Companies Must Better Understand Cookies, Data Flows, Say Privacy Pros
As the presence of regulators and regulations grows in the privacy landscape, states are increasing their proactive enforcement and employing technology to do so, privacy experts said during a Privado webinar Thursday.
Sign up for a free preview to unlock the rest of this article
States are looking at "what's happening ... and bringing in technology" to assess data flows, said Richard Borden, partner at Frankfurt Kurnit Klein and Selz. "And they're coming to companies and saying, ‘We are seeing something that you're doing that's wrong.’ Or they're then sending out sweep letters that say, ‘Tell us what your practices are.’”
Running sweeps and sending letters means regulators have lots of information via large technology auditing teams, which could put business in a situation where "the regulator knows more about your website than you” do, said Vaibhav Antil, CEO and co-founder of Privado.ai.
Borden agreed. “If you don't have the ability to figure out what's happening in at least as good a way as they do, you are behind, and they're going to start to think that you're a bad actor,” he said.
Jake Ottenwaelder, principal privacy engineer at Integrative Privacy, said if companies don’t understand cookies and data flows, regulators will be more skeptical of their comprehension of privacy protections. “On the external side of your website, with cookies and data flows, a lot of regulators are seeing that as an overall health check of maybe your entire processes internally as well,” he said. For instance, strong consent banners and proper tracking notifications can be “a means to keep regulators from asking even deeper questions and even more difficult questions.”
Borden also noted a rise in litigation, especially under the California Invasion of Privacy Act (CIPA). “Those cases…are all over the place, and it's just driven up the regulatory and liability risk.”
Ottenwaelder said these regulations and increased litigation can lead to companies experimenting with new technologies, which can spur further regulation and litigation. “The challenge comes when the advertising technology starts to try to circumvent some of the cookie technology or tries to circumvent some of the regulations that we're trying to put in place.”
An example of this, Ottenwaelder said, is cookieless tracking. Though it was a "fancy new thing" to get out of cookie requirements, now the “regulations are being written and updated so that it does include all...cookieless tracking,” he said.