Privacy finding
Visitors from a region get a consent regime that does not fit that region
Privacy Error Severity: High
Part of the audit Visitors from different regions get the wrong regime. Finding id: privacy.regionRegime.
What it costs you
The banner is right at home and wrong abroad. Visitors in the other region are tracked under rules that do not apply to them, and nobody on the team sees it from the office.
What to do
Set the consent tool's rule for this region to the model the region requires.
What it checks
- Opt-out banner shown where opt-in is required
- No banner where one is required
- Do not sell link missing where required
How to fix it
Add the opt-out link
- Open the site from region [region] and look for the opt-out link in the header and the footer.
- If it is missing, add it with the title the regulation for that region gives.
How to check: Run the scan from that region again.
Correct the geo rules of the consent tool
- Open the geo or region rules of the consent tool and find the rule that applies to the region in the finding.
- Set it to the model the region requires. When in doubt, use the strictest model for all regions.
- Check that the site's CDN or cache does not serve one region's banner to another.
How to check: Run the scan from that region again. The region no longer appears in this rule.
A real case
California's Attorney General found that Sephora ignored opt-out requests sent with the Global Privacy Control browser signal and did not tell customers that the trackers on its site amounted to selling their data. Sephora paid 1.2 million dollars in penalties under the 2022 settlement.
How to verify by hand
The consent platform's geo configuration.
What this relies on
Geo rules were set up for the home market only.