Active Cookie Consent Mode for User Data Privacy Management

Follow

Active Cookie Consent mode enables you to manage your users' data privacy settings. In this mode, users are not served personalized experiences unless they actively provide consent. Only users who gave their consent receive personalized experiences. Users can opt in or out at any time, and can change their status without limitations. 

For information about assumed consent using Dynamic Yield, see the client-side APIs section.

What happens when users have not provided consent?

  • Data is not collected at all, so there are no reports for these users.
  • Dynamic Yield cookies are not set in their browser (unless you use JavaScript code to create a cookie).
  • No variation stickiness (you can use the opt-out targeting condition to target variations to these users if you want to avoid users getting multiple variations across sessions).
  • Custom Code, Visual Edit, Push Notification campaigns, as well as Overlays and Notifications, are served only to consenting users (default behavior, not configured in Active Consent Mode settings).
  • Targeting by "Who" conditions (such as user properties or session behavior) does not target these users. We still track user conditions that are not personal, such as geolocation and browser targeting, because these don't require tracking or data collection. 
  • Recommendations using personalized algorithms (such as affinity or deep learning) fall back to the closest non-personalized algorithm.
  • Dynamic Links, Display Ads, and Landing Pages might fail to attribute conversions.
  • Audiences: Users are not added to any audience report, but during a pageview they are entered into an audience temporarily (for example, a user with a mobile device might match an audience condition of "Mobile Users"), but because every pageview resets the user identity, they do not remain in the same audiences across sessions.

Notes:

  • These conditions are also true in preview mode, as you preview the campaign and variation. 
  • Consent for triggered email campaigns is not managed using Active Cookie Consent. To handle consent for these campaigns, see Enabling Triggered Emails. 

Enabling Active Cookie Consent mode

Do the following to enable Active Cookie Consent mode:

  1. Implement a field in your <head> tag with the current consent preference of the user, and use an API call to notify Dynamic Yield when a user has changed their consent preference.
  2. Validate that the implementation is done properly.
  3. Preview how existing campaigns are served to users who did not provide consent, and make adjustments if needed.
  4. Contact your technical account manager or customer success manager to validate and turn on Active Cookie Consent mode.

Note that as soon as a user opts in, all of the current page data is saved, including the cookie referral data.

Step 1: Implement an Active Cookie Consent snippet and APIs

In this mode, you need to let Dynamic Yield know – on every page and for every user – whether or not the user gave consent. Implement the snippet in the <head> tag of the page, after the page context. If the user changes their consent preference, make an API call to notify Dynamic Yield of this change and ensure that the snippet in the <head> tag of the page changes accordingly.

Note: This is a necessary preliminary step for turning on Active Cookie Consent mode, but it doesn't affect your visitors until Dynamic Yield Support activates it. 

If the user consents:

DY.userActiveConsent = { accepted: true }

If the user does not consent:

DY.userActiveConsent = { accepted: false}

Note: We recommend that you explicitly add this snippet for users who did not give their consent as well. When Active Consent Mode is enabled, the user is considered "False" if no consent is given, or if the snippet isn't implemented for any reason. Only users with explicit consent are served with personalized experiences.

However, using the API means that if a user changes their preferences, the change occurs immediately. Use the following API call:

DYO.ActiveConsent.updateConsentAcceptedStatus(true)

Use "false" to notify that the user moved from consent to no consent:

DYO.ActiveConsent.updateConsentAcceptedStatus(false)

Remember to update the snippet in the <head> tag of the page to match the data sent in this API call.

If you use a custom analytics integration, use an additional API in the code of the custom integration to prevent private user data from being sent to a third party. 

Step 2: Validate the implementation of Active Cookie Consent APIs

It is crucial to validate that everything is implemented correctly. To do so:

  1. Check that the value of DY.UserActiveConsent is false.
  2. Check that active consent is implemented in the head before the script (check at least three pages). Here is an example of a specific implementation, though yours might be different:
    Screen_Shot_2021-02-03_at_20.11.01.png

  3. Check that the status changes with:

    DYO.ActiveConsent.isUserOptOut() ? 'No Consent' : 'Consent'
  4. Check that there are no console errors related to Active Cookie Consent implementation.
  5. To verify that the status was changed by API:
    1. Open the developer console (Option+⌘+C (Mac) or Cmd+Shift+J (PC)).
    2. Go to the Elements tab, and search for the term “updateConsentAcceptedStatus” (press ⌘+F or CTRL+F and paste the term). You'll find the results described in Step 1. 

Step 3: Preview an existing campaign 

You might want to check how users that did not provide consent experience your site. Remember, these users will not be served with experiences that have personalized targeting, in addition to some other limitations (see the section What happens when users have not provided consent?).

To preview how users who did not provide consent experience your site:

  1. Go to Settings › General Settings › Active Cookie Consent and click Preview Site>.
    Screen_Shot_2021-02-03_at_19.47.14.png
  2. In the browser tab that opens, look at your site and see which campaigns and experiences are served.

Step 4: Contact Dynamic Yield Support

After you complete and verify the implementation, and your campaigns are ready, contact Dynamic Yield Support to turn on Active Cookie Consent mode.

Next, we recommend that you verify that data is indeed not collected for users who did not provide consent. Look for the strings px.dynamicyield.com and px-eu.dynamicyield.com in their network calls. These strings don't exist if data isn't being collected.

Manage campaigns for users who are not opted in

Because users who did not provide consent are served with limited Dynamic Yield experiences, you might want to edit some of your existing campaigns as follows:

  • If all the experiences in a campaign use a targeting condition from the "who" category, the campaign will not be served to users who did not provide consent. So, you might want to create another experience for these users without using these conditions.
  • If you have a test with multiple variations, remember that users who did not provide consent will not have variation stickiness. This means that they might see a different variation upon each pageview. If you want to avoid this, you can exclude them from the experience targeting by using the Active Cookie Consent targeting condition.  

How can I target users who have not given consent with unique experiences?

Dynamic Yield provides a targeting condition designed to target users who have not given consent when Active Cookie Consent is enabled. For example, if you have a personalized experience on your homepage, you might want to create an alternative experience for the users who will not be served with the personalized experience.

To do this, create an experience that is targeted only to users who have not consented using the targeting condition Active Cookie Consent. 

Screen_Shot_2022-09-21_at_17.37.53.png

Enabling API campaigns with Active Cookie Consent 

API campaigns behave similarly to site personalization campaigns. This means that a user is considered to be opted out until they actively opt in, and you need to notify Dynamic Yield when a user opts in (or out). User consent data must be sent in every API call, such as Choose, Engagement, Events, and so on.

To indicate the user’s preference, add the active_consent_accepted parameter. If you send requests without this parameter, or with an incorrect value, Dynamic Yield assumes that the visitor has not opted in (value of false).

Param

"user": {
    "dyid": "-4350463893986789401",
    "dyid_server": "-4350463893986789401"
    "active_consent_accepted" :  // true or false
}

 How it works:

  1. For first-time users, you don't send the user ID and session ID to Dynamic Yield.
  2. Dynamic Yield sets and returns the user ID and session ID in a cookie in the response.
  3. After Active Cookie Consent is turned on, Dynamic Yield can't return valid cookies unless the user has consented.
  4. If the user has opted out or not consented, Dynamic Yield sends a cookie with the user ID and session ID with a TTL (maxAge) of -1 (that is, the cookie is not saved, and if there was a cookie before, it is deleted). This way, you don't need to change your implementation as the cookie expires immediately.

Assumed Consent APIs

Consent to Data Collection

User data is collected and they are served personalized experiences unless they request to be opted out. There are two ways to use this method, depending on whether you are using a consent management tool or not (details below). For more details, see Assumed Consent Method of Data Privacy Management.

User Consents:

DY.API('consent_optin');

User Does Not Consent:

DY.API('consent_optout');