Is Munchkin considered a "profiling cookie"?

[Dan_Stevens_]

Due to some recent legislation in Italy, our lawyers have to come to us once again to find out what sorts of additional disclaimers and consent language will be required on our websites.  According to Italian law:

Profiling cookies are defined by the Italian Data Privacy Authority as cookies that are aimed at creating user profiles. They are used to send advertising messages in line with the preferences shown by the user during navigation. In the light of the highly invasive nature of these cookies vis-à-vis users' private sphere, Italian and other European legislation requires that users be expressly informed on their use so as to have an opportunity to give their valid consent.

Does Munchkin fall into this category - especially for those of us that place leads into defined segments based on their demographic attributes and behavioral activity?

[Grégoire_Miche2]

Hi Dan,

From my understanding, yes, Marketo cookies have to be managed by the cookie-consent rules in EU.

Like with email opt-in / opt-out regulations, the various countries have not implemented the EU directive in a uniform way, though.

-Greg

[Dan_Stevens_]

Understood, Greg - and our legal teams definitely keep us on our toes regarding all of this inconsistent legislation.  What I'm trying to determine here though is specifically around "profiling cookies".  Not sure if this is targeted more towards third-party advertisers or if Marketo is clumped in this group.

[Grégoire_Miche2]

Hi again Dan,

No, in fact the EU cookie directive also regards first party cookies, not just third parties. I gather this is because the directive has been written by people who do not understand the difference

-Greg

[Grégoire_Miche2]

Even simple sessions cookies are in the scope, at least in theory. This is really stupid because many web sites become unusable without a session cookie.

-Greg

[Josh_Hill13]

Other than what Greg said, my understanding is that everyone needs to have that consent pop up. There were some great threads on this in 2013 as well as a session or two in 2014 at the Summit.

[Dan_Stevens_]

The entire consent pop-up process is already part of our roadmap for when we launch our redesigned website - we're fully compliant there.  The specific question we were being asked from our legal team focused specifically on first- and third-party profiling cookies. For example, while using the Sitecore Experience Platform CMS, one of the benefits is to profile your users' behavior so that you can serve up the most relevant content in the future.  But we're OK here since the cookie is being served up from us.  The question I had was for Munchkin.

[SanfordWhiteman · Accepted solution]

Dan, the Munchkin cookie:

• is a first-party cookie (it is created and managed by JS in your browser, not "served" by Marketo -- although it is transmitted to Mkto)
• fits the definition of a profiling cookie

Even if the profile created by Munchkin isn't used to customize web pages in real time, it's always used, as you pointed out, to create a behavioral profile that affects later digital marketing efforts. Those efforts could certainly include online ads (within your site) for third parties, and always include tailored emails and content from your own company.  I don't see a way to dodge the reality that Munchkin is tracking a person's click path for later use. As I've said to people trying to avoid strict privacy plugins: We're tracking, don't try to fool people who aren't comfy with that!