Cookies

HTTP Cookies are small pieces of data stored on an individual user's device. They are commonly sent from a website while the user is browsing to remember important stateful information - for instance the items added to an online shopping basket; though as they may also be used in a manner that users do not expect it is important to disclose this information to users and gather their consent where appropriate.

const config = {
    // apiKey and other settings...
    necessaryCookies: ['A', 'B', 'C', 'civic_*'],
}

How Cookie Control stores user choices

Anchor link for How Cookie Control stores user choices

Cookie Control itself remembers user choices via its own cookie named CookieControl.

Internal cookies are automatically acknowledged and protected. By default, these cookies are set as SameSite=Strict and Secure=false on the site's top level domain (TLD) and kept for a period of 90 days.

It is possible to customise these settings with the following properties:

For convenience, you can extend your configuration with these properties and their default values as follows:

const config = {
    // apiKey and other settings...
    consentCookieExpiry: 90,
    encodeCookie: false,
    sameSiteCookie: true, // if false, cookie set as SameSite=None;secure;
    sameSiteValue: 'Strict', // either 'Strict', 'Lax', or 'None'
    secureCookie: false,
    subDomains: true,
}

Renaming the Cookie Control cookie

Anchor link for Renaming the Cookie Control cookie

To alter the name of the cookie that Cookie Control uses to store user preferences, the ccCookie property can be updated with a string containing your chosen name.

This allows preferences to be shared across selected sub-domains, while remaining isolated from others, on a site- or configuration-specific basis.

const config = {
    // apiKey and other settings..
    ccCookie: 'CookieControl'
}

Consent Records

Anchor link for Consent Records

It is also possible to log all consent records received (and revoked) via Cookie Control for up to a year.

This functionality is offered solely for the purposes of satisfying the Conditions for consent within Article 7 of the European Union's General Data Protection Regulation (GDPR):

"
Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
"

To enable consent records, please ensure you have agreed with CIVIC's data processing agreement (DPA) by logging into your account profile and extend your configuration with the logConsent property:

const config = {
    // apiKey and other settings..
    logConsent: true, // also requires acceptance of CIVIC's DPA
}

Privacy Statement

Anchor link for Privacy Statement

A privacy statement discloses ways in which one party gathers, uses and manages data. For websites, this type of document typically outlines the broader, more generalized treatment of its user's personal data and may include details such as the types of software being used and their use of cookies.

Associating a privacy statement with Cookie Control

Cookie Control allows you to make your users aware of your main privacy statement through use of the statementproperty. It is entirely optional, though if configured offers two main benefits:

Increased Transparency:

A description and link to your privacy policy appears underneath the introductory text within the main settings panel - making it easy for users to find before providing consent.

Increased Data Integrity:

Should your privacy policy change after a user gives consent, Cookie Control will invalidate prior records of consent and seek the user's preferences using the latest information available.

To extend your configuration with a valid privacy policy, the statement property must be given the value of a JavaScript Object containing the following properties:

For convenience, you can extend your configuration with the following snippet - though please be aware that there are no default values forURL and updated and the property will be dismissed if not supplied.

const config = {
    // apiKey and other settings...
    statement: {
        description: 'For more detailed information, please check our',
        name: 'Cookie and Privacy Statement',
        url: 'https://www.civicuk.com/',
        updated: '25/05/2018',
    },
}

Site Specific Behaviour

Anchor link for Site Specific Behaviour

Site specific behaviour and functionality may be defined in two different ways:

Optional Categories:

Entirely custom categories and behaviour that you yourself define.

Transparency and Consent Framework (TCF) v2:

Adherence to the policies and specifications set out by IAB Europe and Google's Additional Consent Mode.

These two forms of consent management are incompatible due to policies set out by the TCF v2 specification, so you first need to decide which is more appropriate for your website.

If you have not heard of the Internet Advertising Bureau (IAB Europe), or are running only analytics software on your website then chances are Optional Categories will be sufficient for your needs.

Optional Cookie Categories is the form of consent management the majority of our customers opt for due to its flexibility, though please note it does require some manual upfront effort to configure accurately.