Social Media Cookies

Have you ever wondered how websites recall the contents of your online shopping cart or remember your sign-in information or just give off a more personal feel? Look no further than cookies.

These small packets of data have taken the internet by storm and are currently the most common method of identifying users online and providing a personalized browsing experience.

As a website owner, it's imperative you let your users know what categories of cookies you use, why you need them and how users can control their cookie preferences.

With that said, an important category gradually gaining recognition by websites when presenting cookie information is social media cookies. If you have social media networks integrated into your website, chances are you'll be using social media cookies and therefore need to address them in your policies.

This article will help you better understand various cookies categories and clarify what social media cookies are, why they are used, and how to display them in your Privacy Policy or Cookies Policy as well as in your privacy preference center.

What are Cookies?

Cookies (aka "internet cookies," "web cookies," "HTTP cookies," etc.) are tiny data files placed on a user's internet device by web browsers when visiting a website. They are primarily used to identify users, observe their browsing activities, and remember certain information about them, like their usernames, passwords, shopping cart inventory, and so on.

Cookies are also used to carry out more complex tasks such as:

• Improving a website's performance
• Pinpointing users' locations, and
• Collecting information about user preferences to deliver personalized advertising.

Since their invention in 1994 by Netscape engineer Lou Montulli, cookies have virtually penetrated every corner of the internet, helping websites function more efficiently as well as better understand and serve their users.

In matters of personal security, cookies aren't inherently harmful (contrary to common misconceptions). They can, however, present a threat to users' privacy in the sense that users may be tracked without their consent or approval.

Not surprisingly, this privacy threat has drawn the attention and active supervision of privacy laws like the EU's General Data Protection Regulation (GDPR) and the EU Cookies Directive.

As of now, it is effectively illegal for websites under their scope to implement certain cookies without the consent of users.

Now that we have a basic understanding of cookies and their general functions, let's look at some common cookie categories and their uses.

Types of Cookies

Cookies used by most websites typically fall into (at least) one of the following categories:

• First-party cookies
• Third-party cookies
• Session cookies
• Persistent cookies
• Strictly necessary cookies
• Performance and analytical cookies
• Functionality cookies
• Targeting and advertising cookies

As a website owner, you need to understand each cookie category and how they work in order to stay compliant with applicable laws. Let's examine each one in turn and see their functions.

First-party Cookies

First-party cookies are placed directly on a user's device by the website and are primarily designed to enhance general website functionality.

These cookies allow website owners to obtain information for analytical purposes and help improve the overall browsing experience.

Third-party Cookies

Third-party cookies are a little different. Unlike first-party cookies, third-party cookies are placed on a user's device by external platforms integrated into a website. Common examples are cookies set by ad platforms, live chats, payment gateways, and so on.

That said, third-party cookies are currently experiencing a decline in popularity as they pose a more significant data security risk to individual privacy. As a result, leading companies like Google no longer support them.

Session Cookies

Session cookies (aka temporary or transient cookies) exist only as long as a user is active on a website. They allow users to browse websites without repeatedly filling out the same information every time they switch web pages.

Session cookies are activated when users launch a website and expire when they leave the website or close their browser window.

Here's how Etsy describes this cookie category in its Cookie Policy:

Persistent Cookies

Persistent cookies, on the other hand, are primarily designed to help websites remember a user's settings, preferences, and previously provided information in order to deliver a faster and more convenient browsing experience.

These cookies remain on a user's hard drive (even after closing the browser) until they expire or are manually deleted. Persistent cookies are also known as permanent cookies or stored cookies.

Here's how Pinterest explains its use of persistent cookies in its Cookie Policy:

Strictly Necessary Cookies

Strictly necessary cookies (also known as essential cookies) are simply cookies that must be present for your website to carry out its primary functions. These cookies are required for users to access core features of the website, including the ability to log in, add items to their shopping basket in an ecommerce store, or pay for products.

It's important to note that strictly necessary cookies are the only cookie category that does not require user consent before being implemented.

For example, here's how Rakuten presents this cookie category in its Cookie Policy:

Functionality Cookies

Another important cookie category used by virtually all websites is functionality cookies (aka preference cookies). Although these cookies are not essential for websites to carry out their basic functions, they are needed to remember choices made by users in the past.

Examples include the following:

• Language preferences
• Location details to help deliver relevant weather reports or personalized news stories
• Information entered in online forms

Here's how EY employs functionality cookies to help enhance its users' browsing experience:

Performance and Analytical Cookies

Performance cookies are also known as analytical or statistics cookies. Their sole purpose is to monitor and help improve a website's performance by collecting anonymized information about how visitors use the website.

To put this in context, performance cookies can be used to find out:

• How often users visit your website
• How much time users spend on your website
• The loading speeds of certain areas of your website
• If there's unusually high traffic in some parts of your website

They are typically provided by third-party analytics platforms (e.g., Google Analytics), and are for the exclusive use of the website owner.

Rakuten, once again, presents this information well in its Cookie Policy:

Targeting and Advertising Cookies

Targeting and advertising cookies (also called marketing cookies) are generally third-party cookies specifically designed to collect information about the browsing habits of website visitors.

This information is subsequently used to build individual profiles of users' interests to provide them with the best-suited advertisements based on topics that interest them.

Here's a good example from Snap showing how it and third-party advertising partners use marketing cookies:

While these are the main ways of categorizing cookies, note that some cookies may not fit neatly into these categories or may qualify for multiple categories. For example, advertising cookies are usually a mix of third-party cookies and persistent cookies.

Now that we're clear on what cookies are and how you can classify them, let's talk about social media cookies, examining what they are, why they are needed, and how to present them in relevant sections of your website.

What are Social Media Cookies?

Social media cookies are a newly-introduced category of cookies set by third-party social media platforms that have been integrated into a website. For example, cookies from social networking sites like Twitter, Facebook, Instagram, and LinkedIn can be classified as social media cookies.

To further clarify, a cookie placed on your website by YouTube to measure the views of an embedded video is a social media cookie.

With the proliferation of social media, virtually all websites incorporate social networking platforms to provide additional services and features to their users.

These features typically include the ability to:

• See embedded videos on a website
• Share information with social media networks
• Enjoy a more personalized browsing experience

Social networking platforms, in turn, place cookies on the devices of site visitors to track their online activities and present them with digital content that may be of interest to them.

As a result, social media cookies are closely related to (and sometimes classified under) targeting and advertising cookies since they perform similar functions. Perhaps, the only significant difference between them is that social media cookies are set exclusively by social networking platforms.

Here's a more comprehensive description by the global safety organization UL:

Note how UL disclaims all liabilities by referring its users to the Privacy/Cookies Policy of its integrated social networking sites.

Here's a similar description by the European Union Agency for Cybersecurity, ENISA:

Social media cookies generally become active and collect information when users:

• Link their social media accounts to a website
• Engage with web content through a social networking site, or
• Interact with social media widgets, plug-ins, sharing buttons, or "like" buttons on a website

Disclosing Your Use of Social Media Cookies

As a website owner, you need to provide clear and explicit information about what type of cookies you use (including social media cookies), why you need them, and how users can control their preferences.

While this information is typically addressed in a Privacy Policy or Cookies Policy, it should also be displayed in your privacy preference center.

Not only is this legally required by cookie regulations like the EU Cookies Directive, but your users will appreciate a clear and comprehensive explanation of your cookie practices.

Moreover, being upfront about cookie information is a simple way to show your users that you take their privacy seriously, and will play a huge role in promoting transparency and building credibility for your website.

That said, let's briefly look at key places to display social media cookies.

In Your Privacy Policy or Cookie Policy

When presenting social media cookies in your Privacy Policy or Cookie Policy, it's best practice to observe the following guidelines:

• Start by explaining what social media cookies are to your users in a clear and intelligible way
• Let users know how and why these cookies are being implemented
• Let users know which social networking platforms are responsible for these cookies (preferably including a link to their respective Privacy Policy or Cookies Policy)
• Let users know how they can control their cookie preferences
• Give users clear instructions on how to opt-out of social media cookies anytime they wish

On a final note, social media cookies (much like targeting and advertising cookies) should be implemented only after getting clear, affirmative consent from users. This can be done by presenting a cookie banner upon a user's first visit to your website.

Let's look at some additional examples. Here's how Rise describes social media cookies in its Cookie Policy:

Note how Rise explains cookie information using simple, plain language and disclaims all liabilities where third-party social media cookies are concerned. This is good practice and can help you avoid legal issues.

Here's another brief but succinct example from Planable that details its use of social media cookies, the third-parties responsible, and how users can opt out:

In Your Privacy or Cookie Preference Center

As the name implies, a privacy or cookie preference center is a page on a website where users can choose which cookies they wish to allow or decline.

A preference center typically lists the categories of cookies used on a website, briefly explains their purposes, and provides a switch/button to enable or disable certain cookie categories.

If your website uses social media cookies, you need to include them in your privacy preference center and give users the ability to opt out.

You should also explain the effect of rejecting social media cookies so users can make an informed decision.

For example, here's how Akamai Technologies complies with these requirements:

Here's another example from the travel guide company Lonely Planet:

Lonely Planet takes it a step further and lets its users choose which individual social media cookie to allow and decline. This is a convenient feature that, while not essential, lets users make more informed choices.

Summary

Social media cookies are steadily gaining recognition as websites have begun distinguishing them from targeting and advertising cookies.

As a website owner, keeping your Cookies Policy constantly updated by including all relevant cookie categories is a legal responsibility and shows users you care about their privacy.

If you haven't addressed social media cookies in your Privacy Policy or Cookies Policy, now is a good time to make these changes.

Here's a quick recap of the most important things to note when implementing social media cookies:

• Getting clear, affirmative consent before implementing cookies is a legal requirement in most legal jurisdictions
• Separately addressing social media cookies and explaining how and why they are used will help promote transparency for your website
• Giving users the ability to control their cookie preferences and opt-out of social media cookies is good practice and helps you remain compliant with most cookie regulations
• Letting users know which third-party social media platforms are responsible for social media cookies helps you disclaim liabilities and avoid legal issues