Consent Management & Privacy Policy - Juniqe

This is a series I wanted to start for a while. This is the 1st case study: Let me use a brand, a company that I like. I'm browsing their website and checking their tracking setup. I show you what I notice, what they do well, and what needs improvement, based on my experience.

So what's on the menu today:

👉 Consent management for starters

👉 Privacy policy to continue and...

👉 Marketing tracking with (no) UTM parameters to finish off.

I know this menu could seem dull.

But bear with me, I’ll try to make it interesting and spicy.

Consent management issues

The first thing you see when you land on a website is consent management.

Let's face it, consent management is annoying. Not only for users, but for companies as well. It is a task that is divided between tech, legal and marketing, so it is often not taken care of.

Unfortunately for Juniqe, they seem to be caught up in this chaos. Their consent management is a mess. Let's have a look!

Sorry but what if I don't want to accept?

And here comes the first surprise: it is quite complicated to refuse cookies.

I know there's no single solution to this as there's room for interpretation in GDPR and the ePrivacy directive. However to comply with them, you must:

Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place1.

A bit vague right?

But here at Juniqe, it is definitely not easy NOT to accept.

Having no easy way to check the list of cookies and opt out is beyond the pale in my opinion.

But let’s not stop here. What happens when you click on “settings” (which is the link you click to select services):

Are you too spotting some weird things?

Well ... it’s a mess.

“Analysetools” is not a compliant category. And I can't opt out of it. It is definitely not how it should be.

2nd surprise: Some marketing cookies are opted-in. Most of them are not but Bing Ads and Google AdWords Remarketing are. Obviously they all need to be turned off initially. It's up to me to turn them on if I want to.

What about the Google Ads Click ("_gcl_aw") and the Facebook click ("_fbc") cookies?

Nop. All off. Thank you.

We just checked the consent management, cool. But what happens with cookies concretely when I access the website? Cookies should be set with the user's consent. But I've encountered many sites where that's not the case. So let's see how Juniqe handles cookies:

There are many other issues (Pinterest Tags under Functional?) but I think we get that consent management needs to be fixed at Juniqe.

Marketing Cookies

And that’s a big no no here:

_fbp cookie set? I just said no to that though...

Facebook and Bing are tracking me? But I thought I just refused every marketing cookie???

But maybe I'm wrong. Can i check what I selected a few seconds ago in the cookie banner?

No I can't, as there’s no link on the website to see my cookie selection.

Here's what GDPR and the ePrivacy Directive state:

Allow users to access your service even if they refuse to allow the use of certain cookies2

Privacy Policy

I also checked Juniqe's privacy policy. Sometimes you find interesting discoveries there. But ultimately I just want to be sure that every marketing service they're using on their website is listed there.

Disclaimer: I'm not a lawyer and privacy policy - even for me - is not my favourite content. So it is a superficial check.

Let's make it short: everything looks alright.

Except for one missing service: Usercentrics, which is the service handling their consent management and which sets cookies too.

But all marketing services are listed in the privacy policy page.

Marketing Tracking - No UTMs?

So why do we need cookies for Facebook and Google in the first place?

Well, to run some amazing marketing campaigns. I had to check out Juniqe's performance marketing strategy to see what they do.

And my big reaction here is:

They don't use UTM parameters?

At least for their Google campaigns. I could see some for their Facebook ads.

I obviously don’t know how Juniqe and their performance marketing team work. It is possible that they will not need UTM parameters for their Google ads...

But do you rely solely on third-party data then?

How they do it genuinely interests me and makes me curious.

If you are interested in this topic, I will probably write an entire blog post about UTM parameters and why you should use them.

TL;DR:

  • The cookie banner needs to be changed. Wrong categories. All cookies should be initially turned off.
  • Even if I opt-out, I'm tracked by many cookies. A big NO NO.
  • Privacy policy looks okay.
  • No UTM parameters are used for performance marketing campaigns. I suppose they rely on third-party data then. Curious.

‍

1,2 https://gdpr.eu/cookies/

‍