iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more

Our extensive documentation makes it easy for you to learn all you need to know about compliance and how to use iubenda’s products on your site or app. You can access it here. You can also visit our support forum here.

A good rule of thumb is to always comply with the laws of the region where you are based as well as the region or country in which the users you target are based.

📌 However, for an even easier, more specific way to tell which laws apply to you, you can simply take this 1-minute quiz.

If you’re based in the European Union – including the UK – or target EU users, and your website uses cookies or trackers (which it most likely does), then, yes, you do need a cookie notice.

A privacy policy is a legal requirement almost everywhere in the world. You need it because under most countries’ laws, you’re legally required to inform your users about the data you’re collecting and how you’re processing them.

Find out what should be in a privacy policy here.

While Terms and conditions aren’t always legally mandatory, they’re always recommended. They help you protect you and your business from legal liabilities.

However, please note that if you run an e-commerce, then you’ll most likely need terms and conditions, as they usually contain legally mandatory information related to commerce.

GDPR stands for General Data Protection Regulation (Regulation (EU) 2016/679). The GDPR specifies how personal data should be lawfully processed (including how it’s collected, used, protected or interacted with in general).

While it was still an EU member state, the UK was very instrumental in the creation of the GDPR and therefore, Post-Brexit, has adopted the UK-GDPR – which currently is essentially the same as the European GDPR.

DSGVO & RGPD are, respectively, the German and Spanish translations of the English acronym of the General Data Protection Regulation (GDPR).

Learn more about the GDPR here.

In effect since 2002, the ePrivacy Directive (Cookie Law) was created to put guidelines in place for electronic privacy, including email marketing and cookie usage.

Under the Cookie law, organizations that target users from the EU must inform users about data collection activities and give them the option to choose whether it’s allowed or not.

This means that if your site/app (or any third-party service used by your site/app) uses cookies or similar technologies, you must first obtain valid consent prior to the installation of those cookies, except where they fall into the exempt category.
In practice, you’ll need to:

• show a cookie banner at the user’s first visit;
• implement a cookie policy that contains all required information;
• allow the user to provide or refuse consent;
• block cookie/ tracker scripts from running until consent is provided.

You can learn more about how the ePrivacy and GDPR interact in regards to cookies and trackers here.

The Privacy and Electronic Communications Regulations 2003 (PECR) is the UK’s implementation of the EU’s ePrivacy directive and set’s out rules for electronic privacy

California’s most well known Privacy Laws are some of the most robust in the United States. They are both relevant to you if you likely have users that are based in the state of California.

California Online Privacy Protection Act (CalOPPA) – since 2002
Law requires commercial websites and services to have a privacy policy.
The document:

• Must clearly state what info is collected and who it’s shared with.
• Must disclose how a business’s website or online service responds to Do Not Track signals from Web browsers.
• Must include the effective date of the Privacy Policy and more.

California Consumer Protection Act (CCPA)

• Grants users additional rights such as the right to be informed and the right to access information you’ve collected about them – but perhaps, most relevant to marketing is the right to Opt-out.
• Under the CCPA, users have the right to opt-out of any processing that can be considered a sale of their data. Sale, in this context, is quite broad and simply means sharing for any profit- monetary or otherwise.

*Note that in the case of minors, they are granted the right to Opt-in. *More about the CCPA here.

The Brazilian General Data Protection Law, the Lei Geral de Proteção de Dados Pessoais, (LGPD) can be considered as Brazil’s answer to the GDPR – with the Brazilian law aligning with the EU Regulation in many ways, while differing in others. You can learn more about it here.