Introduction
The Lei Geral de Proteção de Dados (LGPD) aimed to unify over 40 different statutes that formerly governed personal data collection and processing within Brazil. It went into effect in 2018, with full-text enforcement on August 1st, 2021.
Due to the importance of complying with the regulation, we want to ensure you receive clear guidance and a consistent message from Rakuten Advertising. It is important that you understand your obligations as a business under the LGPD and make any necessary amendments to be compliant. This article addresses several options for you to become LGPD-compliant with Rakuten Advertising depending on your use case. We are also available to help support you through the LGPD process to ensure you comply.
Available Options
If your use case is not captured below, contact Customer Support to discuss your situation and determine the options available to you. Click the + to learn more about the options available depending on your use case:
Although the LGPD did not expressly establish minimum requirements to be observed by consent management platforms (CMP), it provided in its Article 49 that the systems used for the processing of personal data must be structured in order to meet the security requirements, the standards of good practices, and governance provided for in the law and other regulatory standards.
With this in mind, and considering the guidelines provided by the National Data Protection Authority of Brazil in the Guide for Cookies and Data Processing, available in Brazilian Portuguese, we can say that the standards defined by the IAB for CMP platforms in the context of GDPR meet the legal requirements for obtaining adequate consent and managing this consent in compliance with LGPD.
So, if you have integrated CMP, such as an IAB-approved CMP, contact Customer Support to request the JavaScript CMP Wrapper tag. The tag is implemented across your website within the <HEAD> section of the page and facilitates sharing the consent details collected by the CMP with the Rakuten Advertising system.
If you use a cookie banner, you must ensure the following:
- Your cookie banner must meet the following criteria:
- You must have a cookie banner.
- It must state that the site uses cookies.
- It must state that the cookies are used for personalized ads. Verbiage such as “to provide a better user experience” is considered vague.
- It ideally links to your privacy policy and/or cookie policy, though this is not required.
- Rakuten Advertising must be listed in your privacy policy and/or cookie policy as a third-party company using website cookies.
- Your policy must provide your data subjects with clear, accurate, and easily accessible information about the form of processing, the retention period, and the specific purposes that justify the collection of their data through cookies, among other information indicated in Article 9 of the LGPD.
- It must require a positive action, such as clicking an accept button, and be visible on subsequent pages until the user provides consent. It is not recommended to use cookie banners with pre-selected authorization options or to adopt tacit consent mechanisms, such as the assumption that, by continuing to browse a page, the holder provides consent for the processing of their personal data.
- There must be an easy way for the user to opt out or change their choice. This can be implemented through third parties like the Network Advertising Initiative (NAI) or the Digital Advertising Alliance (DAA).
- Consult the Cookie Banners section of the Guide for Cookies and Data Processing published by the Brazilian Data Protection Authority for additional best practices and recommendations to implement in your website. This Guide is available in Brazilian Portuguese.
- Once you confirm your cookie banner meets the above criteria, configure your page to set the following JavaScript variable whenever consent is collected:
- Contact Customer Support to request the JavaScript cookie banner wrapper tag. The tag is implemented across your website within the <HEAD> section of the page and facilitates sharing the consent details collected by the cookie banner with the Rakuten Advertising system.
If you do not currently have a LGPD solution for cookies consent, Rakuten Advertising has developed a lightweight LGPD consent pop-up solution built within our Publisher Activation Tag. The Publisher Activation Tag is a compliance solution for the purpose of collecting and passing user consent signals to Rakuten Advertising at the time of the user's click on a Rakuten Advertising affiliate link.
The Publisher Activation Tag will be implemented across your website within the <HEAD> section of the page. As a consumer interacts with your site and clicks a Rakuten Advertising affiliate link, our solution will detect whether the consumer is in scope for LGPD and if consent has been provided previously. If we determine the consumer is in scope for LGPD but has not provided consent, we will display a pop-up when they exit your site to capture their consent. The pop-up states the following:
You are being Redirected.
You are being redirected, using Rakuten Advertising technology, to a site sponsoring the link you just clicked.
As part of this redirect, Rakuten Advertising may collect digital identifiers and information about how you interact with the offers presented so that we can bring the most relevant offers to you, and improve our advertising solutions.
To learn more, please click here, or proceed without accepting.
Contact Customer Support to request the JavaScript for the Publisher Activation Tag to implement on your site.
Comments
Please sign in to leave a comment.