Vendor cookies dropped before end-user consent
If your organization identifies vendors dropping cookies on end-user devices before the end-user provides their consent selections it can be due to a few reasons. In this article, we provide an overview for why a vendor may be dropping certain cookies before end-user consent:
IAB vendor using legitimate interest
Vendor misconfiguration
IAB vendor using legitimate interest
Legitimate interest is a legal basis under the General Data Protection Regulation (GDPR) that permits the processing of personal data without consent where a controller or third party has a genuine interest in doing so, the processing is necessary to achieve that interest, and that interest is not overridden by the rights and freedoms of the data subject.
IAB vendors automatically receive the TC String and drop their cookies according to the end-user's consent status. IAB vendors who utilize legitimate interest as a legal basis for certain purposes (declared when they register for the IAB TCF Global Vendor List) can drop cookies on an end-user's device prior to the end-user providing consent.
Despite the IAB vendor's purpose declarations, your organization can override these settings directly from the consent notice configuration.
Your organization can inspect whether an IAB vendor is relying on legitimate interest as a legal basis for one or more purposes via the Data Manager.
Click Data Manager in the left-hand panel and select the Vendors tab on the subsequent page.
Use the provided filter and search bar to find the IAB vendor.
Purposes that utilize legitimate interest as a legal basis for the IAB vendor will populate in the Opt-out purposes (based on legitimate interest) column for the vendor.
Vendor misconfiguration
Vendors who are not registered with the IAB TCF do not receive the end-user's consent status automatically. Since non-IAB vendors do not receive the end-user's consent automatically, their technology (tags) on your website need to be conditioned so that they only trigger when the appropriate end-user consent is provided.
If a non-IAB vendor's technology is not properly conditioned, the vendor may drop its cookies prior to the end-user providing consent. Ensure these vendor tags are conditioned properly using one of the following methods:
Last updated