Last December Stack Overflow announced a change to the network advertisement policies.
“Retargeting pixels are
not allowed on any campaign.allowed for a limited number of vetted and pre-approved Programmatic partners.”
The change introduced the use of Retargeting pixels on the network.
Later an user asked if the change invalidates previous consent given on the site:
Will this change invalidate the consent granted by existing users, requiring them to re-consent? Since you're changing what you're asking permission for, it should.
Sasha, a staff member replied with the following (emphasis mine):
The change in the advertising guidelines announced on December 12th does not have any effect on the consent that users have given in their cookie settings because nothing in the cookie settings modal has been altered. The cookie consent modal already included a toggle for consenting to targeting cookies, and the consent that users have issued on that is still valid
Now, it is my understanding that a tracking cookie and a tracking pixel are not the same thing. While the pixel can also involve a cookie the former will also use javascript to perform additional tracking that goes beyond the capabilities of a regular cookie. At the very best a standard cookie should stop to work once deleted while a pixel implies a level of tracking that it is not dependent on a file on the user device.
The current cookie consent window for the network looks like this:
Only cookies are specifically mentioned.
It is my understanding in order to be valid, consent for personal data usage has to be given in a way that clearly states the purpose and how the data is collected.
I am not a lawyer but Article 7 specifically seems to point in this direction:
Article 7
Conditions for consent
- Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
- If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
I am therefore curious. Is Sasha statement about "not requiring a new consent" correct or the inclusion of a new form of tracking would require a new specific consent since it does not appear covered by the previous one in a way that a regular, non technical user would understand (it is still tracking, but not the same type of tracking)?
Bonus question: would the answer be different if the consent was made more generic from the start, for example:
Targeted Advertisement
Cookies and other tracking technologies are used to make advertising messages more relevant to you and may be set through our site by us or by our advertising partners. They may be used to build a profile of your interests and show you relevant advertising on our site or on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device.
UPDATE In a comment amon suggested to look at the ePrivacy Directive. I skimmed thru and found an interesting article.
(21a)
Cookies can also be a legitimate and useful tool, for example, in assessing the effectiveness of a delivered information society service, for example of website design and advertising or by helping to measure the numbers of end-users visiting a website, certain pages of a website or the number of end-users of an application. This is not the case, however, regarding cookies and similar identifiers used to determine the nature of who is using the site, which always require the consent of the end-user.
This obviously means that tracking pixels should require consent. The wording seems also to indicate that they require "explicit" consent, so the consent to "tracking cookies" should not provide consent to "javascript based tracking". Is this right?
