1. How New EU Privacy Laws
Will Change Your Marketing
A M A R K E T O W H I T E P A P E R
Contributors:
Josh Aberant, Director of Privacy, Marketo & Duncan Smith, CEO, iCompli

3. How New EU Privacy Laws Will Change Your Marketing
Contents
The Basics ...................................................................................................... 4
Scope of the Law ............................................................................................ 5
The Changes ................................................................................................... 6
Obtaining Consent.......................................................................................... 7
The Process .................................................................................................... 8
Browsing Experience ...................................................................................... 9
Privacy & Marketing Automation ................................................................. 10
Privacy Tracking Software ............................................................................. 11

4. How New EU Privacy Laws Will Change Your Marketing
The Basics
Many companies track website visitors in order to personalize
content and offer web services. Recently, you may have heard
about changes to how companies worldwide are allowed to
collect or use information from web page visitors from Europe.
This is because the European e-Privacy directive has been
amended, requiring European Member States to change their
laws by May 2011. This Directive (2009/136/EC), legally mandates
that websites which track users must ask those users whether
they consent to any recording or retrieval of data on their
browsers.
In Europe, when cookies are used for tracking, websites will
need to obtain the website visitor’s permission. When asking
for permission, the website must be clear about what data is
being tracked and how it will be used. A record of the permission
confirmation action (e.g. clicking an agreement link) must be
retained.
Cookie:
A cookie is a very small piece of software code that websites use to
track visitors.
4

5. How New EU Privacy Laws Will Change Your Marketing
Scope of the Law
The regulations apply to all EU businesses that are tracking individuals on their websites. Do they
apply to non-EU entities? Viviane Reding, the EU’s commissioner for justice has spoken on this
matter. “Privacy standards for European citizens should apply independently of the area of the world
in which their data is being processed,” she said. “To enforce the EU law, national privacy watchdogs
shall be endowed with powers to investigate and engage in legal proceedings against non-EU data
controllers whose services target EU customers.”
Although we are some way from full international agreement, American businesses too should
consider how they might meet the EU prior consent requirements and perhaps identify European
website visitors, even though similar constraints do not yet apply in the US.
The amended European e-Privacy directive is EU law, but it is not yet national law for all EU
members. With EU directives, member states are required to enact national laws implementing the
directive. Most member states have not yet implemented national laws requiring explicit consent for
cookies or other similar technologies. The national legislatures don’t always move at the schedule
ordered by the EU directives. This process could very well take many years to cover all of Europe.
Britain has implemented the directive into National law as the Privacy and Electronic
Communications (EC Directive) (Amendment) Regulations 2011. The Department for Culture, Media
and Sport (DCMS), in consultation with the Information Commissioner, is tasked with developing the
regulatory specifics of the law. They have jointly agreed that they will not begin enforcing the law
until May 2012.
Some news sites that are helpful for keeping up with changing Internet laws in Europe are:
Out-Law.com, eWeekEurope.co.uk and http://icompli.blogs.com
5

6. How New EU Privacy Laws Will Change Your Marketing
The Changes
It is a stated goal of the EU to harmonize privacy regulations and this is a major step forward in EU
privacy harmonization.
Compliance with these changes, and the ability to demonstrate privacy protection plus a robust
online trust mechanism will enhance a company’s reputation. Businesses will need to start
competing on how much they are trusted by their web users/visitors. Marketo believes initiatives
that encourage trust will benefit the online marketing ecosystem over time.
6

7. How New EU Privacy Laws Will Change Your Marketing
Obtaining Consent
The key to compliance is obtaining consent. Before the
law changes, websites using cookie technology could do
so by offering site visitors a privacy policy with clear and
comprehensive information about the use of the technology
and how to opt-out. The new legal regime requires the same
clear and comprehensive information, only this time it has to
be before the cookie is created or read. A positive, affirmative
action (e.g. clicking) where the subscribers acknowledges their
consent to marketing and tracking is required .
It’s important that you don’t mix up consent wording with more
general wording within your business policies. If you integrate
consent wording into your general wording, then be sure to
highlight the consent language, and record the click making
consent.
You can decide where to collect consent but it must be before
the cookie is set or read. Many websites will allow visitors to
browse some pages or sections before “popping the question.”
The objective in these cases is to enable the website visitor to
see the value of the web content or services before asking them
for tracking permission. For example, you might want to pop the
question after a visitor has viewed a certain number of pages,
spent a given amount of time on the site or visited specific
webpages.
1
There is much debate in Europe about the timing of consent acquisition. The EU
advisory body, the Article 29 Working Party, is clear however that consent should
precede any setting or reading of cookies
2
The wording of Recital 66 2009/136/EC, reflected in the Privacy and Electronic
Communications (EC Directive) (Amendment) Regulations 2011 Regulation 6 (3)A,
does allow for consent to be indicated by browser settings inter alia.
7

8. How New EU Privacy Laws Will Change Your Marketing
The Process
EU regulators have suggested many ways for organizations to
comply including:
• Placing a pop-up window or widget asking for permission
when someone first visits the website
• Placing a pop-up window or widget AFTER a few pages of
viewing content
• Placing a pop-up window or widget when accessing a
feature like a video or web service
• Placing forms asking for consent
• Adding clear information and a consent action to Terms &
Conditions pages of web services
• Popping the question on Settings or Subscriber Options
pages
• Use highlighted headers or footers on specific webpages or
turn on scrolling text asking for permission
• No longer using cookies or similar technology e.g. browser
fingerprinting
• Demonstrating that cookies are ‘strictly necessary’ to
provide a service requested by the user e.g. placing items
in a shopping cart.
Note:
Marketo advises all marketers to test all methods employed to
obtain consent. Some early deployments have shown web surfers
can confuse “pop the question” messages with virus or malware
attacks resulting in high website abandonment rates. Careful
attention, testing and optimization must be applied to consent
methods in order to avoid negatively impacting web traffic.
8

9. How New EU Privacy Laws Will Change Your Marketing
Browsing Experience
Visiting other websites?
If you are in the US, these new rules probably won’t affect you
on most websites you visit. Europeans, on the other hand, are
likely to be asked for permission quite often. Europeans will
consequently get better at factoring privacy protection into
their business and purchase decisions. These new rules may
fundamentally change the browsing experience for European
web visitors.
There are many unanswered questions about how the new EU
laws will affect how consumers interact with websites and web
services:
• Will consumers find constant pop-ups asking for consent
frustrating in much the same way many found Windows
Vista’s “User Account Control” constant pop-ups
frustrating?
• Will non-opted in consumers spend less time on websites
that can’t offer relevant advertising?
• Will consumers start to demand some kind of automation
of consent giving like the privacy headers proposed by
browser vendors?
The leading edge marketers out there will be paying attention to
these questions and striving to improve the Internet experience
of European web surfers.
9

10. How New EU Privacy Laws Will Change Your Marketing
Privacy & Marketing
Automation
Pros:
Businesses that can compete on privacy protections and easily
implement marketing automation processes, will do better and
make more money, in a world where more buyers will factor
privacy into their buying decisions.
Cons:
The EU laws will compromise companies that don’t have
marketing automation solutions to easily implement compliance.
The EU regulations will also hurt organizations that don’t or
can’t protect subscriber privacy. When it comes to targeted
advertising, users will see fewer or no targeted adverts
depending on whether they have opted out (the preferred
solution in the US), or not opted in, as is the requirement across
Europe.
Personal blogs and webpages
The EU focus is currently on business compliance. It will be
interesting to see how Europe approaches tracking and consent
for personal web properties.
10

11. How New EU Privacy Laws Will Change Your Marketing
Privacy Tracking Software
This does not mean marketing automation or companies like
Doubleclick, Omniture, and Quantcast will go out of business.
The EU privacy regulations create more need for marketing
automation and web analytics companies. As businesses need
to implement more sophisticated privacy protocols and compete
on trust, they’ll turn to their marketing automation solutions to
make it happen.
Web analytics will work in the EU because businesses will
need web analytics for the EU subscribers they cookie. They’ll
also need web analytics on subscribers they don’t cookie for
things like testing different action flows to obtain consent. Web
analytics solutions are good at analyzing both known subscribers
and unknown visitors.
It’s unlikely that EU courts will excuse lack of technical
capabilities. So if your marketing automation, web analytics,
or other software doesn’t currently help you comply, good
marketing automation solutions could be the edge you need to
give your European customers the privacy options they require.
11

13. About Marketo
Marketo is the global leader in Revenue Performance
Management. Marketo’s powerful yet easy-to-use marketing
automation and sales effectiveness solutions transform how
marketing and sales teams of all sizes work - and work together
- to drive dramatically increased revenue performance and
fuel business growth. The company’s proven technology,
comprehensive services, and expert guidance are helping more
than 1,300 corporations around the world to turn marketing from
a cost center to a business-building revenue driver.
Marketo, Inc. Marketo EMEA Ltd.
901 Mariners Island Blvd, Suite 200 Arena House
San Mateo, CA 94402 Arena Road
Tel: 650.376.2300 Sandyford
Fax: 650.376.2331 Dublin 18
www.marketo.com Ireland
Tel: + 353 1 213 0705