Once you have the complete list of your services, you need to identify those that collect personal data, such as IP addresses, browsing behavior, or login information. These services must be subject to visitor consent, in accordance with applicable regulations.
Your services do not all collect the same type of data, nor for identical purposes
Legally, you are only required to submit non-functional services to consent, that is, those that collect personal data for tracking, analysis, or advertising purposes. These services require explicit user agreement before being loaded on the site, in accordance with applicable regulations.
Your services can be classified into 3 categories, which we describe below:
Services subject to consent
The majority of services that track or trace visitor behavior are subject to consent. Very diverse, they can allow for targeted advertising, content sharing on social networks, or even detailed tracking of a visitor's activity on a website.
It is possible that some of these services that in principle require consent are exempt, but this only concerns certain specific categories described below.
Services exempt from consent because "strictly necessary"
Technical services, allowing the website to function correctly (ensuring that all elements display properly, for example)
CMPs (consent banners, such as Axeptio), allowing the recording of visitor preferences concerning cookies for a duration of 6 months
In certain cases, audience measurement services, allowing understanding of how users use the website and verify that it functions correctly. They are not all nor always exempt from consent!
What does the law say on the matter?
What does the law say on the matter?
To answer this question, we rely on official texts.
Within the meaning of GDPR, Recital 26 of the GDPR states that:
[...] Therefore, the principles relating to data protection do not apply to anonymous information, namely information not concerning an identified or identifiable natural person, nor to personal data made anonymous in such a way that the data subject is not or is no longer identifiable. This regulation therefore does not apply to the processing of such anonymous information, including for statistical or research purposes. |
â For France and concerning cookies related to statistics, we invite you to visit the CNIL website (National Commission for Data Protection and Liberties); for other countries we invite you to check with the supervisory authority of the country concerned.
These services do not require prior consent, but you can choose to display them on a dedicated information screen in your Axeptio banner. This allows you to adopt an even more transparent approach with your users, by giving them a complete overview of the services present on your site.
Audience measurement services exempt from consent according to CNIL
Certain audience measurement services can be configured so that the information collected is anonymized. Thus, the French data protection authority (CNIL) has evaluated that the following services can be exempt from consent if they comply with the settings indicated by CNIL.
Other audience measurement trackers could be exempt from consent provided they meet all exemption criteria specified by CNIL. We therefore recommend that you verify with your legal advisor whether you can or cannot waive consent for an audience measurement tracker not listed below:
Expand to see the list of audience measurement services that can be configured to be exempt from consent
Expand to see the list of audience measurement services that can be configured to be exempt from consent
AT Internet's Analytics Suite Delta solution in its version available as of March 30, 2021 and covered by this configuration guide
Net Solution Partner's SmartProfile solution in its version 21 and covered by this configuration guide
Wysistat's Wysistat Business solution in its version 12.1 and covered by this configuration guide
Piwik PRO's Piwik PRO Analytics Suite solution in its version 15.2.0 and covered by this configuration guide
Astra Porta's Abla Analytics solution in its version 1.9 and covered by this configuration guide
BEYABLE's BEYABLE Analytics solution in its version 1.0 and covered by this configuration guide
etracker's etracker Analytics solution (Basic, Pro, Enterprise) in its version available as of August 4, 2021 and covered by this configuration guide
Retency's Retency Web Audience solution in its version 1.0 and covered by this configuration guide
Nonli's Nonli solution in its version 2.0 and covered by this configuration guide
Contentsquare's CS Digital solution in its version 10 and covered by this configuration guide
Matomo's Matomo Analytics solution in its version 4 and covered by this configuration guide
Wizaly SAS's Wizaly solution in its version 12 and covered by this configuration guide
Marfeel Solutions' Compass solution in its version 1.0 and covered by this configuration guide
Web2Roi's Statshop solution in its version 1.8 and covered by this configuration guide
Eulerian Technologies' Eulerian solution in its version 6 and covered by this configuration guide
Thank-You's Thank-You Marketing Analytics solution in its version 2.0 and covered by this configuration guide
Médiamétrie's eStat Streaming solution in its versions JavaScript/TypeScript: 7.2.2; Apple: 6.0.0; Android: 6.0.0 and covered by this configuration guide
Commanders Act's consent module in its version 10.0 and covered by this configuration guide
Alphalyr's Alphalyr Analytics solution in its version 1.1 and covered by this configuration guide
Admo.tv's Analyse solution in its version 3.1 and covered by this configuration guide
Realytics' AdPerformance solution in its version 3 and covered by this configuration guide
NPAW's NPAW Suite solution in its version 6 and covered by this configuration guide
Adobe's Adobe Analytics solution in its version available as of August 26, 2024 and covered by this configuration guide
Shake helps you identify services subject to consent
Our scanner Shake can help you easily identify which services on your site must be subject to consent. For services listed in our database, the generated PDF report specifies whether it must therefore be subject to consent.
This constitutes a solid starting point for determining which services must be subject to consent. However, it is important to note that Shake may not be exhaustive and certain services may not be listed or up to date in our database.
If in doubt, contact the services concerned
If, after using Shake, you have doubts about a service or are not certain it collects personal data, it is essential to clarify the situation. To do this:
Contact the support of the service in question to obtain detailed information about their data collection.
Consult the service's documentation to find out if they collect personal data and for what purposes.