Privacy finding
A cookie is filed under a consent category that does not fit its vendor
Privacy Error Severity: High
Part of the audit A tracker is filed under the wrong consent category. Finding id: privacy.categoryVsVendor.
What it costs you
A cookie in the wrong category is set without the consent it needs. The banner works as designed and the site still tracks without consent.
What to do
Move the cookie to the category that fits what its vendor does with it.
What it checks
- Advertising cookie marked as necessary
- Analytics cookie marked as necessary
- Unclassified cookie loaded without consent
- Same cookie in different categories per domain
How to fix it
Give the cookie a category
- Find what sets the cookie: see the example page.
- Give it a category in the consent tool. Until then it should not be set before consent.
How to check: Crawl the site again. The cookie no longer appears in this rule.
Use one category for the cookie on every host
- Compare the consent tool's settings for each host of the site.
- Give the cookie the same category everywhere.
How to check: Crawl the site again. The cookie no longer appears in this rule.
Move the cookie to the category that fits its vendor
- Read the vendor's documentation for this cookie.
- In the consent tool, move the cookie, or the script that sets it, to the matching category.
How to check: Crawl the site again. The cookie no longer appears in this rule.
A real case
A Belgian legal information website argued that its analytics cookies were strictly necessary and so needed no consent. The Belgian data protection authority rejected that and fined the company 15,000 euros in December 2019.
How to verify by hand
The vendor's own documentation for that cookie.
What this relies on
The database purpose is right; 'necessary' is the usual mislabel.