area behind a parental gate. … These apps may not include behavioral advertising (e.g. the advertiser may not serve ads based on the user’s activity), and any contextual ads must be appropriate for young audiences. You should also pay particular attention to privacy laws around the world relating to the collection of data from children online.

                And again:

                It is critical to use care when dealing with personal data from kids, and we encourage you to carefully review all the requirements for complying with laws like the Children’s Online Privacy Protection Act (“COPPA”), the European Union’s General Data Protection Regulation (“GDPR”), and any international or local equivalents.

                Apps may ask for birthdate and parental contact information only for the purpose of complying with these statutes, but must include some useful functionality or entertainment value regardless of a person’s age.

                Moreover, apps in the Kids Category or those that collect, transmit, or have the capability to share personal information (e.g. name, address, email, location, photos, videos, drawings, the ability to chat, other personal data, or persistent identifiers used in combination with any of the above) from a minor must include a privacy policy and must comply with all applicable children’s privacy statutes.

                Parental Gates

                Apple’s 1.3 & 5.1.4 mention the term “parental gate”. Parental gates are used in apps targeted towards kids to prevent them from engaging in commerce or following links out of an app to websites, social networks, or other apps without the knowledge of their parent or guardian. 

                There is no set way to do this. For example, you can:

                • include instructions that describe a specific task or combination of interactions for an adult to complete;
                • consider using a voice over prompt to help kids know they need to involve their parent; or 
                • require users to correctly answer age-appropriate questions in order to continue.

                You can read more about the App Store’s requirements regarding privacy policies in iOS apps here.

                Google Play Store and COPPA

                The Google Play store doesn’t impose any similar additional rules as the App Store does. The only reference to COPPA is the following in the Google Play Terms of Service:

                Age Restrictions. In order to use Google Play, you must have a valid Google account (“Google Account”), subject to the following age restrictions. If you are considered a minor in your country, you must have your parent or legal guardian’s permission to use Google Play and to accept the Terms. You must comply with any additional age restrictions that might apply for the use of specific Content or features on Google Play. Family managers and family members must meet these additional requirements as well.

                You can read more about Android and privacy policies in general in our dedicated guide.

                Summary for COPPA Compliance

                If you collect any personal information by children you have to be extra careful with your privacy policy and what you do within your app. We advise you to follow COPPA’s requirements carefully and take a look at what you may need to do according to app store terms if you are a mobile developer.

                Also don’t forget to double-check if your third party services are compliant with COPPA because you are liable for their collection practices as well.

                Create a privacy policy for your app for children under 13 years

                Start generating

                See also

                The post COPPA and Mobile Apps for Children Aged Under 13 appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for Google Analytics Advertising and Remarketing Features https://www.iubenda.com/en/help/12379-privacy-policy-google-analytics-advertising-remarketing/ Tue, 23 Oct 2018 16:02:04 +0000 https://help.iubenda.com/?p=12379 As you probably already know, if your website or mobile app uses Google Analytics, you definitely need to have a Privacy Policy where you disclose the use of Google Analytics, and how it collects and processes data. Using the remarketing feature of Google Analytics entails additional information obligations within the privacy policy. These obligations are […]

                The post Privacy Policy for Google Analytics Advertising and Remarketing Features appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                As you probably already know, if your website or mobile app uses Google Analytics, you definitely need to have a Privacy Policy where you disclose the use of Google Analytics, and how it collects and processes data.

                Using the remarketing feature of Google Analytics entails additional information obligations within the privacy policy. These obligations are fully described in the Policy requirements for Google Analytics Advertising Features guide.

                Here are the most relevant parts:

                If you’ve enabled any Google Analytics Advertising features, you are required to notify your visitors by disclosing the following information in your privacy policy:

                • The Google Analytics Advertising Features you’ve implemented.
                • How you and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as Google advertising cookies) or other third-party identifiers together.
                • How visitors can opt-out of the Google Analytics Advertising Features you use, including through Ads Settings, Ad Settings for mobile apps, or any other available means (for example, the NAI’s consumer opt-out).

                We also encourage you to point users to Google Analytics’ currently available opt-outs for the web.

                European Union user consent policy

                When using Google Analytics Advertising Features, you must also comply with the European Union User Consent Policy.

                Interest-based advertising

                If you’ve enabled interest-based advertising, including Remarketing, with Google Analytics in connection with other Google services, you must follow the policies applicable to those Google services (like the Google Ads Policy for Personalized advertising and its sensitive category restrictions, and the Platform Program Policies).

                If you use Google Analytics to collect sensitive information about your visitors, as described in the Google Ads sensitive category restrictions, you may not use Google Analytics to collect data for the purpose of interest based advertising.

                In short, Google asks you to:

                • inform users about the Google Analytics features you use;
                • obtain end users’ legally valid consent to:
                  • the use of cookies or other local storage where legally required; and
                  • the collection, sharing, and use of personal data for personalization of ads;
                • retain records of consent given by end users and provide end users with clear instructions for revocation of consent.

                Google Analytics’ enhanced advertising features

                There are, however, specific additional requirements which apply when using Google Analytics’ enhanced advertising features such as Remarketing; Google Display Network Impression Reporting; Demographics and Interest Reporting; integrated services that require Google Analytics to collect data for advertising purposes (including the collection of data via advertising cookies and identifiers); and the User-ID feature.

                Meeting the Requirements of Google’s “EU user consent policy”

                We suggest that you also take a look at Google’s European Union User Consent Policy. This Google policy lists additional requirements specific to how you must handle data and consents of end users based in the European Economic Area, and compliance with it is vital. Google states:

                If your agreement with Google incorporates this policy, or you otherwise use a Google product that incorporates this policy, you must ensure that certain disclosures are given to, and consents obtained from, end users in the European Economic Area. If you fail to comply with this policy, we may limit or suspend your use of the Google product and/or terminate your agreement.

                How iubenda can help

                Meeting the requirements of Google’s EU Consent Policy and the related EU regulations is a simple two-part process involving both the Privacy and Cookie Policy Generator and the Privacy Controls and Cookie Solution.

                Privacy and Cookie Policy Generator

                With 1700+ available clauses, our privacy and cookie policies contain all elements commonly required across many regions and services, while applying the strictest standards by default – giving you the option to fully customize as needed.

                With our generator you can quickly set up the privacy and cookie policy you need for your website. Start generating a privacy policy and, among the services available, search for:

                • Google Analytics
                • Remarketing with Google Analytics – In which you outline that you connect tracking activity performed by Google Analytics and its cookies with the Google Ads network.
                • Google Analytics Advertising Reporting Features – In which you outline that you’ve activated any Google Advertising Reporting Features such as the use of DoubleClick Campaign Manager reporting, DoubleClick Bid Manager reporting or the Google Display Network Impression Reporting.
                • Google Analytics Demographics and Interests Reports – In which you outline that you’ve activated display advertiser features such as the use of demographics and interest data for your analytics reports.
                • Google Ads Remarketing – In which you outline that traffic on your site gets connected to the Google Ads network for remarketing purposes.
                • Google Ads Similar Audiences – In which you outline that you’re managing your ads through Google Ads Similar audiences. 
                • Google Ad Manager Audience Extension – In which you outline that the traffic on your site gets connected to the Google Ad Manager network for remarketing purposes.
                • User ID extension for Google Analytics – A feature used for associating multiple sessions with a unique ID.
                • Google Signals – A feature that enhances remarketing & reporting by giving you cross-device user reports.
                Note

                The service formerly known as Display Advertising extension for Google Analytics has been turned into two separate services:

                • Google Analytics Advertising Reporting Features
                • Google Analytics Demographics and Interests Reports

                The Google Analytics clause is available for free, while other services require a Pro License.

                Example

                For example, if you define your remarketing lists via Google Analytics and run the campaign via Google Ads, you would add Google Analytics Advertising Reporting FeaturesGoogle Analytics Demographics and Interests reportsRemarketing with Google Analytics and Google Ads Remarketing to your iubenda privacy policy.

                Read the guide on How to Generate a Privacy Policy here.

                Privacy Controls and Cookie Solution

                Our cookie consent management solution allows you to:

                • easily inform users via banner and a dedicated cookie policy page (which is automatically linked to your privacy policy and integrates what’s necessary for cookie law compliance);
                • obtain and save cookie consent settings;
                • preventively block scripts prior to consent; and
                • keep track of consent and save consent settings for each user for up to 12 months from the last site visit.
                Google Consent Mode

                To help advertisers manage cookies for analytics and advertising purposes, Google has introduced Consent Mode, a feature that allows you to avoid prior blocking for Google Analytics and Google Ads (including Google Ads Conversion Tracking and Remarketing).

                Learn how to implement it with our Privacy Controls and Cookie Solution.

                Create a privacy policy for Google Analytics

                Start generating

                See also

                The post Privacy Policy for Google Analytics Advertising and Remarketing Features appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for Facebook Lead Ads https://www.iubenda.com/en/help/12158-privacy-policy-facebook-lead-ads/ Mon, 15 Oct 2018 13:41:30 +0000 https://help.iubenda.com/?p=12158 What are Facebook Lead Ads? In Facebook’s words: Lead Ads are a type of ad that allows you to run lead generation campaigns on Facebook and Instagram. Unlike other ad types, Lead Ads include a contact form, called an “instant form”, that lets people show their interest in a product or service by filling out […]

                The post Privacy Policy for Facebook Lead Ads appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                What are Facebook Lead Ads? In Facebook’s words:

                Lead Ads are a type of ad that allows you to run lead generation campaigns on Facebook and Instagram. Unlike other ad types, Lead Ads include a contact form, called an “instant form”, that lets people show their interest in a product or service by filling out the form with their details and allowing a business to follow up with them.

                On your Lead Ads instant form, you can request email addresses or contact information from people who click on your ad. You can even ask people custom questions. Lead Ads can be used to collect sign-ups for newsletters, price estimates, follow-up calls and business information.

                In the following example, you can see a Sleeknote Lead Ad from the users’ perspective. As you can see, it looks like any other sponsored Facebook ad:

                Facebook Lead Ad

                However, when you click “Download”, instead of directing you to a completely different website, this pop-up form appears:

                Facebook Lead Ad

                After adding the information requested and pressing submit, a confirmation window appears and you’re given the option to go back to your newsfeed.

                Legal obligations and Facebook’s requirements

                Below, we’ll detail some of the legal complications of this type of data collection and tell you how you can best meet both your legal obligations and facebook’s terms.

                By clicking a Facebook lead ad, customers will see a form that’s already filled with info that they’ve shared with Facebook – such as their name, number or email address. The form is mobile-device friendly and designed for the least amount of typing possible. So it’s quicker for customers to reach you – and gives you accurate, actionable info so that you can contact them.

                This is, of course, very useful, however this also means that these potential customers share their personal data with you and that has resulted in Facebook requiring privacy policy links from all of their Facebook Lead Ads users:

                Facebook Lead Ad - Privacy Policy

                Here’s what Facebook tells you in their Lead Ads Terms of Service:

                B. You will ensure that each Lead Ad includes the following disclosures to Facebook users: (i) all disclosures and choice mechanisms necessary and sufficient to comply with applicable laws, rules and regulations, including any necessary offer terms promoted in the Lead Ad (e.g., criteria to qualify, expiration date, or limitations on redemption) (“Offer Terms”); (ii) a clear and prominent disclosure that if a user submits data to you through a Lead Ad, such data will be governed by your privacy policy; and (iii) a link to your privacy policy. You will further ensure that no Lead Ads will be targeted to any minors.

                To be clear, having a valid privacy policy is legally required under most countries’ legislations anyway, however Facebook has also made it mandatory that you provide one in order to access the Lead Ads service.

                iubenda helps a great deal with this. By signing up and simply telling us exactly which data your site collects, you can have a customized and precise privacy policy in minutes. The privacy policy can then be embedded into your site and/ or you can simply use the direct link provided.

                How to add a privacy policy for Facebook Lead Ads

                1. Generate and customize your privacy policy (very important as in order to be valid, privacy policies should be precise and specific to your situation). Save and close.
                2. Next, head to your embed area and click on the Use a direct link tab. Copy the link.
                3. On your Facebook Ads account go to Lead Generation and click New Form. Add a link to your privacy policy under the section labeled Privacy Policy > Link URL.
                4. You can optionally customize the link’s text (via the Link Text field), however, since you need to be as clear as possible, we suggest sticking to the standard “Privacy Policy” as your link text. If you leave this field blank, Facebook will likely automatically set the text to “Privacy Policy”.
                Facebook Lead Ad

                Additional guidelines marketers with EU-based users

                Based on various requirements — notably the GDPR and ePrivacy Directive — marketers based in the EU or marketers who target EU-based individuals need to ensure that valid user consent is obtained before collecting or otherwise processing users’ data . Additionally, you’re only allowed to use the data for the purposes outlined to and consented by the user, at the time at which the consent was attained.

                Consent

                In order to be considered valid, consent must be informed and actively indicated. Common practice, therefore, is to include an checkbox that isn’t pre-checked with visible links to your privacy policy and a precise description of the purpose of the data collection. The user must clearly understand who they’re giving their consent to, and how they can withdraw that consent if they so desire.

                Furthermore, the consent must be specific to the purpose, meaning that multiple purposes require multiple consents. Click here for an example of how to do this using a single form.

                Double Opt-in

                Best practice when using email forms to collect consent, is to add an additional verification step known as double opt-in. This final step helps you to confirm that the person giving consent is indeed the owner of the email address provided.

                This is particularly useful for marketers as

                • it greatly reduces the probability of your email address being flagged as spam due to unwanted contact; and
                • having fully verified consent is useful and adds an additional layer of legitimacy to your legally mandated Records of Consent.

                For more information on how to handle email lists and newsletters in a legally compliant way, read our detailed Email & Newsletter Compliance Guide.

                While we HIGHLY suggest reading the guide linked above, we’ve created the following practical list to help you get up and running as quickly as possible with Facebook Lead Ads.

                Lead Ad process and checklist

                1. Under Lead Generation click New Form.
                2. Enter your text, image and questions, being careful to apply the principles of data minimalism — i.e. only ask for the data that you actually need in order to fulfil your purpose.
                3. Remember to tell people the exact purpose of why you want their data (for example email address, for your newsletter, or you are giving away an infographic, or potentially both). This way they know what they to expect. You will use the lead ad’s text field to outline what the purpose is of your lead ad.

                4. Make sure that your users are clearly informed of how they can withdraw their consent if they so choose.
                5. While iubenda automatically includes some necessary details related to user rights in your policy (see What Should Be in a Privacy Policy), when creating your privacy policy, remember to add services specific to your particular purposes of data collection. In this case, at minimum you’ll need to select the Mailing list or newsletter service and whichever facebook services apply.
                  Add Facebook services to your privacy policy
                6. Add a link to your privacy policy and any additional disclaimers you may have.
                7. Don’t use the data for any purpose other than the ones you’ve outlined on the lead ad form and further detailed in your privacy policy.
                8. Important! Since Facebook doesn’t have the option of adding an un-checked box, utilizing double-opt-in could make your consent more meaningful. We strongly suggest using this approach here.

                Create a privacy policy for your Facebook Lead Ads

                Start generating

                See also

                The post Privacy Policy for Facebook Lead Ads appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for Google Ads Remarketing https://www.iubenda.com/en/help/12079-privacy-policy-for-google-ads-remarketing/ Wed, 10 Oct 2018 13:21:18 +0000 https://help.iubenda.com/?p=12079 Google Ads Remarketing is a powerful tool that allows you to further enhance your marketing efforts by giving you the ability to reach people who previously visited your website or app. However, using this feature also comes with its specific privacy-related responsibilities. Under the vast majority of global legislations you must explicitly inform your users […]

                The post Privacy Policy for Google Ads Remarketing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Google Ads Remarketing is a powerful tool that allows you to further enhance your marketing efforts by giving you the ability to reach people who previously visited your website or app. However, using this feature also comes with its specific privacy-related responsibilities.

                Under the vast majority of global legislations you must explicitly inform your users of the fact that you gather information for these purposes on your website.

                In addition to the legal requirements, Google also expressly requires that you disclose any remarketing activity to your end users.

                In Google’s words:

                When you use the remarketing feature in your website, you’re required to have the following information in your website’s privacy policy:

                • An appropriate description of how you’re using remarketing or similar audiences to advertise online.
                • A message about how third-party vendors, including Google, show your ads on sites across the Internet.
                • A message about how third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to your website.
                • Information about how your visitors can opt out of Google’s use of cookies by visiting Google’s Ads Settings. Alternatively, you can point your visitors to opt out of a third-party vendor’s use of cookies by visiting the Network Advertising Initiative opt-out page.

                So what does this mean in practical terms? What do you have to do?

                If you want to ensure that you comply with Google’s terms ( and with the law) you’ll need to:

                1. Create a legally compliant privacy policy. Read the specifics below.
                2. Ensure that the privacy policy includes clauses specific to the processing activities handled via Google Ads Remarketing.
                3. Include a cookie policy. From the quote above, you’ll note that in addition to the general privacy policy requirement, Google further requires that you include notice of your use of cookies as well.
                4. Handle cookies and consent to cookies in a legally compliant way. This generally means informing users of the use of cookies (as mentioned in the previous point), obtaining consent to the use of cookies and maintaining proof of that consent. One Analytics feature that may help with the consent requirement here is the IP Anonymization feature, however, you’re still required to inform users in a conspicuous and detailed way, about the use of even these cookies. Furthermore, the use of cookies may be considered “monitoring behavior” under the GDPR, even where those cookies are anonymized statistical cookies. Therefore, it is recommended that you block cookies prior to obtaining express consent, by default.
                Google Consent Mode

                To help advertisers manage cookies for analytics and advertising purposes, Google has introduced Consent Mode, a feature that allows you to avoid prior blocking for Google Analytics and Google Ads (including Google Ads Conversion Tracking and Remarketing).

                Learn how to implement it with our Cookie Solution.

                Generally, the national/regional laws of your base of operations will apply, as well as (in many cases), the laws governing the regions in which your users are based. This can be quite tricky online, as, unless you’re actively blocking some regions, you may need to address requirements across geographical boundaries and legal jurisdictions.

                For this reason, it’s always the best idea to handle these activities with the strictest applicable regulations in mind (currently European Law, mainly the GDPR and Cookie Law).

                Example outline of a privacy policy for Google Ads Remarketing

                While the exact required contents of a privacy policy will vary depending on the law applicable to you and all your specific processing activities, in general, a compliant privacy policy that’s also valid for Google Ads Remarketing activities should contain:

                • site/app owner details;
                • description of what data is being collected; 
                • the Legal basis for the collection (GDPR-specific but may likely apply to you);
                • which third-party have access to the data (include Google here);
                • for which specific purposes are the data collected — including third-party purposes (e.g analytics, marketing activities such as remarketing);
                • user rights in regards to their data;
                • information related to cross-border data transfer (if applicable);
                • your notification process for policy changes;
                • the effective date of the privacy policy; and
                • a cookie-related section (also known as the “cookie policy”).

                See our post on the Elements of a Privacy Policy for a more detailed list of basic privacy policy requirements.

                Important

                The exact required contents of your privacy policy depends heavily on your processing activities, law of reference and may even need to address requirements across geographical boundaries and legal jurisdictions.

                You can read more about determining your law of reference here or read our in-depth Legal Overview Guide here.

                How to create a privacy policy for Google Ads Remarketing

                Because a valid privacy policy must always be up-to-date and specific to your own particular situation, it can be a both legally and technologically difficult to write a compliant policy yourself.  Here’s where our Privacy and Cookie Policy Generator comes in very handy: with hundreds of available clauses, our privacy policies contain all elements commonly required across many regions and third-party services (including Google products), while applying the strictest standards by default – giving you the option to fully customize as needed.

                Our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

                Creating a privacy policy for Google Ads Remarketing is straightforward and intuitive:

                • Enter the name of your website or app and start generating
                • Add any service you may be using. In this case, it will be “Google Ads Remarketing
                  Add 'Google Ads Remarketing' service
                • Fill out your web/app owner and contact details
                • Add the iubenda Privacy Policy to your site (a best practice is to link to your privacy policy from your footer, where your users or visitors can find it at any given time)
                Note

                Analytics services use various techniques to track user behavior and must be mentioned in the privacy policy. Add “Google Ads conversion tracking” clause if you use this analytics service. Conversion tracking services are useful for understanding the impact of your advertising spend on a given network.

                For more guidance on selecting services or  how to structure your privacy policy read How to Generate a Privacy Policy.

                Create a privacy policy for Google Ads Remarketing

                Start generating

                See also

                The post Privacy Policy for Google Ads Remarketing appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for Google AdSense https://www.iubenda.com/en/help/12047-privacy-policy-for-google-adsense/ Wed, 10 Oct 2018 10:00:00 +0000 https://help.iubenda.com/?p=12047 Google AdSense may utilize user data for advertising communication purposes by tracking user interactions with your content and with ads. This is why, in accordance with most countries’ privacy laws, Google requires you to have a privacy policy if you use Google products like Google AdSense and a cookie management solution where applicable (especially if […]

                The post Privacy Policy for Google AdSense appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Google AdSense may utilize user data for advertising communication purposes by tracking user interactions with your content and with ads. This is why, in accordance with most countries’ privacy laws, Google requires you to have a privacy policy if you use Google products like Google AdSense and a cookie management solution where applicable (especially if running personalized ads).

                As a matter of fact, when you sign up for Google AdSense, you consent to their terms and conditions which states under section “10. Privacy”:

                Our privacy policy explains how we treat your personal data and protect your privacy when you use our Services. By using our Services, you agree that Google can use such data in accordance with our privacy policy. You and Google also agree to the Google Ads Controller-Controller Data Protection Terms.

                You will ensure that at all times you use the Services, the Properties have a clearly labeled and easily accessible privacy policy that provides end users with clear and comprehensive information about cookies, device-specific information, location information and other information stored on, accessed on, or collected from end users’ devices in connection with the Services, including, as applicable, information about end users’ options for cookie management. You will use commercially reasonable efforts to ensure that an end user gives consent to the storing and accessing of cookies, device-specific information, location information, or other information on the end user’s device in connection with the Services where such consent is required by law.

                This means that – aside from likely breaking the law – not having a privacy policy would also put you in violation of the Terms you agreed to with Google.

                So what do you need to do and which laws apply?

                1. Create a legally compliant privacy policy. Read the specifics [below].
                2. Ensure that the privacy policy includes clauses specific to the processing activities handled via Google AdSense.
                3. Include a cookie policy. From the quote above, you’ll note that in addition to the general privacy policy requirement, Google further requires that you include notice of your use of cookies as well.
                4. Handle cookies and consent to cookies in a legally compliant way. This generally means informing users of the use of cookies (as mentioned in the previous point), obtaining consent to the use of cookies and maintaining proof of that consent.

                Generally, the national/regional laws of your base of operations will apply, as well as (in many cases), the laws governing the regions in which your users are based. This can be quite tricky online, as, unless you’re actively blocking some regions, you may need to address requirements across geographical boundaries and legal jurisdictions. For this reason, it’s always the best idea to handle these activities with the strictest applicable regulations in mind (which currently, is likely European Law, mainly the GDPR and Cookie Law).

                You can read more about determining your law of reference here or read our in-depth Legal Overview Guide here.

                Example privacy policy for Google AdSense

                A lot of people ask for sample privacy policies for their sites/apps and Google AdSense. The exact required contents of a privacy policy depend upon the law applicable to you and your particular processing activities.

                It’s therefore advisable, as referenced above, that approach your (legally mandated) privacy policy with the strictest applicable regulations in mind.

                Let’s start with the legal minimum requirements. These are the most basic elements that a privacy policy should have:

                • Who is the site/app owner?
                • What data is being collected? How is that data being collected?
                • What is the Legal basis for the collection? (e.g consent, necessary for your service, legal obligation etc.) – This is more specifically related to the GDPR and EU Law, however, even if you fall outside of GDPR obligations, under most countries’ legislations, you’ll still need to say why you’re processing the personal data of users.
                • For which specific purposes are the data collected? Analytics? Email Marketing?
                • Which third parties will have access to the information? Will any third party collect data through widgets (e.g. social buttons) and integrations (e.g. Facebook Connect)?
                • What rights do users have? Can they request to see the data you have on them, can they request to rectify, erase or block their data? (under European regulations most of this is mandatory)
                • Description of process for notifying users and visitors of changes or updates to the privacy policy
                • Effective date of the privacy policy
                Caution

                Remember the above example text is given outside of the specific context of your site, therefore, this will not yet be an effective privacy policy on its own as legal documents are invalid if they’re not written properly.

                How to create a privacy policy for Google AdSense

                Here’s where our Privacy and Cookie Policy Generator comes in very handy: with 1700+ available clauses, our privacy policies contain all elements commonly required across many regions and services, while applying the strictest standards by default – giving you the option to fully customize as needed.

                Our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

                The process is straightforward and intuitive:

                • Add any service you may be using. In this case, it will be Google AdSense
                  Add 'Google AdSense' service
                • Fill out your web/app owner and contact details
                • Add the iubenda Privacy Policy to your site (a best practice is to link to your privacy policy from your footer, as you’re legally required to make the policy easily accessible from every page of your site or app)

                Note: The AdSense clause is a PRO service that you can easily access with a premium account. The Google Analytics clause falls under our free limits.

                How You Can Manage Cookie Usage

                As mentioned above, there are two sets of specifications to be met — those of Google and those of the Cookie Law. Luckily, these two intersect and requirements for both are easily met by our comprehensive Cookie Solution.

                Our Cookie Solution allows you to:

                • easily inform users via banner and a dedicated cookie policy page (which is automatically linked to your privacy policy and integrates what’s necessary for cookie law compliance);
                • obtain and save cookie consent settings;
                • preventively block scripts prior to consent; and
                • keep track of consent and save consent settings for each user for up to 12 months from the last site visit.

                You can collect consent via multiple mechanisms including continued browsing, scrolling, and/ or specific clicking actions. Keep in mind though that allowed consenting actions may differ depending on the Member State law.

                The process is straightforward:

                After creating your account simply go to your website area:

                • click on “Generate Now” under Cookie Solution;
                • configure and customize as you’d like;
                • integrate your cookie policy; and
                • embed into your site.

                It’s easy to run, fast and does not require heavy investments. For more information on our Cookie Solution click here.

                Please note: if you run personalized ads using Google services like AdSense and Google Publisher Tag, you’re required to ensure that explicit consent to ad personalization is collected before displaying personalized ads for end-users based in the EAA. Where this requirement is not met, Google will default to serving your EEA end-users with non-personalized ads, potentially impacting your ad revenue. Find full details in the dedicated guide here.

                Create a privacy policy for Google AdSense

                Start generating

                See also

                The post Privacy Policy for Google AdSense appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for Google Analytics https://www.iubenda.com/en/help/11994-privacy-policy-for-google-analytics-2/ Mon, 08 Oct 2018 16:37:35 +0000 https://help.iubenda.com/?p=11994 In accordance with international privacy laws, Google generally requires you to have a legally compliant privacy policy in place if you use Google products. This condition is usually included in the terms that you agree to when you sign up to use their services. In regards to Google Analytics, in particular, Google states in their […]

                The post Privacy Policy for Google Analytics appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                In accordance with international privacy laws, Google generally requires you to have a legally compliant privacy policy in place if you use Google products. This condition is usually included in the terms that you agree to when you sign up to use their services.

                In regards to Google Analytics, in particular, Google states in their Terms of Service under section “7. Privacy“:

                You will have and abide by an appropriate Privacy Policy and will comply with all applicable laws, policies, and regulations relating to the collection of information from Visitors. You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data. . . . You will use commercially reasonable efforts to ensure that a Visitor is provided with clear and comprehensive information about, and consents to, the storing and accessing of cookies or other information on the Visitor’s device where such activity occurs in connection with the Service and where providing such information and obtaining such consent is required by law.

                Google repeatedly references “applicable law” throughout their terms as many of these privacy-related stipulations are related to actual legal requirements. Google is bound to many of the same privacy laws that you are and as such, their terms reflect this.

                So what does this mean in practical terms and which laws apply?

                Let’s assume you have a website, you run Google Analytics on it and you want to ensure that you comply with Google’s terms (and the law). What do you have to do?

                1. Create a legally compliant privacy policy. Read the specifics [below].
                2. Ensure that the privacy policy includes clauses specific to the processing activities handled via Google Analytics.
                3. Include a cookie policy. From the quote above, you’ll note that in addition to the general privacy policy requirement, Google further requires that you include notice of your use of cookies as well.
                4. Handle cookies and consent to cookies in a legally compliant way. This generally means informing users of the use of cookies (as mentioned in the previous point), obtaining consent to the use of cookies and maintaining proof of that consent. One Analytics feature that may help with the consent requirement here is the IP Anonymization feature, however, you’re still required to inform users in a conspicuous and detailed way, about the use of even these cookies. Furthermore, the use of cookies may be considered “monitoring behavior” under the GDPR, even where those cookies are anonymized statistical cookies. Therefore, it is recommended that you block cookies prior to obtaining express consent, by default. You can read more about Google Analytics and the GDPR here.

                Generally, the national/regional laws of your base of operations will apply, as well as (in many cases), the laws governing the regions in which your users are based. This can be quite tricky online, as, unless you’re actively blocking some regions, you may need to address requirements across geographical boundaries and legal jurisdictions. For this reason, it’s always the best idea to handle these activities with the strictest applicable regulations in mind (which currently, is likely European Law, mostly the GDPR and Cookie Law).

                You can read more about determining your law of reference here or read our in-depth Legal Overview Guide here.

                Google Analytics Advertising Features

                Google Analytics Advertising features allow you to enable features in Analytics that aren’t available through standard implementations. Advertising features include:

                • remarketing with Google Analytics;
                • Google Display Network Impression Reporting;
                • Google Analytics Demographics and Interest Reporting;
                • integrated services that require Google Analytics to collect data for advertising purposes, including the collection of data via advertising cookies and identifiers;
                • User-ID, a feature that you can use to associate multiple sessions with a unique ID.

                For more information read Remarketing with Analytics and User-ID and Cross Device on Analytics Help.

                How This Relates to Your Privacy Policy

                In Google’s words:

                If you use an SDK to implement any Google Analytics Advertising Features, such as Audience Reporting or Remarketing, you must comply with the Policy for Google Analytics Advertising Features, in addition to the Google Play Developer Program Policies, and any other applicable policy.

                This requires slight modifications/additions to your privacy policy which is outlined in our guide How to update your Privacy Policy to reflect enhanced advertising features in Google Analytics.

                Basic privacy policy outline

                Let’s start with the minimum legal requirements for a privacy policy. These are the most basic elements that a privacy policy should have:

                • Who is the site/app owner?
                • What data is being collected? How is that data being collected?
                • What is the Legal basis for the collection? (e.g consent, necessary for your service, legal obligation etc.) – This is more specifically related to the GDPR and EU Law, however, even if you fall outside of GDPR obligations, under most countries’ legislations, you’ll still need to say why you’re processing the personal data of users.
                • For which specific purposes are the data collected? Analytics? Email Marketing?
                • Which third parties will have access to the information? Will any third party collect data through widgets (e.g. social buttons) and integrations (e.g. Facebook Connect)?
                • What rights do users have? Can they request to see the data you have on them, can they request to rectify, erase or block their data? (under the GDPR most of this is mandatory)
                • Description of process for notifying users and visitors of changes or updates to the privacy policy
                • Effective date of the privacy policy

                How to Create a Privacy and Cookie Policy for Google Analytics

                Here’s where our Privacy and Cookie Policy Generator comes in very handy: with 1700 + available clauses, our privacy policies contain all elements commonly required across many regions and services, while applying the strictest standards by default – giving you the option to fully customize as needed.

                The cookie policy is a section of the privacy policy dedicated to cookies. It details all legally required information including the categories of cookies used, their purposes, names the third parties who install or may install cookies through the website and provides links to said third parties’ respective privacy policy and possible consent forms. The Generator features a one-click set-up for the cookie policy which then automatically pulls all the relevant cookie information from the services indicated in your privacy policy.

                All our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

                The generation process is easy and intuitive:

                • Click on any of the green “Start Generating” buttons visible throughout this site to begin, and select the “Generate Now” button under Privacy and Cookie Policy in your site area.
                • Add any service you may be using. In this case, it will be Google Analytics, and possibly Google Analytics with anonymized IP, User ID extension for Google Analytics, Remarketing with Google Analytics, Google Analytics Advertising Reporting Features and/or Google Analytics Demographics and Interests Reports depending on what features you have enabled.
                • Enable the optional Cookie Policy (strongly recommended, requires a Pro License).
                • Fill out your web/app owner and contact details.
                • Add the iubenda Privacy Policy to your site (best practice is to link to your privacy policy from your footer, where your users or visitors can find it at any given time).

                Read the guide on How to Generate a Privacy Policy here.

                How You Can Manage Cookie Usage

                As mentioned above, there are two sets of specifications to be met — those of Google and those of the Cookie Law. Luckily, these two intersect and requirements for both are easily met by our comprehensive Cookie Solution.

                Our Cookie Solution allows you to:

                • easily inform users via banner and a dedicated cookie policy page (which is automatically linked to your privacy policy and integrates what’s necessary for cookie law compliance);
                • obtain and save cookie consent settings;
                • preventively block scripts prior to consent; and
                • keep track of consent and save consent settings for each user for up to 12 months from the last site visit.
                Google Consent Mode

                To help advertisers manage cookies for analytics and advertising purposes, Google has introduced Consent Mode, a feature that allows you to avoid prior blocking for Google Analytics and Google Ads (including Google Ads Conversion Tracking and Remarketing).

                Learn how to implement it with our Cookie Solution.

                You can collect consent via multiple mechanisms including continued browsing, scrolling, and/ or specific clicking actions. Keep in mind though that allowed consenting actions may differ depending on the Member State law.

                The process is straightforward:

                After creating your account simply go to your website area:

                • click on “Generate Now” under Cookie Solution;
                • configure and customize as you’d like;
                • integrate your cookie policy; and
                • embed into your site.

                It’s easy to run, fast and does not require heavy investments. For more information on our Cookie Solution click here.

                Create a privacy policy for Google Analytics

                Start generating

                See also

                The post Privacy Policy for Google Analytics appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Minors and the GDPR https://www.iubenda.com/en/help/11429-minors-and-the-gdpr/ Tue, 18 Sep 2018 10:31:43 +0000 https://help.iubenda.com/?p=11429 In my business, I need to process personal data referring to minors of age. Is there anything I should know? 👉 Some provisions of the GDPR set specific rules for the processing of personal data referring to minors of age, notably GDPR-Article 8, paragraph 1: “Where point (a) of Article 6(1) applies, in relation to […]

                The post Minors and the GDPR appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                In my business, I need to process personal data referring to minors of age. Is there anything I should know?

                👉 Some provisions of the GDPR set specific rules for the processing of personal data referring to minors of age, notably GDPR-Article 8, paragraph 1:

                “Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorized by the holder of parental responsibility over the child.”

                Let’s have a closer look at this clause:

                1. First of all, unlike the rest of the GDPR, this provision only applies to services provided online (“information society services”)
                2. Most importantly, it only applies if the offer of information society services is expressly, solely or mainly intended for children. This is the case, where children are being expressly addressed e.g. in an informal, childish language, where the goods, services or content offered is specifically meant for children (e.g. child literature, games, school-related resources etc.) or, obviously, where the offer is expressly limited to children (“just for kids”). It instead is not sufficient, that you offer or sell goods, services or content that may be suitable for children or includes child-friendly items. Therefore, if you sell toys online, this does not necessarily imply that your online shop is “directly offered to children”.
                3. It only applies in case the legal basis for processing personal data is consent. So, if you’re selling ring-tones to teens for their smartphones, personal data collected when completing the purchase (name, last name, e-mail address, payment details) will typically be “necessary for the performance of a contract to which the data subject is party” and thus covered by the contractual legal basis (Art. 6 par. 1 lit. b). If, however, you would also like to use the data subject’s e-mail address to send out newsletters about your ringtones, then you will need to collect the data subject’s consent since the processing of personal data for marketing purposes is not covered by the contractual scope. This is where art. 8 becomes relevant: if the data subject is less than 16 years of age, you’ll need to get the consent also by his/her parents.
                4. “Minors” for the purposes of art. 8 GDPR are children below 16 years of age. The GDPR, however, allows member states to lower this minimum age to 13. For instance, Austria has lowered the threshold age to 14 years.

                If you think that such conditions are all met in your case, you should definitely implement an additional step into your online-offer, allowing you to check the age of your users. To these ends, a pop-up window with a question (“How old are you?” or “Which year were you born in?”) will be enough.

                Online age verification is a complex topic fraught with privacy and security concerns. The French DPA (CNIL) issued an analysis to explain its position on online age verification and outline how publications can meet their legal obligations. Read more about CNIL- Privacy Friendly Age Verification System here

                How do I collect consent from the parents or have them authorize their child’s consent?

                Art. 8 gives you two options: you either collect such consent directly from the data subject’s parents, or you have the parents “authorize” the data subject’s consent. No processing of personal data may be performed, before one of these two options has been played out.

                The question is: how do I know who the parents are and that they are actually giving their consent? There is no clear answer to this question. Commentators have pointed out various methods to check the identity and collect consent, including:

                • the provision of passport or ID copy via e-mail;
                • the provision of a consent or authorization letter signed by the parents via e-mail;
                • the processing of online orders through the parents’ credit card;
                • the parents’ consent or authorization is expressed via telephone.

                All of these methods imply a heavy burden for all involved parties. Therefore, some commentators have pointed out that the well known double-opt-in method could also serve for this purpose.

                Example

                A 14-year-old data subject wants to subscribe to a newsletter. After having declared that he’s 14 years old, he needs to provide a) his own e-mail address, to which newsletters will eventually be sent and b) his parent’s e-mail address. After having subscribed, both the data subject and the parents receive an automated e-mail, asking to confirm the subscription and confirm that the parents agree to such processing of their son’s personal data.

                Of course, one could claim that a smart teen would need less than a minute to open up fake e-mail accounts for his parents. But in a way, the same reasoning applies to any other authentication procedure: in the end, it’s the parents’ responsibility to prevent such abuses by their children.

                As a golden rule, you should always pick the authentication method according to the risk potentially resulting from the processing of personal data. In the newsletter example, where the risk is considerably low, the double-opt-in procedure could be deemed as sufficient.

                If instead, you’re collecting the data subject’s consent to make some of his personal data publicly available on the internet, this might entail considerably high risks: in this case, you should rather go for a more complex but safer authentication method, such as requesting the submission of passports or IDs.

                🚀
                5 things you need to do now to comply with GDPR

                ow to comply with GDPR? Compliance can be difficult to achieve if you don’t know where to start.
                Here you’ll find 5 easy things you need to do to get GDPR-compliant.

                See also

                The post Minors and the GDPR appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                How to Comply with the GDPR on a WordPress Site https://www.iubenda.com/en/help/11028-wordpress-gdpr-compliance/ Mon, 03 Sep 2018 11:43:31 +0000 https://help.iubenda.com/?p=11028 WordPress has made some important changes in relation to the GDPR. The changes are part of WordPress’s effort to make it easier for their users to be GDPR compliant, however simply utilizing these tools in and of themselves do not guarantee GDPR compliance. Below we’ll go through the important GDPR features, how they can benefit […]

                The post How to Comply with the GDPR on a WordPress Site appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                WordPress has made some important changes in relation to the GDPR. The changes are part of WordPress’s effort to make it easier for their users to be GDPR compliant, however simply utilizing these tools in and of themselves do not guarantee GDPR compliance.

                Below we’ll go through the important GDPR features, how they can benefit you, their limitations, and how to address them. Let’s dive in.

                WordPress Privacy Policy Page

                wordpress privacy tool

                WordPress now makes it easier for website owners to set a dedicated Privacy Policy page by simply selecting Settings > Privacy from your WordPress dashboard. Once there, you can either select an existing page or create a new page to be designated as your privacy policy page.

                While the feature makes it easy to designate a page, it does not provide the complete and applicable text, which is completely understandable as in order to be compliant, the text of your privacy policy should apply specifically to your case and include disclosures relevant to the data you process. What it does provide, if you click on the “Create New Page” button, is some starter text and a basic template.

                How this benefits you

                Limitations and How to Address Them

                Main Limitations

                As mentioned, the tool does not actually generate a usable and compliant privacy policy. The actual text of the template, while it is a useful starting point in helping you to think about the kind of disclosures you should include in your privacy policy, is, in and of itself, far from compliant.

                In the accompanying Privacy Policy guide, WordPress informs users of this as follows:

                Please edit your privacy policy content, making sure to delete the summaries, and adding any information from your theme and plugins. . . It is your responsibility to write a comprehensive privacy policy, to make sure it reflects all national and international legal requirements on privacy, and to keep your policy current and accurate.

                While a full analysis of the provided starter text may require a separate article, at a quick glance, it’s clear that some sections (e.g the one under the user’s rights over their data) are either incorrect or incomplete, if you’re processing personal data under the provisions of the GDPR.

                Under the GDPR, and most similar privacy-related laws, it is required that your privacy policy be available from every page of your website, the new privacy tool does not automatically do this.

                Solutions

                • Produce a comprehensive, easy to read the privacy policy that meets legal requirements. One way to do this is to hire a lawyer to draft one for you, or you can simply and easily generate one of our lawyer-crafted, comprehensive and customizable privacy policies by using the privacy and cookie policy generator here. Getting started is easy. Simply enter your site name into the generator, select the language you’d like to the policy to be in and click generate.
                  Getting started with the generator

                  After that, select the services that apply to you:

                  Services

                  Customize as needed, save and you’re done. You can read the dedicated guide, How to Generate a Policy, here.

                • Make your policy visible and easily accessible from all pages of your website. You can do this a number of ways as seen in the picture below,
                  integration methods

                  but, by far the easiest method is to place the link to your privacy page in the footer, either directly, via a set footer menu, or via a text widget placed in your footer. You can read the full privacy and cookie policy integration guide for WordPress here.

                Comments

                The new comment feature now allows logged out commenters to set preferences for which personal details (name, email, website) are stored in a cookie on their browser.

                wordpress comment cookie checkbox

                You can find the option to enable this under Settings > Discussion.

                comment cookie settings

                How this benefits you

                • This feature gives you the opportunity to collect granular consent specific to the purpose of improving user experience of your site’s comment function, using a cookie.
                • It further provides another opportunity to get consent specific to this purpose even if the user has previously refused to consent to cookies via your main cookie management mechanism (assuming that you haven’t separately set your cookie management system to block these particular cookies).
                • It has the added benefit of allowing users to understand the purpose of the collection within context.

                Limitations and How to Address Them

                Main Limitation

                The new comment feature only addresses one type of cookie. Under the GDPR, and more relevantly, the still applicable Cookie Law (you can think of it as currently working alongside the GDPR), your users need to be informed of via a conspicuous and sufficiently interruptive means such as a banner, of all of the purposes for which your site uses cookies (with the exception of exempt cookies), and they must be allowed to give their consent via opt-in (this can be done using a gdpr checkbox, button, toggle etc), refuse or withdraw consent for those cookies.

                Solution

                Regardless of if you decide to use the new comment feature or not, in order to be compliant, you must ensure that you still have an active cookie management solution in place that meets legal requirements.

                iubenda’s Privacy Controls and Cookie Solution meets all the provisions of the law while giving you the ability to extensively customize, optimize for consent acquisition and proofs of users’ preferences, view site metrics and more. Setting up with the Privacy Controls and Cookie Solution is made even easier with our dedicated WordPress plugin. For more information on how to integrate the Privacy Controls and Cookie Solution with your WordPress site, see the plugin installation guide.

                Data Handling

                The new data handling features allow you to easily export a ZIP file containing a particular user’s personal data, and to fully erase a particular user’s data, including the data collected by participating plugins.

                The export feature sends a zip folder with a “mini website” with an index HTML page containing the user’s personal data segmented into groups and both features also make a new email-based method available to site owners for confirming personal data requests for both registered users and commenters.

                How this benefits you

                • The feature makes it easier for you to meet the GDPR’s Right of Access (Art. 15) requirements by allowing you to conveniently export and provide user data in compliant and convenient format.
                • This feature makes it easier for you to meet the GDPR’s Right to erasure (Art. 17) requirements.
                • You can easily request confirmation for critical actions like erasure requests via email.

                Limitations and How to Address Them

                Main Limitations

                While the Data Handling updates are easily one of the most valuable and time-saving updates, it does have certain critical limitations that you should be aware of. The first is that it only automatically exports the data collected by participating plugins. This means that the workability of these depends entirely on if the plugins you’re using have hooked into the new export/erasure feature. This means that this feature will not work with plugins that have not been modified to do this, or with old (non-updated) versions of plugins that might be in use on your site (in this case of course, you can simply update those particular plugins to the latest version).

                The truly problematic thing here is that (at the time of writing this post) no central repository exists that shows specifically which plugins have this feature integrated. Furthermore, no incentives were created to encourage plugin creators to implement the feature, meaning that likely, very few plugins have gone through the trouble to re-work their code and add these features.

                It’s worth noting here though, that even if every single plugin on the WordPress site supported these features, not all of the user data you process is necessarily handled by plugins. For example, if you use a cloud service or external mailing list management system, the data handled by these will not be automatically pulled into WordPress’ new Data Handling system. This is a very important point to note as the Rights to Access and Erasure apply to ALL the applicable user data, not some. So relying on an incomplete mechanism, or only providing some of the data simply means that you’re non-compliant.

                With that said, these new features will likely be sufficient if you’re the only one processing users’ personal data via the functionalities built into the WordPress platform itself, as in this way your compliance will not be dependant on whether or not various third-party plugins have integrated with the new feature.

                Solutions:

                Currently, the best option for addressing these issues are two-fold and involve mostly preliminary measures and manual effort.

                Preliminary measures

                • Choose GDPR aware partners: Ensure that the Data Processors you work with are GDPR compliant/have the means in place to facilitate user requests such as erasure or access requests. This information should be stated in the Data Processing Agreement you enter into with them.
                • Be aware of your processes: Evaluate your data processing cycle and systems and aim to set them up in a way that makes it easy for you to facilitate these requests. Some questions to ask yourself here are, for example,
                  • how can I easily export a particular user’s data from my databases (this issue is somewhat dealt with by the WordPress update, as it relates to data stored on your own databases)?
                  • how can I easily access and completely erase a particular users data (also made easier by the new data handling feature)?
                  • which specific data am I handing over to third parties to be processed and is it considered personal data?
                • Be aware of the data you process: Truly take note of and implement the GDPR principle of data minimalization. Some questions to ask yourself here are, for example,
                  • what data am I processing?
                  • is it considered personal data?
                  • is it strictly necessary for the provision of the service?

                Manual effort
                Under the current system, if you use any third-party services to process personal data, outside of what’s covered by the WordPress Data Handling tools, you’ll need to apply some manual effort in identifying, exporting from relevant databases and making the data available, or erasing the data if so requested by the user. Generally, you’ll have an average of one month to comply (with some exceptions).

                Take note that if fulfilling an access request, the data will need to be provided to the user in a common and easy to access format (e.g. a spreadsheet).

                Additionally if fulfilling an erasure request, it’s useful to preemptively inform the user that fully erasing their data will mean that your systems will no longer recognize them as a user (unless they somehow again add their data to your systems) and therefore you will be unable to fulfill any requests regarding that data subsequent to its deletion.

                For more information on these WordPress features, read the Privacy section of the WordPress Plugin Handbook here.


                These newest additions by WordPress indicate an acknowledgment of the importance of compliance and a willingness by the company to assist their users in meeting requirements. Ultimately, however, compliance is a custom venture and the responsibility (and liability) falls on you, the data controller, to properly assess your data processing activities and ensure that your systems and processes are compliant.

                Procedures like maintaining Records of Processing and carrying out a Data Impact Assessment can be very helpful in figuring this out.

                For this reason, based on our work surrounding the GDPR in the last few months, we’ve compiled the following list of GDPR related resources and articles to further help you with compliance.

                💡

                Did you know? The GDPR can apply to cookies, too. We have a plugin for that!


                👉 Check it out here

                See also

                The post How to Comply with the GDPR on a WordPress Site appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                How to Make Your Site Compliant (for Bloggers and Web Publishers) https://www.iubenda.com/en/help/8385-gdpr-for-bloggers/ Thu, 19 Jul 2018 09:56:55 +0000 https://help.iubenda.com/?p=8385 As the owner of a blog or similarly simple website, you may be wondering if the same rules of commercial sites and apps apply to you. To answer that question, here are a couple of things you need to consider: If you answered yes to any of these, then many of the same privacy rules […]

                The post How to Make Your Site Compliant (for Bloggers and Web Publishers) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                As the owner of a blog or similarly simple website, you may be wondering if the same rules of commercial sites and apps apply to you.

                To answer that question, here are a couple of things you need to consider:

                • Are you collecting/interacting with the personal data of your readers (eg. names, usernames, email address, IP addresses, session activity or payment details)?
                • Do you have a contact form or newsletter sign-up?
                • Do you use any third-party widgets or services (for example, Google Analytics or AdSense)?

                If you answered yes to any of these, then many of the same privacy rules that apply to commercial websites and apps will apply to you.

                Legal requirements in general

                Major legislations

                • In the US privacy laws can vary widely and are often implemented on both a State and Federal Level.
                • In the EU, the main data privacy regulations are the General Data Protection Regulation (GDPR) and the ePrivacy Directive (the Cookie Law).
                • In Brazil, the LGPD can be considered as Brazil’s answer to the GDPR. It’s intended to replace or supplement its current dispersed legal landscape (of over 40 federal sector-based norms) with one regulatory framework.

                You can read our general legal overview.

                Which Regulations apply to you

                As mentioned above, if you implement any kind of service that interacts with the personal data of users, you’re legally required to have a privacy policy in place and to comply with applicable data privacy laws. Generally, these laws apply to any service targeting residents of the region, which effectively means that they may apply to your business whether it’s located in the region or not.

                For the most part, compliance requires that you disclose data collection, inform users of their rights in regards to their data and implement methods of receiving/rescinding consent. Failure to adhere to data privacy laws can result in hefty fines, leave you open to litigation and negatively affect the credibility of your website.

                Compliance requires that you disclose data collection, inform users of their rights in regards to their data and implement methods of receiving/rescinding consent

                You can learn more about which laws apply to you here.

                🎙
                Ask our experts live

                View live demos and have your questions answered in real time by attending one of our free English webinars. They are all practical and designed to really help you with understanding and achieving compliance for your websites or apps.

                Attend our free webinars

                Legal requirements specific to blogging

                Using a privacy policy to inform users about personal data use

                By law users of your site need to be informed about:

                • what data is being collected;
                • their rights in regards to that data;
                • your notification process for policy changes;
                • the effective date of your privacy policy;
                • third-party access to their data (for example, third-party comment widgets, social buttons, ad service integrations etc.)

                Disclosing endorsements in accordance with legal guidelines

                Many regulations, including those by US, EU and The International Consumer Protection and Enforcement Network (ICPEN), have specific guidelines in place regarding product/ service endorsements.

                Generally, they require that endorsements made by bloggers and influencers reflect the truth-in-advertising principles. This means that you’re not allowed to make any claims about the product that the marketer couldn’t legally make and that endorsements must be non-misleading and fully disclosed. You must inform users when there’s a connection between an endorser and the marketer a consumer would be interested in knowing, or that would change their perception if known.

                For example:

                • you’re endorsing a product that is marketed by your relative;
                • you’re an employee, shareholder or investor in the product.

                You must also inform users when you’ve been given an incentive (financial or otherwise) to push the product. This means that whether you were given a free product/service, paid directly, or you make a percentage off each sale (in the case of Affiliates) you’re equally obligated to inform users of the fact.

                For example:

                • you’ve been given a free night at a hotel in exchange for an endorsement;
                • you’re reviewing a product with an affiliate link that earns you money, discounts or free products;
                • you’re being paid by a brand to post pictures of yourself wearing their clothing.

                According to ICEPEN, you must clearly and prominently label content that you’re paid to endorse and ensure that it is clear whose opinion or experiences is being stated. This means that disclosures need to be specific to the particular endorsement, so simply putting a single disclosure on your homepage won’t suffice.

                Here’s an example of a complaint disclosure using the affiliate example above:

                This blog received a commission for using “company name” products in the tutorial shared in this post. Although we receive a commission for using and linking their products, all of the products are tested thoroughly and only the ones that meet our standards are linked. All opinions stated are our own.

                Third-party requirements

                Third-party apps and services also need to follow the law. As organizations themselves, they too can be exposed to major reputation damage, fines, and sanctions if their legal obligations are not met. For this reason, it’s often mandatory that all partners and customers that use their services meet regulatory standards.

                One example is Google. In order to access certain services and tools (for example, AdSense, Google Analytics, Google Play store), Google requires that you have a comprehensive and up-to-date privacy policy in place. Here’s an excerpt from the Google Analytics terms of use:

                You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect traffic data, and You must not circumvent any privacy features (e.g, an opt-out) that are part of the Service.

                Another example is Amazon. Users of the Amazon Affiliate program are not only expected to have a privacy policy in place but are also required to be transparent and specifically disclose the affiliate relationship:

                We extended the requirement to disclose our affiliate relationship to any means where you may be leveraging Associates’ content.

                Needless to say, it’s important to ensure that both legal and third-party requirements are met. From time to time, however, third party requirements can change in response to internal or regional regulations. It’s therefore necessary that your policies meet the latest requirements in order to avoid interruption of service or legal consequences. For this reason, we use embedding and NOT copy & paste for our document solutions. With this method, you can rest assured that your policy is up to date and being maintained remotely by our legal team.

                You can read more about Google’s requirements here and Amazon’s requirements here.

                How to comply

                Have an up-to-date privacy policy in place that informs users of:

                • what data you’re collecting;
                • how you’re collecting it;
                • their rights in regards to their data;
                • your purposes for collecting this data;
                • which third-parties have access to their data and for which purpose.

                Regulations require that your policy is clear, easy-to-understand and that it lists specific third-parties in a granular manner. The policy also needs to be easily accessible throughout the website.

                How iubenda can help

                Putting together a privacy policy that fits your specific needs while addressing legal requirements across various geographical boundaries and jurisdictions can be difficult to do. We solve this problem by generating policies that work within the best-practices of various jurisdictions.

                With hundreds of available clauses, our privacy policies contain all the elements commonly required across many regions and services, while applying the strictest standards by default – giving you the option to fully customize as needed.

                Our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal and third-party requirements.

                Easily integrate with your website/app using any one of our integration methods to make sure that your policies are visible and easily accessible as legally required.

                The process is straightforward and intuitive, simply click to add your services, fill out your web/app owner and contact details, embed. Click here to read the full guide on How to Generate a Privacy Policy.

                1. Add your services

                • Click “Add a service” then start typing the name of the service you’d like to add. Remember to include all services processing personal information as a blogger, you’ll most likely want to add services like “Contact Form”, “Mailing list or Newsletter” and social widget services such as the “Facebook like button”.
                • Select each applicable service from the list of suggestions that shows up and customize by simply adding the specific types of personal data you collect. Our lawyer-crafted clauses automatically include the relevant user-rights disclosures and service definitions based on your input here.
                • If you’d like to add a custom service clause, simply click the “Create custom service” button and fill out the built-in form.

                2. Fill out your web/app owner and contact details

                • Enter name and full address
                • Enter email address

                Congratulations! Your policy has been created. Simply check that all the details are correct, then:

                3. Embed

                • Customize the look of your button or simply choose a text link;
                • Choose the embedding method (choose between embedding code, direct link or direct text embedding);
                • Easily embed wherever you’d like! Remember you’re required to choose a location that is easily accessible and visible to users.

                Create a privacy policy for your blog

                Start generating

                Consent for data collection forms

                Generally, US laws require that you provide users with an option for withdrawing consent (opt-out) when using data collection mechanisms (e.g. newsletter sign-up forms).

                Compared to US laws, however, EU laws (in particular the GDPR) are more stringent. Consent under the GDPR must be “explicit and freely given”. This means that the mechanism for acquiring consent must be straightforward and involve a clear “opt-in” action. Within the context of a blog, this means that you’d be in violation of regulations if you were to employ mechanisms such as pre-ticked newsletter sign-up boxes when a user registers an account, as GDPR regulation specifically forbids pre-ticked boxes and similar “opt-out” mechanisms.

                The mechanism for acquiring consent must be straightforward and involve a clear “opt-in” action

                The regulation also gives users a specific right to withdraw consent. This means that you’re required to make it as easy to withdraw consent as it is to give it.

                🔎
                Looking for a simple and compliant way to manage consent for newsletter subscriptions?

                Try our Newsletter Opt-in Booster 👉 it adds a customizable signup form to your site, allowing you to collect and manage consent through a double opt-in process for a more engaged and responsive audience.

                Activate now

                You can read more about newsletters here and the GDPR here.

                How to Comply

                Put in methods in place for obtaining informed, verifiable and explicit consent

                The user should be honestly and straightforwardly informed about what they’re consenting to and the mechanisms chosen for obtaining the consent should require the user to actively consent via a clear affirmative action, such as clicking an “agree” button or clicking a checkbox. Ensure that the consent obtained is specific to the purpose of obtaining it and clearly indicate that the consent is optional as consent must not be “freely given” and not coerced in any way.

                For example:
                Yes, I would like to receive weekly offers and deals in my inbox as indicated in the privacy policy (optional)

                Provide a means of withdrawing consent

                As consent must be as easy to withdraw as it is to give, the withdrawal mechanism must be visible, easy to understand, simple and immediately available. Your withdrawal mechanism should be both situationally and generally available and involve no more than a single webpage. It should also be accompanied with an explanation as to its purpose.

                For example:
                If you no longer wish to receive weekly emails from us, you can click here to modify your settings or click here to unsubscribe instantly.

                As shown in the example above, the mechanism most commonly used is the email unsubscribe link, however, it’s important to remember that the user should also have withdrawal options available within their account in order to facilitate withdrawal even before they’ve received the first email communication from you.

                User requests for withdrawal must be honored within 10 days under US law and within 30 days under EU law.

                Keep clear records of the consent attained

                Records of consent should at least contain the following information:

                • The identity of the user giving consent;
                • When they consented;
                • What disclosures were made (what they were told) at the time they consented;
                • Methods used for obtaining consent (e.g. newsletter form, during checkout etc.);
                • Whether they have withdrawn consent or not.

                How iubenda can help

                iubenda can help with this in 2 ways:

                • Firstly, while you’re separately required to implement methods to collect, record and verify consent, our privacy policy solution makes it easy for you ensure that the consent received is informed as per your legal obligations. Our solution helps you to meet your disclosure obligations by allowing you to comprehensively disclose and define necessary details in a legally compliant way. The interface is intuitive, the process straightforward and the results precise.
                • Our Consent Database helps you meet your legal requirements by helping you to easily store proof of consent and manage consent and privacy preferences for each of your users. It allows you to keep track of and record every aspect of individual consents, including:
                  • the legal or privacy notice made available to the user at the time the consent was acquired (including multiple versions of the same document);
                  • the consent form (accepts various file formats) that the user was presented with at the time of consent collection;
                  • the identification of the specific user (it allows you to do this in multiple ways including an automatically-assigned user id); and
                  • the related preferences expressed by the user.

                  It conveniently installs via HTTP API or JavaScript widget, allowing you to retrieve consents at any time and keep them updated.

                Create a privacy policy and collect GDPR consent for your forms

                Start generating

                Cookies are small bits of information that websites and apps store on a computer or mobile device, which are designed to hold small amounts of user-specific data. Many platforms, such as WordPress, and third-party widgets use them by default. Because using cookies means both processing user data and installing files that could be used for tracking, it is a major point of concern when it comes to user data privacy rights.

                The ePrivacy Directive (or EU Cookie Law) was implemented to address this concern. The Cookie law is intended to protect online privacy by informing users about data collection activities and empowering them to choose whether it’s allowed or not. This means that if your blog (or any third-party service used by your blog) uses cookies, you must first obtain consent before the installation of those cookies.

                You can read more about the Cookie Law here.

                How to Comply

                Allow users to exercise their rights in regards to their data and cookies. If your blog (or any third-party service used by your blog) uses cookies, you must first obtain consent before the installation of those cookies. In many EU countries, this will require the use of script-blocking (preventing code execution that could install cookies) prior to obtaining user consent.

                If you monetize content on your site via ads (including Google’s ad services), we heavily suggest that you meet industry requirements by enabling the IAB Transparency & Consent Framework feature in the Privacy Controls and Cookie Solution. Failure to do so can potentially result in reduced ad reach and revenue.

                How iubenda can help

                Our comprehensive Privacy Controls and Cookie Solution simplifies compliance with provisions of the European Cookie Law.

                It allows you to:

                • easily inform users via banner and a dedicated cookie policy page (which is automatically linked to your privacy policy and integrates what’s necessary for cookie law compliance);
                • obtain consent and save cookie consent settings;
                • store proofs of users’ preferences via The Cookie and Consent Preference Logs;
                • preventively block scripts prior to consent.

                Simply go to dashboard > [your website] > Privacy Controls and Cookie Solution > Edit to open the configuration settings: enter name details and set consent model, customize your look, integrate cookie policy and embed.

                1. Enter name details

                • Enter your site/app name or url into the text-box.
                • Select your language and country from the drop-down menu.

                2. Set consent model

                • Click to choose between “With prior consent” (script blocking prior to user consent and reactivation after consent) or “No prior consent” (no prior script blocking). Remember script blocking prior to consent is mandatory in some regions including the EU.
                • Choose whether to activate “Consent via scroll” or not. When the option is chosen, your users can consent by simply scrolling and continuing to browse; the banner will be automatically closed by the action of scrolling. If this option is not activated, the user will have to click to close the banner.

                3. Customize your look

                • Customize the location and look of your banner via the simple built-in options or edit the css yourself via the “advanced” tab.

                4. Integrate cookie policy and embed

                • Choose whether to automatically generate an integrated cookie policy or simply paste the link of your existing cookie policy.
                • Easily embed into your site. Choose between directly pasting the embed code into the head section of your site’s pages or using a plugin.

                Congratulations! Your Privacy Controls and Cookie Solution has been created and is fully operational.

                Manage cookie consent with the Privacy Controls and Cookie Solution

                Generate a cookie banner

                Protecting your interests and your content

                Though not always legally required, a Terms & Conditions document is pragmatically required. It governs the contractual relationship between you and your users and is therefore essential for protecting your content from a copyright perspective as well as protecting you from potential liabilities.

                The Terms & Conditions document is a legally binding agreement, therefore not only is it important to have one, but it’s also necessary to ensure that it’s clear, easily understandable, precise and that users can both easily see it and agree to it in an unambiguous way (for example, clicking a checkbox with a visible link to the document before being allowed to create an account or comment).

                You’ll likely need a Terms & Conditions document if any of the following apply to you:

                • You have different user levels (eg. registered vs non-registered);
                • You want to set the rules for user behavior (including comments) and state grounds for termination of accounts;
                • Your users are allowed to upload content;
                • You participate in some kind of commerce, including affiliate programs;
                • You’d like to protect your blog and it’s content by stating how it can be used.

                How to Comply

                Set clear terms for users with a comprehensive and up-to-date terms and conditions document. This legal agreement is essential to protecting the interests of your business and establishing terms of usage.

                It is therefore vital that this contract be precise and up-to-date with all applicable regulations. It should include the general conditions for use of your service with special attention to limitation-of-liability clauses and disclaimers.

                How iubenda can help

                Here’s where our Terms and Conditions Generator comes in very handy: customizable from over 100 clauses, available in 8 languages, drafted by an international legal team and up to date with the main international legislations, it’s capable of handling even the most complex, individual scenarios and customization needs.

                Our solution works for businesses of any size, from the single blogger to enterprise level organizations, protecting their interests and their content. It’s optimized for e-commerce, marketplace, SaaS, mobile apps, blogs, publications and more.

                The generation process is easy and intuitive:

                For more information read our guide on How to Generate a Terms and Conditions document.

                Generate Terms and Conditions for your blog

                Start generating

                Please note that from time to time, laws are amended and updated. It’s therefore important to ensure that your policies meet the latest requirements. For this reason, we use embedding and NOT copy & paste. With this method, you can rest assured that your policy is up to date and being maintained remotely by our legal team.

                See also

                The post How to Make Your Site Compliant (for Bloggers and Web Publishers) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Which data can be safely stored in cookies without having to request consent? https://www.iubenda.com/en/help/7515-which-data-can-be-safely-stored-in-cookies-without-having-to-request-consent/ Thu, 21 Jun 2018 10:10:29 +0000 https://help.iubenda.com/?p=7515 For full context, let’s quickly recap exactly what cookies are and which legislations they fall under. 🔍 What are cookies? Cookies are small data files that are generally stored on a user’s computer/browser — so to clarify in regards to the original question, cookies do not ‘store data’, they are the actual pieces of data. […]

                The post Which data can be safely stored in cookies without having to request consent? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                For full context, let’s quickly recap exactly what cookies are and which legislations they fall under.

                Cookies are small data files that are generally stored on a user’s computer/browser — so to clarify in regards to the original question, cookies do not ‘store data’, they are the actual pieces of data. They’re quite useful for various things ranging from technically enhancing users’ website experience to the personalization of ads.

                The use of Cookies and the related legal requirements fall under the ePrivacy Directive or the Cookie Law (aka the reason all those website cookie banners exist).

                The Cookie Law has pretty specific requirements when it comes to managing consent to cookies (read more about those here), however, there are some exemptions — which brings us to the following question.

                Which data can be safely stored without having to request consent?

                📌 Strictly speaking, you don’t need consent for:

                • Technical cookies that are solely necessary for the provision of the service. (eg. preference cookies, session cookies, load balancing, etc.)
                • Statistical cookies managed directly by you (not third-parties), provided that the data is not used for profiling.

                📌 One more exception that can apply is statistical (anonymized) third-party cookies such as Google Analytics, however, this exception is subject to specific local regulation and may not always apply.

                👉 It’s therefore strongly advised that you take the safe route and always ask for consent for these (statistical, third-party) cookies.

                Curious to learn more about collecting cookie consent?

                If you need to set up a cookie banner (or have already done so!), make sure to check out this short guide:

                👉 Don’t make these 5 mistakes when collecting cookie consent!

                Alternatively you can take the less practical approach of reading the relevant local laws for each region you’d like to target and selectively apply your settings based on this information, however, this approach is less secure and can leave you open to litigation should you misunderstand/misapply settings.

                📌 Lastly, one point worth mentioning here is that using this data for any kind of user profiling takes it out of the “exempt” category and brings this processing squarely into the realm of the GDPR, which has specific requirements and considerations in regards to user profiling. For more details on this point, see our first “Question of the week” here.

                How iubenda can help

                If you are using cookies that do not fall cleanly into the exempt category, you’re required to block scripts (that can install cookies) from running prior to obtaining consent.

                The Privacy Controls and Cookie Solution makes it easy to comply with the Cookie Law by:

                • Blocking scripts prior to consent (with asynchronous activation of scripts after the consent is obtained, for a smooth user experience).
                • Providing a customizable and easy to implement cookie banner that links to a comprehensive cookie policy and optional IAB consent management section.
                • Store proofs of users’ preferences.
                • Allowing you to prove consent to cookies.

                You can see how it works here:

                 

                For more information on our Privacy Controls and Cookie Solution, click here.


                You can read more about our GDPR solutions or read all our compliance solutions here or click below to start generating.

                See also

                The post Which data can be safely stored in cookies without having to request consent? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                The complete guide to iubenda CMP and IAB TCF 2.3 https://www.iubenda.com/en/help/7440-the-complete-guide-to-iubenda-cmp-and-iab-tcf/ Fri, 15 Jun 2018 14:44:50 +0000 https://help.iubenda.com/?p=7440 With the introduction of IAB TCF 2.3, the consent management landscape continues to evolve to meet regulatory expectations and improve transparency across the digital advertising ecosystem. Laws like the GDPR, the ePrivacy Directive, and U.S. State Privacy Laws have made consent management platforms (CMPs) essential for businesses operating in the EU, UK, Switzerland, and the […]

                The post The complete guide to iubenda CMP and IAB TCF 2.3 appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                With the introduction of IAB TCF 2.3, the consent management landscape continues to evolve to meet regulatory expectations and improve transparency across the digital advertising ecosystem.

                Laws like the GDPR, the ePrivacy Directive, and U.S. State Privacy Laws have made consent management platforms (CMPs) essential for businesses operating in the EU, UK, Switzerland, and the United States — especially for publishers relying on advertising.

                This guide explains what a consent management platform is, why publishers need one, and how to enable and use the industry-standard Transparency and Consent Framework (TCF 2.3) in our Privacy Controls and Cookie Solution.

                Understanding Google IAB TCF, TCF 2.3, and IAB Europe is crucial. This guide sheds light on these essential aspects, answering the question of “What is TCF?” and explaining its significance in the digital landscape 👇

                🚨 Important:

                TCF 2.3 becomes the enforced default on February 28, 2026. From that date onward, all newly generated TC strings must comply with TCF 2.3 specifications.

                Starting February 1, 2026, iubenda already stores user consent using the TCF 2.3 format, ensuring compatibility with the latest specifications ahead of the official deadline.

                iubenda fully supports this transition and ensures continuity without requiring changes to your consent banner or user experience.

                In short

                • If you use cookies or trackers for advertising, analytics, remarketing, or personalization, you likely need a Consent Management Platform (CMP) like our Privacy Controls and Cookie Solution.
                • Major advertising platforms (including Google) require valid GDPR consent signals before serving personalized ads in the EEA, the UK, and Switzerland.
                • You can meet this requirement by enabling the IAB Transparency and Consent Framework (TCF) in our Privacy Controls and Cookie Solution with just a few clicks.
                • The IAB Transparency and Consent Framework (TCF) standardizes how consent is collected and shared across the advertising ecosystem.
                • TCF 2.3 is the latest version of the framework, with a mandatory adoption deadline of 28 February 2026.
                • If you use iubenda’s Privacy Controls and Cookie Solution, you’re already covered:
                  • you can switch to TCF 2.3 now by setting tcfVersion = 2.3, or
                  • let iubenda automatically switch your configuration before the adoption deadline.

                What is a Consent Management Platform (CMP)

                CMP is short for Consent Management Platform or, less commonly, Consent Management Provider. CMPs are also responsible for passing user consent along with the Transparency and Consent Framework (TCF) and must therefore be registered and meet TCF standards and policies.

                Simply stated, a CMP helps you provide transparency to the users regarding the access and storage of their personal information (through cookies and other trackers) in compliance with major data privacy laws like the GDPR, the ePrivacy Directive, the US State Privacy Laws and more.

                More specifically, CMPs help you gather, store, and use users’ preferences to collect and process their personal information for specific purposes (e.g., analytics, advertising, and retargeting strategies).

                Do I need a Consent Management Platform (CMP)?

                Short answer: yes, you probably need one. 

                A) The GDPR/ePrivacy Directive or UK GDPR/PECR applies to you (not sure? Take our 1-minute quiz), and your site/app (or any third-party service run by your site/app) uses cookies or other trackers to process personal information.

                Why?

                Because according to the ePrivacy Directive (as well as PECR, its UK transposition), you must clearly and visibly inform users of your site/app’s use of any cookies (or trackers) and collect active consent before running scripts related to non-exempt cookies/trackers

                For example, let’s consider publishers operating in Europe. Cookies and trackers are their bread and butter since they help them monetize their site/app via third-party advertisers. The use of trackers for purposes like behavioral advertising, remarketing, and content personalization requires obtaining users’ informed consent before installing those trackers. 

                What is a publisher?

                Generally, a publisher is any site/app operator that monetizes its content via third-party advertisers. Blogs and online newspapers that display ads on their site/app are examples of publishers.

                B) Beyond the EU regulations, there are other compelling reasons to consider implementing a Consent Management Platform (CMP), particularly when addressing specific requirements in US state laws.

                In the United States, some US State Laws, such as the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), introduce precise guidelines for the format and labeling of the link leading to Privacy Controls, now named “Your Privacy Choices“.

                In the context of user consent, it’s important to note that while the United States doesn’t have the same high level of requirements as Europe, where opt-in consent is the norm, a number of U.S. states still operate under an opt-out system. Nevertheless, implementing a Consent Management Platform (CMP) remains a valuable step in providing users with the ability to opt out and, and facilitate businesses in reobtaining consent. This is particularly important when considering initiatives such as Global Privacy Controls (GPC), which allow users to opt out automatically through their browsers.

                In general, given the rapid emergence of privacy laws worldwide, it’s hard to imagine a site or app that doesn’t need a Consent Management Platform. Such a platform streamlines the compliance process, making it more manageable and efficient, allowing businesses to stay ahead of the ever-changing privacy landscape.

                💡 As a certified CMP, we’ve integrated IAB Europe’s industry-standard TCF and US State Laws Compliance Framework with our Privacy Controls and Cookie Solution to help publishers comply with the law while meeting industry requirements and maximizing ad revenue.

                What is the IAB TCF? GDPR Transparency and Consent Framework

                The IAB Transparency and Consent Framework (TCF) is a digital advertising initiative that helps publishers, technology vendors, agencies, and advertisers meet the transparency, consent, and choice requirements of the GDPR and ePrivacy Directive when processing personal data or accessing and/or storing information on users devices (such as cookies, advertising identifiers, device identifiers, and other tracking technologies).

                The IAB TCF provides a standard process for getting GDPR user consent and signaling those consent preferences across the advertising supply chain (You can read the framework policies here)

                What is TCF 2.3? 

                TCF 2.3 is the latest version of the IAB Europe Transparency and Consent Framework

                It builds on TCF 2.2 and focuses on one key issue: removing ambiguity around vendor disclosure

                The main change introduced in TCF 2.3 is the introduction of a mandatory “Disclosed Vendors” segment in the TC string. This allows vendors to reliably confirm whether they were shown to the user before processing personal data — including when relying on Legitimate Interest for Special Purposes. 

                What’s changed compared to TCF 2.2? 

                • The “Disclosed Vendors segment is now mandatory in all TC strings 
                • TC strings now follow this structure: 
                  [Core segment].[Disclosed Vendors segment].[Publisher TC] 
                • Vendors receive a clear binary signal
                  • 1 = vendor was disclosed to the user 
                  • 0 = vendor was not disclosed 
                • This removes uncertainty for vendors and strengthens transparency across the advertising supply chain 

                ⚠ What did not change 

                • No new purposes or legal bases were introduced 
                • No new categories of personal data are collected 
                • No changes are required to the consent banner UI 
                • No re-collection of consent is required in standard scenarios 

                The IAB TCF and Brexit / UK Law

                Currently, the requirements of the UK’s General Data Protection Regulation (UK GDPR) and the UK’s Privacy and Electronic Communications Regulations are closely aligned with to that of their EU counterparts (the GDPR and ePrivacy). Therefore, the TCF Frameworkalso helps companies meet the current requirements of both UK Regulations. 

                The TCF provides a system (a standard JavaScript API) that allows the different advertising ecosystem players to speak the same language and communicate the user’s preferences between them. The main actors of this system are publishers, vendors (third parties advertisers who collect end-users data from the publisher’s site/app through the use of cookies or other trackers, in connection with surfacing content to the publisher’s end users), and CMPs like iubenda.

                Publishers, vendors and CMPs who decide to participate in the IAB TCF are all bound to adhere to the standard Framework protocol and policies. Vendors are also requested to register on the Global Vendor List (GVL), a centralized, dynamic list of vendors, their purposes, maximum storage and access duration, and privacy policy URLs. Within the TCF and related GVL the purposes for data processing are also standardized and each purpose and each vendor have a unique ID. This unique vendor ID allows vendors to retrieve and interpret user consent preferences regarding their and other vendors’ services. 

                The user choices and vendor signals collected via the CMP UI are represented by binary values, compressed into as small a data structure possible (Base64), and transmitted throughout the online advertising ecosystem via a Daisy Chain.

                The scripts of vendors that are part of the GVL are automatically blocked before receiving user choices. Each vendor can check its status by first pinging the CMP and then waiting for a call back for the ID they pass, which lets them know whether they can process personal data.

                Why publishers should enable the Transparency and Consent Framework

                The IAB TCF, initially launched as 2.0, has rapidly evolved to establish itself as the unequivocal industry standard, with the collaboration of major vendors such as Google, Adobe, AdRoll, and a wide range more contributing to its implementation. The most recent iteration, IAB TCF 2.3, introduces substantial enhancements, meticulously designed to align more proficiently with regulatory mandates and to cater more effectively to user needs.

                Enabling the TCF 2.3 offers many benefits for publishers and users, maximizing ad revenue and allowing publishers to smoothly collect and transmit user preferences to the third-party ad vendors they work with, while exercising stricter control over how they process users’ data.

                IAB TCF 2.3 benefits for publishers

                The IAB Transparency and Consent Framework (TCF) has become the industry standard for managing consent and transparency in digital advertising.

                Many of the key benefits for publishers were introduced with TCF 2.2 and remain fully applicable under TCF 2.3, which strengthens signal clarity and vendor accountability without changing the user experience.

                • Secure your ad revenue
                  • Advertising networks may limit access to their network or serve only non-personalized ads where TCF 2.3 consent is not passed to vendors. This means that your ad revenue could potentially decrease if you’re not using the framework. Publishers in Europe, the UK, and Switzerland who use Google publisher products should especially consider IAB TCF, as non-compliance with TCF v2.3 could lead to a reduction in ad revenue.
                  • Implementing TCF 2.3 can boost ad revenue as it grants publishers more control and flexibility in establishing the legal basis for collaborating with vendors. This approach allows them to maintain ad revenue generation while adhering to privacy-compliant data processing.
                  • The Framework also empowers organizations to foster trust among users through transparency and choice, thus promoting increased engagement with ads as users feel assured of their privacy being respected.
                • Enhanced options and control
                  • With TCF 2.3, vendors receive an explicit signal confirming whether they were disclosed to the user, reducing ambiguity and strengthening accountability across the advertising supply chain.
                  • These changes were introduced in TCF 2.2 and remain in force under TCF 2.3. ⤵
                  • Purposes: you have full control over which third-party ad vendors you want to work with and disclose to your users and for what purposes you allow these vendors to process personal information.
                  • Purpose 11 (Use limited data to select content) intended to cover processing activities such as the selection and delivery of non-advertising content based on real-time data (e.g. information about the page content or non-precise geolocation data), and controlling the frequency or order in which content is presented to a user.
                  • Legal Basis: Vendors, previously able to declare reliance on both consent and legitimate interest for purposes 2 to 10 in TCF 2.0, can, starting with TCF 2.2 and continuing under TCF 2.3, only rely on consent for purposes 3, 4, 5, and 6. While stricter data usage and consent collection might impact ad targeting capabilities and revenue, the enhanced trust and user engagement potentially counterbalance the negative impacts, leading to increased user satisfaction.
                  • Publishers must now select partners diligently and ensure that these partners comply with TCF standards, reinforcing their ethical standing and allowing the development of partnerships with entities sharing a commitment to user privacy.
                  • Introduced with TCF 2.2 and still applicable under TCF 2.3, the framework establishes a standardized platform for publishers and third-party vendors, facilitating compliance and enabling adherence to data privacy regulations like the GDPR and the ePrivacy Directive.

                Publishers are now required to disclose, prominently on the first level of their CMP user interface, the total number of third party vendors they work with. While the TCF Policy does not set a specific limit on the number of vendors, publishers are strongly encouraged to work only with those vendors that best meet their needs and objectives.

                An inappropriately large number of vendors may affect the ability of users to make informed decisions and may increase legal risks for both publishers and vendors.

                In order to facilitate publishers to determine which vendors they wish to establish transparency and consent for, a comprehensive Vendor Information List, known as the “B2B GVL“, is available. This resource provides valuable guidance to help publishers identify relevant vendors. Specifically, the B2B GVL provides information that helps publishers avoid seeking user consent from vendors operating in irrelevant technical environments and jurisdictions. It also helps to understand the scope of each TCF vendor’s operations and whether they are involved in data transfers outside the EEA.

                👉 To further streamline this process, we strongly recommend using our Privacy and Cookie Policy Generator as the 🎖 Preferred Method for selecting relevant vendors and in order for the Privacy Controls and Cookie Solution to automatically update accordingly. For those looking for more flexibility, you can also manually add vendors using the Privacy Controls and Cookie Solution Configurator.

                A legal basis is a lawful ground under which personal data are processed. According to GDPR, there are six possible legal basis. In the advertising sector, two legal bases are commonly used:

                • consent of the data subject; and
                • legitimate interest of the data controller.

                The TCF supports both legal bases. However, starting with TCF 2.2 — and still applicable under TCF 2.3, legitimate interest is no longer an acceptable legal basis for purposes 3, 4, 5 and 6. Therefore, for these purposes, Vendors can now only rely on consent.

                Furthermore, consider that some national DPAs, like in Italy and Belgium, have excluded the use of legitimate interest as a valid legal basis in general in the advertising context and that’s why it’s important to restrict it to “Consent only” if you operate in those countries (you can read more about country-specific requirements in our Cookie Consent Cheatsheet).

                No, the TCF Policies do not require re-establishing legal bases and therefore do not require CMPs to resurface the interface. The standardization improvements introduced in TCF 2.2 and still applicable under TCF 2.3 focus on how information and choices are structured, rather than on introducing new purposes or legal bases. Publishers should review the information they provide in their CMP interfaces and make a case-by-case determination, taking into account their specific needs, operating context, and local Data Protection Authority requirements.

                Google and IAB TCF v2.3

                Google fully supports IAB TCF v2.3 and is part of the TCF global vendor list. If you serve ads via Google publisher products — AdSense, Ad Manager, or AdMob — in the EEA, the UK, or Switzerland, you are required to use a Google-certified Consent Management Platform (CMP) to collect and signal valid user consent.  

                Google has confirmed support for TCF 2.3, which becomes the enforced default for newly generated consent signals before February 28, 2026

                💡 iubenda, as a certified IAB TCF Consent Management Platform (CMP) and a Google CMP Partner, aligns with TCF 2.3, offering all the assistance and support you require. Therefore, using iubenda’s tool allows you to comply with Google’s standards when displaying ads to audiences in Europe, the UK, and Switzerland.

                With these actions, Google aims to clarify and enhance the reliability of ad consent requests. They also aim to ensure ad displays uphold individuals’ privacy rights.

                If your CMP is not compliant by the enforcement deadline, Google may default ad requests to Limited Ads, which can reduce personalization and impact revenue. With iubenda, you can switch to TCF 2.3 now or let us handle the transition automatically. 

                What about ad vendors that are not yet part of the TCF?

                While the framework comprises an ever-growing list of ad vendors, some advertisers are not yet part of the TCF. That’s the case with some of Google’s partners. To circumvent this problem, Google has defined a technical specification called Additional Consent Mode, intended only for use alongside TCF to serve as a bridge for Google’s Ad Tech Providers who are not yet registered on the TCF Global Vendor List.

                💡  iubenda CMP fully supports TCF integration requirements set by Google, including the Additional Consent Mode.

                IAB TCF Benefits for End-Users

                The IAB Transparency and Consent Framework (TCF) improves transparency and bring a higher level  of standardization to the information and choices available to users regarding the processing of their personal data, as well as clarifying how these choices should be recorded, conveyed, and honored. 

                Many of the user-facing improvements were introduced with TCF 2.2 and remain fully applicable under TCF 2.3, which does not introduce new user-facing requirements. 

                Key benefits for end-users include: 

                • Consent-Centric Processing: Starting with TCF 2.2 and still applicable under TCF 2.3, vendors can no longer rely on legitimate interest for certain advertising and content personalization purposes. For purposes 3, 4, 5, and 6, vendors must rely only on user consent, giving users stronger control over how their data is processed.
                • Enhanced User Information: The framework provides more user-friendly descriptions and real-use case examples, replacing complex legal text. This change improves user understanding of the purposes and features of data processing, facilitating more informed choices.
                • Standardized Vendor Information: Vendors are mandated to disclose more comprehensive information about their data processing activities, which includes:
                  • Types of data collected
                  • Data retention periods for each purpose
                  • Any legitimate interests involved
                  • Multilingual support for URL declaration
                  • This disclosure enables users to receive detailed insights into vendors’ data practices.
                • Transparent Vendor Count: Publishers must disclose the total number of vendors seeking to establish a legal basis on the primary layer of their user interfaces, promoting transparency and informed decision-making for users.
                • Facilitated Consent Withdrawal: Publishers and CMPs are required to provide easy options for users to revisit the consent interface and withdraw their consent effortlessly. It also mandates vendors to retrieve the Transparency & Consent String in real-time when necessary.

                iubenda and the IAB Transparency and Consent Framework (TCF 2.3) 

                Implementation Timeline

                ⚠ Please take note of the following deadlines for implementation:

                TCF 2.3 enforcement timeline: 

                • June 19, 2025 – TCF 2.3 officially announced by IAB Europe 
                • October 2025 – Google confirms support for TCF 2.3 consent strings 
                • By February 28, 2026 – TCF users must adopt TCF 2.3 and make the necessary changes to their implementations 

                Starting February 1, 2026, iubenda, as a certified CMP, stores user consent using the TCF 2.3 format, ensuring compatibility with the latest specifications ahead of the official adoption deadline. 

                From February 28, 2026, all newly generated TC strings must comply with TCF 2.3. TCF 2.2 strings created before this date remain valid, but no new TCF 2.2 strings should be generated after the deadline

                If you use Google AdSense, Ad Manager, or AdMob in the EEA, the UK, or Switzerland and are not ready by the deadline, ad requests may default to Limited Ads, potentially impacting revenue. 

                💡 Our cookie consent manager for the ePrivacy, GDPR, and US State Privacy Laws allows you to display a fully customizable cookie banner, collect cookie consent and implement prior blocking. 

                Also, as a registered Consent Management Platform (id number 123), the iubenda Privacy Controls and Cookie Solution lets users set advertising preferences and is compatible with the IAB GDPR Transparency and Consent Framework. This feature allows users to toggle advertising preferences for advertisers on the IAB’s extensive global vendor list.

                1. Enable the IAB Transparency and Consent Framework

                With the introduction of IAB TCF 2.3, the Transparency and Consent Framework continues to evolve while remaining fully supported in iubenda’s Privacy Controls and Cookie Solution. TCF 2.3 is a technical update that builds on previous versions of the framework and does not introduce new user-facing features or changes to the consent banner.

                iubenda has precisely integrated these updates to provide even more sophisticated consent management. For optimal convenience and usability, the use of our Privacy and Cookie Policy Generator (Preferred Method 🎖) is recommended. For those who need more flexibility, Manual insertion of vendors is also available on the Privacy Controls and Cookie Solution Configurator, allowing users to adjust services according to their particular needs.

                To enable the TCF v. 2.3, head to your dashboard and click on the site/app that you’d like to update.

                ⚠ The very first action that we suggest is to select the vendors you’re using through our Privacy and Cookie Policy Generator.

                Use our Privacy and Cookie Policy Generator (🎖 Preferred Method)

                1. On the Privacy and Cookie Policy Generator
                  • Select TCF-related vendors from the services modal.
                2. Then, on the Privacy Controls and Cookie Solution Configurator:
                  • Activate the TCF tile (if it is not already enabled).
                  • The Privacy Controls and Cookie Solution updates automatically with any addition or removal of any TCF service on the Privacy and Cookie Policy. Subsequently, the Configurator will display the number of providers added, and the banner will adjust its display, affecting the TCF panel accordingly.
                IAB TCF

                If you haven’t already activated the Privacy Controls and Cookie Solution, here’s a tutorial on getting started.

                💡 Are you looking to manage Consent Mode parameters?

                Activate the “Manage Google Consent Mode consents status within the TCF string” option to instruct Google to infer Consent Mode consents for ad_storage, ad_user_data, and ad_personalization directly from the TCF string.

                Manually Insert Vendors

                1. You can manually add vendors by selecting “Manually enter the list of TCF vendors you want to display” and then adding the vendor IDs, separated by commas. The list and additional vendor information can be obtained by consulting the Global Vendor List and the additional vendor information list.
                2. IAB TCF
                3. If the TCF v2.3 is enabled on the Privacy Controls and Cookie Solution Configurator, the system will promptly display an alert if it can’t find any TCF vendors.

                ⚠ Note: Without a selection, the Privacy Controls and Cookie Solution will display all TCF vendors, potentially breaching TCF policies.

                1. Managing Purpose Options:

                Users have the capability to manage all the purpose options, which are kept updated with the latest policy version. This means updated definitions, the exclusion of legitimate interest for purposes from 3 to 6, and the inclusion of the new purpose 11.

                Once enabled the IAB TCF option, you’ll immediately notice that:

                • The banner text will be lengthened to meet IAB requirements. The additional text (only editable upon request) contains essential disclosures related to the enhanced options that we mention in the sections below.
                • “Accept” and “Learn more and customize” buttons will be force-enabled, as required by IAB.
                IAB TCF

                What the banner notice for TCF v2.3 needs to contain

                • information about the fact that information is stored on and/or accessed from the user’s device (e.g. use of cookies, device identifiers, or other device data);
                • information about the fact that personal data is processed, and the nature of the personal data processed (e.g. unique identifiers, browsing data);
                • a link to the list of vendors and the number of third party vendors;
                • a list of purposes (using the GVL version 3 standardized names and/or stack names);
                • information about the special features used by the vendors (using the GVL standardized names and/or stack names);
                • information about the fact that the user can withdraw their consent at any time, and how to resurface the Framework UI in order to do so;
                • a call to action for the user to express their consent
                • a call to action for the user to customize their choices 

                💡 TCF 2.3 does not introduce new banner disclosure requirements or changes to the user interface.

                The main update in TCF 2.3 concerns how vendor disclosure is signaled technically (via the mandatory Disclosed Vendors segment in the TC string), which happens entirely behind the scenes and does not require changes to banner content or wording.

                Furthermore, you’ll have the chance to enable Google’s Additional Consent Mode option, a feature that allows you to gather consent for Google ad partners that are not yet part of the Transparency and Consent Framework, but are on Google’s Ad Tech Providers (ATP) list.

                Editing the cookie banner

                Please note that any previous changes to the banner text will be nullified when the TCF is enabled. Therefore, if you’ve previously edited the HTML or banner text, re-test with the default text and the buttons enabled.

                HTML

                If you want to edit the HTML, you must necessarily include our default text by including the %{banner_content} shortcode in the input, an element with the class="iubenda-cs-accept-btn" attribute and an element with the class="iubenda-cs-customize-btn" attribute.

                Text

                By enabling the TCF, the banner text will only be editable upon request. If you wish to edit the text of the cookie banner, make sure you check the IAB requirements and reach out to us via chat or email to have the modifications approved.

                Privacy Controls and Cookie Solution snippet

                Once enabled, your Privacy Controls and Cookie Solution embed code will go from this:

                <script type="text/javascript">
                  var _iub = _iub || [];
                  _iub.csConfiguration = {
                    "siteId": XXXXXX, // your siteId,
                    "cookiePolicyId": YYYYYY, // your cookiePolicyId,
                    "lang": "en"
                  };
                </script>
                <script type="text/javascript" src="https://cs.iubenda.com/autoblocking/3095420.js"></script>
                <script type="text/javascript" src="///cdn.iubenda.com/cs/iubenda_cs.js" charset="UTF-8" async></script>

                To this (note the stub-v2.js script, "enableTcf": true and other TCF options):

                <script type="text/javascript">
                var _iub = _iub || [];
                _iub.csConfiguration = {
                  "siteId":3156898, //use your siteId
                "cookiePolicyId":36614288, //use your cookiePolicyId
                 "lang":"en"
                };
                </script>
                <script type="text/javascript" src="//cdn.iubenda.com/cs/tcf/stub-v2.js"></script>
                <script type="text/javascript" src="//cdn.iubenda.com/cs/tcf/safe-tcf-v3.js"></script>
                <script type="text/javascript" src="//cdn.iubenda.com/cs/beta/iubenda_cs.js" charset="UTF-8" async></script>
                
                <script type="text/javascript">
                var _iub = _iub || [];
                _iub.csConfiguration = {
                 "askConsentAtCookiePolicyUpdate":true,
                 "enableTcf":true, //enable IAB TCF 
                 "tcfVendors":"628,1111,92", //(OPTIONAL) use this parameter to select manually the vendors you're using
                 
                 /*
                 (OPTIONAL) Limit the legal basis and choose which TCF purposes to prompt 
                 "tcfPurposes": {
                 "1":"true",
                 "2":"consent_only",
                 "3":"consent_only",
                 "4":"consent_only",
                 "5":"consent_only",
                 "6":"consent_only",
                 "7":"consent_only",
                 "8":"consent_only",
                 "9":"consent_only",
                 "10":"consent_only",
                 "11":"consent_only"
                 },
                 */
                 "floatingPreferencesButtonDisplay":"bottom-right",
                 "googleAdditionalConsentMode":true,
                 "lang":"en",
                 "perPurposeConsent":true, //enable per-category consent
                 "siteId":3156898, //use your siteId
                 "cookiePolicyId":36614288, //use your cookiePolicyId
                 
                 "banner":{ 
                 "acceptButtonDisplay":true,
                 "closeButtonDisplay":false,
                 "customizeButtonDisplay":true,
                 "explicitWithdrawal":true,
                 "listPurposes":true,
                 "position":"float-top-center",
                 "rejectButtonDisplay":true 
                 }
                };
                </script>
                <script type="text/javascript" src="//cdn.iubenda.com/cs/tcf/stub-v2.js"></script>
                <script type="text/javascript" src="//cdn.iubenda.com/cs/tcf/safe-tcf-v3.js"></script>
                <script type="text/javascript" src="//cdn.iubenda.com/cs/beta/iubenda_cs.js" charset="UTF-8" async></script>

                Now that you’ve pasted the Privacy Controls and Cookie Solution code inside the body of your pages, let’s talk about prior blocking the vendor scripts.

                The iubenda CMP provides the __tcfapi function in order for vendors to read the consent properly.
                We use a script (safe-tcf-v3.js) that has the only job of reading the TCF cookie and releasing the __tcfapi function and not directly blocking the vendor scripts. It is a synchronous activator that runs at the very beginning of the page, guaranteeing that the consent is read within 500ms from the vendor scripts being executed.

                This is the default behavior when enabling the Iab TCF options of our configurator.
                It works from the second pageview (when consent is already present on the page) and it allows to achieve high-performing in terms of load speed.

                However, it may result in some incompatibilities with Google Ad Manager, AdSense, and AdMob. If you want to directly block the vendor scripts you can see below.

                Further implementations and optimization – Google Ads users

                Vendors have a maximum time (generally 500ms, usually non-configurable) to wait for consent from the CMP. 
                In cases where the CMP does not respond within a maximum of 500ms, vendors’ Sell-Side Platform uses the opt-out status of the user instead, which means that in such cases, your end-users will be served with non-personalized ads.

                This might happen if you use Google’s advertising services such as Ad Manager, AdSense and AdMob.
                To prevent these issues, you can directly block the vendors’ scripts using one of the prior blocking methods supported by our Privacy Controls and Cookie Solution, then execute them only after consent has been collected.

                You can use this to have more direct control regarding ensuring compliance and serving personalized ads from the first pageview when consent hasn’t been collected yet. It also allows you to avoid error 2.1a (for Google Ad Manager, AdSense, and AdMob users).

                Our Privacy Controls and Cookie Solution offers various tools for the prior blocking of scripts that may install cookies. More in our introduction to the prior blocking of scripts. To block Google’s scripts, you can directly reference the examples for Google AdSense and Google Publisher Tag.

                Per-category consent

                Please note that if you’ve enabled the Privacy Controls and Cookie Solution’s per-category consent feature, you’ll need to tag TCF scripts as “purpose 1” (Necessary).

                The stub-v2.js and safe-tcf-v3.js can also be embedded inline or self-hosted, if necessary. Read this guide for more optimization tips.

                To read the consent from the __tcfapi function, you can open the browser console and launch these commands:

                window.__tcfapi('getTCData', 2, function(result,success) { console.log(result) });
                window.__tcfapi('getTCData', 2, function(result,success) { console.log(result) }, [1,2]);
                window.__tcfapi('ping', 2, function(result) { console.log(result) });

                Finally, as required by IAB, you have to provide a link or button (e.g. in the footer) that allows your visitors to update their advertising tracking preferences even after closing the cookie banner. 

                Let’s see how.

                To implement, just add the iubenda-advertising-preferences-link class to a custom link or button:

                <a href="#" class="iubenda-advertising-preferences-link">
                    Update your advertising tracking preferences
                </a>

                Place it anywhere on your site (typically added to the footer). Once clicked, the link above will trigger the opening of the advertising tracking settings modal:

                open-preferences

                To meet IAB’s requirements, please note that if you don’t implement the iubenda-advertising-preferences-link class, we’ll automatically display a small widget that hovers on your pages:

                IAB TCF

                Additional features and settings

                Under the IAB TCF tile you’ll find these enhanced publisher options:

                To do this scroll to the “Restrictions of purposes and legal basis” option, decide which purposes you want to enable, and finally select the legal basis under which personal data can be processed for active purposes. 

                restrict purposes

                Note: if you are not sure about this aspect, consider that “Consent only” is usually the safest option and definitely best practice for purposes related to profiling.

                We’ve already mentioned the importance of restricting the number of vendors you want to work with. Another advantage of providing transparency for a limited number of vendors is the possibility to basically eliminate the problem of requesting new consent at the global vendor list update. In fact, the IAB vendor list is updated almost weekly. 

                If, nevertheless, you decide not to limit the number of vendors to work with, you may want to choose how to handle new consent requests, avoiding showing the cookie banner to users who have already given consent a few days or weeks before.

                Inside the tile IAB TCF, you’ll find a section called Request new consent from users that had previously provided consent, if the IAB Framework preference is not found

                request new consent

                Some vendors may ask you to explicitly provide gdpr and gdpr_consent parameters into their request. Here’s a snippet to meet this requirement:

                <script type="text/javascript">
                    __tcfapi('addEventListener', 2, function(tcData) {
                        if (tcData.eventStatus !== 'useractioncomplete' && tcData.eventStatus !== 'tcloaded') {
                            return;
                        }
                        var gdpr = tcData.gdprApplies ? 1 : 0;
                        var gdpr_consent = tcData.tcString;
                        console.log({ gdpr: gdpr, gdpr_consent: gdpr_consent });
                        // Remove event listener to avoid invoking the ads multiple times
                        __tcfapi('removeEventListener', 2, function(success) {
                            console.log('event listener removed', success);
                        }, tcData.listenerId);
                    });
                </script>

                Once replaced the console.log line with the request to the vendor by using the gdpr and gdpr_consent variables, add this snippet below the iubenda_cs.js script, and it will automatically invoke the vendor script with the correct consent data.

                Now when your users click on the Learn more and customize button in your cookie banner in order to manage their preferences, they’ll see the following options:

                Note: when the user indicates that they would like to manage preferences by opening the preference window, all cookies are “turned off” by default as a positive affirmative/opt-in action is legally required for valid consent.

                Frequently Asked Questions

                Do publishers need to resurface the banner to obtain new consent?

                In alignment with IAB’s guidelines, we’ll not force any reconsent; however, publishers should evaluate this on a case-by-case basis. Publishers must limit the vendors to those they actively collaborate with and clearly state this in the privacy policy. By doing so and avoiding from adding new vendors, there should be no need to resurface the banner or re-establish consent, especially as they are already restricting Legitimate Interest. This means there should be no issues with changes in legal basis. However, publishers should evaluate their specific circumstances and make determinations accordingly.

                If I have my own Privacy and Cookie Policy, can I use the iubenda generator for specifying only the TCF-related services/vendors and my own for the rest?

                Yes, you can. However, we recommend an additional step: when an iubenda Privacy and Cookie Policy is detected, the purposes displayed in the second layer are derived from the added services. To ensure correct handling of all purposes, users should choose the custom option of granular control by category under GDPR.

                IAB - Interactive Advertising Bureau

                See also

                The post The complete guide to iubenda CMP and IAB TCF 2.3 appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]> How to Prove You Honored the Right to Be Forgotten https://www.iubenda.com/en/help/7399-right-to-be-forgotten/ Wed, 13 Jun 2018 13:43:36 +0000 https://help.iubenda.com/?p=7399 What is the Right to Be Forgotten under the GDPR? Under the GDPR, data subjects can request data controllers to erase all the personal data they’ve collected about them. This is the GDPR right to be forgotten (or right to erasure). As a data controller, you may be wondering: How can you prove to data […]

                The post How to Prove You Honored the Right to Be Forgotten appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                What is the Right to Be Forgotten under the GDPR?

                Under the GDPR, data subjects can request data controllers to erase all the personal data they’ve collected about them. This is the GDPR right to be forgotten (or right to erasure).

                As a data controller, you may be wondering: How can you prove to data subjects that you’ve fulfilled their request?

                right to be forgotten gdpr

                How to prove you honored the Right to Be Forgotten (GDPR)

                The answer to this is is a bit abstract, but essentially the protections offered by the GDPR relate to “personal data” which is defined under the Regulation as data that makes it possible to directly or indirectly identify a natural person.

                So in the case where a user has exercised the Right to be Forgotten (in regards to all of their data), that user’s personal data would technically no longer exist on your systems and as such the user would no longer be “identifiable” by you or your systems.

                Article 12 of the GDPR states:

                The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.

                What does this mean?

                Data controllers are exempt from the fulfillment of “Users’ Rights”, where the data subject cannot be identified — as in case where all of the user’s personal data is removed from your systems in the fulfillment of the initial request.

                In this situation, there would be no possibility or need to “provide proof” of something that no longer exists in relation to an identifiable person.

                In practical terms, the best way to handle such a request would be to clearly inform the user (at the time of the initial request) that in fulfilling the request, all their data will be removed and that it would therefore be impossible for them to exercise any further rights in regards to this data as the data will no longer exist on your systems.

                Another required (in most cases) and practical way of maintaining proof of your overall compliance is to maintain valid records in regards to your processing activities and acquisition of consent (where applicable). This way, you are better equipped to prove (to the Authority or otherwise) that you have systems in place to facilitate the fulfillment of the User’s Rights, even if the data in question is no longer available.

                How iubenda can help

                Register of Data Processing Activities

                Meeting GDPR regulations can be a technical challenge to implement in practical terms. This is especially true for your register of data processing activities. In order to be compliant, you must be able to keep track of and describe:

                • which data you collect;
                • for which purposes it was collected;
                • the legal basis for processing;
                • data retention policy for each processing activity;
                • the parties involved (both inside and outside your organization);
                • security measures;
                • data transfer outside of the EU, if any; and
                • other related details which may apply company-wide, including data of employees.

                Our solution helps you to easily record and manage all the data processing activity within your organization so that you can easily comply with requirements and meet your legal obligations. It allows you to create records of processing activity: add processing activities from 1700+ pre-made options, divide them by area (sub-divisions within which data processing activities are the same), assign processors and other member roles, and to document legal bases and other GDPR-required records.

                Please note: As mentioned in this guide, full and extensive records of processing are typically required for organizations that handle “special categories of data” or have more than 250 employees, however there are some record-keeping requirements — such as which data you collect, its purpose, all parties involved in its processing and the data retention period — which are mandatory for everyone. Additionally, even though the GDPR is a common reason to put more effort into your register of data processing activities, our tool is not exclusively made for application under the GDPR. It can also be used for all your data processing activties in general, even by companies who do not have any users/customers within the EU.

                👉 For a list of the full features of the Register of Data Processing Activities, click here or read the guide here.

                Managing consent and maintaining detailed records related to it

                In order to comply with privacy laws, especially the GDPR, companies need to store proof of consent so that they can demonstrate that consent was collected. These records must show:

                • when consent was provided;
                • who provided the consent;
                • what their preferences were at the time of the collection;
                • which legal or privacy notice they were presented with at the time of the consent collection; and
                • which consent collection form they were presented with at the time of the collection.

                Our Consent Database simplifies this process by helping you to easily store proof of consent and manage consent and privacy preferences for each of your users. It allows you to track every aspect of consent (including the legal or privacy notice and the consent form that the user was presented with at the time of consent collection) and the related preferences expressed by the user.

                To use, simply activate the Consent Database and get the API key, then install via HTTP API or JS widget and you’re done; you’ll be able to retrieve consents at any time and keep them updated.

                👉 For a list of the full features of the Consent Database click here or read the guide here.

                Fulfill your users’ request easily

                Start generating

                Read also

                The post How to Prove You Honored the Right to Be Forgotten appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Google Analytics and the GDPR: Is It Considered Monitoring Behavior? https://www.iubenda.com/en/help/7227-google-analytics-gdpr-monitoring-behavior/ Wed, 06 Jun 2018 12:33:34 +0000 https://help.iubenda.com/?p=7227 ⚠️ Important update Say goodbye to manual IP anonymization. Google Analytics 4 now ensures IP addresses are not stored by default, enhancing your user privacy. 👉 Want to learn more? Check out our Google Analytics 4 overview. Is Google Analytics and the GDPR? Is It Considered Monitoring Behavior? We’ll take a look at all below […]

                The post Google Analytics and the GDPR: Is It Considered Monitoring Behavior? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                ⚠ Important update

                Say goodbye to manual IP anonymization. Google Analytics 4 now ensures IP addresses are not stored by default, enhancing your user privacy.

                👉 Want to learn more? Check out our Google Analytics 4 overview.

                Is Google Analytics and the GDPR? Is It Considered Monitoring Behavior? We’ll take a look at all below 👀

                Monitoring behavior

                The short answer here is that it depends on what you’re doing with the raw data. “Monitoring” under the GDPR is referred to within the context of profiling:

                In order to determine whether a processing activity can be considered to monitor the behavior of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analyzing or predicting her or his personal preferences, behaviors and attitudes.

                So for example, if you were using Google Analytics (even with IP the anonymization feature in place), you can at least tell the region of users. This information coupled with user account details such as a company email address and /or age information can be used to infer further details such as average income, about an individual user, which can then be used in profiling.

                Alternatively, if the raw anonymized Google Analytics data isn’t coupled with individual user data and is instead used statistically to give you general information about how users are using the website, then this is not considered “monitoring” behavior.

                💡 To learn more about which EU cookie consent rules apply on a per-country basis, check out our Cookie Consent Cheatsheet here.

                Is Google Analytics compliant with the GDPR?

                Several European data protection authorities have found that Google Analytics’ processing of European user data could result in illegally transferring data outside of Europe. Here’s why →

                Due in part to this conversation around the use of Google Analytics, Google released Google Analytics 4 in an attempt to address some concerns.

                ❓
                Not sure what privacy laws apply to you?

                Take this 1-min quiz to find out! 

                How iubenda can help

                Regardless of which of the above-mentioned approaches you take, you must meet your disclosure requirements by having accurate and up-to-date information about the data you collect, the purpose, use and third-party processing in your privacy policy. Read more about the GDPR and its requirements here.

                Our Privacy Policy Generator is affordable, available in several languages, lawyer crafted, customizable and self-updating (as it’s monitored remotely by our lawyers). It easily allows you to create a beautiful, precise privacy policy. Our 1700+ lawyer-crafted clauses and custom clause option makes it easy for you to comply with even the strictest requirements.

                 

                👀 For more information on privacy policies click here

                Our privacy policies also comes with the option to include a cookie policy (which is likely necessary if you’re using Google Analytics as under the Cookie Law, whether statistical third-party cookies are exempt from consent requirements may depend on the law of the individual member state )

                This also means that our Privacy Controls and Cookie Solution for the Cookie Law will also be useful to you. Our comprehensive Privacy Controls and Cookie Solution simplifies compliance with provisions of the European Cookie Law. It’s an easy to run cookie policy and cookie consent solution (including banner management), that’s fast and does not require heavy investments.

                👀 For more information on our Privacy Controls and Cookie Solution, click here.

                You can read more about our GDPR solutions or read all our compliance solutions here.

                🚀
                Google Analytics 4

                Here’s how to switch to and set up Google Analytics 4 →

                See also

                The post Google Analytics and the GDPR: Is It Considered Monitoring Behavior? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                GDPR Offline Compliance Duties https://www.iubenda.com/en/help/6738-gdpr-offline-compliance-duties/ Fri, 25 May 2018 13:56:48 +0000 https://help.iubenda.com/?p=6738 One of the most common misconceptions is to think that the GDPR only applies to the online environment: it doesn’t! The GDPR is technology-neutral: it applies to the processing of personal data no matter how it takes place (online, offline, via a website, via an app, in an employment relationship etc.). The GDPR applies to […]

                The post GDPR Offline Compliance Duties appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                One of the most common misconceptions is to think that the GDPR only applies to the online environment: it doesn’t! The GDPR is technology-neutral: it applies to the processing of personal data no matter how it takes place (online, offline, via a website, via an app, in an employment relationship etc.).

                The GDPR applies to the processing of personal data no matter how it takes place (online or offline)

                This post dives into what we’ll call offline-compliance. Find some of the most relevant offline-compliance requirements to be taken care of below:

                1. Appointment of an EU-representative
                2. Data processors and Data Processing Agreement (DPA)
                3. The Data Protection Officer (DPO)
                4. Confidentiality obligations of employees
                5. The Data Protection Impact Assessment (DPIA)

                1. Appointment of an EU-representative

                If you are a controller based outside of the EU, but you are offering goods or services (even for free) to EU-based users or you are monitoring their behavior as far as it’s taking place within the EU, you have to appoint an EU-representative established in one of the EU countries your Users are based in.

                The EU-representative may be a natural or legal person.

                📌 What does the EU-representative do?

                The EU-representative acts as one-stop-shop for any inquiries, requests or claims submitted against the controller by data subjects or supervisory authorities. This means that the representative has to forward to the controller any such inquiry along with all thereto related information it disposes of. More generally, it has to support the controller in complying with the GDPR under all aspects, including but not limited to notifying data breaches or cooperating with supervisory authorities. In general, however, the controller and not the representative bears all responsibility for the data processing activities.

                The EU-representative also has specific own obligations (and thereto connected liabilities). For instance, it has to maintain records of processing activities.

                📌 How to appoint the EU-representative (template)

                The GDPR requires you to appoint the EU-representative “in writing”. You may use for instance our standard appointment agreement, available via .docx direct download:


                2. Data processors and data processing agreement (DPA)

                When processing personal data as a controller, you often need to have a part of the processing activities done by an external supplier. Such a supplier will then typically process personal data referring to your clients on your behalf: it will not process them in its own interest. Such suppliers are called “processor” by the GDPR and the underlying relationship with you as a controller is a data processing order.

                Let’s look at a practical example

                You have an online shop for shoes. When customers place an order, the shoes are actually packed and prepared for delivery by your external supplier, who obviously needs to receive all necessary customers’ personal data to fulfill the order. The external supplier is, therefore, processing customers’ data on your behalf as a data processor.

                📌 What do I need to do?

                Pursuant to art. 28 GDPR, data controllers and data processors must close a “Data Processing Agreement” in writing – including in electronic form. Such agreement is intended to specify the parties’ rights and duties in the performance of processing activities by a processor. Just to name a few, processors shall only act on instructions by controllers, adopt adequate technical and organizational security measures to ensure personal data protection, cooperate with the controller in case of data subjects’ inquiries or actions by supervisory authorities, etc.

                The greatest news brought about by the GDPR is that, pursuant to art. 82, controllers and processors bear a joint liability vis-à-vis third parties. This means that, whenever a data subject considers that his data have been processed unlawfully, he may turn to the controller or to the processor and claim compensation for the entire damage suffered. Only subsequently may the party that has paid compensation, in turn, take recourse to the other one.

                Example continuation

                A data subject receives a pair of shoes delivered at his home address, although he has never ordered them. He chooses to claim compensation from the fulfillment supplier. The latter pays and eventually takes recourse to the controller since that’s who issued the instruction to deliver the pair of shoes to the complaining data subject.

                Any entity that’s not appointed as a processor is a “third party“. Therefore, if you forward personal data of your clients to any party that has not been appointed as a processor, from a legal perspective you are transferring data to a third party: which you can only do according to a legal basis – typically the data subject’s consent. However, it’s often not easy to meet the requirements of valid consent when transferring data to a third party.

                📌 DPA and transfer of data to third countries

                Sometimes the processors you appoint for specific data processing activities are based outside of the EU. This confronts you with the problem of providing a valid legal basis for the transfer of personal data to such country. We have explained the different legal bases available here. What must be stressed is that the legal basis for transfer and the DPA are two different issues that may or may not coincide with the same document.

                Example continuation
                • You transfer data to Google (e.g. Google Analytics). You will need to sign a DPA with Google.
                • You transfer data to a company based in Australia. Currently, there is no adequacy decision or any other framework applicable to transfers to Australia (from the EU or Switzerland). Therefore, you might want to base the transfer on “standard contractual clauses”. If so, your DPA with the Australian data recipient will include also the standard contractual clauses provided by the European Commission’s decision 78/2010/EC. In this case, the basis for transfer and the DPA will actually coincide.

                🚀 Template

                A base template for the Data Processing Agreement can be found via .docx direct download:


                3. The Data Protection Officer (DPO)

                Pursuant to art. 37 GDPR, controllers must under certain conditions appoint a Data Protection Officer (DPO). But what is a Data Protection Officer?

                A DPO is a natural (or legal) person, that has to supervise the controller’s (or processor’s) compliance with privacy provisions. Whenever the conditions for a mandatory appointment exist, the DPO must at least

                • inform and advise the controller (or processor) and their employees about relevant data protection provisions;
                • monitor compliance with such applicable provisions, first and foremost the GDPR;
                • upon request, assist the controller (or processor) in connection with the data protection impact assessment (DPIA) and monitor its performance;
                • cooperate with and act as contact point for supervisory authorities on any issues relating to the processing of personal data;
                • act as contact point for data subjects with regard to all issues related to the processing of their personal data and to the exercise of their rights under the GDPR.

                The GDPR does not expressly require the DPO to be a natural person: this means, in principle also a legal entity such as a consultancy company may be appointed as DPO. However, already now various commentators are pointing out at least some of the requirements provided for by the GDPR can only apply to a natural person: for instance the “professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfill the tasks referred to in Article 39 GDPR” are clearly to be referred to a natural person, rather than to a legal person.

                The GDPR does not expressly require the DPO to be a natural person: this means, in principle also a legal entity such as a consultancy company may be appointed as DPO. However, already now various commentators are pointing out at least some of the requirements provided for by the GDPR can only apply to a natural person: for instance the “professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfill the tasks referred to in Article 39 GDPR” are clearly to be referred to a natural person, rather than to a legal person.

                However, at this stage it’s not possible to answer this question conclusively: we’ll have to wait and see which approach is embraced by data protection authorities and/or courts of law.

                📌 How does the DPO perform its tasks?

                First of all, the DPO can be either internal to the controller’s organization (typically an employee) or an external supplier (free-lance). In both cases, he may also fulfill other tasks or duties while performing its activities as a DPO. However it must always be guaranteed that this does not result in a conflict of interests: therefore, the company’s managing director may for instance not be appointed as a DPO. The same applies to the CTO: it would be rather awkward to have the same person develop the IT infrastructure and have it checked from a personal data protection point of view!

                Overall, the DPO is subjected to a statutory duty of secrecy regarding any information learned while performing its task, and must always maintain full independence (even if formally he’s an employee!). This means that the DPO must be provided with all necessary means of work, workforce, and budget to fulfill its tasks and may not be subjected to any directive powers.

                Let’s look at a practical example

                The data protection authority carries out a data protection audit and requires access to the registry of processing activities pursuant to art. 30 GDPR. The DPO knows that there is no such registry because the controller never took this requirement too seriously. However, the DPO must be neutral and may not “defend” the controller with some excuse: he must confirm that the registry has never been made.

                In terms of liability, it’s important to note that the DPO is not liable for the controller’s compliance. The DPO’s duty is to inform, advise and cooperate as already described. If the controller does not follow the DPO’s advice, it’s its sole responsibility. The DPO could only be considered liable vis-à-vis the controller if he has delivered wrong advice. But even then, with respect to the data subjects, the controller shall always be liable.

                📌 When do I have to appoint a DPO?

                Under the GDPR, the appointment of a DPO is mandatory in three scenarios:

                1. the controller (or processor) is a public body or authority (e.g. an administrative or governmental agency);
                2. the core activities of the controller (or processor) consist of processing on a large scale of sensitive data or personal data relating to criminal convictions and offenses;
                3. the core activities of the controller (or processor) consist of processing operations which require regular and systematic monitoring of data subjects on a large scale;

                The scenarios nos. 1 and 2 are relatively clear: “sensitive” data are data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

                But what about the “regular and systematic monitoring of data subjects on a large scale”? Does this only apply to entities such as Facebook or Google, whose business model is pretty much based on the massive processing of personal data, or is this already applicable if – say – you implement Google Analytics in your webshop since this feature allows you to monitor your customers?

                The truth is: we don’t know yet. Several authorities, commentators, and experts, such as the WP29, have delivered their two cents on this issue, but none of them is legally binding. Therefore, also in this regard, all we can do is wait and see which approach is embraced by data protection authorities and/or courts of law.

                🚀 Template

                Here’s a template for a DPO appointment, currently available via .docx direct download:


                4. Confidentiality obligations of employees

                Although the GDPR, unlike some pre-GDPR legislations (e.g. the Italian and German), does not introduce an express and general requirement to subject employees or, more generally, staff involved in the processing of personal data to a confidentiality obligation, it is still advisable to inform staff members about the duty of secrecy and to have them sign a binding obligation in order to meet the conditions set by some GDPR provisions, such as:

                • The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law (art. 32 par. 4).
                • The processor ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (art. 28 par. 3 lit. b).
                • The data protection officer must inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions (art. 39 par. 1 lit a).

                On top of all that, art. 24 requires the controller to “be able to demonstrate that processing is performed in accordance with this Regulation”, which at least indirectly also includes being able to demonstrate that employees and other staff have been processing personal data in compliance with the GDPR.

                We suggest that you close a specific confidentiality and non-disclosure agreement with all staff members, thereby referring to the instructions about the correct dealing with personal data you have previously given to them. You should make sure that such instructions are handed out to staff and signed for receipt, in order to be able to eventually provide evidence thereof.

                🚀 Template

                A template for non disclosure/confidentiality of employees is currently available via .docx direct download:


                5. The Data Protection Impact Assessment (DPIA)

                Pursuant to art. 35 GDPR, controllers must under certain conditions proform a Data Protection Impact Assessment (DPIA). But what exactly is a Data Protection Impact Assessment?

                A DPIA is a process used to help organizations comply effectively with the GDPR and ensure that the principles of accountability, privacy by design and privacy by default are put in practice by the organization.

                The DPIA should include:

                • Full descriptions of the data processed
                • The purpose of the processing activity (and where applicable, information on the legitimate interests of the data controller)
                • An evaluation of the scope and necessity of the processing activity in relation to the purpose
                • An assessment of the risk posed to users
                • Measures in place to address that risk

                The DPIA process should be recorded in writing.

                📌 When is it mandatory?

                Generally speaking, the DPIA is only mandatory in cases where data processing activity is likely to result in a high risk for users (this is particularly applicable when introducing new processing technology). However, if unsure as to whether or not your processing activity falls within what is considered “high risk”, it is recommended that a DPIA be carried out nonetheless as it is a useful tool for ensuring that the law is complied with.

                “High risk” data processing activities include:

                • Large-scale processing of sensitive data
                • Systematic monitoring of a publicly accessible area (e.g. CCTV)
                • Situations where there are extensive automated evaluations of personal data that is intended to influence decisions that can affect the user’s life significantly

                DPIAs can also be required in other circumstances (based on a by case evaluation) including but not limited to processing data concerning vulnerable persons (e.g. children, the elderly), data transfer across borders outside the EU and data that is being used in profiling (e.g. credit scores). You can read more about the criteria here [PDF].

                While publishing the DPIA is not a general legal requirement of the GDPR, it is suggested that data controllers consider publishing all or part of their DPIA as a gesture of transparency and accountability, especially in cases where members of the public are affected (for example, where a public authority carries out the DPIA).

                An effective DPIA is useful in meeting the requirement of “Privacy by design” as it makes it possible for organizations to find and fix issues at an early stage, thus mitigating both data security risks for users, and the risk of fines, sanctions and reputation damage that might otherwise occur to the organization.

                🚀 Template

                A base template for the Data Protection Impact Assessment can be found here:

                💡

                Since you’ve ticked off your offline compliance duties, why don’t you check that you’re 100% compliant?


                👉 Here are 5 things you need to do now to comply with GDPR

                The post GDPR Offline Compliance Duties appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Manage Cookie Consent Easily https://www.iubenda.com/en/help/6293-cookie-consent-management-faq/ Sat, 12 May 2018 00:04:45 +0000 https://help.iubenda.com/?p=6293 The use of Cookies and similar technologies are governed by the ePrivacy Directive 2002/58/EC (or Cookie Law) which works alongside the GDPR.  Managing cookie consent comes with a few requirements. Our cookie consent management tool makes it super easy to meet these requirements in just a few clicks. Here’s how it works: 🚀 Ready? Try it yourself here risk free! Want […]

                The post Manage Cookie Consent Easily appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                The use of Cookies and similar technologies are governed by the ePrivacy Directive 2002/58/EC (or Cookie Law) which works alongside the GDPR. 

                Managing cookie consent comes with a few requirements. Our cookie consent management tool makes it super easy to meet these requirements in just a few clicks.

                Here’s how it works:

                1. Click “scan”. Our solution autodetects services running on your site and suggests them for your privacy and cookie policies. Add them with a click
                2. Customize your banner & set up prior blocking. Our easy-to-use configurator lets you control the look and behavior of the cookie banner & solution. Add your logo, brand colors, block custom scripts, change banner text and behavior based on geo-location, and more.
                3. Embed & you’re done.

                🚀 Ready? Try it yourself here risk free!

                Want to see more? Here’s how easy it is to set up and customize with the Privacy Controls and Cookie Solution.

                 

                Manage cookie consent with the Cookie Solution

                All you need for the EU Cookie Law: cookie banner, prior blocking and asynchronous re-activation

                Generate a cookie banner

                Want to learn more about ePrivacy and GDPR cookie requirements? Keep reading below.

                Update May 2020: The European Data Protection Board (EDPB) has updated its guidelines specifically related to recommended consent collection mechanisms. More on that here.

                The Cookie Law requires users’ informed consent before storing or accessing information on user’s devices. This means that if your site/app (or any third-party service used by your site/app) uses cookies or similar technologies, you must:

                • inform users about your data collection activities;
                • give them the option to choose whether it’s allowed or not;
                • obtain informed consent prior to the installation of those technologies.

                Here are some of the most common questions regarding cookie consent management and their answers.

                The process of collecting cookie consent includes clearly and explicitly informing the user of the cookies and similar technologies you run on your site/app, their purposes, the user’s right to grant or refuse consent, and how they can exercise that right.

                The cookie consent must be informed, explicit, and given via an unambiguous opt-in action.

                Specifically, you must:

                • display a clearly visible cookie banner/ notice at the user’s first visit (you can read what the banner should contain here);
                • provide a link in the banner to a more detailed cookie policy;
                • display a command to accept all cookies;
                • display a command to reject all cookies;
                • add a link to a dedicated area where users can make any granular choice as to the functionalities, the third parties and the categories of cookies to be installed;
                • block all non-exempt cookies and scripts from being run until after consent is received;

                Do I need to list the name of each cookie (including third-party cookies) used on our website?

                No, the Cookie Law does not require that you list and name individual cookies. You are instead explicitly required to clearly state their type, purposes, and if they are third-party trackers, you shall also indicate the third party who is managing them and link to the relevant third-party privacy/cookie policy.

                The Cookie Law does not require that you list and name individual cookies. However, you are required to clearly state their categories and purpose.

                This decision by the Authority is likely deliberate as to require this would mean that individual website/app owners would have to constantly monitor every single third-party cookie, looking for changes that are outside of their control. This would be both unreasonable and likely unhelpful to the average user.

                ? You can read more about this here or here (for even more in-depth information and legal sources).

                Active consent refers to consent that is based on the user being clearly and sufficiently informed of the purpose, categories and use of the cookies being used by your website, and that is indicated by an explicit affirmative action.

                Subject to the local authority, these active behaviors may include continued browsing, clicking, scrolling the page or some method that requires the user to actively proceed.

                This is somewhat left up to your discretion as according to the general guidelines no specific mechanism (e.g. checkboxes) is mentioned as mandatory: provided that your method facilitates active consent, however, it’s worth noting here the because the ePrivacy is, in fact, a Directive, the specifics of how requirements should be met are heavily dependent on individual Member State law.

                For this reason, we give you the option to easily enable or disable the Privacy Controls and Cookie Solution’s “scroll to consent” feature should the particular Member State law require it.

                The Cookie Law itself does not require that records of consent be kept, but instead indicates that you should be able to prove that consent occurred — even if that consent has been withdrawn. However it’s important to note that some EU Data Protection Authorities in alignment with the GDPR, now require that records of consent – rather than simply proof – be kept. If this applies to your particular situation, you will need to maintain valid records of consent.

                ? You can read more about records here.

                Here’s an example of how cookie consent should be collected:

                Cookie consent through iubenda Cookie Solution

                How iubenda can help you manage cookie consent

                Our cookie management solution makes it easy to comply with the Cookie Law, allowing you to:

                 

                The Privacy Controls and Cookie Solution allows you to collect consent via multiple mechanisms including continued browsing, scrolling, and/or specific clicking actions. Keep in mind though that allowed consenting actions may differ depending on the Member State law.

                Manage cookie consent with the Privacy Controls and Cookie Solution

                Generate a cookie banner

                See also

                The post Manage Cookie Consent Easily appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Legal Sources on Third-Party Cookie Names and Opt-Out Mechanisms https://www.iubenda.com/en/help/6282-legal-sources-third-party-cookie-names-opt-out-requirements/ Fri, 11 May 2018 15:28:16 +0000 https://help.iubenda.com/?p=6282 In the spirit of avoiding unreasonable unnecessary burdens being placed on individual businesses, the document includes the decisions of different privacy authorities in regard to the mentioning of third-party party cookie names and pointing users to opt-out mechanisms. In short: Postulates:

                The post Legal Sources on Third-Party Cookie Names and Opt-Out Mechanisms appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                In the spirit of avoiding unreasonable unnecessary burdens being placed on individual businesses, the document includes the decisions of different privacy authorities in regard to the mentioning of third-party party cookie names and pointing users to opt-out mechanisms.

                In short:
                • Mentioning third-party party cookie names one by one is not mandatory.
                • Pointing users to opt-out mechanisms such as browser settings or the opt-out mechanism provided by each third-party is a validand even suggestedapproach.
                Postulates:
                • It’s not necessary to mention the name of cookies in the Cookie Policy one by one for third-party cookies, the requirement is on the third party to provide the names and information
                • The requirement for opt out is also on the third party to provide.
                Legislations looked at:

                Summary

                As supported by the authorities, the right approach to follow for any cookie related processes and consent gathering solution implemented on a website is the following:

                • Cookies are bundled, categorized and outlined by purpose in a cookie policy.
                • Information about opt-out is provided by pointing to the browser options, third party tools (such as Your Online Choices) and the links to the third party providers, who are ultimately responsible for the opt-out for their own tracking tools.

                This is the process iubenda chooses to adopt on purpose. We think that any other process would be and will be prohibitive on any website owner, as third-party cookie names could change at any time and without notice, putting on the website owner the burden of watching constantly over each single third party, looking for cookie changes that are outside of the owner’s control and thus prone to failure.

                For this reason, our privacy and cookie policy focuses on highlighting the purposes of the processing (required), identifying the third parties involved (required), where they process data (required), their privacy and cookie policies (required), their opt-out links (when provided).

                The majority of the singled-out countries do not require that cookies must be named one by one or that the obligation of the opt-out is exclusively on the website provider. On the contrary, the exact implementation seems to be largely left to the website provider and the authorities point to some best practices and examples which are outlined within the body of this document for detailed reference.

                *It’s also worth noting here that IAB’s industry-wide Transparency and Consent Framework (TCF) also does not support listing out the names of individual cookies.

                💡

                Opt-in vs Opt-out


                The term “opt-in” refers to when a positive/affirmative action is required in order to grant the consent in the first place as opposed to “opt-out”, which is where the consent is already assumed, giving the user only the option to withdraw consent.

                So for example:

                • if your sign-up form used a checkbox that was pre-ticked, you would have implemented the “opt-out” method as the user is required to opt-out or withdraw the (assumed) consent;
                • alternatively, if your sign-up form used a checkbox that was un-ticked, therefore requiring the user to take the positive action of actually ticking the box in order to provide consent, you would have implemented an “opt-in” method.

                Generally, opt-out is allowed for US-American email marketing messages, while opt-in is required under European and Canadian data protection rules. Opt-in is also usually considered to be “best practice” in many countries, even not specifically required. For this reason, it is often the best and safest course of action.

                Legal references

                Italy 🇮🇹

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                The Italian Data Protection Authority (the Garante Privacy) expressly stated the following in the relevant resolution – please see “Simplified Arrangements to Provide Information and Obtain Consent Regarding Cookies” adopted on the 8th of May 2014 (“DPA Provision”):

                (…) account should be taken of the entity installing cookies on the user’s terminal, which may be the manager of the website visited by the user – which can be referred to as the “publisher” for the sake of convenience – or the manager of another website that installs the cookies by way of the former – which is a so-called “third party”… There are several reasons why it would appear impossible to require a publisher to provide information on and obtain consent for the installation of cookies on his own website also with regard to those installed by “third parties”.

                In the first place, a publisher would be required to always be equipped with the tools and the legal and business skills to take upon himself the obligations of third parties – thus, the publisher would be required to check, from time to time, that what is declared by the third parties corresponds to the purposes they are actually aiming at via their cookies. This is a daunting task because a publisher often has no direct contacts with all the third parties installing cookies via his website, nor does he/she know the logic underlying the respective processing. Furthermore, it is not seldom the case that licensees step in between a publisher and the said third parties, which makes it ultimately highly difficult for the publisher to keep track of the activities of all the stakeholders.

                Secondly, third parties’ cookies might be modified by the third parties with time, and it would prove rather dysfunctional to require publishers to keep track also of these subsequent changes. Furthermore, one should also consider that publishers – a category including natural persons and SMEs – are often the “weaker” party in this context. Conversely, third parties are usually large companies of substantial economic import that work as a rule with several publishers, so that one publisher may often have to do with a considerable number of third parties.

                For all of the above reasons, this DPA is of the opinion that publishers may not be required to include, on the home page of their websites, also the notices relating to the cookies installed by third parties via the publishers’ websites. From all the above, we can conclude that third-party cookies do not need to be named one by one by the website owner (the “publisher” in the DPA Provision), because since the publisher is in no position to single them out, it shall not be able to name them one by one in its privacy notice.

                Should opt out for third-party tools be provided by such third parties?

                The DPA provision does not expressly answer this question but the answer can be implicitly inferred from the following lines which refer to the extended cookie notice:

                The notice must also contain an updated link to the information notices and consent forms of the third parties the publisher has agreed to let install cookies via his own website. If the publisher is not directly in touch with third parties, he will have to include the links to the websites of the intermediaries or brokers between him and those third parties… In order to keep publishers’ responsibilities separate from those vested in third parties as regards the information provided and the consent obtained via the publishers’ websites for the said third parties’ cookies, it is considered necessary for the publishers to acquire the aforementioned links from the third parties (including licensees, if any) at the time of entering into the respective agreements.

                If, as stated above, the publisher has no control whatsoever on the cookies installed by the third parties it stands to reason that it cannot possibly offer its users the means to opt out. Therefore, a link should be provided to the third-party privacy notices and opt-out from such cookies should be provided by the same third parties involved.

                Finally, the Italian DPA emphasises that the user must be informed that they have the possibility to communicate their choices by way of browser settings. If the technology underlying the website is compatible with the user’s browser version, the publisher may make available a direct link to the settings configuration section in the browser.

                Belgium 🇧🇪

                The Belgian data protection authority (the Commission de la protection de la vie privée) has published a recommendation about cookies (Projet de recommandation concernant l’utilisation des cookies, attached). From the document we can take away the following:

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                The information to be provided to Users with regards to cookies are the purposes of each type or category of cookies, personal data collected, retention time, opt-out tools, transfer of personal data to third party (see p. 37).

                L’information relative aux cookies sera de préférence fournie par types de cookies ou finalités de ces cookies (m.n. 156). (…) Elle porte aumoins sur les points suivants:

                • les finalités des accès et/ou des inscriptions pour chaque type de cookie ou catégorie de finalités de ces cookies;
                • les catégories d’informations stockées;
                • les durées de conservation des informations;
                • les modalités pour l’effacement des informations;
                • les éventuelles communications à des tiers et les informations qui leur sont communiquées. (m.n. 157)

                There is no mention to be found that cookies must be named one by one.

                Should opt out for third-party tools be provided by such third parties?

                The document merely states that website owners must inform Users about the way to withdraw their consent to accepting cookies (see p. 40).

                176. L’utilisateur doit pouvoir à tout moment et de manière aisée retirer le consentement qu’il a précédemment donné. Cette possibilité lui sera donnée dans le cadre de l’information relative à la politique d’utilisation des cookies

                Finally, the document gives some examples of cookie policy best practices, which expressly include the referral to browser settings or to third-party tools (in their example they mention, for instance, Google Analytics) in order to opt-out from receiving cookies (see p. 54).

                Cookies statistiques (…) Pour certaines analyses, nous utilisons Google Analytics qui peut être désactivé de différentes façons selon les navigateurs utilisés (modules et extensions tierces, blocage du site www.google-analytics.com/*, …)
                Cookies tiers (…)
                Ces cookies peuvent être bloqués ou effacés par les options de votre navigateur.

                Spain 🇪🇸

                The national authority for data protection (the Agencia Española de Protección de Datos) has issued a number of documents regarding cookies, notably a “Cookie Guide” and a legal opinion (Informe jurídico 196/2014, “Informe”) about the question, whether cookies must be mentioned one-by-one.

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                The answers to the question boils down to the following:

                Cookies do not need to be mentioned one by one, it’s sufficient to inform about the types of cookies implemented, their purposes and the procedure to opt-out (see p. 4 of the Informe).

                Comenzaremos indicando que en opinión de esta Agencia la normativa estudiada pretende que el usuario sea suficientemente informado sobre la utilización de dispositivos de almacenamiento y recuperación de datos en su equipo terminal, siendo esencial que dicha información verse sobre las finalidades de dichos dispositivos. Ahora bien, la normativa no exige que la información detalle el nombre de los dispositivos, puesto que lo esencial es informar sobre los extremos indicados más arriba, y singularmente sobre el uso de cookies, quién las utiliza y para qué. Por tanto, no es necesario mostrar la segunda capa de información en una tabla o de otro modo en que se especifiquen los nombres de todas y cada una de las cookies.

                Should opt out for third-party tools be provided by such third parties?

                In order to inform the User about how to opt-out from receiving cookies, the Controller may provide its own tools, instructions about how to set preferences on the User’s browser or “common opt-out tools” (see p. 18 of the Cookie Guide).

                Información sobre la forma de desactivar o eliminar las cookies enunciadas a través de las funcionalidades facilitadas por el editor, las herramientas proporcionadas por el navegador o el terminal o través de las plataformas comunes que pudieran existir, para esta finalidad, así como la forma de revocación del consentimiento ya prestado

                There is no explicit mention of the fact that tools provided by third parties themselves are sufficient, but we deduce this from the fact that the three different solutions mentioned (own tools, browser settings, common tools) are considered all equivalent and equally valid.

                Moreover, the document further states that Controllers must merely “provide information about how to withdraw consent to accepting cookies” (p. 23) and that the Spanish data protection law does not determine, who is responsible for providing information about third-party-cookies (Controller or third-party), so that both entities must cooperate to these ends (p. 24) and be deemed responsible (p. 25).

                There is no mention that the opt-out tools must be provided by the Controller.

                By the way: the “Informe jurídico 0011/2014” only deals with the fact that cookies must be opted into, and not out of. The only thing it says about opt-out tools is that Controllers must provide a simple and free way to opt-out from receiving cookies (which essentially repeats the point made above: these tools don’t necessarily need to be provided by the Controller).

                UK 🇬🇧

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                From the ICO website (PECR stands for Privacy in Electronic Communications Regulations):

                PECR do not set out exactly what information you must provide or how to provide it – this is up to you. The only requirement is that it must be “clear and comprehensive” information about your purposes.

                The ICO also published a Cookie Guide (Guidance on the rules on use of cookies and similar technologies). This document states that:

                It could be an option to provide long lists of all cookies implemented, but for most users a broader explanation of the way cookies operate and of the categories of cookies used will be helpful (see p. 18). Long tables or detailed lists of all the cookies operating on the site may be the type of information that some users will want to consider. For most users it may be helpful to provide a broader explanation of the way cookies operate and the categories of cookies that you use on your website. A description of the types of things analytical cookies are used for on the site will be more likely to satisfy the requirements than simply listing all the cookies you use with basic references to their function.

                In any case, there is no requirement to mention cookies one by one. In fact, the document also provides a best-practice example in which cookies are only described per categories (same spot as above).

                Example: The cookies we use are “analytical” cookies. They allow us to recognize and count the number of visitors and to see how visitors move around the site when they’re using it. This helps us to improve the way our website works, for example by making sure users are finding what they need easily. Read more about the individual analytical cookies we use and how to recognize them [link]

                Should opt out for third-party tools be provided by such third parties?

                Regarding withdrawal, the document (or website) do not elaborate much, or in detail.

                The document only states that website owners must provide information to Users about how to withdraw consent. It does not state anything about which tools are deemed acceptable to these ends, but it mentions repeatedly browser settings as an acceptable mean to withdraw consent.

                Denmark 🇩🇰

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                According to the Datatilsynet guidelines, the consent you collect is considered “informed” if a list of third-party controllers is disclosed:

                in a “fold-out menu which is one-click-away in close association with the description of the purpose of the treatment”.

                This wording suggests that there is no need to provide such information in the first layer of the banner, but it should be easily accessible, for example through an expandable link.

                There is no mention of the names of third-party cookies, so we can assume it’s not necessary to disclose them.

                However, according to the guidelines, consent is not considered valid if the procedure for obtaining it does not allow consenting separately to different processing activities and thus to be forced to consent to all purposes. In other words, consent should always be granular, so it’s necessary to – at the very least – disclose the different categories of cookies that the website is installing.

                Should opt out for third-party tools be provided by such third parties?

                In the guidelines, there is no mention of this. The Danish Data Protection Authority states that it’s responsibility of the controller to ensure that data subjects can withdraw their consent in a simple and easily accessible way. Withdrawing consent should be as easy as giving it, but it is not a requirement that withdrawal must be done in the same way as consent was originally given.

                Greece 🇬🇷

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                There is no mention of this in the Compliance Recommendations, even though the Hellenic DPA stresses the requirement of granular consent.

                Acceptance or rejection of consent must be given at the same layer and with the same number of actions, either to accept the use of trackers or to reject it, either all or each category separately. This implies that granular consent must be given either to each and every cookie or to each and every category of cookies.

                Should opt out for third-party tools be provided by such third parties?

                The HDPA also does not mention anything about opt-out for third-party tools, but the withdrawal of consent must be available in the same manner and with the same ease with which it had been granted.

                Poland 🇵🇱

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                In Poland, there are no specific guidelines for cookies. All that concerns consent to cookies is inferred by the Polish Telecommunications Act.

                Polish legislation does not make any reference whatsoever to the modes of obtaining consent, other than by configuring browser settings. Indeed, the “acceptance” or “rejection” of cookies from one’s device as well as obtaining further information or making granular choices is completely absent.

                We can then assume that there is no requirement to mention the name of third-party cookies.

                Should opt out for third-party tools be provided by such third parties?

                Since the legislation is quite blurred, there is no mention of this requirement as well.

                Sweden 🇸🇪

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                Swedish Regulations do not explicitly mention this requirement, but the PTS Cookie Guidance does require that websites using cookies disclose:

                • whether the cookies are first-party cookies or third-party cookies;
                • if the information is shared with any third party and what these are.

                Thus, there is no need to mention each third-party cookie that is used, but you need to disclose the third parties that may install cookies through your website.

                Should opt out for third-party tools be provided by such third parties?

                There is no direct mention of this requirement. The Swedish PTS says that it must be easy for the user to withdrawconsent. And that the user must receive information on how this is done.

                Netherlands 🇳🇱

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                Yes, it’s necessary. The Dutch DPA requires that websites using cookies have a full cookie policy that – among other things – discloses the categories of companies to which you provide data, the names of the cookies, and information on the purpose of the processing.

                This information is often included in a third layer of the cookie banner.

                Should opt out for third-party tools be provided by such third parties?

                There is no mention of this requirement.

                Brazil 🇧🇷

                Is it necessary to mention the name of any third-party cookies or is the duty on the third party?

                According to the ANPD’s Guidelines, website owners should provide a cookie policy that contains information about sharing personal data with third parties, if applicable. There is no mention of the name of third-party cookies.

                Should opt out for third-party tools be provided by such third parties?

                There is no mention of this requirement. The ANPD states that users must be able to revoke the consent provided for the use of cookies at any time in a simplified and free-of-charge manner.

                See also

                The post Legal Sources on Third-Party Cookie Names and Opt-Out Mechanisms appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Picking the right privacy policy options https://www.iubenda.com/en/help/5858-switch-privacy-policy-options/ Mon, 07 May 2018 12:11:59 +0000 https://help.iubenda.com/?p=5858 How can you know which options to apply to your privacy policy document inside the iubenda generator? We’ve got everything outlined in this guide. Read on to learn more. Start with location In picking the right privacy policy options, you must first consider the area that you are based in as well as the area […]

                The post Picking the right privacy policy options appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                How can you know which options to apply to your privacy policy document inside the iubenda generator? We’ve got everything outlined in this guide. Read on to learn more.

                Start with location

                In picking the right privacy policy options, you must first consider the area that you are based in as well as the area where your users are located. You would also need to carefully consider if a Representative is to be appointed in a foreign jurisdiction and what considerations are to be made if your users’ personal data is to be transferred to third countries.

                iubenda offers the opportunity to create various privacy policy options that cater to the GDPR (which also encompasses the UK GDPR), FADP, LGPD and US Law needs.

                Follow these simple steps from your account

                • Once you have logged into your account and identified your area of operations and your target users, you can then access the privacy policy admin area.
                • From there, you can then edit your privacy policy by clicking on Dashboard > [your policy] > Edit
                • You will then find a box labelled “Legislation-specific standards” on the right hand side of the page, which will allow you to select the relevant disclosures for your users or the GDPR’s broader protection standards (which are further explained below) as the case may be.

                It is that simple to modify your privacy policy options and to ensure that your privacy policy reflects your business operations and the privacy of your users.

                iubenda’s System

                iubenda has implemented a system that allows you to apply different rights to different user groups, whose personal data you collect and process as “controller” (that is the word that GDPR uses for whoever determines the purposes and means of the processing of personal data).

                In particular:

                • You can decide to apply broader protection standards to all your users. In this case, you will generate a privacy policy that applies in all its parts to all your users and follows the GDPR.
                • You can decide to apply a basic set of rights to all users, and broader protection standards only to some of them. In this case, such broader protection standards will always apply whenever the processing of personal data is subject to the GDPR. In all other cases, a basic set of rights shall apply.

                👋 If you target US based users, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) could apply to you. You can read all about the CCPA and take our free assessment here.

                How do I make the right choice?

                You can choose from “Apply GDPR’s broader protection standards to”:

                • EU only; or
                • All users

                You can find the switch here:

                • Log into your privacy policy admin area
                • Enter the editing of your privacy policy, which can be found via Dashboard > [your policy] > Edit
                • There you’ll find a box housing the switch to enable the GDPR text labeled “Legislation-specific standards”
                • Under the heading “Apply GDPR’s broader protection standards to” choose from Apply to all users (default option) or Apply to EU users only
                • This allows you to consider your specific case and react to where your users/clients are based and choose accordingly

                Once you have decided what rights to offer to whom, you can continue.

                Then you must apply the broader protection standards to all your users, because all data processing activities you perform are subject to the GDPR – this even extends to your users that are not based within the EU.
                Then in principle, you may choose to apply broader protection standards to all your users or to grant them only in cases where the processing of personal data is subject to the GDPR. Please note that you must apply broader protection standards whenever the processing
                • concerns the Personal Data of users who are in the EU and is related to the offering of paid or unpaid goods or services, to such Users;
                • concerns the Personal Data of users who are in the EU and allows the Owner to monitor such users’ behavior taking place in the EU.

                💡 Let’s look at a practical example:

                If you’re a US-based controller, you may choose to apply basic rights to your users, as required by US legislation. However, if part of your processing activities consists in the offering of paid or unpaid goods or services to EU-based users, or in monitoring user behavior taking place in the EU, then you’re obliged to apply broader protection standards in those cases.

                The applicability of broader protection standards results in further implications, described below.

                📌 Transfer of data outside of the EU

                If you collect Personal Data within the EU, you’re free to transfer them to other EU or EEA countries. However, if you plan to transfer them to other countries, such as Switzerland or the U.S., you need to name a valid legal basis allowing for such transfer.

                Services to consider adding:

                • Data Transfers to countries that guarantee European standards
                • Data Transfer abroad based on standard contractual clauses
                • Data Transfer abroad based on consent
                • Other legal basis for Data transfer abroad

                With our Register of Data Processing Activities, you can specify for each service provider which is the legal basis for data transfer abroad.

                💡 Some examples of data transfer

                • Whenever you work with partners or add services based outside the EU/EEA (such as e.g. Google Analytics), you are transferring personal data outside of the EU. Services listed in our generator have an estimation of the service’s home base.

                • When adding a custom service (i.e a service written by you), be sure to indicate what the legal basis is for such a transfer.

                • If you’re a controller based outside of the EU, you’re transferring personal data outside of the EU each time you collect data of users based within the EU. Please make sure you do so according to one of the legal bases for transfer.

                📌 Legal bases for transfer

                The GDPR provides for a set of valid legal bases to transfer data outside of the EU. The most relevant are:

                Whenever the European Commission thinks that a specific country in the world guarantees data protection standards comparable to those applicable in the EU, it issues an adequacy decision. If you plan to transfer data into such a country, you may do so – you just need to tell your Users via your privacy policy.

                Adequacy decisions have so far been adopted for Andorra, Argentina, Canada (commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan.

                Service to add in this case: “Data transfer to countries that guarantee European standards“.

                If the country you plan to export data to does not seem to guarantee an adequate level of protection, you can make sure that the specific data importer (i.e. the company or individual you’re exporting data to) complies with stricter rules. To these ends, you will close a contract with the data importer, that includes standard contractual clauses drafted by the European Commission. In most cases, you’ll use the standard contractual clauses for Controllers based in the EU exporting data to Processors based elsewhere.

                Here again: if you have such a contract in place, you may transfer personal data – but you have to mention this in your privacy policy.

                Service to add in this case: “Data transfer abroad based on standard contractual clauses“.

                Finally, if none of the above-mentioned options seems viable, you have to collect your Users’ consent to transfer their data outside of the EU. This is the most complicated scenario, because you have to make sure that their consent is – among other aspects – “informed”. Do you really know what is going to happen to User data once they are exported outside the EU? Can you tell, what kind of security measures are being provided by the local legislation or adopted at the data importer’s initiative to ensure protection of personal data?

                If you’re able to provide such information, you may ask your Users to consent to the transfer of personal data, but if you’re not able to provide it, be careful: any consent collected would not be considered “informed” and therefore void.

                Service to add in this case: “Data transfer abroad based on consent“.

                Finally, a lesser known fact is that the GDPR mentions a few other (though less relevant) options for transferring data outside of the EU. If you’re basing your transfer on any such option, you should choose the service “Other legal basis for Data transfer abroad” and specify or add any relevant details by adding a custom clause.

                What about transfers from Switzerland?

                If you’re transferring personal data from Switzerland to another country, you have to do so according to one of the legal bases recognized under Swiss legislation. Among these the most relevant are:

                • Adequacy decisions;
                • Standard data protection clauses subject to the prior approval of the FDPIC;
                • Consent.

                More information about data protection rules on a federal level in Switzerland can be found here.

                💡 Read our dedicated guide to know how the iubenda solution can help you to provide transparency about the transfer of personal data from Switzerland to another country.

                What about transfers from the United Kingdom?

                If you’re transferring personal data from the United Kingdom to another country, you have to do so according to one of the legal bases recognized under the UK GDPR.

                A guide to transfers outside of the United Kingdom can be found here.

                Our Privacy and Cookie Policy Generator offers additional clauses related to the transfer of data outside of the United Kingdom. These clauses, if selected, will be shown in your privacy policy inside both the simplified and the complete versions, under the section “Transfer of Personal Data outside of the United Kingdom”.

                • Data transfers according to a UK adequacy regulation;
                • Data transfer abroad based on standard contractual clauses (UK);
                • Data transfer abroad based on consent (UK);
                • Other legal basis for Data transfer abroad (UK);

                These additional clauses can be of great help, but they contain broad and generic descriptions since we do not know exactly how you transfer data abroad. Therefore, we highly recommend that you check if they apply to your case and, if needed, describe your data transfer activities in more detail by adding custom clauses.

                💡With our Register of Data Processing Activities you can specify for each service provider which is the legal basis for data transfer abroad.

                📌 Profiling

                Profiling means any form of automated processing of personal data performed to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

                If you profile your users, you have to tell them. Therefore, you must pick the relevant clause from the privacy policy generator.

                Services to consider adding:

                • Analysis and predictions based on the User’s Data (“profiling”)

                💡 Practical example

                If you’re selling products and keep record of users’ choices for marketing purposes, dividing them into meaningful categories, such as by age, gender, geographical origin etc., you’re profiling them.

                📌 Automated decision making

                Automated decision making, or ADM, is a process allowing you to make decisions that may produce legal or similarly significant effects on users in a fully automated manner, without human intervention. Such ADM may also be based on profiling (see above).

                In case you’re implementing any ADM process, you have to tell your users. Therefore, you must pick the relevant clause in the privacy policy generator. Please note that users enjoy a specific right of opposition to ADM processes, specified in the section called regarding automated decision-making of the privacy policy you will generate.

                Services to consider adding:

                • Automated decision-making
                • Analysis and predictions based on the User’s Data (“profiling”)

                💡 Practical example

                You are a bank. In order to decide whether users are eligible to receive a loan, you have them fill their personal data into a form. Thanks to an algorithm, such data is evaluated in a fully automated manner and the decision is made.

                📌 Sourcing data from third parties

                If you’re not collecting personal data directly from the user they refer to, but you’re sourcing them from a third party instead, you must inform the relevant user about such third party in addition to all other information duties. Please pick the relevant clause from the privacy policy generator.

                This information must be given to the user no later than one month after having collected the data, and in particular

                • if the personal data are to be used for communication with the user, at the latest at the time of the first communication to that user; or
                • if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

                Services to consider adding:

                • Personal Data collected through sources other than the User

                💡 Practical example

                You are a head hunter. You find an interesting profile on LinkedIn. As soon as you contact the relevant candidate or transfer his/her data to the potential employer, and in any case within one month, you have to give the candidate all mandatory information, including mentioning LinkedIn as source of his/her data.

                📌 Representative in the EU

                If you are a controller based outside of the EU, you need to appoint any natural or legal person based in one of the EU countries where your users are, as EU representative. The appointment must be done in writing and the appointed representative must be mentioned in your privacy policy.

                Therefore, please insert the representative’s details (name and contact details of your representative) in the field where you have your own company information.

                📌 Representative in Switzerland

                If you are a controller based outside of Switzerland and are involved in high risk processing of Swiss users, you need to appoint a person based in Switzerland as a representative.

                Please insert the representative’s details (name and address of your representative) in the field where you have your own company information.

                📌 Representative in the United Kingdom

                If you are a controller based outside of the United Kingdom you need to appoint any natural or legal person based in the United Kingdom as a representative. The appointment must be done in writing and the appointed representative must be mentioned in your privacy policy as indicated in this guidance note.

                Therefore, please insert the representative’s details (name and contact details of your representative) in the field where you have your own company information.

                📌 Data protection officer

                Under certain conditions, you must appoint a natural or legal person as data protection officer (or DPO), and mention it in your privacy policy. This applies whether you are following the GDPR, UK GDPR or the FADP (however Swiss law refers to them as Data Protection Advisors).

                In particular, you must appoint a DPO whenever:

                • you are a public authority or body; or
                • your core activities consist in operations that require regular and systematic monitoring of users on a large scale; or
                • your core activities consist of processing on a large scale of sensitive data or data relating to criminal convictions and offenses.

                If any of the above-mentioned conditions applies to you, please insert the DPO’s details (contact details of your data protection officer) in the field where you have your own company information.

                Please note that the GDPR allows EU Member States to provide for further conditions under which the appointment of a DPO is mandatory. Therefore, please check if you are subject to any national provisions of an EU Member State in addition to the GDPR and if such provisions require you to appoint a DPO.

                More information about the data protection officer and other single topics can be found at our GDPR guide.

                Create a privacy policy today!

                Start generating

                The post Picking the right privacy policy options appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Legal Requirements for Websites and Apps Used by Children https://www.iubenda.com/en/help/5717-legal-requirements-websites-apps-children/ Sun, 29 Apr 2018 17:15:06 +0000 https://help.iubenda.com/?p=5717 If you’re an app or website owner whose service is knowingly collecting, using, or disclosing personal information from children under 13, then there are some special regulations that you are legally required to follow under the vast majority of legislations. “Personal information” within this context refers to the child’s name, location, any contact information, identification […]

                The post Legal Requirements for Websites and Apps Used by Children appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                If you’re an app or website owner whose service is knowingly collecting, using, or disclosing personal information from children under 13, then there are some special regulations that you are legally required to follow under the vast majority of legislations. “Personal information” within this context refers to the child’s name, location, any contact information, identification information (eg. social security number), device identifiers, IP address, photo, video or audio containing the child’s image or voice.

                While this guide will separate US and EU law for your convenience, it should be noted that both cases the regulatory bodies have made it clear that the requirements of these laws will apply as long as you have or target users located in the region that these regulations are from. This means that it doesn’t matter if your business or servers are located in the region or not, the laws will still apply to you.

                Legal Requirements

                🇺🇸 US legislation

                Children’s Online Privacy Protection Act (COPPA) is a United States federal law which was put in place to better protect the personal data and rights of children under 13 years of age. Under COPPA, operators of websites or online services that are either directed to children under 13, or which have actual knowledge that they are collecting personal information from children under 13 must give notice to parents and get their verifiable consent before collecting, using, or disclosing such personal information and must keep secure the information they collect from children.

                Verifiable” here means using a method of attaining consent that is not easily faked by a child and that is demonstrably likely to be given by an adult (eg. control questions). Even after consenting, parents must also have the option to disallow disclosure to third parties if so desired, unless such disclosures are part of the service (for example, social networking).

                A central requirement of this Act is having a COPPA-compliant privacy policy in place. You can read more about compliance in the sections below and learn more about COPPA here.

                🇪🇺 EU legislation

                Under EU GDPR regulations, consent is one of the Lawful Reasons for processing the data of children. If using this basis for processing the data of children under 13, you must get verifiable consent from a parent or guardian unless the service you offer is a preventative or counseling service. You must make reasonable efforts (using available technology) to verify that the person giving consent actually holds parental responsibility for the child.

                If using another lawful reason as the basis for processing a child’s data, you must consider factors such as the child’s competence to understand and agree to the processing, and the interests and fundamental rights of the child. Furthermore, if you target children over the age of 13, you must write clear and age-appropriate privacy notices for them so that they understand what they’re consenting to.

                The right to erasure is particularly relevant in cases where a person gave consent to processing when they were a child. When processing the data of children, the law requires that you take appropriate measures to ensure that their data is safeguarded.

                Learn more about considerations regarding children under EU law on our guide to minors and the GDPR and on ICO’s website.

                👋
                Targeting Minors in the US?

                Here’s 1 Thing you Have to Know.

                 Click here to see the specific guidelines.

                Practical steps toward compliance

                What you need to do

                • Describe the types of personal information processed online from children, the purpose and the way it’s handled.

                • List all operators processing personal information. Name each third party operator involved in the processing including social plugins, widgets, and ad networks.

                • Describe parental rights in relation to their child’s data and the procedures to follow to exercise these rights.

                • Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children.

                • Provide parents access to their child’s personal information to review and/or have the information deleted.

                • Give parents the opportunity to withdraw consent and prevent further processing of a child’s personal information.

                • Maintain the confidentiality, security, and integrity of data collected from children. This includes taking reasonable steps to ensure that such data is only released to third-parties capable of maintaining its confidentiality and security.

                • Ensure that you keep personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected. When no longer necessary, be sure to delete the information using secure measures to protect against its unauthorized access or use.

                • Do not make a child’s ability to access an online activity dependent on the child providing more information than what is reasonably necessary for the activity.

                How iubenda can help

                In terms of compliance with child data protection laws, one of the first logical steps is making sure that your privacy policy meets its legal obligations. With this in mind, we’ve built a solution that implements the strictest regulations from the major legislations into one inclusive yet easy-to-read policy.

                While you’re separately required to implement methods to collect, record and verify parental consent, our privacy policy solution makes it easy for you to meet your disclosure obligations by allowing you to comprehensively disclose and define necessary details in a legally compliant way; we’ve also specifically included an additional, comprehensive COPPA clause to further simplify the process.

                The process is straightforward and intuitive, simply click to add your services > fill out your web/app owner and contact details > embed.

                • Click “add a service” then start typing the name of the service you’d like to add.
                • Select each applicable service from the list of suggestions that shows up, and customize by simply adding the specific types of personal data you collect. Our lawyer-crafted, pre-created clauses automatically include the relevant user-rights disclosures and service definitions based on your input here. Remember to include all services processing personal information including social plugins, widgets, and contact forms.
                • If your service targets children under 13 based in the US, you must add the COPPA clause using the same procedure above.
                • If you’d like to add a custom service clause, simply click the “create custom service” button and fill out the built-in form.

                • Enter name and full address
                • Enter email address

                Congratulations! Your policy has been created. Simply check that all the details are correct, then:

                • Customize the look of your button or simply choose a text link
                • <
                • Choose the embedding method (choose between embedding code, direct link or direct text embedding)
                • Easily embed wherever you’d like! (Remember, you’re required to choose a location that is easily accessible and visible to users throughout your website/app)

                Our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal and third-party requirements. Our privacy policies also come with the option to include a cookie policy which is necessary to include if your website or app is using cookies.

                You can read more about our policy generator and features here and read about our full range of solutions here.

                Create a privacy policy

                Start generating

                See also

                The post Legal Requirements for Websites and Apps Used by Children appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                How to Make your Emails and Newsletter Compliant (with Form Examples) https://www.iubenda.com/en/help/5640-email-newsletter-compliance-guide/ Sat, 28 Apr 2018 11:55:44 +0000 https://help.iubenda.com/?p=5640 In Short:  👉 Email and Newsletter Legal Requirements in General 👉 Legal obligations when adding users to your mailing list US LAW EU LAW 👉 Legal obligations related to Newsletter content US LAW US LAW 👉 Consequences of non-compliance✅ Steps for making your newsletter process compliant with the law A newsletter is an incredibly powerful marketing […]

                The post How to Make your Emails and Newsletter Compliant (with Form Examples) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                A newsletter is an incredibly powerful marketing tool but is your newsletter legal? 

                It’s a cost-effective way to build and maintain a relationship with your customers, but it can also end up costing you if you’re not meeting your legal obligations. 

                👉 If you plan to or are currently maintaining an email newsletter, you’re legally required to have a comprehensive privacy policy in place as you are collecting personal data.

                Most laws require that you inform users about your data processing activities (typically done via a privacy notice) and – depending on the region – that you obtain user consent and/or provide an easy way for them to withdraw consent.

                Generally, these laws apply to any service targeting residents of the region, which effectively means that they may apply to your business whether it’s located in the region or not. This is even more relevant if you’re using a bought email list as in such a case, you may not know the recipient’s country of residence. For this reason, it’s always advisable that you approach your data processing activities with the strictest applicable regulations in mind.

                You can read more about which laws apply to you here or read our General legal overview here.

                 

                The vast majority of legislations require that your privacy policy informs your users about your data collection activities in an easy-to-understand, unambiguous and easily accessible way.

                It will need to include details on:

                • What data you process;
                • How you process it;
                • The purpose of the processing (e.g, for sending a newsletter or market analysis);
                • All third-party involvement;
                • The user’s rights in regards to their data;
                • How you handle requests related to their rights;
                • The actual mechanisms of communication used (e.g email, paper mail);
                • How you protect their data

                Third-party Requirements

                Third-party apps and services also need to follow the law. For this reason, it’s often mandatory that all partners and customers that use their services meet regulatory standards. The vast majority of reputable newsletter management platforms have made it mandatory for users of their services to have a comprehensive privacy policy in place that clearly discloses their involvement and that meets regulations.

                Here’s an excerpt from the Mailchimp Terms of Service:

                Will clearly describe in writing how you plan to use any data collected, including for your use of Mailchimp. You’ll get express consent to transfer data to Mailchimp as part of this process, and you’ll otherwise comply with whatever privacy policy you have posted.

                And another from Campaign Monitor’s Terms of Service:

                You will adopt and maintain a policy that complies with all applicable privacy laws and which is at least as stringent as our Privacy Policy (as modified by Campaign Monitor from time to time). You acknowledge that all personal information that you provide to us has been collected with the relevant individual’s consent, and that you have informed the individual of the purpose for which that information was collected, and that you may provide this information to us for the purposes of use in relation to the Services. You acknowledge that we may store the personal information that you provide to us on servers located in the United States of America, and you warrant that you have obtained the consent of the relevant individuals to the storage and transmission of their personal information in this manner.

                Where should you place your privacy policy

                Generally, regulations require that your privacy policy be clearly visible and easily accessible throughout your website or app site, so simply having it in your footer may suffice. However, within the context of transparency (which itself is usually one of the key purposes of data laws), it’s advisable that you also make your privacy policy situationally available; for example, linking to it in both your sign-up form and email newsletter.

                Is it illegal to add someone to a mailing list?

                No, it’s not illegal to add someone to a mailing list; nevertheless, there are legal obligations you need to abide by when adding users to your mailing list. This depends on where your users are based. Below we cover US and EU law:

                US law

                Under the FTC’s CAN-SPAM Act, you do not need consent prior to adding users located in the US to your mailing list or sending them commercial messages, however, it is mandatory that you provide users with a clear means of opting out of further contact.

                EU law

                As newsletter sign-up forms are data collection tools, under EU law (namely the GDPR) it is mandatory that you obtain the informed consent of the user before subscribing them to the service. Under EU regulations, acquiring consent can be considered a two-part process that includes informing the user and obtaining verifiable consent via an affirmative action.

                When informing the user you must:

                • Be specific.

                  You must clearly state the type of email that the user will be consenting to;

                • Be clear and unambiguous.

                  The average user should be easily able to understand what they’re consenting to;

                • Make it clear that signing up is optional.

                  Consent must be “freely given”; you may not coerce users into joining your mailing list or make it appear as if joining the list is mandatory. For this reason, you must make it clear that signing up is optional. This is especially relevant in cases where you offer free white-papers (or e-books) for download. While the user’s email address is required for the delivery of the service, signing up for your newsletter is not. In such a case, you must not make it appear as if signing-up to the newsletter list mandatory and must make it clear that it is optional.

                So in practice, if, for example, you also wanted to add people that download your e-book to your newsletter list, you should include something similar to the following, under the e-book download form:

                Newsletter - Consent

                As can be seen in the example, users must be made aware that the consent is in fact optional and not mandatory.

                The consenting action must be explicit and verifiable.
                The process for getting user consent must be straightforward and involve a clear “opt-in” action. This means that mechanisms such as pre-ticked newsletter sign-up checkboxes at checkout are not allowed, as EU regulation specifically forbids pre-ticked boxes and similar “opt-out” mechanisms.

                You may, however, use any method that would require the user to take a direct affirmative action (This can include any verifiable consenting action including sending an email or clicking a check-box).

                You must give users the ability to withdraw consent.
                Under the GDPR, users have the specific right to withdraw consent. This means that you’re required to make it as easy to withdraw consent as it is to give it. This can be easily achieved by including a visible and valid unsubscribe link in your newsletter. Users should also have the ability to manage their mail preferences from within their account.

                The consent acquired must be specific to the type of content being sent.
                This means that the newsletter should only contain information that the user consented to receive. So for example, if the user only consented to receive emails about your new products, you should not send them promotional emails related to partner/ third-party offers.

                In cases where you want to send more than one type of email to your users, you’re required to get additional consent specific to those uses as you must have multiple consents for multiple purposes.

                This does not have to be an additional form. In practice, you can simply add several GDPR checkboxes informing the user of each additional purpose and allowing them to give consent specific to those cases.

                This is especially applicable to Direct Email Marketing communications (emails where the singular purpose is to directly advertise products or services). In the case of DEM communications, you must obtain additional consent if also sending emails about third-party products/services in addition to your own.

                There are some exceptions to the requirement for the type of active consent mentioned above. Let’s have a look at soft opt-in and explicit form.

                Soft opt-in may allow you to bypass the need for prior consent. Soft opt-in can occur when a user has provided their email address while purchasing a product or service from you. In particular, soft opt-in may apply where the following conditions are met:

                • the email address was collected as part of a previous sales process on your site;
                • the customer is adequately informed (e.g. via a notice on the sales page or in your privacy policy) that you use emails collected during the sales process in this way;
                • the user has not opted-out of being contacted (e.g. by unsubscribing from your newsletter);
                • your future promotional emails are related to your products and services that are similar to the ones initially purchased; and
                • the products/ services you intend to promote are your own (not third-party).

                💡 Learn more about where soft opt-in applies by checking our global email marketing cheatsheet.

                An explicit form is where the purpose of the sign-up mechanism is unequivocal. So for example, in a scenario where your site has a pop-up window that invites users to sign up to your newsletter using a clear phrase such as: “Subscribe to our newsletter for access to discount vouchers and product updates!“, the affirmative action that the user performs by typing in their email address would be considered valid consent.

                Because consent under the GDPR is such an important issue, it’s vital that you keep clear records related to the consent attained. Records of consent should at least contain the following information:

                • The Identity of the user giving consent;
                • When they consented;
                • What disclosures were made (what they were told) at the time they consented;
                • Methods used for obtaining consent (e.g., newsletter form, during checkout etc.);
                • Whether they have withdrawn consent or not

                Maintaining valid records, while mandatory, can be a technical challenge. Our Consent Database simplifies this process, making it easy for you to view, manage and export your recorded consents. you can read more about it here.

                While ‘single opt-in’ only requires that users submit their information in order to be added to your list, ‘double opt-in’ requires that users first validate their email address before being added to your mailing list. The validation is carried out when users click on a specific link contained in a “confirmation” message sent to their email address.

                With this method, you can ensure the email address receiving your communication actually belongs to the person giving the consent and hereby further ensure that you avoid high unsubscribe rates, retain the integrity of your list and the reputation of your address. This method of registration is considered best practice in many countries, especially Germany and in the EU in general.

                In several cases, German courts have decided that a single opt-in process is not sufficient proof of prior consent. An example of this would be the OLG Celle, judgment of 15.05.2014:

                In principle, the sender of (e-mail) advertising must state that there is a consent to this and this in particular comes from the addressee… The sender of advertising e-mails can comply with this requirement by the so-called “double-opt-in procedure”… in a reasonable manner for each individual e-mail address.

                🔎
                Looking for a simple and compliant way to manage consent for newsletter subscriptions?

                Try our Newsletter Opt-in Booster 👉 it adds a customizable signup form to your site, allowing you to collect and manage consent through a double opt-in process for a more engaged and responsive audience.

                Activate now

                US Law

                Depending on where your customers live, specific laws relating to spam may apply. In the US, the FTC’s CAN-SPAM Act sets rules for sending commercial messages, including email.

                • Use truthful header information.
                  Your name, email address and routing information (including domain) must be accurate and correctly identify the sender of the message.

                • Use non-misleading subject lines.
                  Subject lines must give an accurate depiction of message content.

                • Identify the message as an ad.
                  A specific method of doing this is not specified, however, the disclosure must be “clear and conspicuous.”

                • Tell recipients where you’re located.
                  You must include your valid physical postal address.

                • Monitor what others are doing on your behalf.
                  Even if you’ve out-sourced your email marketing to another company, the law may hold both you and the other company responsible.

                • Inform users of and provide a visible unsubscribe option.
                  The “unsubscribe” option must be easily seen and must include a clear explanation of how the user can opt-out of receiving future emails from you. The notice must be easy for an average user to recognize, read, and understand. A practical way to implement this would be to simply include an “unsubscribe” link together with a statement informing the user of the option.

                  For example, your statement could be something like: “You are receiving this business communication from [Business Name] as you have expressed your interest in our products and services]. If you no longer wish to receive these communications, you can unsubscribe by clicking here”.

                  Under CAN-SPAM, the ability to unsubscribe should be free and should not be behind a login process. This means that users must be able to unsubscribe without paying a fee and without needing to log into their account to do so. The FTC states:

                  You can’t charge a fee, require the recipient to give you any personally identifying information beyond an e-mail address, or make the recipient take any step other than sending a reply e-mail or visiting a single page on an Internet website as a condition for honoring an opt-out request.

                Unsubscribe requests
                • The unsubscribe link must be valid for at least 30 days after you’ve sent the email;
                • You must honor unsubscribe requests within 10 days

                Exemptions

                Some types of email are exempt from most of the CAN-SPAM Act’s requirements and are only subject to the requirement of truthful routing information.

                These exemptions include emails in which the primary purpose is:
                • Transactional: These are emails relating to already-agreed-upon transactions, or emails that deliver goods or services as a part of a transaction that the user already agreed to (e.g. License key or E-book delivery).

                • Relationship: These are emails that update users (that already have a relationship with your service) about changes in product / service terms, features or account information; this also includes warranty, recall, safety, or security information about a product or service.

                • Other (Non-commercial) emails.

                EU law

                In the EU, the ePrivacy directive sets overall guidelines that are individually implemented by member states, however, some elements (such as the ability to withdraw consent) fall within the scope of the GDPR.

                • Provide an unsubscribe link in the email.
                  The withdrawal option must be clear, visible and easily accessible. This element falls under the scope of the GDPR and specifically under the right to erasure; as such, you will have a maximum of 30 days to honor user withdrawal requests. It’s worth saying though that while the law may give you up to 30 days to honor these requests, most subscribers won’t. It is therefore prudent to honor opt-out requests promptly or risk being marked as spam and compromising the total legitimacy of your associated address.

                • Clearly indicate the identity of the sender.
                  Disguised sender identities are prohibited; the information must be clear and straight-forward.

                • Include a physical company address.
                  A valid return address must be provided.

                • Clearly identify and specify the nature of the message.
                  You should indicate, in an unambiguous way, the type of message being sent (e.g. promotional or not).

                • Avoid the use of false or deceptive expressions in your text.
                  Advertising in any form (including commercial messages) must not be done in a way that would make it likely to deceive the persons to whom it reaches.

                Some legislations (e.g. Germany and Australia) may further require that you include information on how to contact the sender. It’s always best practice to either simply follow the most robust legislations or to check the local anti-spam requirements specific to where your recipients are based.

                Included below is an example of a commercial communication that contains all the basic elements. In the example, elements such as the name and address are included at the top of the email, however, the placement is entirely up to you provided that the information is visible and easily found.

                John’s Store Ltd [address] [City] [State] [ZIP] [Country]
                [Return email address (eg. info@johnsstoreltd.com) ]
                [Subject: New arrivals for spring! [Your Website Name]
                [Type of email (eg.Promotional)]

                Dear Customer, we are delighted to offer you our latest arrivals for Spring. See something you like? You can purchase any one of these items by clicking directly on the products in this email and you’ll be taken to our website where you can pay securely.

                [Opt-out] If you no longer wish to receive communications from us, click here to unsubscribe.

                The conditions outlined here also apply to other marketing methods that use electronic messages including Direct Email Marketing messages and Viral marketing communications (e.g. asking users to forward a marketing message to their friends).

                Consequences of non-compliance

                Legal consequences

                The legal ramifications of non-compliance include hefty fines in both the EU and the US, with fines ranging from the tens of thousands to millions. But perhaps equally as concerning are the other potential sanctions that may be implemented against organizations found to be in violation. These sanctions include official reprimands (for first-time violations), periodic data protection audits and liability damages.

                The GDPR, in particular, gives users the explicit right to file a complaint with a supervisory authority if they feel that any processing of their personal data was done in violation of regulations. So for example, if a report is made to the authority about an instance of regulatory violation, the authority may choose to perform an audit of your data processing operations. If it’s found that some processing activity was done unlawfully, not only is a fine imposed, but you may be forbidden from making further use of both the data of the inquiry and data acquired using similar mechanisms. This means that if the violation use was in regards to email address collection, you risk being barred from using the entire associated email list.

                💡 In regards to liability damages, both the EU and US laws give individual users the right to compensation for any damages resulting from an organization’s non-compliance with regulations. This means that violating regulations can leave you open to potential litigation.

                Other consequences

                📌 Loss of Services

                Some third-party services may make compliance with legal regulations a part of their terms of use. In such cases, a violation of legal requirements can also be considered a violation of their terms; such violations may lead to service termination or potentially, permanent bans.

                📌 Reputational damage

                Failure to comply with your legal obligations may lead to users negatively perceiving your business as either incompetent or malicious. This can lead to significant and lasting damage to public trust and the reputation of your organization.

                Steps for making your newsletter process compliant with the law

                What you need to do

                In regards to compliance, it is always a good idea that you approach your data processing activities with the strictest applicable regulations in mind. In regards to the newsletter process, compliance, at the very least, requires that you put the following into practice:

                ✅ Step 1: Inform your users of the data you collect, why, and the method of delivery (If you’re using direct email marking, make sure to include this in your privacy policy)

                ✅ Step 2: Inform your users of all third-party providers involved in your newsletter management process, including links to their privacy documents and their rights in regard to their data (including the right to withdraw consent).

                ✅ Step 3: Keep valid records of the consent collected. Without these records, the consent you collect is considered invalid. 

                👋 See our step-by-step breakdown for how to achieve this!

                How do I keep valid Records of consent?

                Our Consent Database simplifies the process of collecting and maintaining compliant records of consent. It allows you to track every aspect of consent (including the legal or privacy notice and the consent form that the user was presented with at the time of consent collection) and the related preferences expressed by the user.

                To use, simply activate the Consent Database and get the API key, then install via HTTP API or JS widget, and you’re done; you’ll be able to retrieve consents at any time and keep them updated.

                For a list of the full features of the Consent Database click here, read the overview guide here, or for a practical tutorial using a common scenario, read our guide on How to use the Consent Database with Contact Form 7.

                👋 Keep reading for direct email marking and more, or Get Started now for free today!

                Using Direct email marketing?

                If using Direct Email Marketing (DEM) for the German market, you must add a statement to your privacy policy that specifies the companies and type of goods and services that will be promoted through the newsletter.
                Obtain prior consent (depending on the regional law) that is:

                • based on a clear affirmative action;
                • informed;
                • specific.

                Step-by-step breakdown

                1. Add your services

                • Click Add a service and start typing the name of the service you’d like to add. In this case, it will be Newsletter. Select the Mailing list or Newsletter clause.

                → If you use a third-party service for newsletter management e.g. Mailchimp, Constant Contact etc., you should add the third-party service as well. You can also add “email sign-up form” (or any other collection forms you use) to your policy.
                → If you promote third-party services/products via your email newsletter in any way, you may need to add the Direct Email Marketing clause to your policy.

                2. Fill out your web/app owner and contact details

                • Add name, address, and email.

                🎉 Congratulations! Your policy has been created. Simply check that all the details are correct, then:

                3. Embed

                • Easily embed wherever you’d like! As mentioned above, you’re required to choose a location that is easily accessible and visible to users. In the spirit of transparency, consider embedding the policy in your newsletter as well.

                → Customize the look of your button or simply choose a text link;
                → Copy the embed code with one click and paste it into your site.

                💡 Remember these compliance steps are related specifically to requirements for emails and newsletters. If you’d like more information on overall website requirements, see our Getting Started guide here.

                See also

                The post How to Make your Emails and Newsletter Compliant (with Form Examples) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Cookies and the GDPR: What’s Really Required? https://www.iubenda.com/en/help/5525-cookies-gdpr-requirements/ Thu, 12 Apr 2018 12:51:04 +0000 https://help.iubenda.com/?p=5525 Update May 2020: The European Data Protection Board (EDPB) has updated its guidelines specifically related to recommended consent collection mechanisms. More on that here. When you think about data law and privacy legislations, cookies easily come to mind as they’re directly related to both. This often leads to the common misconception that the Cookie Law […]

                The post Cookies and the GDPR: What’s Really Required? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                Update May 2020: The European Data Protection Board (EDPB) has updated its guidelines specifically related to recommended consent collection mechanisms. More on that here.

                When you think about data law and privacy legislations, cookies easily come to mind as they’re directly related to both. This often leads to the common misconception that the Cookie Law (ePrivacy directive) has been repealed by the General Data Protection Regulation (GDPR), which in fact, it has not. Instead, you can think of the ePrivacy Directive and GDPR as working together and complementing each other.

                Manage cookie consent with the Privacy Controls and Cookie Solution

                Easy to run, fast and customizable

                Generate a cookie banner
                • The Cookie Law was not repealed by the GDPR and still applies.
                • The Cookie Law actually applies not only to cookies but more broadly speaking to any other type of technology that stores or accesses information on a user’s device (e.g. pixels tags, device fingerprinting, unique identifiers etc.). For simplicity, all such technologies, including cookies, are commonly defined as trackers. However, in this guide, the terms cookie(s) and tracker(s) will be used interchangeably.
                • The Cookie Law requires users’ informed consent before storing or accessing information on user’s devices.
                • Consent to cookies must be freely given, specific, informed, and based on an explicit affirmative action; many EU Data Protection Authorities have released guidance on cookies and similar technologies that include advice and recommendations on valid methods to obtain consent.
                • While the Cookie Law does not explicitly require that records of consent be kept, in most cases cookies do process personal data, which is why the record-keeping requirements stemming from the GDPR apply. Hence the vast majority of Data Protection Authorities (also referred to as DPAs) across the EU have aligned their cookie rules to GDPR requirements.
                • The Cookie Law does not require that you list cookies one by one, only that you state their type, usage and purpose.
                • If you use third-party cookies both you and the third-party are responsible for ensuring users are clearly informed and obtaining consent. As part of this obligation, you should always make sure to provide information about any such third-party and link to their respective privacy and/or cookie policies.

                The ePrivacy Directive 2002/58/EC (or Cookie Law) was established to put guidelines in place for the protection of electronic privacy, including email marketing and cookie usage, and it still applies today. As mentioned above, you can think of the ePrivacy Directive as currently “complementing” the GDPR in a sense, rather than being repealed by it.

                Meet legal cookie requirements the easy way

                • Custom clauses icon

                  Create your free cookie banner

                • Webserver module icon

                  Manage cookie consent (Google Partner CMP)

                • Clauses icon

                  Store your users’ preferences

                Try it now

                Generate your cookie banner in minutes

                Desktop Cookie banner image

                Strictly speaking, if you use cookies you need to consider Cookie Law compliance before you look to the GDPR. That’s because the Cookie Law is what is called in legal jargon a “lex specialis” which means that it takes precedence over the GDPR.

                Generally, directives set certain agreed-upon goals and guidelines in place with Member States being mandated to implement these directives into national legislation. Regulations, on the other hand, are legally binding across all Member States from the moment they are put into effect and they are enforced according to union-wide established rules.

                💡 To learn more about which EU cookie consent rules apply on a per-country basis, check out our Cookie Consent Cheatsheet here.

                With that said, the ePrivacy Directive is, in fact, going to be repealed soon by the ePrivacy Regulation. The ePrivacy Regulation is expected to be finalized in the near future and will work alongside the GDPR to regulate the requirements for the use of cookies, electronic communications, and related data/privacy protection.

                The Cookie Law actually applies not only to cookies but more broadly speaking to any other type of technology that stores or accesses information on a user’s device (e.g. pixels tags, device fingerprinting, unique identifiers, etc.). For simplicity, all such technologies, including cookies, are commonly defined as trackers*.

                Moreover, the Cookie Law is, so to speak, technology-neutral, which means that it covers not only website and browser environment but also other types of technology, including apps on smartphones, tablets, smart TVs, or other devices.

                *However, in this guide, the terms cookie(s) and tracker(s) will be used interchangeably.

                The Cookie Law requires users’ informed consent before storing or accessing information on user’s devices.

                This means that if you use cookies you must:

                • inform your users that your site/app (or any third-party service used by your site/app) uses cookies;
                • explain, in a clear and comprehensive manner, how cookies work and what you use them for;
                • obtain informed consent prior to the storing of those cookies on the user’s device.

                In practice, you’ll need to show a cookie banner (also called cookie notice) upon the user’s first visit, implement a cookie policy and allow the user to provide consent – unless your website uses solely exempt cookies, which is highly unlikely. Prior to consent, no cookies — except for those exempt — should run or be installed.

                You’ll need to show a cookie banner upon the user’s first visit, implement a cookie policy and allow the user to provide consent. Prior to consent, no cookies — except for exempt cookies — should be run or installed

                The cookie notice must:

                • inform users that your site/app (or any third-party service used by your site/app) uses cookies;
                • clearly state which action will signify consent;
                • be sufficiently conspicuous so as to make it noticeable;
                • link to a cookie policy or make details of cookies’ purposes, usage, and related third-party activities available to the user.

                Bear in mind that those mentioned above are basic minimum requirements. Cookie banner content requirements may vary from country to country depending on the respective DPA’s views.

                basic cookie banner requirements under the gdpr and eprivacy

                The cookie policy must:

                • indicate the type of cookies installed (first-party cookies vs third-party cookies* );
                • indicate all third-parties that install, manage, or access cookies via your site/app, with a link to their respective policies, and any opt-out forms (where available);
                • describe – in detail – the purposes for which cookies are used;
                • be available in all languages in which the service is provided.
                💡 What’s the difference between “first-party” and “third-party” cookies?

                First-party cookies are those managed directly by you, the owner of the site/app, on the contrary, third-party cookies are managed by third parties and enable services provided by them. Typically, third-party cookies are present when your site/app uses third-party services to incorporate for example images, social media plugins, or advertising.

                In compliance with the general principles of privacy legislation, which prevent the processing before consent, the Cookie Law does not allow the storing of information or the accessing to information stored on user devices before obtaining user consent. In practice, this means that you may have to employ a form of script blocking prior to user consent.

                Consent to cookies

                Consent to cookies freely given, specific, informed, and explicit, which means that it must be provided via a clear affirmative (opt-in) action. Therefore, if you use mechanisms such as checkboxes, they must not be pre-checked.

                The Working Party document on the Cookie Law states:

                To ensure that a consent mechanism for cookies satisfies the conditions in each Member State such consent mechanism should include each of the main elements specific information, prior consent, indication of wishes expressed by user’s active behavior and an ability to choose freely.

                Many EU Data Protection Authorities have released guidance on cookies and similar technologies that include advice and recommendations on valid methods to obtain consent.

                The Italian DPA has updated guidelines on the use of cookies and other trackers. The guidelines were adopted back in June 2021. You can read the summary here.

                Caution

                The European Data Protection Board (EDPB) has updated their guidelines on consent: Guidelines 05/2020 on consent under Regulation 2016/679. This update is important as it aims to remove any ambiguity on the official position regarding several aspects of cookie usage. Perhaps most significantly, these latest guidelines clearly state that Cookie Walls are prohibited and that the EDPB does not consider consent via scrolling or continued browsing to be valid.

                📌To learn more about which EU cookie consent rules apply on a per-country basis, check out our Cookie Consent Cheatsheet here.

                In regards to the refusal of consent or opting-out after consent has been given, the law states that users must be “given the possibility” to refuse or withdraw their consent. The Working Party document further elaborates on this point by stating that in regards to withdrawing or refusing consent, you must provide:

                • information on how users can withdraw consent and the action required to do so;
                • a means by which the user can choose to accept or decline cookies.

                This means or mechanism may not have to be hosted directly by you. In some cases under member state law, browser settings are considered to be an acceptable means of withdrawing consent.

                The particular consent collection mechanisms considered to be valid may vary by member state

                Listing cookies one by one (is it actually required?)

                In general, the directive does not specifically require that you list cookies one by one. Instead, you are explicitly required to clearly state their type, purpose, and if they are third-party cookies, you must also indicate the third party who is managing them and link to the relevant third-party privacy/cookie policy.

                This decision by the Authority is likely deliberate, as to require listing cookies one by one would mean that individual website/app owners would bear the burden of constantly watching over every single third-party cookie, looking for changes that are outside of their control; this would be largely unreasonable, inefficient and likely unhelpful to users.

                To further expand on this point, here’s an excerpt from the ICO’s Cookie Guide:

                It could be an option to provide long lists of all cookies implemented, but for most users a broader explanation of the way cookies operate and of the categories of cookies used will be helpful. A description of the types of things analytical cookies are used for on the site will be more likely to satisfy the requirements than simply listing all the cookies you use with basic references to their function.

                This sentiment is even further elaborated upon by the Italian Data Protection Authority (the Garante Privacy) which expressly states:

                There are several reasons why it would appear impossible to require a publisher to provide information on and obtain consent for the installation of cookies on his own website also with regard to those installed by “third parties”.

                In the first place, a publisher would be required to always be equipped with the tools and the legal and business skills to take upon himself the obligations of third parties – thus, the publisher would be required to check, from time to time, that what is declared by the third parties corresponds to the purposes they are actually aiming at via their cookies. This is a daunting task because a publisher often has no direct contacts with all the third parties installing cookies via his website, nor does he/she know the logic underlying the respective processing.

                Furthermore, it is not seldom the case that licensees step in between a publisher and the said third parties, which makes it ultimately highly difficult for the publisher to keep track of the activities of all the stakeholders.

                Secondly, third parties’ cookies might be modified by the third parties with time, and it would prove rather dysfunctional to require publishers to keep track also of these subsequent changes.

                Furthermore, one should also consider that publishers – a category including natural persons and SMEs – are often the “weaker” party in this context. Conversely, third parties are usually large companies of substantial economic import that work as a rule with several publishers, so that one publisher may often have to do with a considerable number of third parties.

                For all of the above reasons, this DPA is of the opinion that publishers may not be required to include, on the home page of their websites, also the notices relating to the cookies installed by third parties via the publishers’ websites.

                You can read more about this here.

                The law states that the consent collected must be freely given by the user in order for it to be considered valid. Using coercive methods to obtain consent can make the consent collected invalid. The law does make some concessions (within reason) in cases where the actual ability to provide particular site services is directly affected by the consent or lack thereof.

                The Working Party document states:

                Websites should not make conditional “general access” to the site on acceptance of all cookies but can only limit certain content if the user does not consent to cookies.

                Therefore, while certain content (within legitimate reason) can be restricted based on cookie preferences, users’ ability to generally access your site must not be coerced or conditional upon their consent.

                In this respect, bear in mind that, in their guidelines and recommendations, the EDPB, as well as several EU DPAs, have explicitly prohibited the use of the so-called “cookie walls” based on a “take it or leave it approach” that requires users to necessarily provide their consent to access an online service’s content. Cookie walls are considered invalid since the user has no genuine choice.

                Update The Italian DPA (Garante Privacy) stated in its latest Guidelines on cookies and other tracking tools that it currently prohibits the use of the cookie wall unless the website gives the user an equivalent alternative to access the content or services without providing consent to cookies or other tracking mechanisms, which will need to be assessed case-by-case. 

                We are following the developments on the matter since the Garante published a press release to say that it’s analyzing this solution as implemented by some Italian publishers. 

                iubenda will, as always, be following this evolving case and keep you updated with any new decisions.

                Exemptions to the consent requirement

                The Cookie Law envisages two exemptions to the consent requirement, namely:

                • the communication exemption which applies to cookies and other trackers whose sole purpose is for carrying out the transmission of a communication over a network (e.g. to identify the communication endpoints; to allow data items to be exchanged in their intended order; to detect transmission errors or data loss);

                Example: you use a load balancing cookie to distribute network traffic across different servers. The cookie’s sole purpose is identifying one of the servers (i.e. a communication endpoint) and as such, it falls under the communication exemption.

                • the strictly necessary exemption which applies to cookies and other trackers essential to provide an ‘information society service’ (i.e. a service delivered over the internet, such as a site or an app) requested by the user.

                Example: your e-commerce site uses a session cookie that allows users to “hold” items in their cart while they’re using the site or for the duration of a session. In this scenario, the cookie is necessary for the functioning of the purchasing service that was explicitly requested by the user when they indicate that they would like to add the item to the cart. Similarly, cookies used to remember a user’s language preferences can fall within the necessary exemption.

                It’s critical to note that even where these exceptions to the consent requirement apply, you’ll still need to inform the user of your use of cookies and similar technologies via a cookie policy. The banner is not necessarily required in these specific instances if the cookie policy is easily accessible and visible from every page of the site.

                Are cookies and other trackers used for analytics purposes likely to meet an exemption?

                There is not a straight answer. Indeed, EU Data Protection Authorities have different interpretations on this. For example, according to UK ICO’s guidelines the analytics cookies do not fall within the strictly necessary exemption and consequently always require consent. The Belgian and Irish DPAs have similar opinions. On the contrary, in the French, German, Dutch, and Italian DPAs’ views analytics cookies can fall within the strictly necessary exemption in so far as specific circumstances are met (e.g. they are first-party cookies, opt-out are anonymized, cross-tracking is not enabled). To conclude, you should carefully check what rules apply to analytics cookies in your country of reference.

                After having shown the cookie banner at the user’s first visit, you don’t have to repeat showing the banner at every visit of that user. However, you should consider giving users the option to resurface the banner should they need to change their preferences. 

                If the user has not given consent or has given consent only for the use of certain cookies, the banner shall not be re-presented except in the following specific cases:

                • when one or more conditions of the processing significantly change, e.g. ‘third parties;
                • when it is impossible for the provider to know whether a technical cookie has already been placed on the user’s device (e.g., when the user deletes cookies);
                • when at least six months have elapsed since the previous presentation of the banner.

                There are many reasons why you may need to provide users with the option to withdraw consent. Some Data Protection Authorities require that users have easy access to updating their preferences. For example, the Italian DPA (the Garante) suggests providing an icon always visible during navigation that summarizes the user’s choices. For further information on this and to see what other DPAs require, check out our GDPR Cookie Consent Cheatsheet. It’s worth highlighting that this is also a point of focus for privacy NGOs such as Noyb, which requires that users are given a way to withdraw consent. 

                Make sure you are giving your users the possibility to reopen your cookie banner by enabling the privacy widget in your Privacy Controls and Cookie Solution.



                You should also take into consideration that there are a number of reasons and circumstances that may trigger the need to ask visitors to “reconsent” and consequently resurface the banner.


                A practical example is when you are using a new non-exempt third-party cookie. In such a situation you will need to obtain fresh consent since the consent previously gathered from the user would apply only to those third-parties that you declared at the original time of collection.

                In order to help you with this requirement, we give you the possibility to easily refresh the consent collection at each cookie policy update.

                Note that some EU DPAs have specified what can be considered a reasonable period of time for cookie consent validity (for example according to the French DPA, 6 months is considered a reasonable period of time). Our Privacy Controls and Cookie Solution enables you to easily set this time frame. To learn more about cookie consent validity timelines, see our Cookie Consent Cheatsheet.

                Records of consent

                While the Cookie Law does not explicitly require that records of consent be kept as cookies do process personal data, GDPR consent-related principles, including those regarding proof of consent, generally apply.

                The Cookie and Consent Preference Log is now available in our Privacy Controls and Cookie Solution. Simply integrate this feature with one click, and you can easily store and manage GDPR proofs of your users’ consent.

                How iubenda can help you manage cookie consent

                 

                Our comprehensive cookie management solution simplifies compliance with provisions of the EU Cookie Law. As an IAB verified Consent Management Platform (CMP) our Privacy Controls and Cookie Solution allows you to meet industry standards and pass consent preferences to advertisers in a compliant way.

                💡WordPress user? See our EU cookie law plugin
                Not using WordPress? Continue reading below

                Our solution works for all websites and apps, and allows you to:

                • easily inform users via cookie banner and a dedicated cookie policy page (which is automatically linked to your privacy policy and integrates what’s necessary for Cookie Law compliance);
                • obtain and save cookie consent settings;
                • collect granular, per purpose consent;
                • preventively block scripts prior to consent;
                • apply IAB’s TCF with a single click;
                • store proofs of users’ preferences via the Cookie and Consent Preference Log.

                Our Privacy Controls and Cookie Solution adequately informs the user of:

                • potential cookies, their purpose and how they’re used;
                • third-party cookies, their purpose (and directly links to the relevant third-party policies);
                • their (various) options in regards to opting-in/providing consent and opting-out/withdrawing consent;
                • which action will signify consent;
                • how they can manage their cookie preferences.

                It gives you further options to:

                • Choose between “with prior consent” (script blocking prior to user consent and reactivation after consent) or “no prior consent” (no prior script blocking); using the “with prior consent” option ensures that before providing consent, the user can open the cookie policy and opt-out of any of the tracking scripts by using the opt-out tools provided by each third party. Remember script blocking prior to consent is required in some regions including the EU.
                • Add explicit “Accept” and “Reject” buttons as required under some member state laws.
                • Customize the location and look of your cookie notice, e.g. changing banner colors to match your website, applying your logo, and custom branding.
                • Keep track of and save consent settings for each user for up to 12 months from the last site visit, as legally required.
                • Easily embed into your site. Choose between directly pasting the embed code into the head section of your site’s pages or using a plugin (currently we have plugins available for WordPress, Joomla!, PrestaShop and Magento).

                Manage cookie consent with the Privacy Controls and Cookie Solution

                Easy to run, fast and customizable

                Generate a cookie banner

                FAQs: 

                What are cookies?

                Cookies are small text files that are stored on a user’s device (such as a computer or smartphone) when they visit a website. These files contain data that helps the website remember information about the user, such as their preferences and browsing history.

                What is cookie consent?

                Cookie consent refers to the act of obtaining permission from website visitors before placing cookies on their devices. It is a legal requirement in many jurisdictions to obtain explicit consent from users for the use of cookies.

                Do I need a cookie policy on my website?

                Yes, it is advisable to have a cookie policy on your website if you use cookies. A cookie policy is a document that explains to users how your website uses cookies, what types of cookies are used, and how users can manage their cookie preferences. It helps fulfill legal requirements and provides transparency to your website visitors.

                What are the requirements for cookie consent?

                The specific requirements for cookie consent may vary depending on the applicable laws in your jurisdiction. However, some common elements of cookie consent include:

                • Obtaining explicit consent from users before placing non-essential cookies.
                • Providing clear and understandable information about the purpose of cookies.
                • Giving users the option to accept or reject cookies, including specific cookie categories.
                • Allowing users to easily change their cookie preferences or withdraw consent at any time.

                What are cookie consent popups?

                Cookie consent popups are a common method used by websites to obtain user consent for the use of cookies. When a user visits a website for the first time, a popup or banner appears, typically at the bottom or top of the page, informing the user about the use of cookies and giving them options to accept or reject them.

                Can you provide examples of cookie consent?

                Examples of cookie consent implementation can vary based on design and functionality, but some common examples include:

                • A banner at the top of a website that notifies users about the use of cookies and provides a link to the cookie policy.
                • A popup window that appears when a user lands on a website, giving them options to accept or reject cookies.
                • A cookie consent widget integrated into the website’s footer or sidebar, allowing users to manage their preferences at any time.

                See also

                The post Cookies and the GDPR: What’s Really Required? appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                ePrivacy and Direct Email Marketing (DEM) https://www.iubenda.com/en/help/4315-eprivacy-direct-email-marketing/ Wed, 13 Sep 2017 14:04:00 +0000 http://help.iubenda.com?p=4315 If you are sending a newsletter to your users, then we suggest you add the Newsletter service from within the generator admin. In addition to this we suggest you add your newsletter sending provider (the service that gets your users’ email address). If, in addition to sending a simple newsletter, you also send direct email […]

                The post ePrivacy and Direct Email Marketing (DEM) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                If you are sending a newsletter to your users, then we suggest you add the Newsletter service from within the generator admin. In addition to this we suggest you add your newsletter sending provider (the service that gets your users’ email address).

                If, in addition to sending a simple newsletter, you also send direct email marketing (DEM) emails (emails that promote services other than your own or include product advertising from third parties), you’ll want to look at our service called Direct Email Marketing (DEM).

                Depending on how you collect the email address by your users, you may want to add a contact form, or any other form you devise.

                These are therefore the 3 main service types usually connected with email newsletters on iubenda:

                • Newsletter [iubenda service]
                • Direct Email Marketing (DEM) [iubenda service]
                • Newsletter provider [any provider you use]

                Keep in mind that in many legislations, you may need to request consent (e.g. using an unchecked checkbox for newsletter sign up) before sending emails to the user.

                About the DEM service in Germany

                If you do DEM in Germany, then you need to write some custom parts to get your privacy policy ready.

                The following statement is included in our standard DEM service:

                Direct Email Marketing (DEM)
                This Application uses the User Data to propose services and products provided by third parties or unrelated to the product or service provided by this Application.

                In addition to this you must add a statement that specifies which kind of goods and services of which companies will be promoted through the newsletter.

                Create the DEM service for Germany

                This is how you do that:

                • Press on Add service
                • Press on Create custom service (there you describe your DEM’s processes and contents)
                • Press on Add

                There are two ways to get this job done:

                • copy the above original DEM statement, paste it into the custom service made under the instructions above (Create the DEM service for Germany) and then add the additional statement (“there you describe your DEM’s processes and contents”). You will end up with one clause/service covering the topic. Or

                • add the DEM service from the generator admin and add a custom service referring to that service. You will end up with two clauses/services covering the topic.

                💡

                Wait! Before sending your newsletter: are you making this 1 mistake?


                👉 You can check it out here

                See also

                The post ePrivacy and Direct Email Marketing (DEM) appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                EU-US Data Privacy Framework: How Can iubenda Help https://www.iubenda.com/en/help/3272-eu-us-data-privacy-framework-certification-integration/ Thu, 24 Nov 2016 10:32:32 +0000 http://help.iubenda.com/?p=3272&lang=en In Short: EU Commission Adequacy Decision The Framework DPF’s Main Principles How to Certify How Can iubenda Help? EU Commission Adequacy Decision On July 10, 2023, Commissioner Reynders announced the adoption by the EU Commission of a new adequacy decision (the “Decision”) on the EU-US Data Privacy Framework (the “Framework” or “DPF”), a new framework […]

                The post EU-US Data Privacy Framework: How Can iubenda Help appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                EU Commission Adequacy Decision

                On July 10, 2023, Commissioner Reynders announced the adoption by the EU Commission of a new adequacy decision (the “Decision”) on the EU-US Data Privacy Framework (the “Framework” or “DPF”), a new framework developed after the invalidation of the Privacy Shield by the European Court of Justice.

                The Decision concludes that the

                United States ensures an adequate level of protection for personal data transferred from the Union to organizations in the United States that are included in the Data Privacy Framework List.

                This means, in other words, that the standards of personal data protection issued by the US Department of Commerce and included in the DPF are “essentially equivalent” to those guaranteed by the GDPR.

                This also means that personal data can now flow from the EU to US organizations that meet the privacy principles of the DPF and are included in the relevant List without the need for any additional measures.

                The Framework

                The DPF is based on a certification system.

                US organizations that wish to be certified and included in the DPF List need to meet the privacy principles outlined in the DPF and be subject to the investigatory and enforcement powers of the Federal Trade Commission. 

                Organizations must re-certify on an annual basis. 

                The framework also addresses and regulates the access to and use of personal data transferred from the EU by public authorities in the US, the topic that led, among others, to the invalidation of the Privacy Shield by the European Court of Justice. 

                DPF’s Main Principles

                1. Notice

                Organizations are required to provide the following information to individuals:

                • that they participate in the DPF and provide a link to the Data Privacy Framework List;
                • the categories of personal data collected and, where applicable, the US entities or subsidiaries of the organization also adhering to the Principles;
                • the commitment to process all personal data received from the EU in line with the DPF’s Principles;
                • the purposes for which personal information is collected and used;
                • how to contact the organization with any inquiries or complaints, including any relevant establishment in the EU that can respond to such inquiries or complaints;
                • the categories or identity of third parties to which personal information is disclosed and relevant purposes; 
                • the right of individuals to access their personal data ();
                • how individuals can limit the use and disclosure of their personal data;
                • the independent dispute resolution body designated to address complaints and provide appropriate recourse free of charge to the individual, and whether it is:
                  • the panel established by EU DPAs;
                  • an alternative dispute resolution provider based in the EU; or
                  • an alternative dispute resolution provider based in the United States;
                • that the organization is subject to the investigatory and enforcement powers of the Federal Trade Commission, the US Department of Transportation, or any other US authorized body;
                • the individual’s right, under certain conditions, to have access to binding arbitration;
                • the organization’s obligation to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; and
                • the organization’s liability in cases of onward transfers to third parties.

                How?

                All the above information must be provided to individuals in clear and conspicuous language.

                When?

                The information must be made available to individuals when personal information is first collected or as soon as possible. In any case, before the information is used for a purpose different from that for which it was originally collected or processed by the transferring organization, or it is disclosed for the first time to a third party.

                Under the Notice Principle, organizations are required to include the following links in their privacy policy:

                1. to the US Department of Commerce’s DPF website (link) → where individuals can find additional information on the certification, data subjects’ rights, and recourse mechanisms;
                2. to the DPF List (link); and
                3. to the website of an appropriate alternative dispute settlement provider.

                2. Choice

                Organizations must allow individuals to opt out (opt-in for sensitive information) of the:

                1. disclosure of their personal information to a third party; or 
                2. use of their personal information for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized.

                3. Accountability for Onward Transfers

                Under the DPF, organizations are subject to strict requirements before transferring personal data to a third party (e.g., ensuring that the transfer occurs only for limited and specified purposes and the third party provides at least the same level of privacy protection and processes personal information consistently with the Principles).

                The organization remains liable for how data is processed by the third party.

                4. Security

                Organizations are required to grant the security of the information they receive.

                5. Data Integrity and Purpose Limitation

                Organizations are not allowed to process personal information for purposes that are not compatible with the purposes for which it was collected or those authorized by the individual.

                Under the Integrity Principle, organizations must ensure that personal data is reliable for its intended use, accurate, complete, and current.

                6. Access

                The DPF, save for minor limitations, grants individuals the right to access their personal information.

                The Principle also entails the individuals’ right to correct, amend, or delete their information where it is inaccurate or has been processed in violation of the Principles.

                7. Recourse, Enforcement, and Liability

                This Principle ensures the effectiveness of the Framework by setting up mechanisms that assure compliance with the Principles, recourses for individuals who are affected by non-compliance, and that organizations are held liable when the Principles are not followed. 

                The Principle also includes follow-up checks to verify that what organizations state about their privacy practices is true and implemented.

                How to Certify

                Self-certification

                US organizations that wish to become part of the Framework must submit a self-certification on the Department of Commerce’s dedicated website (link).

                DPF’s benefits operate from the moment in which the organization is added to the Data Privacy Framework List.

                The self-certification or subsequent re-certification (on an annual basis) must be submitted by a corporate officer and include, among others, the following:

                1. the name of the self-certifying or re-certifying US organization; 
                2. a description of the processing activities performed on the personal information received from the EU; 
                3. a description of and link to the organization’s privacy policy regarding such personal information;
                4. a contact point within the organization for the handling of complaints, access requests, and any other issues arising in connection with the Principles;
                5. the authority that has jurisdiction to hear any claims against the organization regarding possible unfair or deceptive practices and violations of privacy laws or regulations;
                6. the method of compliance verification chosen by the organization (e.g. self-assessment or external compliance reviews, including the third party that performs such reviews); and
                7. independent recourse mechanism(s) available to investigate unresolved Principles-related complaints.

                How Can iubenda Help?

                Following the Decision and in line with the DPF’s standards, all organizations that wish to be part of the Framework are required to update their privacy policies to include mandatory disclosures under the Notice Principle.

                Easily add required information in your Privacy Policy through custom clauses in our generator!

                Generate a cookie banner

                The post EU-US Data Privacy Framework: How Can iubenda Help appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Privacy Policy for iOS and macOS Apps https://www.iubenda.com/en/help/401-privacy-policy-for-ios-and-macos-apps/ Mon, 13 Jun 2016 16:00:21 +0000 http://help.iubenda.com/?p=401 Since the release of iOS 8, Apple has implemented many requirements that need to be met in order to avoid having your app application rejected. One of the major requirements (that often results in Apps being rejected where conditions are not met) is that of data privacy. Data privacy is more important than ever across […]

                The post Privacy Policy for iOS and macOS Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>

                Since the release of iOS 8, Apple has implemented many requirements that need to be met in order to avoid having your app application rejected. One of the major requirements (that often results in Apps being rejected where conditions are not met) is that of data privacy.

                Data privacy is more important than ever across various companies and platforms; with major fines and sanctions being handed down for non-compliance, companies are paying attention – and Apple is no exception: Apple’s App Store Review Guidelines have been updated to better accommodate recent changes in Data Protection Law.

                From October 3, 2018 App Store Connect requires a privacy policy for all new apps and app updates before they can be submitted for distribution on the App Store or through TestFlight external testing.

                From October 3, 2018 App Store Connect requires a privacy policy for all new apps and app updates.

                Article 5.1 of Apple’s App Store Review Guidelines provides an overview of Apple’s privacy guidelines (and grounds for rejection where these conditions are not met). Article 5.1.1 on Data Collection and Storage further specifies as follows:

                5.1.1(i) Privacy Policies: All apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner. The privacy policy must clearly and explicitly:

                • Identify what data, if any, the app/service collects, how it collects that data, and all uses of that data.
                • Confirm that any third party with whom an app shares user data (in compliance with these Guidelines) — such as analytics tools, advertising networks and third-party SDKs, as well as any parent, subsidiary or other related entities that will have access to user data — will provide the same or equal protection of user data as stated in the app’s privacy policy and required by these Guidelines.
                • Explain its data retention/deletion policies and describe how a user can revoke consent and/or request deletion of the user’s data.

                In addition, your app’s privacy policy link or text will only be editable when you submit a new version of your app. Read the App Store’s privacy clause here.

                Starting with iOS 14.5, new requirements will go into effect, that will make data collection and processing more transparent for users. You must:

                • Answer privacy questions in App Store Connect, to explain how you handle users’ data and which third-parties are involved. This will provide users with relevant information on:
                  • the types of data you or third-party partners collect, unless the data meets all the criteria for optional disclosure;
                  • how their data may be used;
                  • your privacy policy.
                • Use the AppTrackingTransparency framework to obtain the users’ permission to track them or to access their device’s advertising identifier. The AppTrackingTransparency framework will:
                  • Present an app-tracking authorization request to the user: the prompt contains a purpose string that explains why you’d like to track the user.
                  • Provide the tracking authorization status. Unless you receive permission from the user to enable tracking, the device’s advertising identifier value will be all zeros (meaning that you cannot not track the user).

                Privacy policy requirements for iOS/macOS apps

                A lot of people ask for sample privacy policies for apps. The exact required contents of a privacy policy depend upon the applicable law and may need to address requirements across geographical boundaries and legal jurisdictions.

                For this reason, it’s always advisable that you approach your (legally mandated) privacy policy with the strictest applicable regulations in mind. You can read more about determining your law of reference here or read our in-depth Legal Overview Guide here.

                Let’s start with the legal minimum requirements. These are the most basic elements that a privacy policy should have:

                • Who is the app owner?
                • What data is being collected? How is that data being collected?
                • What is the Legal basis for the collection? (e.g consent, necessary for your service, legal obligation etc.) – This is more specifically related to the GDPR and EU Law, however, even if you fall outside of GDPR obligations, it’s likely that under many other legislations, you’ll still need to say why you’re processing the personal data of users.
                • For which specific purposes are the data collected? Analytics? Email Marketing?
                • Which third parties will have access to the information? Will any third party collect data through widgets (e.g. social buttons) and integrations (e.g. Facebook Connect)?
                • What rights do users have? Can they request to see the data you have on them, can they request to rectify, erase or block their data? (under European regulations most of this is mandatory)
                • Description of process for notifying users and visitors of changes or updates to the privacy policy
                • Effective date of the privacy policy

                Example privacy policy for iOS/macOS apps

                Here’s an example of privacy policy for an iOS app, created with our generator.

                Terms and Conditions for Mobile Apps

                Terms and Conditions (also called ToS – Terms of Service, Terms of Use or EULA – End User License Agreement) set the way in which your product, service or content may be used, in a legally binding way. Not only are crucial for protecting you from potential liabilities, but (especially in cases where something is being sold to consumers) they often contain legally mandated information such as users’ rights, withdrawal or cancellation disclosures.

                In general, you’ll likely need to set Terms and Conditions if you have an app that participates in some form of commerce (whether selling to users directly or facilitating trading). Additionally, some specific instances where they might be needed are where you:

                • need to make legally required disclosures related to consumer rights (especially withdrawal and cancellation rights);
                • have different user levels (eg. registered vs non-registered);
                • your platform allows users to sell or trade with other users;
                • facilitate or otherwise process payments and/or other sensitive user data;
                • want to set the rules for user behavior and state grounds for termination of accounts;
                • participate in affiliate programs;
                • provide a software or service which can potentially cause harm if misused;
                • would like to have some legally enforceable control over, and set rules about, how your app may be used.

                Particular emphasis should be given to account termination clauses, payment conditions and the limitation of liability clauses (and disclaimers).


                Our Term and Conditions Generator helps you to easily generate and manage documents that are engineered to meet the specific requirements of all major app stores and up to date with the main international legislations.

                How to add a privacy policy to your iOS/macOS app

                iubenda makes solving this issue easy: With hundreds of available clauses, our privacy policies contain all elements commonly required across many regions and services, while applying the strictest standards by default – giving you the option to fully customize as needed.

                Our policies are created by lawyers, monitored by our lawyers and hosted on our servers to ensure that they are always up-to-date with the latest legal changes and third-party requirements.

                The process is straightforward and intuitive, simply:

                1. click to add your services;
                2. fill out your web/app owner and contact details;
                3. embed.

                Click here to read the full guide on how to generate a Privacy Policy.

                1. Add your services

                • If you use Twitter or other auth (=OAuth) services for user management, then add the respective service by clicking “Add a service” then start typing the name of the service you’d like to add. Remember to include all services processing personal information. If you handling user registration yourself, don’t forget to add the “Direct Registration” service.
                • Select each applicable service from the list of suggestions that show up and customize by simply adding the specific types of personal data you collect. Our lawyer-crafted clauses automatically include the relevant user-rights disclosures and service definitions based on your input here.
                • If you’d like to add a custom service clause, simply click the “Create custom service” button and fill out the built-in form.
                How to create a custom service

                2. Fill out your app owner and contact details

                Enter:

                • name and full address;
                • email address.

                Congratulations! Your policy has been created. Simply check that all the details are correct, then embed.

                3. Embed

                As we said above, you have to include a link to your privacy policy within the app and in the App Store Connect metadata field.

                Within the app

                For apps, the direct link or direct text embedding methods are best. Apple specifically requires “a link” to the privacy policy, so the direct link method is sufficient in meeting Apples’s requirements, however if your app processes user data while offline, be sure to provide users with an in-app offline method of accessing the privacy policy in order to be legally compliant.

                Whichever embed method you choose, remember that you’re required to choose a location that is easily accessible and visible to users.

                App Store Connect metadata field

                When your app is ready, you have 2 options to choose from: you can either beta test it by using TestFlight or submit it for review. In both cases – in addition to the app’s internal link – you’ll have to include a link to your privacy policy in the App Store Connect metadata field. Here’s how to meet this requirement:

                TestFlight Beta Testing

                In App Store Connect, under “My Apps > TestFlight”, you will find “Test Information”, among which you will also find the privacy policy URL. Fill in the url for the translated privacy policy for each language that your app is translated into (iubenda offers 9 privacy policy languages out of the box):

                App Store Connect / TestFlight Beta Testing - Privacy Policy URL
                App submission

                In App Store Connect, under “My Apps > App Store”, you will find “App Information”, among which you will also find the privacy policy URL. As mentioned above, fill in a privacy policy URL for each language that your app is translated into:

                App Store Connect - Privacy Policy URL

                Once your application is approved, you will find your privacy policy linked under “Information” on the Application landing page that App Store generates for you:

                Learnji on the App Store - Privacy Policy link

                Create a privacy policy for your iOS/macOS app

                Start generating

                See also

                The post Privacy Policy for iOS and macOS Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                When Do You Need a Privacy Policy in Different Languages https://www.iubenda.com/en/help/539-privacy-policy-different-languages/ Sat, 11 Jun 2016 15:00:01 +0000 http://help.iubenda.com/?p=539 This requirement arises in the following cases: You have a website/app in two or more languages This situation is the most common and occurs when two (or more) completely different sets of users are targeted. It’s best that the documentation be available in all the languages in which your site/app has been translated. The purpose […]

                The post When Do You Need a Privacy Policy in Different Languages appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                This requirement arises in the following cases:

                You have a website/app in two or more languages

                This situation is the most common and occurs when two (or more) completely different sets of users are targeted. It’s best that the documentation be available in all the languages in which your site/app has been translated. The purpose of the policy is in fact for the owner to fulfil his obligation to inform the user with regards to how his or her data is to be collected and processed.

                When the policy addresses users in a certain language only, while the site addresses them in their own language, then these users will not be properly informed about the data processing (you can’t assume that everyone reads and understands English, for instance).

                That’s why the privacy policy of a multilingual site can’t be in English only.

                Your app is in one language, but you’re based somewhere with another official language

                If you’ve made an app in English and everything is kept in English, but you are however based in Germany. It’s possible that your local data protection authorities require you to offer a privacy policy in their language as well. In the case above you’d offer English & German.

                Create a privacy policy in different languages

                Start generating

                See also

                The post When Do You Need a Privacy Policy in Different Languages appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                How to Anonymize IP Addresses and Avoid the Cross-Referencing of Data in Google Analytics https://www.iubenda.com/en/help/1184-how-to-anonymize-ip-addresses-and-avoid-the-cross-referencing-of-data-in-google-analytics/ Sat, 11 Jun 2016 11:00:20 +0000 http://help.iubenda.com/?p=1184 ⚠️ Important update Say goodbye to manual IP anonymization. Google Analytics 4 now ensures IP addresses are not stored by default, enhancing your user privacy. 👉 Want to learn more? Check out our Google Analytics 4 overview. If you’re using Google Analytics to track your user activity, and you have European users, to anonymize IP […]

                The post How to Anonymize IP Addresses and Avoid the Cross-Referencing of Data in Google Analytics appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                ⚠ Important update

                Say goodbye to manual IP anonymization. Google Analytics 4 now ensures IP addresses are not stored by default, enhancing your user privacy.

                👉 Want to learn more? Check out our Google Analytics 4 overview.

                If you’re using Google Analytics to track your user activity, and you have European users, to anonymize IP address is probably worth implementing.

                Europe-based users have enhanced data privacy rights under the GDPR, and as IP addresses are considered personal data, you need to be mindful of how it’s processed.

                In the sections below, we explain how to anonymize IP address in Google Analytics, and the reasons why you may need to.

                To limit consequences related to the use of Google Analytics it’s often necessary to:

                🔎 IP anonymization in Google Analytics

                The IP anonymization feature in Google Analytics anonymizes the last digits of the user’s IP.

                In Google’s words :

                When a customer of Analytics requests IP address anonymization, Analytics anonymizes the address as soon as technically feasible at the earliest possible stage of the collection network. The IP anonymization feature in Analytics sets the last octet of IPv4 user IP addresses and the last 80 bits of IPv6 addresses to zeros in memory shortly after being sent to the Analytics Collection Network. For example, an IP address of 12.214.31.144 would be changed to 12.214.31.0 (if the IP address is an IPv6 address, the last 80 of the 128 bits are set to zero). The full IP address is never written to disk in this case.

                For more details on how anonymization works, read Google’s IP Anonymization in Analytics post in the Analytics help center.

                Caution

                Recent decisions by several European Data Protection Authorities have deemed the use of Google Analytics to be unlawful when handling the personal data of Europe-based users. To see which provisions are currently in place or follow the discussions about the use of Google Analytics in Europe, read this post.

                Why anonymize IP addresses in Google Analytics?

                Google has provided this function since May 2010 to allow website owners to request that all of their users’ IP addresses be anonymized within Google Analytics .

                This feature is designed to help site owners comply with their own privacy policies, recommendations from local data protection authorities and legal regulations like the GDPR , which may prevent the storage of full IP address information.

                Google Consent Mode

                To help advertisers manage cookies for analytics and advertising purposes , Google has introduced Consent Mode, a feature that allows you to avoid prior blocking for Google Analytics and Google Ads (including Google Ads Conversion Tracking and Remarketing).

                👉 Learn how to implement it with our Privacy Controls and Cookie Solution.

                How to use the IP anonymization

                To set up and use IP anonymization, you need to do two things:

                1. edit the Google Analytics code on your site / app ;
                2. update your privacy policy .

                Code

                Before diving into code implementations, here are a few points to note regarding Google Analytics libraries:

                • ga.js is a legacy library. Here’s how to migrate from ga.js to analytics.js .
                • the gtag.js library is the recommended tracking code for new implementations. However, there may be cases where you may still be using  analytics.js (eg, your site already makes use of analytics.js). In any case, here’s how to migrate from analytics.js to gtag.js .

                That being said, below you’ll find implementation snippets for:

                Important

                The codes below are just examples and need to be adapted to your working site.

                📌 IP anonymization with gtag.js

                To anonymize IP addresses for all events, update the configfor your property by setting the value of the anonymize_ipparameter to true:

                gtag('config', 'GA_TRACKING_ID', { 'anonymize_ip': true });

                The full Google Analytics snippet therefore would look something like this:

                <!-- IP anonymization with gtag.js - Google Analytics -->
                <script async src="https://www.googletagmanager.com/gtag/js?id=GA_TRACKING_ID"></script>
                <script>
                    window.dataLayer = window.dataLayer || [];
                    function gtag() {
                        dataLayer.push(arguments);
                    }
                    gtag('js', new Date());
                    gtag('config', 'GA_TRACKING_ID', { 'anonymize_ip': true });
                </script>

                More info regarding the IP anonymization with gtag.js and the implementation snippets can be found on this Google Developers guide .

                📌 IP anonymization with analytics.js

                To anonymize the IP address for all hits sent from a single tracker, use the setcommand to set the anonymizeIpfield to trueon the tracker:

                ga('set', 'anonymizeIp', true);

                The full Google Analytics snippet therefore would look something like this:

                <!-- IP anonymization with analytics.js - Google Analytics -->
                <script>
                    (function(i, s, o, g, r, a, m) {
                        i['GoogleAnalyticsObject'] = r;
                        i[r] = i[r] || function() {
                            (i[r].q = i[r].q || []).push(arguments)
                        }, i[r].l = 1 * new Date();
                        a = s.createElement(o),
                            m = s.getElementsByTagName(o)[0];
                        a.async = 1;
                        a.src = g;
                        m.parentNode.insertBefore(a, m)
                    })(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');
                
                    ga('create', 'UA-XXXXX-Y', 'auto');
                    ga('set', 'anonymizeIp', true);
                    ga('send', 'pageview');
                </script>

                More info regarding the IP anonymization with analytics.js and the implementation snippets can be found on this Google Developers guide .

                📌 IP anonymization for Google Analytics for iOS

                Firebase SDK

                The Firebase SDK is the recommended method to track iOS apps.

                All IP addresses are unconditionally anonymized and stored by Firebase Analytics. There is no need (or method) to explicitly do so .

                However, according to Google’s product manager Steve Ganem :

                Nothing guarantees that we anonymize these in Firebase’s API design or terms of service . Given that it’s just an implementation detail, you should be careful if you are trying to rely on this for any sort of legal compliance or to meet your company’s privacy policies . The docs and APIs are updated frequently and you should keep an eye on them, as well as the release notes , for changes.

                Note: This is one noteworthy example of why it’s important that your privacy policy include the relevant and up-to-date clauses specific to the particular service and the current guarantees of that service.

                iOS SDK

                If you choose to use Google Analytics Services SDK for iOS , here’s how to enable the AnonymizeIP functionality for a tracker:

                [tracker set:kGAIAnonymizeIp value:@"1"];

                The AnonymizeIP functionality can be set at any time.

                More info on developers.google.com .

                📌 IP anonymization for Google Analytics for Android

                Similar to iOS apps, the Firebase SDK is the recommended method to track Android apps. All IP addresses are unconditionally anonymized and stored by Firebase Analytics, with the necessary precautions mentioned above .

                Not withstanding the above, if you choose to use Google Analytics Services SDK for Android , use the following parameter in your configuration file to enable anonymize IP functionality:

                <string name="ga_anonymizeIp">true</string>

                To enable anonymize IP functionality programmatically for a tracker use the setAnonymizeIpmethod:

                mTracker.setAnonymizeIp(true)

                The setAnonymizeIpmethod can be called at any time.

                More info on developers.google.com .


                Avoiding the cross-referencing of data

                This constraint has been required by the Italian Authority in order to ensure that Google Analytics cookies are not subject to extra legal requirements. It’s also useful when approaching GDPR specifications related to the monitoring or profiling of users ( see recital 24 ). In other words, it’s the procedure to prevent Google from “cross-referencing” information from Analytics with other data in its possession.

                💡  To learn more about which EU cookie consent rules apply on a per-country basis, check out our Cookie Consent Cheatsheet here .

                To comply with this requirement it is necessary to change the settings of your Google Analytics account in order to disable permissions related to ” Google products and services “, ” Benchmarking “, ” Technical assistance ” and ” Account expert “.

                Here’s how:

                • Log in to your Google Analytics account
                • Click on Administration at the bottom of the left menu
                • If you manage multiple Analytics accounts, choose the desired account from the pull-down menu at the top left
                • Click on Account Settings
                • Remove the check mark from the sharing settings as shown in the image below: anonymize ip address
                • Click on Save

                For more information, please read Data sharing settings on the official Google Analytics Help Center.


                Adding the Corresponding Disclosures in Your Privacy Policy

                Once you’ve changed the code on your site / app, it’s time to include this information in your Privacy Policy.

                Our Privacy and Cookie Policy Generator makes it easy for you to meet your legal disclosure obligations by allowing you to correctly inform your users and define necessary details in a legally compliant way.

                The process is straightforward and intuitive:

                • Add any service you may be using. You can choose the services that apply to you from among our 1700+ pre-created clauses. In this case, it will be ” Google Analytics with anonymized IP ” (or ” Google Analytics for Firebase ” if you use the Firebase SDK for iOS / Android)Google Analytics with anonymized IP
                • Fill out your web / app owner and contact details
                • Add the iubenda Privacy Policy to your site or app

                Create your Privacy Policy for Google Analytics with anonymized IP

                Start generating

                See also

                The post How to Anonymize IP Addresses and Avoid the Cross-Referencing of Data in Google Analytics appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Cookies and Mobile Apps https://www.iubenda.com/en/help/1353-cookies-mobile-apps/ Sat, 11 Jun 2016 10:00:35 +0000 http://help.iubenda.com/?p=1353 Many app developers use cookies either in-app or via the app website for everything from usage statistics to remarketing ads. If you use cookies and you have EU-based users, you’re required by both by law and by law-abiding third-parties such as Google, Amazon, Apple, Facebook etc. to comply with legal requirements – in this case […]

                The post Cookies and Mobile Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>
                Many app developers use cookies either in-app or via the app website for everything from usage statistics to remarketing ads.

                If you use cookies and you have EU-based users, you’re required by both by law and by law-abiding third-parties such as Google, Amazon, Apple, Facebook etc. to comply with legal requirements – in this case the Cookie Law. This generally means having valid cookie policy and cookie management solution in place.

                Curious to learn more about collecting cookie consent?

                If you need to set up a cookie banner (or have already done so!), make sure to check out this short guide:

                👉 Don’t make these 5 mistakes when collecting cookie consent!

                How iubenda can help

                Our Privacy Controls and Cookie Solution allows you to easily generate a fully customizable cookie banner, seamlessly collect consent and proofs of users’ preferences, and implement prior blocking with asynchronous re-activation. It’s light, fast and fully customizable.

                Our Privacy Controls and Cookie Solution mobile SDK is available as a native component for both iOS and Android. You can contact us directly to access all files and instructions needed for implementation.

                See also

                The post Cookies and Mobile Apps appeared first on Compliance Solutions for Websites, Apps and Organizations | iubenda.

                ]]>