GDPR: A Cookiebot CMP checklist

Step 1: Add your domain

• Log into the Cookiebot Manager and navigate to the Domains tab.
• Enter the domain name (excluding https://-part, for example: domain.com)

Step 2: Configure your banner type

In order to make sure the banner and consent method used on your website is GDPR compliant, you can follow the steps in this guide: Using a GDPR compliant banner

Geo location settings ^(optional)

If you want to target visitors from specific countries or regions in the world, Cookiebot CMP can in real-time determine which country the individual user comes from, and display the consent banner only to visitors from the selected countries and regions. For all other visitors your website will function unchanged. You can limit the banner to EU-users only. See: Display the cookie consent banner to EU users only).

Step 3: Configure your Privacy trigger

Withdrawing consent should be as easy as giving it. You can also simply enable the Privacy trigger on your website and have this option easily and visibly available for your users at all time: The Cookiebot CMP Privacy trigger.

Step 4: Configure your Cookie Declaration

We provide a cookie policy that can be integrated in your website's privacy policy. The script for it can be found on the tab ‘Your scripts’ (it’s the second of the 2 scripts). It is implemented as described in the second part of step 3 in our general 3-step installation guide or following the instructions in the other implementation guides available.

For more information, see also: What is included in the Cookie Policy

Step 5: Get your scripts

• Navigate to the "Your scripts" panel
• Choose the correct blocking mode you want to use: automatic cookie blocking or manual cookie blocking.^*
• Follow the instructions to insert your banner and cookie declaration on your website.
  If you intend to implement Cookiebot CMP by other means than manually adding the script(s) to your template, please refer to our implementation section in the Help Center.

^*Under GDPR, you must get a consent from your website users before you set any cookies that contain personal data other than those that are strictly necessary for the website to function. This means you have to hold back all those cookies and online trackers containing personal data that are not strictly necessary, until the user agrees to them by giving an appropriate consent. And if the user does not want for his/her personal data to be used that way and doesn’t give a consent, then you need to continue holding back everything but strictly necessary cookies.

Step 6: Check your scan report

Any issues with blocking cookies will also be highlighted in your monthly scan report. We advise to check the scan report each month for the 3 following issues:

- unclassified cookies: Check your unclassified cookies 
- cookies not blocked: Make sure you have enabled prior consent
- inadequate countries: Data transfers between the EU and the US

Step 7: Share information about who the data controller is and about the DPO

What is required?

The Article 29 Data Protection Working Party (WP29) has issued Guidelines on transparency under Regulation 2016/679 (wp260rev.01). According to this, and Article 13 of the GDPR, it should be clear to the website user - at the time when the user is asked for consent regarding the use of his personal data - who the data controller is and how the data controller can be contacted. Most often, the data controller will be the company behind the website.

If the company makes use of a representative, this info should also be included. If the company has a Data Protection Officer (DPO) this and contact information should also be included.

How can I implement it?

If you have already included this information in e.g. your website’s Privacy Policy in a clear way, then you can choose to link to your Privacy Policy from the cookie consent banner to make this available to the user. Alternatively, you can insert the information directly in the banner to make it clear to the user.

See How can I customize the content in the cookie consent banner?

Examples of text you can use if you have included the needed information in your Privacy Policy and would like to link to it from the cookie consent banner:

English (EN): "Learn more about who we are, how you can contact us and how we process personal data in our Privacy Policy."

Danish (DA): "Få mere at vide om, hvem vi er, hvordan du kan kontakte os, og hvordan vi behandler persondata i vores Privatlivspolitik."

German (DE): "Erfahren Sie in unserer Datenschutzrichtlinie mehr darüber, wer wir sind, wie Sie uns kontaktieren können und wie wir personenbezogene Daten verarbeiten."

French (FR): "En savoir plus sur qui nous sommes, comment vous pouvez nous contacter et comment nous traitons les données personnelles veuillez voir notre Politique confidentialité."

Italian (IT): "Scopra di più su chi siamo, come può contattarci e come trattiamo i dati personali nella nostra Informativa sulla privacy."

Spanish (ES): "Obtenga más información sobre quiénes somos, cómo puede contactarnos y cómo procesamos los datos personales en nuestra Política de privacidad."

Please note that if you have enabled Cross-domain Consent Sharing on multiple domains, then the same banner text will be displayed on all the domains. It may therefore be necessary to include multiple links to the different places where the relevant information about the data controller(s), representatives (if relevant) and DPOs (if relevant) can be found.

For further details, see the Annex of wp260rev.01 and Article 13 of the GDPR.

Check your website

Use the Cookiebot compliance test to check if your website's cookies and tracking meet GDPR and the ePrivacy Directive.

Sources:

https://www.cookiebot.com/en/gdpr/

https://www.cookiebot.com/en/gdpr-cookies/

https://www.cookiebot.com/en/cookie-compliance/

https://www.cookiebot.com/en/eu-privacy-laws/