Use case for making CJA/AA cookies strictly neccesary

[NitinSi5]

Hello,

We are working with customer who is thinking of making all the Adobe cookies part of strictly necessary.

Has anyone done that in the past and how does it gel with compliance and legal point of view?

Thanks,

Nitin

[bjoern__koth]

Hi @NitinSi5 ,

I think the easiest way would be asking your client "Does your website work without Adobe Analytics or CJA?"

If the answer is "Yes", then these are not strictly necessary cookies and require consent (unless the legal teams says it's fine, which I doubt).

[Jennifer_Dungan · Accepted solution]

I suppose this depends on where the website operates and what they are legally required to do...

In Canada (or at least most of Canada) analytics isn't required to provide an opt-out... I work in media, and from what I have seen from a lot of media companies is that we have opt-out for advertising cookies, but not for analytics cookies. While Quebec has stricter rules, since many of the English media outlets don't do direct business in Quebec, they either do a specific opt out policy for Quebec, or again, if they don't really have operations or products targeted to Quebec they just put in the legalese that analytics is part of the website and therefore not included in the opt-out.

Now, depending on your implementation, in the old AppMeasusement.js for AA, not setting an ECID, and forcing the s.vid and s.fid cookies to session based allowed tracking to continue without setting "fingerprinting cookies" during an opt-out scenario... 

However, the webSDK doesn't seem to offer anything equivalent to this for some reason... which personally seems like a miss. If the opt-out is specifically around cookies that "follow" a user, this does not mean that you need to opt completely out of tracking (unless the opt out specifically gives the option to opt-out of tracking in general). I very much disagree with that approach, as opting out of cookies is very different from opting out of tracking.