Opt-In – Impact on Online Marketing through the EU Cookie Directive

Under the new General Data Protection Regulation (GDPR), many marketers have experienced significant confusion regarding the EU Cookie Directive and the Opt-In and Opt-Out procedures. Additionally, there is uncertainty about the e-Privacy regulation, which is expected to become mandatory in 2019. In our article "No Google Analytics without Google Analytics Opt-Out Cookie", we have already discussed the necessity of a Google Analytics Opt-Out Cookie on the privacy page.

In this article, we want to explain the Opt-In procedure, which requires the explicit consent of the user for analysis and marketing measures. We will also illustrate how this procedure affects all online marketing channels and activities.

What is the Opt-In procedure?

The Opt-In procedure is based on the increasingly popular cookie notice, which mentions the use of cookies on websites. As shown in images 1 and 2, the formulations were revised on May 25, 2018, and supplemented with additional information on the use of cookies in many cases.

Fig. 1  Old cookie notice as it was used on https://www.internetwarriors.de before GDPR.

Fig.2 Current notice, allowing users to exclude themselves from tracking.

Since this revision, many users have had the opportunity to agree to or decline the use of cookies on individual websites. Once users make a decision here, the use of cookies, aside from specific exceptions like session cookies, must be respected across the entire domain.

However, many lawyers and data protection officers interpret the GDPR differently, resulting in users being offered various solutions. These range from simple cookie banners without selection options to Opt-In procedures.

The impacts of the Opt-Out procedure are already known. However, with the Opt-In procedure, only a very few companies have experience. For this reason, we tested the Opt-In procedure within the framework of GDPR cookies to gather initial insights that we can consider in future implementations.

Distinction between Opt-In and Double Opt-In

Before we begin with the implementation and the impact on traffic, we need to differentiate between Opt-In and Double Opt-In:

• Opt-In: An information banner is displayed to the user on accessing the website, informing them about the use of cookies and, if necessary, their purposes. The user must also explicitly consent to the use of cookies before web analysis and marketing measures may be carried out. If they do not, neither tool may be used.

• Double Opt-In: This procedure is primarily used in email marketing. Upon subscribing to a newsletter, the user receives a confirmation email, requiring them to actively confirm their subscription.

As you can see, both procedures are independent of each other and have nothing in common.

Changes in traffic due to the implementation of Opt-In

As part of our Opt-In investigation, we examined the traffic development on 10 websites in Google Analytics before and after implementing the Opt-In. The Google Analytics screenshot in image 3 shows the number of sessions of a website on a daily basis, before and after the implementation of Opt-In.

Fig. 3 Traffic development from May 24, 2018, to June 21, 2018. Opt-In was implemented on June 8, 2018.

Comparing the period after implementation with the period before implementation and excluding the day of implementation, the following traffic changes arise:

Fig. 4 Comparison of developments in Google Analytics in the periods June 9, 2018 – June 15, 2018, and June 1, 2018 – June 7, 2018

Other websites with about 5,000 sessions per day even show deviations of 83% - 85%. Only a few websites have a smaller deviation than shown in the screenshots here.

Configuring Opt-In with a Step-by-Step Guide

To help you understand how the entire procedure works, we would like to give you a detailed Step-by-Step explanation. Additionally, at the end of the article, we offer you the chance to download our configuration of the Google Tag Manager container so that you can import it into your Google Tag Manager and gain experience with the implementation.

GDPR Cookie Notice on the Website

An essential requirement is a cookie banner on your website, informing users about the use of cookies and giving them the option to activate or leave analysis and advertisement cookies deactivated. For simplicity's sake, we use the popular solution Consent by Insites for our attempt. We have also integrated this script on our website. Via the Download menu, you can configure a banner that you only need to copy into the source code of your website afterward. During this process, you have to decide whether you want to use the Opt-In or Opt-Out procedure. In our current scenario, we use the cookie notice for Opt-In. Subsequently, the banner is displayed immediately. Thus, implementation is very easy to carry out even for less technically skilled individuals.

Storing User Decision in a Cookie

Once you've embedded the banner on your website, it will be displayed to all users. However, initially, nothing else happens, no cookies are blocked yet. Insites itself uses a cookie named "cookieconsent_status" to store the user's decision and not display the banner again on their next visit. This decision is valid for one year. The cookie values can be seen in image 5:

• "allow" for consent

• "dismiss" for rejection

You also get the expiration date of the cookie, from which the browser no longer considers the cookie. We can read the "allow" and "dismiss" values with the Google Tag Manager and take them into account for triggering Google Analytics, Google AdWords, Affiliate, etc. The decision of an Opt-In should not be limited to web analytics using Google Analytics, Etracker, Webtrekk, etc. alone. All remarketing and conversion tracking from other providers should also be considered.

Fig. 5: Status of the "cookieconsent_status" cookie for Opt-In

Consideration of Do Not Track

After considering the GDPR cookie decision by the user, we want to consider a second option of rejecting analysis and marketing cookies. This involves the Do Not Track procedure. In this case, the browser sends information to the server with each new page view that no user profile should be created and personal activities should not be tracked. Image 6 shows the setting in Firefox's "Privacy & Security" section.

Fig. 6: Activation of the "Do Not Track" information in Firefox's privacy settings

Do Not Track is integrated into all relevant browsers like Google Chrome, Mozilla Firefox, Apple Safari, etc., but is disabled by default. Therefore, the user must make a conscious decision and manually enable Do Not Track. If they do, website operators should respect this decision if they offer the Opt-In procedure.

Interaction of individual configurations in the Google Tag Manager

To configure Opt-In in the Google Tag Manager and consider GDPR relevant cookies, we have defined the following rules:

1. Has the user explicitly agreed to the use of cookies for Opt-In?

   • If yes, we check whether the user has activated Do Not Track

   • If no, we keep all tracking disabled

2. Has the user activated Do Not Track

   • If yes, we keep all tracking disabled. This rule also overrides the previous rule if the user has agreed to tracking on the banner

   • If no, we check whether the user has consented to the use of cookies.

Only if both conditions are fulfilled will analysis and marketing cookies be activated

1. The user has consented to the use of cookies

2. The user has deactivated Do Not Track

If even one value deviates, the cookies remain blocked. This way, the website operator offers maximum protection for users from cookie capture.

At the beginning of the article, we showed that this setting in the Google Tag Manager resulted in significant traffic loss in Google Analytics. But since all remarketing and conversion tracking is also blocked, website operators can no longer tag their users and can measure success significantly less.

Measuring Do Not Track Usage on Another Website

Currently, according to our non-legally binding understanding, there is no obligation to use Opt-In tracking. However, this may change with the e-Privacy regulation in 2019. Regardless, it is not known to us that the Do Not Track feature is a mandatory measure for website operators.

For this reason, we analyzed the use of Do Not Track on an eleventh site. This site serves family entertainment and is characterized by a high national as well as international traffic. It also serves both genders and age groups from infants to great-grandparents. We consider these numbers a good cross-section of society.

In image 7, we have juxtaposed the number of sessions and accesses with activated Do Not Track. For measuring activated Do Not Track, we use "Unique Events" in Google Analytics, as this value is "session-based" and thus provides a comparable data basis.

Fig. 7: At 10% of all sessions, Do Not Track is activated in the period June 13, 2018 – June 20, 2018

The collection period is June 13, 2018 – June 20, 2018. It is clearly visible that in 10% of all sessions, Do Not Track is activated. Here, users have made a very conscious decision not to be tracked.

Learnings from the Test

These are very valuable and important insights for us. The Opt-In procedure significantly reduces the metrics in the analysis and marketing tools and makes it considerably more difficult to capture users. If the use of Opt-In becomes mandatory, other methods would need to be developed to continue offering online marketing in the same quality. If you, as a website operator, need to decide between Opt-In or Opt-Out, you now know the pros and cons. We are also happy to offer our Google Tag Manager container configuration for download. Fill out the following form, and we will send you the download link by email. The .zip file can be easily opened, and you will find a .json file inside. When you are in your Google Tag Manager, click on "Admin" and then on "Import Container." Subsequently, select the .json file and import it into your Google Tag Manager container. You will then find all the templates we created. It will be exciting to see how the e-Privacy regulation impacts the EU Cookie Directive and how users take advantage of Opt-In options.

What can we do for you?

If you are unsure whether you need Opt-In tracking or if you experience difficulties implementing the Opt-In or Opt-Out procedures, we are here to help you. We support you in the implementation of your online marketing strategies and can quickly make technical adjustments to your website, should the new e-Privacy regulation require it.