How Many Cookies Do You Have?

Hi, I’m Lisa, founder of Five Penny Web Studio, and this is the No Stress Web Success Podcast. Welcome to the first episode of our series, Web Understood, where we will discuss everything website—covering the latest news, website security, compliance, analytics, and so much more.

Let me start with a short intro into Five Penny Web Studio. This business was founded with the mission to coach and support those who desire to understand web technologies and more so WCAG accessibility. We’ve seen the nonprofit executive director who has a staff of three maintaining their own website and trying to keep up with everything. Our mission is to be that support system—whether it’s through our podcasts, through our coaching sessions, through our support tiers. We just want those individuals to know that they have someone they can rely on, someone they can reach out to for their questions.

So why do we focus on accessibility? Our tagline is “seen, considered, crafted.” That “seen” is not only for users with disabilities, but it’s also for the smaller agencies, the individual marketing teams, the executive director and her staff of three from the nonprofit organization. We want them to know that they are seen just as much as somebody with larger budgets and larger teams. We want the users with disabilities to know that they are seen—their vision issues, their colorblindness, their hearing impairment, whatever it may be.

So let’s pick our topic for today. Today I want to talk a little bit about compliance and the cookie notice.

If you’re like me, you hate the pop-ups that come up: Do you approve? Do you accept? Do you reject? Do you ignore? You’re seeing these more and more on websites, and the option is… it’s not an option anymore.

A lot of people don’t realize what’s behind the mechanics of analytics. They sound really great for tracking visitors to see how many people are coming to your website. You want to know, if you’re doing an ad campaign, is it going to the right people, the right regions? You get so much useful information out of this. But now there are so many states that have their own data privacy policies in place that you really have to look at where you live, who you are targeting, what regions, what states. Because actually being in one state and having most of your customers in that state with you doesn’t mean visitors from other states cannot see your website—because it’s just out there. Technically, it’s open to the world. And when that happens, you have to start listening to what the policies are from the rest of the world.

It’s one of those things that we’ve always taken for granted. We never thought about it much before. And things have changed, especially in the last ten to twelve years on data privacy. Texas, California, New York, Florida—so many states have their own policies or are in the process of creating their policies.

So how much data are you collecting on your website? Do you even realize you’re collecting data? Is it IP addresses? Is it locations? Because the whole theory behind it is that even though you don’t seem to be collecting personal information, you can actually put pieces together and determine where somebody’s at. And that’s what a lot of people put behind these policies they create—that even though you may not be doing it, you’re collecting puzzle pieces. And if you put these puzzle pieces together, you actually have a whole puzzle, and you can see the whole picture. So if you’re collecting email addresses, if you’re looking at the regions they’re coming from, if you’re getting IP addresses and phone numbers, all that could play a part into it.

Again, everybody has an opinion on this. Marketing teams love analytics, and I understand why. I’ve kind of seen things from both sides. But you have to really think about what you’re collecting, and we have to be good stewards of that data. Our users come to our websites, they share information with us, they subscribe to a newsletter, they let us know what pages they’re visiting. And so yes, they may leave their name, they may leave their email address and phone number. We have that data in our website. How long do we keep it? Where do we store it? How much security do we put on our server and on our website to protect that data? Do we mask anything? Who has access to that website and to that server? These are all questions you have to start asking.

So when somebody comes to your website, just remember you have to be a good steward of that data. You have to protect them. I am way more cautious and wary of it than I used to be. I prefer to err on the side of security and compliance anytime over marketing. And I miss it. I miss the ignorant bliss that I used to have when I was just looking at things from a marketing perspective. I never meant anything malicious. I just wanted to know who was going where, and why they were going there, and if their time spent on a website was a pleasant time, or if they had frustrations, if they struggled to find links. All that is very useful information when you’re trying to serve somebody. But now you do have to be more cautious about it.

So that’s where your cookie notices come in place. Find one that’s good, that will help you keep up with things. Be wary of who has access to your website, who can install things. Because if you put something in place, and then somebody else goes in and they add a tracking script from LinkedIn, or from a TV station that they’re doing a campaign with—it’s not just Google Ads anymore. Now Google gets the brunt of things because Google has the most analytics and ads out there. But it’s not just Google, and you have to think pass that now. If you’re using anything with any kind of campaigns and any kind of advertising to track “how well did my newsletter do? Did it lead people from my newsletter to my website?”—there’s probably cookies involved somewhere. And if any of these vendors you’ve worked with told you, “Hey, just install this script on my website, give this to your web developer,” then you probably have cookies on your website. And if you’re not protecting it, you may get pinched.

The actual law is the CIPA law. And it comes out of the state of California. It actually has been around for a very long time, but it started off as the Wiretapping Act. It is now the law that they use for data privacy and cookie policies. And just because you’re not in California does not mean people in California aren’t going to your website, and they are protected. So do your due diligence, talk to your legal teams, find somebody with the actual legal knowledge to lead you in the right direction. But make sure that you’re not running a bunch of cookies on your website and sharing data for people that could get you caught in the long run.

At the end of the day, you have to realize you are the website owner, so it is your responsibility. And if you’re using different resources, different frameworks—don’t assume that whether it’s WordPress or Squarespace or Wix or Webflow or even a custom-built site—don’t assume that the company or the vendor or the developer has got this covered. It’s up to you to make sure that it’s taken care of, that it’s in place and it’s working properly.

If you’re using WordPress, some of the best resources out there: there’s Termageddon, there’s WP Consent, plenty of other cookie notices out there. Some handle the cookie notice and the policies. Some handle only policies, some handle only the cookie notice. Some will do the scheduled scans, where it will schedule a scan on a weekly basis or however you set it to scan the website for any new cookies added. But you have to go through—it’s not just installing it. You have to make sure that it’s configured correctly.

A lot of them will give you options for the GDPR, which is the General Data Protection Regulation. It’s basically the European privacy laws. They will also sometimes give you options for Google Consent Mode, and that basically tells Google how users want their data handled. So there’s a lot of little tweaks and balances in there. There’s also the options to make sure that cookies don’t run until a user actually accepts—because sometimes, depending on how your website loads, it can load a cookie before the user even sees your pop-up or before they accept. So again, it’s one of those little caveats you have to be careful for.

So if you’re using a cookie policy or cookie notice on your website, you definitely want to read the instructions, follow their guidelines, and set it up securely. Don’t just—it’s not a set-it-and-forget-it kind of thing. It’s not once you enable it, it’s good to go. There are options in there that you need to look at closely. You just want to make sure that you’re following what you need to for your industry, for your business, where you’re located, and the users that are coming to your site from where they may be.

If you’re looking for a good list of resources, I’ll be happy to create a list for anybody, and feel free to reach out to me. You can always leave feedback on this podcast. You can also leave a comment for me, fill out a form at fivepennyweb.com. I’m always happy to hear what people have to say, and we always do better when we brainstorm together. So let me know your thoughts on this episode. Until next time, see you soon.