Consent to data processing (cookies)

The following integration guide takes into account the ECJ ruling of October 1, 2019; see the report on eu-info.de. As a shop operator, you must specify which consents or objections regarding data processing the shop visitor must or may give. To help with the decision, you or your data protection officer can also refer to the data protection documents in the online service area. This page first describes how the feature works and some special cases. This is followed by the integration in ten steps. Finally, you will find notes on migrating an existing integration, a simplified variant for econda services, and the specifics of the WEBSALE app for iOS.

How it works

All functions that require consent following the ECJ ruling and that are located directly in the shop templates can be offered as a group or individually — a combination of both is also possible. Examples:

A separate cookie is set for each function or function group that is explicitly consented to or objected to. In the case of consent, this cookie ensures that the permitted function — tracking, for example — takes place from the next page called onwards. In the case of an objection, the corresponding function ends from the next page onwards. For more information, see Materials: Cookies used. The layer for consent or objection can be designed freely. Possible options are:

summary buttons or checkboxes for all services
checkboxes for groups of services from one or more providers
an individual checkbox for each function

The configuration of whether the presentation shows groups or individual functions is set in the shop configuration. Corresponding explanatory texts can also be added here.

Notes on special cases

By preventing tracking on the first call, the tracking data is cut off from important information, for example the origin of the shop visitor. Tracking therefore only transmits correct information over the course of a visit or on the next visit.
If the shop visitor deletes the cookie of the declaration of intent given, either via the browser or using a tool, the banner appears again on the next shop page call, with the settings that currently still apply based on the possibly still existing opt-in and opt-out cookies of the individual functions.
If a shop visitor withdraws consent to tracking, for technical reasons the cookies set by the third-party provider cannot be removed by WEBSALE. The processing of this data is prevented because the provider’s tracking scripts are no longer embedded.
Cookies already set by WEBSALE are automatically deleted via JavaScript when consent is withdrawn.
When an affiliate program is used, the collected data is passed on to WEBSALE but only processed after the shop visitor has given consent.
When a cookie is to be deleted, the content of the cookie is removed by WEBSALE and the expiration date of the cookie is set to the past. Deletion of the cookie itself cannot be guaranteed, as this is handled by the shop customer’s browser.

Integration

Step 1: Activation

No technical activation by WEBSALE is required.

Step 2: Configure services

In the shop configuration shop.config, create a new <AgreementCookies> section and configure the parameters as shown in the examples below.

If, as part of the integration of consent to data processing, you are also newly embedding data-protection-relevant functions — such as tracking services — the Allow parameter for the overall function must not be set to test in the shop configuration shop.config. Otherwise the services would be executed immediately and without consent.

Example 1, all functions listed individually, without grouping:

<AgreementCookies>
   Allow                       = test

   <+Entry>
      ID                          = cookiebasket
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Save shopping basket for the next visit
      Descr                       =
      +WEBSALEService             = CookieBasket
   </+Entry>

   <+Entry>
      ID                          = welcomecookie
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Personal greeting
      Descr                       =
      +WEBSALEService             = WelcomeCookie
   </+Entry>

   <+Entry>
      ID                          = google
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Google Analytics
      Descr                       =
   </+Entry>

   <+Entry>
      ID                          = econda
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Econda
      Descr                       =
   </+Entry>

   ...

</AgreementCookies>

Example 2, functions combined into thematic groups. Compared to Example 1, the ConsentGroupID parameter is added in each <+Entry>, together with a <+ConsentGroupInfo> section for each group:

<AgreementCookies>
   Allow                      = test

   <+Entry>
      ID                          = cookiebasket
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Save shopping basket for the next visit
      Descr                       =
      ConsentGroupID              = comfort
      +WEBSALEService             = CookieBasket
   </+Entry>

   <+Entry>
      ID                          = welcomecookie
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Personal greeting
      Descr                       =
      ConsentGroupID              = comfort
      +WEBSALEService             = WelcomeCookie
   </+Entry>

   <+Entry>
      ID                          = google
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Google Analytics
      Descr                       =
      ConsentGroupID              = optimize
   </+Entry>

   <+Entry>
      ID                          = econda
      Type                        = OptIn
      Preselection                = unchecked
      Name                        = Econda
      Descr                       =
      ConsentGroupID              = optimize
   </+Entry>

   ...

   <+ConsentGroupInfo>
      ConsentGroupID             = comfort
      Name                       = Comfort functions
      Descr                      = We want to make the use of this shop as comfortable as possible for you.
   </+ConsentGroupInfo>

   <+ConsentGroupInfo>
      ConsentGroupID             = optimize
      Name                       = Shop optimizations
      Descr                      = In order to optimize the shop, we would like to use services
                                   that collect and aggregate data and provide it to us as statistical overviews.
   </+ConsentGroupInfo>

   ...

</AgreementCookies>

Reference: AgreementCookies section

Step 3: Embed JavaScript

Embed the current version of the JavaScript ws-module-agreementcookies in version 1.8.5 or newer via the PageSpeed tool or in the <head> section of the desired template:

<script type="text/javascript" src="/$WS/ws_sysdata/js/ws-module-agreementcookies-1.8.5.js"></script>

Reference: WEBSALE JavaScript library

Step 4: Bracket services and functions

The bracket can be used to enclose inline scripts. The ID from the <+Entry> section is required for this:

{AC-AgreementMadeForID(google)}

   <script type="text/javascript">
      var _gaq = _gaq || [];
      _gaq.push(['_setAccount', 'UA-XXXXX-X']);
      _gaq.push(['_trackPageview']);

     (function() {
        var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
        ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
        var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
     })();
   </script>

{/AC-AgreementMadeForID(google)}

External JavaScript files can also be bracketed in this way:

{AC-AgreementMadeForID(google)}

   <script src="meine-google-datei.js"></script>

{/AC-AgreementMadeForID(google)}

Reference: AC-AgreementMadeForID() Guide: JavaScript and jQuery

Step 5: Adapt the tracking interface

If functions and services are embedded via the tracking interface, this must be integrated for consent via the PageSpeed tool. If this is not the case, then activating the consent to data processing feature means that ws_analyse.js is no longer embedded automatically. If the tracking interface has been integrated via the PageSpeed tool, the following bracket usage is possible:

~WS-ExternalStatistics~
{AC-AgreementMadeForID(optimize)}
   ...
   <script type="text/javascript" src="~WS-JSURL(ws_analyse)~"></script>
   ...
{/AC-AgreementMadeForID(optimize)}

Above the bracket, the WS-ExternalStatistics tag is required, which contains the JavaScript block with the general and page-dependent tracking information in JavaScript variables. With this procedure, all functions and services that are embedded via ws_analyse.js are activated or deactivated with a single click. If you want to offer the functions and services individually, ws_analyse.js must be broken up. Each function and each service must be outsourced as an individual JavaScript file and set up as an individual group via the PageSpeed tool:

~WS-ExternalStatisticsData~
{AC-AgreementMadeForID(google)}
   ...
   <script type="text/javascript" src="~WS-JSURL(analyse-gruppe-01)~"></script>
   ...
{/AC-AgreementMadeForID(google)}

{AC-AgreementMadeForID(econda)}
   ...
   <script type="text/javascript" src="~WS-JSURL(analyse-gruppe-02)~"></script>
   ...
{/AC-AgreementMadeForID(econda)}

Guide: Integrating the tracking interface, integration with the PageSpeed tool Guide: Tracking interface, how it works Guide: JavaScript and jQuery Reference: AC-AgreementMadeForID() Reference: WS-ExternalStatisticsData To display a detail page with checkboxes for the shop customer to actively confirm consent, integrate the following code in the desired template. If necessary, the third-party services used still need to be supplemented accordingly. Example 1, all functions listed individually, without grouping:

{AC-Entry}
   ...
   {@AC-Entry}
      <label><strong>~AC-Entry_Name~ (ID: ~AC-Entry_ID~)</strong></label><br>
      <input type="checkbox" value="" onclick="ws_agreement_updatecheckboxes();" class="~AC-Entry_CheckboxClass~" ~AC-Entry_CheckboxIsChecked~>
         ~AC-Entry_Descr~
   {/@AC-Entry}
   ...
{/AC-Entry}

Example 2, functions combined into thematic groups:

~DC-DynamicLoop1_set($AC-ConsentGroupList$)~
{@DC-DynamicLoop1}
   {AC-ConsentGroup($DC-DynamicLoop1_data$)}
      <input type="checkbox" value="" onclick="ws_agreement_updatecheckboxes();" class="~AC-ConsentGroup_CheckboxClass~" ~AC-ConsentGroup_CheckboxIsChecked~>
      Allow all ~AC-ConsentGroup_Name~<br>
      ~AC-ConsentGroup_Descr~
      {AC-Entry}
         {@AC-Entry($DC-DynamicLoop1_data$)}
            <input type="checkbox" value="" onclick="ws_agreement_updatecheckboxes();" class="~AC-Entry_CheckboxClass~" ~AC-Entry_CheckboxIsChecked~>
            ~AC-Entry_Name~
         {/@AC-Entry($DC-DynamicLoop1_data$)}
      {/AC-Entry}
   {/AC-ConsentGroup($DC-DynamicLoop1_data$)}
{/@DC-DynamicLoop1}

Reference: AC tags Reference: AC-Entry Reference: DC-DynamicLoop1…3_set() Reference: DC-DynamicLoop1…3_data

Step 7: Insert a button with a JavaScript function

Typically, the function ws_agreementcookies_set(); is placed on the Save button of the consent layer to set the cookies. Insert the following code into the consent layer.

<input type="button" onclick="ws_agreementcookies_set();">
   Save settings
</input>

In the materials, we provide you with the complete layer that has been integrated in the demo shop v8s-demoshop.websale.biz. Materials: Consent to data processing

Step 8: Change the lifetime of the agreement cookies (optional)

The lifetime of the agreement cookies is 10 years by default. Starting with the JavaScript module component ws-module-agreementcookies-1.8.6.js, the function ws_agreementcookies_set() can be supplemented with an expires_days parameter. Enter the desired number of days in the argument of the button’s onclick function. Examples:

ws_agreementcookies_set();     // Lifetime 10 years (default)
ws_agreementcookies_set(365);  // Lifetime 365 days, i.e. 1 year

Guide: JavaScript and jQuery

Step 9: Notice for outdated browser version (optional)

In outdated browser versions — for example Firefox up to version 52 — the consent to data processing feature is not executed correctly. The shop visitor can be made aware of this with an appropriate notice. To do this, embed the script described in the linked chapter. Guide: Notice for outdated browser version

Step 10: Going live

If you want to enable the function for live operation, set the Allow parameter to yes in the <AgreementCookies> section of the shop configuration shop.config:

<AgreementCookies>
   Allow   = yes
   ...
</AgreementCookies>

Reference: AgreementCookies section Once you have carried out all the steps, the feature is fully integrated and active.

Notes on migration

If you have already integrated the consent to data processing function in your shop and now want to switch to the current integration from November 2019, please note the following:

Update the JavaScript ws-module-agreementcookies to version 1.8.5 or newer, as shown in Step 3.
Assign the following onclick attribute to the checkboxes for querying consent: onclick="ws_agreement_updatecheckboxes();"; see Step 6.

Simplified integration for econda services

If you use econda Tracking or econda ARP in your shop without the WEBSALE tracking interface, you can control the consent to data processing by econda directly via the consent layer without wrapping or unwrapping the complete file from econda. econda distinguishes between the following privacy modes:

Privacy Mode	Type	Description
3	Full measurement	Measurement with visitor cookies and personal data in accordance with GDPR, for example an anonymized IP address for GeoIP resolution or an order number. Only personally identifiable data submitted by the buyer is collected.
2	Anonymized measurement	Measurement without a visitor cookie. Critical personal data is already deleted or hashed in the script. This is econda’s recommendation.
1	No measurement	No tracking requests are executed.

Further information and current code examples can be found in the econda documentation. A login is required.

Prerequisites

The integration of econda in your shop has been carried out without the WEBSALE tracking interface — that is, using the standard integration. In addition, the consent to data processing function, as described above, has been implemented in your shop. Guide: Integration of econda Tracking and econda ARP

Step 1: Activation

This function does not need to be activated by WEBSALE.

Step 2: Setting in the econda backend

Open your econda backend and select the desired privacy mode that is to be used by default there, that is, without a selection by the buyer. This step only applies if relevant. If consent to data processing by econda has already been integrated into your shop by bracketing the complete file from econda as described above, first remove all corresponding brackets and settings in your shop configuration shop.config. For econda Tracking, insert the following code on the consent layer (see Step 6 of the general integration):

...
{AC-AgreementMadeForID(econda)}
   <script>localStorage.setItem('emos_privacy','3');</script>
{/AC-AgreementMadeForID(econda)}
{!AC-AgreementMadeForID(econda)}
   <script>localStorage.removeItem('emos_privacy');</script>
{/!AC-AgreementMadeForID(econda)}
...

With this setting, privacy mode 3 is set when econda is checked in the consent layer. If econda is not checked, the default privacy mode that you specified in the econda backend is used. If you want to select a different privacy mode instead of privacy mode 3, that is 1 or 2, simply replace the 3 in the code example with the corresponding digit; see the table above. For econda ARP, add the following code on the consent layer:

...
{AC-AgreementMadeForID(econda_arp)}
<script>
window.econda.ready(() => {
   window.econda.arp.PrivacyProtection.updatePermissions([{
      state: 'ALLOW',
      version: '1.0',
      timestamp: new Date().toISOString()
   }])
})
</script>
{/AC-AgreementMadeForID(econda_arp)}

{!AC-AgreementMadeForID(econda_arp)}
<script>
window.econda.ready(() => {
   window.econda.arp.PrivacyProtection.updatePermissions([{
      state: 'DENY',
      version: '1.0',
      timestamp: new Date().toISOString()
   }])
})
</script>
{/!AC-AgreementMadeForID(econda_arp)}
...

For econda ARP to be executed, the buyer must have selected privacy mode 3.

WEBSALE app for iOS (App Tracking Transparency)

Since operating system version iOS 14.5, Apple requires that the AppTrackingTransparency framework (ATT) be implemented in apps that track user data. Through the framework, the user is asked when opening the app for the first time whether they consent to tracking by the app or not. When using the iOS app, the WEBSALE consent layer is therefore no longer displayed. The AppTrackingTransparency framework sends the HTTP tracking status in the header to the WEBSALE app. In addition to Apple’s tracking status values, there is also the value always:

Value	Meaning
`authorized`	User allows tracking.
`pre_ios14`	The device runs an older version of iOS than 14, so ATT does not yet exist there.
`denied`	The user refuses tracking.
`not_determined`	The user has not yet provided any information.
`restricted`	The user has disabled tracking globally on the device.
`always`	The service is always activated, regardless of the transmitted tracking status.

Further information can also be found in the Apple documentation. These tracking status values must be inserted as a comma-separated list in the new parameter in order to activate the respective service, that is, the cookie and the associated <+Entry> entry. If you use the WEBSALE app, supplement all individual <+Entry> entries in the <AgreementCookies> section of the shop configuration shop.config with the following parameter:

<AgreementCookies>
   ...
   <+Entry>
      ...
      iOSApp-AcceptViaTrackingFramework-List =        # Comma-separated list of (status) values at which the service is activated.
      ...
   </+Entry>
   ...
</AgreementCookies>

Reference: AgreementCookies section If you omit the parameter or leave no value after the parameter, the corresponding service is not activated and the cookie is not set.

Examples

Add the following parameter-value pair to all <+Entry> sections whose tracking you only want to activate after explicit consent or on older iOS versions:

iOSApp-AcceptViaTrackingFramework-List = authorized,pre_ios14

Add this parameter-value pair to all <+Entry> sections whose activation does not require explicit consent from the customer, for example when the data is not forwarded to external systems:

iOSApp-AcceptViaTrackingFramework-List = always

As a shop operator, you can thus decide for each service — that is, for each individual <+Entry> entry — at which tracking status transmitted by iOS the respective service is activated and a corresponding cookie is set. With the value always, you assume general consent from the user for this service, regardless of the value transmitted.

All essential cookies that are fundamentally necessary for the functionality of the shop are not affected and are not available for selection. This is the same as with the WEBSALE consent layer.

​How it works

​Notes on special cases

​Integration

​Step 1: Activation

​Step 2: Configure services

​Step 3: Embed JavaScript

​Step 4: Bracket services and functions

​Step 5: Adapt the tracking interface

​Step 6: Show consent layer with checkboxes

​Step 7: Insert a button with a JavaScript function

​Step 8: Change the lifetime of the agreement cookies (optional)

​Step 9: Notice for outdated browser version (optional)

​Step 10: Going live

​Notes on migration

​Simplified integration for econda services

​Prerequisites

​Step 1: Activation

​Step 2: Setting in the econda backend

​Step 3: Remove existing econda-related configurations and brackets

​Step 4: Adapt the consent layer

​WEBSALE app for iOS (App Tracking Transparency)

​Examples

How it works

Notes on special cases

Integration

Step 1: Activation

Step 2: Configure services

Step 3: Embed JavaScript

Step 4: Bracket services and functions

Step 5: Adapt the tracking interface

Step 6: Show consent layer with checkboxes

Step 7: Insert a button with a JavaScript function

Step 8: Change the lifetime of the agreement cookies (optional)

Step 9: Notice for outdated browser version (optional)

Step 10: Going live

Notes on migration

Simplified integration for econda services

Prerequisites

Step 1: Activation

Step 2: Setting in the econda backend

Step 3: Remove existing econda-related configurations and brackets

Step 4: Adapt the consent layer

WEBSALE app for iOS (App Tracking Transparency)

Examples