For businesses operating across the U.S., UK, and EU, cookie and tracking technology compliance is becoming increasingly complex. While organizations in Europe are accustomed to consent-based requirements for nonessential cookies and trackers, the U.S. presents a different mix of regulatory requirements and litigation risk.
In Episode 2 of Data Across the Pond, Hintze Law’s Sam Castic and Skyscanner Deputy General Counsel Gemma Witham discuss how common UK and EU approaches to cookies may need to adapt for the United States. They discuss the growing trend of businesses facing legal demands and litigation due to use common tracking technologies under laws such as the California Invasion of Privacy Act (CIPA). They also discuss the types of obligations state privacy laws impose around the sale and sharing of personal data, targeted advertising, and for opt-out signals such as the Global Privacy Control (GPC).
UK and EU Cookie Compliance May Not Translate Across Borders
European organizations commonly classify cookies by categories such as strictly necessary, performance, functional, or advertising. Those categories do not align with how tracking technologies are treated under U.S. privacy laws or the legal theories driving U.S. tracking litigation.
This creates practical decisions for global businesses. Requiring consent before tracking technologies fire may help address certain U.S. litigation risks, but it may also reduces the data businesses can get from website visitors. The podcast discusses these challenges and how to think of scaling a compliance approach globally.
A Global Approach to Tracking Technologies
The conversation covers the types of capabilities and considerations companies should think of when setting a global approach to governing tracking technologies. Gemma and Sam discuss capabilities for consents and opt-outs, up-to-date disclosures, and classifying cookies and trackers over time.
Ultimately, the episode highlights an important distinction for global businesses: cookie compliance cannot necessarily be approached the same way on both sides of the Atlantic. Understanding the different sources of U.S. risk, and developing a tracking governance strategy that takes them into account, is an important way for cookie and tracking practices to scale globally.
Listen to the full episode here: Apple, Spotify, or YouTube
Sam Castic is a Partner with Hintze Law, chair of the firm’s Retail Group, and co-chair of the Cybersecurity and Breach Response Group and FinTech + Financial Services Group. As a former chief privacy officer, he helps companies build, scale, and right-size privacy programs and strategies.
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on AI, privacy, and data security. Hintze attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of AI, privacy, and data security.