User consent: how to comply with CNIL (the French national information science and liberties commission)

Orchestrating proprietary data

These days, proprietary data are collected in great numbers and within the law by our clients, for example product, CRM data, etc. It would be a shame to restrict yourself to the use of web analysis or advertising data in this context. 

You need to think about the orchestration of all the data to  make them work together in very advanced scenarios. You can work on know-your-customer and use that data for media activation. 

That gives you a better knowledge of your users and allows you to reflect otherwise than via the marketing aspect and recapitalise on other data that belong to advertisers. 

In conclusion, compliance with CNIL's recommendations and more generally the arrival of a digital world with strict limits on the use of cookies, is a hot topic that you need to plan ahead for. Whether it's the evolution of methodologies, new models or the orchestration of proprietary data - solutions already exist. Would you like to know more about these solutions? Our experts will give you the answers!Last October, CNIL revealed new rules and recommendations for advertisers in relation to user consent. Advertisers have six months in which to comply. 

That leads us to the fatal date of 31 March 2021!

There are three main aspects that need to be considered: legal, marketing and technical. All of these aspects need to be understood in order to achieve compliance and limit the impact on business.

With new actors such as the CMP (Consent Management Platform), the work to be carried out to maximise the levels of consent, or the complementary analysis components, such as Consent Mode, offered by Google, it's hard to find your way around!

That's why we've offered you a webinar to answer all these questions. See the video right here.

This article goes over our recommendations in detail to help you achieve CNIL compliance, not forgetting digital marketing.

Overall context: a world without cookies

Certain regulatory changes have been appearing for several years. It relates mostly to the GDPR since 2018, but also changes in recommendations from CNIL since October, which will come into force in March 2021.

These changes require advertisers to update the mechanics of consent on their websites so that the latter can be easily given or denied.

Nevertheless, this change in the digital landscape is not limited to the actions of public institutions, it is also the result of private initiatives . Browsers also restrict the placing of cookies.

For example, Safari's ITP seriously restricts the option to place third-party cookies in particular. Elsewhere, Chrome has announced the disappearance of third-party cookies by 2022. 

The third big trend comes from internet users themselves: according to eMarketer, 29% of users and 48% of those aged between 18 and 24 use a blocker for ads or cookies. Compliance with regulations also means responding to users' demands, to protect your reputation as a brand.

As you can see, complying with  CNIL's recommendations seems to be a necessity for advertisers in 2021. 

Serious consequences for marketing performances

Three issues seem particularly hot to us.

The impact on conversions

It is now becoming increasing difficult to link advertising campaigns and conversions  which ultimately take place on the site. The collection of consent puts a limit on gathering data with analytics and advertising tools, for example, and affects the interpretation of performance.

This is even more the case on Social Media, particularly on Facebook, where the KPIs are very focused on post-impression analysis.

The impact on bidding strategies

Actors such as Google Ads and Bing Ads use data to to feed algorithms and optimise campaign performance. The less data there is at input, the less the algorithms can improve performance, which then limits their relevance. 

The impact on audiences

The retargeting ability will be reduced. For example, audience data can be created on Google Analytics, then transferred to Google Ads to target a particular audience. Without users' consent, such targeting becomes impossible.

However, there are ways to get round these problems.

Three objectives derived from the new recommendations

Complying with the law

From an organisational point of view, companies need to change to face the challenge of a world without cookies. It is a fact that the skills required are very broad with the legislative aspect that demands a compliance strategy. The role of the DPO (Data Protection Officer) is particularly important here. 

In addition, the legal experts need to work together with the technical and marketing teams. The implementation of actions to ensure compliance with CNIL requires technical skills. Additionally, the marketing team is then responsible for defining how to optimise and exploit the data collected within the law. 

Auditing your compliance in relation to CNIL seems to us to be an additional and necessary step. It involves knowing where your company is now and where you want to take it. CNIL imposes 5 key guidelines that have to be adopted before 31 March 2021:

• The end of implied consent 
• Symmetrical consent (as easy to accept as to refuse)
• Adapting one's consent (by modifying one's parameters)
• Clarifying the use made of data 
• To be able to prove the application of the rules of consent

Lastly, the best way to work out where you want to go, is to use a CMP (Consent Management Platform). A CMP is an outsourced tool that allows you to deploy your banner and easily manage trackers, buttons etc. It facilitates two things:

• The ability to apply analytics to the opt-in opt-out information
• The ability to collect data on proof of consent in the event of an inspection by CNIL, for example.

Maximising consent

This is also a key point. A badly managed banner will mean you miss out on opportunities to collect user consent. The aim of this strategy is to get the best possible opt-in rate. 

There's a lot of sharing of good practices within the market, particularly regarding the best name to give to your refusal button, for example. 

Fixing opt-in rate targets for the banner deployed is also important for forward planning.  You should also consider the initial consent, market data for the sector, advice and good practice from actors such as CMPs, etc. A/B testing of different banners before 31 March to maximise the opt-in an excellent way to approach the date calmly.

A different approach to management

New mechanisms are appearing to help manage input data efficiently. We believe that there are four aspects to consider to ensure that you make the most informed decision possible. 

• Knowing your opt-in rates for better decision-making
• Altering measurement KPIs by working on a ratio rather than an absolute values basis
• Using technology and predictive tools to model the performance of visitors who have given their consent and extrapolating them to those who did not.
• Using your proprietary data 

Our best practices for a different approach to management

Modifying your analyses to make more informed decisions 

This is all about being as precise as possible in your use of the data that you have available to you. 

We believe that the first step should be to change your measurement KPIs by preferring traffic rates and ratios rather than absolute values when interpreting performance. 

Due to the fact that we're used to thinking in terms of number of sessions, number of impressions, etc. In the future, it would be better to think in terms of the evolution in the number of sessions between two particular periods, for example. This will help you spot trends and measure evolutions. 

Next, you need to consider the lowest data volumetrics in bidding strategies on Google Ads for example. You will need to adjust the indicators on which the algorithms base their optimisations. For example, you can enrich your ROAS with your visitors' opt-in rate. 

The last point concerns the rationalisation of the interpretation of your data. Sometimes, the interpretation of data doesn't reveal on which ratio of visitors having opted in you should base your calculations. 

The dashboards equipped with CMPs that we provide for our clients make it possible to place opt-in rate indicators in the interpretation input. This provides a good perspective of the way to interpret data in the dashboard, as shown below:

Capitalising on predictive models

The main idea is to maximise knowledge of opt-in and opt-out rates. The other observation is that in spite of everything, the data will not be collected due to lack of consent and will therefore be "lost". 

This raises two questions: 

• What data do I have containing consent information?
• How to work on lost data.

This means moving from marketing based on precision to marketing focused on prediction with new technologies that enable you to work on models created from "lost" data.

That's why Google has released Consent Mode, and why some of our clients ask us to model the behaviour of their opted-in users. 

The diagram below shows you how modelling can enable you to build bidding and optimisation strategies on all conversions.

Modelling allows you to collect consent information which in turn enables you to consider extrapolations and calculate a conversion number for the opted-out population. This then gives you a holistic conversion rate, which is comprehensive, taking into account the conversion rate and the conversion rate by modelling. 

Orchestrating proprietary data

These days, proprietary data are collected in great numbers and within the law by our clients, for example product, CRM data, etc. It would be a shame to restrict yourself to the use of web analysis or advertising data in this context. 

You need to think about the orchestration of all the data to  make them work together in very advanced scenarios. You can work on know-your-customer and use that data for media activation. 

That gives you a better knowledge of your users and allows you to reflect otherwise than via the marketing aspect and recapitalise on other data that belong to advertisers. 

In conclusion, compliance with CNIL's recommendations and more generally the arrival of a digital world with strict limits on the use of cookies, is a hot topic that you need to plan ahead for. Whether it's the evolution of methodologies, new models or the orchestration of proprietary data - solutions already exist.