Block: Cookies

GDPR

With privacy legislation like the EU’s General Data Protection Regulation (GDPR) coming into effect more and more, it is crucial for Greenpeace to respect our users’ privacy concerns. The Cookies Block, along with Google’s Consent Mode, allows users to have complete control over which cookies to accept in any of the P4 sites.

Live Example? International privacy policy or this Google doc Template

🤔 KEY INFO : Please read this Medium Post and watch this 5 minutes video to fully understand the new P4 Consent Mechanism. The Tag Manager setup is also available in gitbook.

This block should generally be used in the “Privacy & Cookies” pages (see Legal check), and makes the cookies management in our P4 sites 100% compliant to the highest web security standards.

Definition & Purpose

Definition

The Cookies block is a card that displays the cookies settings and control panel within P4 for editors to control their level of compliance regarding data collection. For EEA countries, this block is related to GDPR to ensure their regulations and compliance.

Learn more here.

Purpose

Empowers editors to manage and control their preferences regarding data collection, ensuring transparency and compliance with privacy regulations. This block should generally be used in the “Privacy & Cookies” pages (see Legal check), and ensures that cookies management within our P4 sites achieves full compliance with the highest web security standards.

For EEA countries, learn more about GDPR here.

Add the block to your page

Users will automatically have Necessary cookies (aka First-party cookies, the same for all P4 sites) enabled and have the option to enable / disable analytical cookies (only if enabled in P4 Settings > Cookies) and Marketing cookies, which depend on which 3rd party cookies you will have installed in your P4 site.

Check the texts we decided to adopt for cookies block of the International site.

It is mega important to carefully describe all the three types of cookies you are placing in people’s browsers. Please read this Medium post and watch this video.

🤔 Tip :
1 – The strictly necessary cookies are automatically enabled for everyone
2 – If a user accepts 2nd or 3rd checkbox, the system will automatically accept the Necessary cookies
3 – All EU NROs must enable the Consent Mode setting for GDPR compliance

Check the .gif below to see the block’s behaviour in real-time.

Behaviour of the cookies block consent control.

Cookies settings

⚠ SUPER IMPORTANT NOTE
Previously, the Enforce Cookies feature prevented cookies from firing without consent, however that solution has been discontinued as of October 2021. See the Medium Post for more information on this decision.

🔎 Where can I find this ? Dashboard > Planet 4 > Cookies

If the “Enforce cookies policy” setting is checked -> The acceptance of the visitor means that cookies are allowed to be stored on the browser. If the visitor does not accept the cookies, the P4 Google Tag Manager is not fired.

If the setting is NOT checked -> The acceptance of the visitor means only that the visitor is aware that cookies are stored. Not accepting it does not block cookies from being stored, this is how every site was behaving before GPDR.

The Analytical cookies checkbox must be checked to correctly enable the full functionality of the Cookies Block.

Site Admins can also add the “Reject all” option on the settings (see image below)

All texts to explain the types of cookies can be setup directly in Planet 4 Settings > Cookies (see image below)

The Cookies Settings page (text fields to describe the cookies type)

Please keep reading to understand the behaviour of the cookies block in combination with the Tag Manager setup.

Understand Planet 4 Cookies

Consent Mode

The Cookies Block allows users to accept or deny the use of cookies, but in order to ensure those preferences are being respected, we must enable Google Consent Mode. Instructions on setting up Consent Mode and Google Tag Manager requirements can be found in Gitbook.

Google Consent Mode helps you to adjust Google tags behaviour based on the consent status of your users, helping you to indicate whether consent was granted for Analytics and Ads storage.

Google consent mode introduces two new tags:

analytics_storage
ad_storage

When consent for ad storage or analytics storage is denied, the associated Google measurement functions deployed via global site tags (gtag.js) or Google Tag Manager will adjust their behavior accordingly. In other words, Google’s ad_storage and analytics_storage consent types will dynamically adapt, only utilizing cookies for the specified purposes when consent has been given by the user:

When consent is granted, the associated tags will function normally;
With the analytics_storage tag, if consent is given, Google Analytics will collect detailed analytical data. But even if there is no consent, some basic measurements are still passed to Google (eg. Timestamp, Referrer) but won’t appear in your reports.
The ad_storage tag instructs Google Consent Mode to control the behaviour of marketing cookies. If consent is denied, advertisement will be less targeted.
You can also manually add these consent types to any other Google Tag Manager tag (using the Consent View).

For example, if a user does not provide consent for ads cookies (and therefore advertising purposes are disabled), but does provide consent for analytics cookies, you’ll still be able to measure site behaviour and conversions in Analytics as the analytics_storage setting will be enabled.

See below how the Consent Mode was adapted to Planet 4 user consent preferences:

To set up Google Consent Mode follow the instructions in Gitbook

Cookies Settings

🤔 IMPORTANT NOTE: The “Enforce Cookies Policy” Setting has been discontinued as of October 2021. See the Medium Post for more information on this decision. The setting temporarily remains under Cookies Settings, but will be sunset soon.

Understanding the cookies

The P4 dev team created two 1st party cookies that will help us to understand and record the user’s preferences. Please check the Tag Manager setup to learn more.

Those cookies will be used inside Google Tag Manager to create specific triggers:

The P4 cookies values according to users’ preferences – from the Gitbook documentation

User flow and cookies

Instead of avoiding Google Tag Manager to load before user consent, we have taken a new approach. By disabling the “Enforce Cookies Solution” (on WordPress) we are able to control what types of tags are going to be fired based on user preferences.

The user flow proposed below will allow us to track statistical and anonymized data for our analysis, while still being compliant with GDPR.

🤔 Important: Before applying this setup to your live website, please make sure that you have done your due diligence and verified this setup against your local legislation for cookies and privacy. There may be local variations as to the interpretation and implementation of GDPR and other rules with regard to cookies.

Here’s the cookies flow in a Google Drawing: