Cookies und elektronisches Marketing

Cookies & Electronic Marketing

Align cookie disclosures, consent management behavior, and direct marketing flows with ePrivacy rules (such as Art. 5(3) ePrivacy Directive and national implementations) and GDPR consent standards.

Terminal Equipment Storage & Tracking Audit

1. Inventory Every Client-Side & Server-Side Tracker:
   • Inspect codebase scripts, tag managers, SDKs, cookies, localStorage, sessionStorage, IndexedDB entries, and tracking pixels.
   • Record for each item: exact name/key, provider (first-party vs. third-party), technical purpose, lifespan/expiry, and data recipients.
2. Strictly Necessary vs. Consent-Required Classification:
   • Strictly necessary (exempt from prior consent): Session authentication, CSRF security tokens, load balancing, shopping cart state, and storing the user's own privacy/cookie preference.
   • Requires prior opt-in consent: Analytics and telemetry not exempted by strict national rules, session replay, A/B testing, advertising/retargeting pixels, social media embeds, and cross-site attribution.
3. Consent Banner & Technical Enforcement:
   • Verify in code that non-essential scripts, SDKs, and cookies do not load or fire before the user grants affirmative opt-in consent.
   • Check banner UX against dark-pattern prohibitions (EDPB Guidelines 03/2022):
     • Equal visual prominence and single-layer symmetry for "Accept" and "Reject / Necessary only" actions.
     • No pre-ticked boxes for non-essential categories.
     • No deceptive color contrast or nudging, and a persistent link/control allowing users to withdraw or change consent at any time with equal ease.

Electronic Direct Marketing & Communications

1. Separate Transactional from Marketing Messages:
   • Transactional / service messages: Password resets, security alerts, billing receipts, mandatory contract updates — sent without marketing consent, must remain free of promotional upsell.
   • Direct marketing (newsletters, promos, product announcements): Requires prior opt-in consent (with unbundled checkbox and double opt-in where required or recommended) or verified compliance with narrow statutory "soft opt-in" conditions for existing customers' similar products.
2. Unsubscribe & Email Tracking Pixels:
   • Verify that every marketing message contains a functional, frictionless, free-of-charge unsubscribe mechanism (including one-click List-Unsubscribe headers) that immediately updates suppression lists.
   • Audit whether outbound emails embed open/click tracking pixels; disclose them accurately and verify whether consent is required in target jurisdictions.